Publish a Ruby gem to RubyGems.org with trusted publishing
Register the release workflow as a trusted publisher on RubyGems.org, pending or not, and let the job trade its OIDC token for a short-lived push key.
How-to › Section 12
Release and secure packages#
Publishing to registries, versioning and release automation, supply-chain integrity, and hardening clients and servers.
16 guides in 4 topics. Every guide compares its approaches and shows the output its commands printed.
- Publish to package registries 3
- Version, changelog and automate releases 3
- Secure the supply chain 3
- Harden clients and servers 7
Publish to package registries 3 guides
The mechanics of each registry: npm (provenance, scoped packages), PyPI (trusted publishing), Go modules (tags, major version paths, proxies), Packagist, RubyGems, LuaRocks, crates.io, Maven Central, NuGet, pub.dev, Swift Package Index, Hex; yanking; and releasing many SDKs from one commit or monorepo (changesets, release-please, goreleaser, repo-manager as one tool for many repos, the sdkgen release-and-tag flow).
Recover when one registry upload fails mid release
Make each publish step ask the registry and skip what it holds, give each registry its own job, push the tag last, and know when to burn a half-published version.
Set up PyPI trusted publishing from GitHub Actions
Register the workflow on PyPI and TestPyPI, publish through pypa/gh-action-pypi-publish with id-token write, and check the record still matches the file.
Version, changelog and automate releases 3 guides
Semver for SDKs, deciding whether a regenerated SDK is a minor or major release, conventional commits, CHANGELOG generation, release candidates, human-gated production releases, deprecation policy and long-term support, scheduled live suites, regenerating SDKs in CI (the Speakeasy action, Fern CI, sdkgen doctor and release-and-tag as options).
Adopt conventional commits in an SDK repository
Write commits as type(scope): subject with a scope per language, enforce it with commitlint and a title check, and keep draft footers out of squash merges.
Choose a release automation tool for an SDK repository
Dry-run changesets, git-cliff, release-please, and semantic-release against a throwaway copy of the repository, then pick by where a person decides the release.
Generate a changelog from conventional commits
Turn a commit range into CHANGELOG.md sections grouped by release, with dependency bumps and regeneration noise filtered out rather than published.
Secure the supply chain 3 guides
SLSA levels, Sigstore signing and cosign, SBOMs (CycloneDX, SPDX), provenance attestations, dependency pinning and lockfiles, Dependabot and Renovate, Socket, secret scanning, CVE runbooks, reproducible builds as a security property, and the trade-offs of a zero-dependency policy (the Voxgig multi-language libraries as one example of that policy).
Automate dependency updates with Dependabot or Renovate
Configure Dependabot and Renovate side by side for an SDK repository: a release-age delay on every update, and automerge only for the updates that earn it.
Choose a SLSA build level for a package release pipeline
Grade each release pipeline against the three SLSA Build levels from its workflow and runner, then write the level each artifact tier must reach into one policy.
Write a CVE response runbook for an SDK
Take a private vulnerability report to a fixed release in every language you ship, then check the advisory against the OSV schema and your SDK list.
Harden clients and servers 7 guides
Runtime security for integrations: the OWASP API Security Top 10, TLS pinning, SSRF defence for user-supplied URLs, input validation at the boundary, mass assignment, security.txt (RFC 9116), secret redaction in logs and debug output, least-privilege tokens, dependency isolation, server-side key rotation.
Audit the scopes of the tokens your integrations use
Inventory every long-lived token your services and CI jobs hold, map each to a week of calls, and re-issue it at the smallest scope behind a flag.
Defend a URL-fetching endpoint against SSRF
Allowlist the scheme and port, resolve the name yourself, refuse special-purpose addresses, connect to the address you checked, and check again on each redirect.
Keep internal detail out of API error responses
Map every unhandled exception to an RFC 9457 problem with a correlation id, run the mapper everywhere, and scan responses for your own host names and table names.
Publish security.txt for an API
Serve an RFC 9116 security.txt so a researcher who finds a bug in your API knows where to send it, and add the expiry check that stops the file going stale.
Review an API against the OWASP API Security Top 10
Review a running API against the ten risks of the 2023 edition, recording a replayable request and an owner for every risk, and rank the gaps you find.
Rotate API keys without breaking your clients
Run two keys at once, watch which one each caller uses, and retire the old one on evidence rather than on a date somebody picked.
Test an API for broken object level authorization
Try every identifier with every credential and assert that a caller who does not own a resource gets the same answer as one asking for something that does not exist.
Generate the client instead of writing it#
Retries, timeouts, pagination and auth are the same problems in every client. Voxgig generates them from your OpenAPI description, in 23 languages, from one model.