Pushing updates to rubygems by others

[jeremytregunna]

Right now, I'm the only one who can push changes to the gem. I'd like to allow some contributors to this repository to be able to push changes to push a release out. Anyone have any thoughts on a good secure way to accommodate this? My main thought is GitHub Actions. I feel like I am not available frequent enough to be the only one who can push bug fixes out to rubygems.

[hoppergee]

I would like to do some research on this next month

[hoppergee]

After some research, I found the old release way maybe is still a better way to release Ruby gem for an opensource project.

We cannot do permission management on a specific user on Github

All collaborators can:

• create and edit releases
• Publish packages

Seems not much popular ruby repos use it for release

I didn't find any popular ruby gems which are using GitHub Action for release. Even GitHub itself is not using GitHub action to do automate releases.

GitHub Action can't work with the RubyGems OTP

I asked a question under github/view_component. about the Github Action. They say GitHub action can't work with the OTP, so they are not using it.

Summary

So it seems that we have two options:

• If we currently not using OTP, and want to allow all collaborators have the permission to do release works then it's good enough to deploy with GitHub actions.
• If we consider the security concern as the most important thing, we maybe have to go with the old way - gem owner command. Add a few collaborators as the gem owners like runlevel5 and me.

References:

• Permission levels for a user account repository
• Permission levels for an organization

[jeremytregunna]

@wokenqingtian Thanks for this, I think the best way to approach this is to see if you and @runlevel5 are both interested in being able to push to rubygems, ruby-trello updates. You are the two people I had in mind. I'd like both your feedback, and the owner approach is what I'll probably settle on.

[runlevel5]

@jeremytregunna I am happy to help

[jeremytregunna]

@runlevel5 Alright, shoot me an email jeremy@tregunna.ca with your email

[hoppergee]

@jeremytregunna I would like to do this with @runlevel5. Also, emailed you.

[jeremytregunna]

@wokenqingtian Thanks, just waiting on @runlevel5's email to add as well, but you were just added.

[jeremytregunna]

I'm going to close this issue for now, please @runlevel5 let me know via email the address you use on rubygems, and I'll add you. No sense in keeping this issue open right now though.