From 98defc36018cc4d83282a2e2e3bf7605c7ef57aa Mon Sep 17 00:00:00 2001 From: "Duong (Yoon)" Date: Tue, 7 Jul 2026 14:54:08 -0400 Subject: [PATCH 1/4] Add Trusted Publishing workflow for RubyGems releases Replace the static rubygems.org API key with a GitHub Actions OIDC-based Trusted Publishing workflow. No long-lived secret is stored; short-lived tokens are exchanged at publish time via dd-octo-sts and rubygems.org Trusted Publishing. Co-Authored-By: Claude Opus 4.6 (1M context) --- .github/workflows/publish.yml | 60 +++++++++++++++++++++++++++++++++++ 1 file changed, 60 insertions(+) create mode 100644 .github/workflows/publish.yml diff --git a/.github/workflows/publish.yml b/.github/workflows/publish.yml new file mode 100644 index 0000000..561edd7 --- /dev/null +++ b/.github/workflows/publish.yml @@ -0,0 +1,60 @@ +name: Publish gem + +on: + workflow_dispatch: + inputs: + push: + description: "Push gem to RubyGems.org (false = dry run, true = publish)" + type: boolean + default: false + required: false + +concurrency: "rubygems" + +permissions: {} + +jobs: + publish: + name: Build and publish gem to RubyGems.org + runs-on: ubuntu-24.04 + environment: ${{ inputs.push && 'rubygems.org' || '' }} + permissions: + id-token: write + contents: write + steps: + - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 + with: + persist-credentials: false + - uses: ruby/setup-ruby@d45b1a4e94b71acab930e56e79c6aa188764e7f9 # v1.316.0 + with: + ruby-version: "3.3" + bundler-cache: true + + - name: Verify gem version is not already published + run: | + GEM_VERSION=$(ruby -e "puts Gem::Specification.load('fluent-plugin-datadog.gemspec').version") + echo "GEM_VERSION=${GEM_VERSION}" >> "$GITHUB_ENV" + + if gem search fluent-plugin-datadog --exact --remote --version "${GEM_VERSION}" | grep -q "(${GEM_VERSION})"; then + echo "::error::Version ${GEM_VERSION} is already published on RubyGems.org" + exit 1 + fi + echo "Version ${GEM_VERSION} is ready to publish" + + - name: Build gem (dry run) + if: ${{ !inputs.push }} + run: | + gem build fluent-plugin-datadog.gemspec + echo "::notice::Dry run complete. Gem built successfully: fluent-plugin-datadog-${GEM_VERSION}.gem" + + - uses: DataDog/dd-octo-sts-action@96a25462dbcb10ebf0bfd6e2ccc917d2ab235b9a # v1.0.4 + if: ${{ inputs.push }} + id: octo-sts + with: + scope: DataDog/fluent-plugin-datadog + policy: self.publish + - name: Publish to RubyGems.org + if: ${{ inputs.push }} + uses: rubygems/release-gem@052cc82692552de3ef2b81fd670e41d13cba8092 # v1.4.0 + with: + token: ${{ steps.octo-sts.outputs.token }} From 23e28170080434025f1ac14ec5a347c3072b9670 Mon Sep 17 00:00:00 2001 From: "Duong (Yoon)" Date: Wed, 8 Jul 2026 13:08:45 -0400 Subject: [PATCH 2/4] Add dd-octo-sts policy for Trusted Publishing Defines the OIDC claim requirements for the self.publish policy used by dd-octo-sts-action in the publish workflow. Restricts token issuance to manual workflow_dispatch runs from master in the rubygems.org environment. Co-Authored-By: Claude Opus 4.6 (1M context) --- .github/chainguard/self.publish.sts.yaml | 13 +++++++++++++ 1 file changed, 13 insertions(+) create mode 100644 .github/chainguard/self.publish.sts.yaml diff --git a/.github/chainguard/self.publish.sts.yaml b/.github/chainguard/self.publish.sts.yaml new file mode 100644 index 0000000..2c1bf4a --- /dev/null +++ b/.github/chainguard/self.publish.sts.yaml @@ -0,0 +1,13 @@ +issuer: https://token.actions.githubusercontent.com + +subject: repo:DataDog/fluent-plugin-datadog:environment:rubygems.org + +claim_pattern: + event_name: workflow_dispatch + environment: rubygems.org + ref: refs/heads/master + repository: DataDog/fluent-plugin-datadog + job_workflow_ref: DataDog/fluent-plugin-datadog/\.github/workflows/publish\.yml@refs/heads/master + +permissions: + contents: write From bf2562f90ccba9a3fb92f2dd8035a2d78e256bed Mon Sep 17 00:00:00 2001 From: "Duong (Yoon)" Date: Wed, 8 Jul 2026 14:58:24 -0400 Subject: [PATCH 3/4] Update release instructions for Trusted Publishing Replace the old manual gem push instructions (which required local API key credentials) with the new GitHub Actions workflow process. Co-Authored-By: Claude Opus 4.6 (1M context) --- README.md | 18 ++++++++++-------- 1 file changed, 10 insertions(+), 8 deletions(-) diff --git a/README.md b/README.md index 0cbf3ec..edba0e2 100644 --- a/README.md +++ b/README.md @@ -148,17 +148,19 @@ Configuration example: ``` -## Build +## Releasing -To build a new version of this plugin and push it to RubyGems: +This gem is published to RubyGems via a GitHub Actions [Trusted Publishing](https://guides.rubygems.org/trusted-publishing/) workflow. No API keys or local credentials are needed. -- Update the version in the .gemspec file accordingly -- `rake build` to build the gem file -- `rake release` to push the new gem to RubyGems +To release a new version: -**Note**: The latest command will fail without appropriate credentials configured. You can set those credentials by running the following command: - -`curl -u https://rubygems.org/api/v1/api_key.yaml > ~/.gem/credentials`, it will ask for your password. +1. Update the version in `lib/fluent/plugin/version.rb` +2. Update `CHANGELOG.md` +3. Merge to `master` +4. Go to **Actions** > **Publish gem** > **Run workflow** +5. Run with `push` unchecked first (dry run) to verify the build +6. Run again with `push` checked to publish to RubyGems +7. The `rubygems.org` environment gate will ask for approval before publishing ## Development Environment From 6d103b22e54c60055de6a3cc1ff08f956a32f34e Mon Sep 17 00:00:00 2001 From: "Duong (Yoon)" Date: Wed, 8 Jul 2026 16:01:45 -0400 Subject: [PATCH 4/4] Restore build section and add changelog entry Keep the local build instructions (rake build) separate from the new Trusted Publishing release instructions. Add changelog entry for the publishing workflow change. Co-Authored-By: Claude Opus 4.6 (1M context) --- CHANGELOG.md | 3 +++ README.md | 6 ++++++ 2 files changed, 9 insertions(+) diff --git a/CHANGELOG.md b/CHANGELOG.md index cf37876..58e0d43 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -1,3 +1,6 @@ +## Unreleased +- Switch to GitHub Actions Trusted Publishing for gem releases (replaces manual API key publishing) [#89](https://github.com/DataDog/fluent-plugin-datadog/pull/89) + ## 0.15.0 - Provide a configuration option to delete kubernetes and docker attributes from the log after the relevant information has been extracted into tags [#78](https://github.com/DataDog/fluent-plugin-datadog/pull/78) by [@sambart19]. - Fix launch.json and update readme [#76](https://github.com/DataDog/fluent-plugin-datadog/pull/76) diff --git a/README.md b/README.md index edba0e2..512e790 100644 --- a/README.md +++ b/README.md @@ -148,6 +148,12 @@ Configuration example: ``` +## Build + +To build the gem locally: + +- `rake build` to build the gem file + ## Releasing This gem is published to RubyGems via a GitHub Actions [Trusted Publishing](https://guides.rubygems.org/trusted-publishing/) workflow. No API keys or local credentials are needed.