Packaging metadata, Ruby 4.0 CI, and trusted-publishing release workflow - #29
Merged
Conversation
…lease workflow Add gemspec metadata (changelog/source/bug-tracker URIs, rubygems_mfa_required), ship CHANGELOG.md in the gem, and remove the dead `spec.bindir = "exe"`. CI matrix adds Ruby 4.0 and drops the `rm Gemfile.lock` hack now that the lockfile is healthy. Add release.yml, which publishes to RubyGems via trusted publishing on v*.*.* tags after tests pass. Co-Authored-By: Claude <noreply@anthropic.com>
erb, rdoc, and sass-embedded all shipped releases that bumped their minimum ruby version to 3.2, breaking bundle install on ruby 3.1 (the oldest ruby CI still tests). Pin them below those releases, and add logger explicitly since ruby 4.0 dropped it as a default gem. Co-Authored-By: Claude <noreply@anthropic.com>
Contributor
There was a problem hiding this comment.
🟡 Changes recommended
Release tags currently execute the complete CI matrix twice.
Once you've addressed the issues Copilot identified, you can request another Copilot review.
Pull request overview
Updates gem packaging, Ruby compatibility, CI coverage, and automated trusted publishing.
Changes:
- Adds gem metadata and ships the changelog.
- Adds Ruby 4.0 CI and Ruby 3.1-compatible dependency constraints.
- Adds a tag-triggered trusted-publishing workflow.
File summaries
| File | Description |
|---|---|
jekyll-tailwindcss.gemspec |
Adds metadata and packages the changelog. |
Gemfile |
Adds compatibility dependencies and constraints. |
Gemfile.lock |
Locks the updated dependency set. |
.github/workflows/main.yml |
Adds Ruby 4.0 and reusable workflow support. |
.github/workflows/release.yml |
Tests and publishes tagged releases. |
Review details
- Files reviewed: 4/5 changed files
- Comments generated: 1
- Review effort level: Balanced
💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.
| cancel-in-progress: true | ||
| on: | ||
| workflow_dispatch: | ||
| workflow_call: |
Release tags enter through release.yml, which calls this workflow via workflow_call; keeping the push.tags trigger ran the matrix twice. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_015kxK16Xgi7P4GeUfkmQNxr
Contributor
There was a problem hiding this comment.
🔵 Needs a closer look
Release tags need version validation, and the manual release documentation conflicts with the automated workflow.
Review details
Suppressed comments (2)
Previously missed (2) — in code that hasn't changed since the last review.
.github/workflows/release.yml:27
- Validate that the pushed tag matches the gemspec version before invoking this action.
release-gemruns Bundler'srake release; Bundler only checks whether the gem version's tag exists anywhere, not whether it equalsgithub.ref_name. A typo such as taggingv0.8.0while the gemspec says0.8.1can therefore create/pushv0.8.1and publish that unintended version. Add an explicit tag/version check so a mismatch fails closed.
- uses: rubygems/release-gem@v1
.github/workflows/release.yml:27
- The new automatic publish conflicts with the existing “Cutting a release” instructions in
README.md:207-219, which still tell maintainers to build andgem pushmanually before pushing the tag. Following those instructions bypasses trusted publishing and then triggers this workflow only to attempt a duplicate push. Update that section to make pushing the version tag the publishing step.
- uses: rubygems/release-gem@v1
- Files reviewed: 4/5 changed files
- Comments generated: 0 new
- Review effort level: Balanced
release-gem runs `rake release`, which builds from the gemspec version rather than the pushed tag, so a mistyped tag would publish an unintended version. Fail closed when the tag and VERSION disagree, and replace the manual `gem push` instructions with the tag-driven flow. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_015kxK16Xgi7P4GeUfkmQNxr
Contributor
There was a problem hiding this comment.
🟡 Changes recommended
The release trigger can publish tags from commits that have not passed the documented main-branch review path.
Once you've addressed the issues Copilot identified, you can request another Copilot review.
Review details
Suppressed comments (1)
Previously missed (1) — in code that hasn't changed since the last review.
Gemfile:20
- The compatibility note is off by one major version: ERB 5 already requires Ruby 3.2, which is why the
< 5constraint preserves Ruby 3.1 support. Update the comment so future dependency maintenance does not incorrectly treat ERB 5 as compatible.
gem "erb", "< 5" # erb >= 6 requires ruby >= 3.2
- Files reviewed: 5/6 changed files
- Comments generated: 1
- Review effort level: Balanced
Comment on lines
+4
to
+6
| push: | ||
| tags: | ||
| - v*.*.* |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
rubygems_mfa_required.spec.bindir = "exe".rm Gemfile.lockhack is removed now that the lockfile is healthy.release.ymlpublishes to RubyGems via trusted publishing onv*.*.*tags after tests pass.One-time setup
On rubygems.org → jekyll-tailwindcss → Trusted Publishers, add a publisher with:
vormwald/jekyll-tailwindcssrelease.ymlreleaseTest plan
🤖 Generated with Claude Code