Move publish rubygems to Github Actions trusted publisher workflow

.github/chainguard/self.publish.sts.yaml

@@ -0,0 +1,13 @@
+issuer: https://token.actions.githubusercontent.com
+
+subject: repo:DataDog/datadog-lambda-rb:environment:rubygems.org
+
+claim_pattern:
+  event_name: workflow_dispatch
+  environment: rubygems.org
+  ref: refs/heads/main
+  repository: DataDog/datadog-lambda-rb
+  job_workflow_ref: DataDog/datadog-lambda-rb/\.github/workflows/publish\.yml@refs/heads/main
+
+permissions:
+  contents: write

.github/workflows/publish.yml

@@ -0,0 +1,69 @@
+name: Publish gem
+
+on: # yamllint disable-line rule:truthy
+  workflow_dispatch:
+    inputs:
+      version:
+        description: 'Expected gem version (must match lib/datadog/lambda/version.rb)'
+        required: true
+        type: string
+
+concurrency:
+  group: rubygems-publish
+  cancel-in-progress: false
+
+permissions: {}
+
+jobs:
+  publish:
+    name: Build and push gem to RubyGems.org
+    runs-on: ubuntu-latest
+    environment: rubygems.org # see: https://github.com/DataDog/datadog-lambda-rb/settings/environments
+    permissions:
+      id-token: write # request an OIDC token for RubyGems Trusted Publishing
+    steps:
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        with:
+          ref: main
+          fetch-tags: true
+          persist-credentials: false
+
+      - name: Set up Ruby
+        uses: ruby/setup-ruby@3ff19f5e2baf30647122352b96108b1fbe250c64 # v1.299.0
+        with:
+          ruby-version: 3.2
+          bundler-cache: true
+
+      - name: Verify version format
+        run: |
+          if [[ ! '${{ inputs.version }}' =~ ^[0-9]+\.[0-9]+\.[0-9]+$ ]]; then
+            echo "Version must be semver (e.g. 3.30.0)"
+            exit 1
+          fi
+
+      - name: Verify version matches version.rb
+        run: |
+          expected='${{ inputs.version }}'
+          actual=$(ruby -Ilib -r datadog/lambda/version -e 'puts Datadog::Lambda::VERSION::STRING')
+          if [ "$expected" != "$actual" ]; then
+            echo "Version mismatch: input=$expected version.rb=$actual"
+            exit 1
+          fi
+
+      - name: Verify release tag does not exist
+        run: |
+          if git rev-parse "refs/tags/v${{ inputs.version }}" >/dev/null 2>&1; then
+            echo "Tag v${{ inputs.version }} already exists"
+            exit 1
+          fi
+
+      - uses: DataDog/dd-octo-sts-action@96a25462dbcb10ebf0bfd6e2ccc917d2ab235b9a # v1.0.4
+        id: octo-sts
+        with:
+          scope: DataDog/datadog-lambda-rb
+          policy: self.publish
+
+      - name: Publish to RubyGems.org
+        uses: rubygems/release-gem@052cc82692552de3ef2b81fd670e41d13cba8092 # v1.4.0
+        with:
+          token: ${{ steps.octo-sts.outputs.token }}

.gitlab/template.yaml.tpl

@@ -147,20 +147,6 @@ publish layer {{ $environment_name }} ({{ $runtime.ruby_version }}, {{ $runtime.
 
 {{- end }}
 
-publish rubygems:
-  stage: publish
-  tags: ["arch:amd64"]
-  image: ${CI_DOCKER_TARGET_IMAGE}:${CI_DOCKER_TARGET_VERSION}
-  cache: []
-  rules:
-    - if: '$CI_COMMIT_TAG =~ /^v.*/'
-  when: manual
-  needs: {{ range $runtime := (ds "runtimes").runtimes }}
-    - sign layer ({{ $runtime.ruby_version }}, {{ $runtime.arch}})
-  {{- end }}
-  script:
-    - .gitlab/scripts/publish_rubygems.sh
-
 layer bundle:
   stage: build
   tags: ["arch:amd64"]

Rakefile

@@ -1,20 +1,10 @@
 # frozen_string_literal: true
 
+require 'bundler/gem_tasks'
 require 'rspec/core/rake_task'
 
-$LOAD_PATH.unshift File.expand_path('lib', __dir__)
-require 'datadog/lambda/version'
-
 task default: :test
 
-task :build do
-  system 'gem build datadog-lambda.gemspec'
-end
-
-task release: :build do
-  system "gem push datadog-lambda-#{Datadog::Lambda::VERSION::STRING}"
-end
-
 RSpec::Core::RakeTask.new(:test) do |t|
   t.pattern = 'test/**/*\.spec\.rb'
 end

integration_tests/snapshots/logs/appsec-request_ruby32.log

@@ -11,7 +11,7 @@ START
 START
 START
 START
-W, [XXXX]  WARN XXXX[datadog] Unable to patch Datadog::Tracing::Contrib::Aws::Integration (Available?: true, Loaded? false, Compatible? true, Patchable? false)
+W, [XXXX]  WARN XXXX[datadog] Unable to patch Datadog::Tracing::Contrib::Aws::Integration (Available?: X, Loaded? X, Compatible? X, Patchable? X)
 {"e":XXXX,"m":"aws.lambda.enhanced.invocations","t":["dd_lambda_layer:datadog-ruby32","functionname:integration-tests-rb-XXXX-appsec-request_ruby32","region:eu-west-1","account_id:XXXX","memorysize:1024","cold_start:false","runtime:Ruby 3.2.X","resource:integration-tests-rb-XXXX-appsec-request_ruby32","datadog_lambda:X.X.X","dd_trace:2.XX.X"],"v":1}
 {"e":XXXX,"m":"aws.lambda.enhanced.invocations","t":["dd_lambda_layer:datadog-ruby32","functionname:integration-tests-rb-XXXX-appsec-request_ruby32","region:eu-west-1","account_id:XXXX","memorysize:1024","cold_start:false","runtime:Ruby 3.2.X","resource:integration-tests-rb-XXXX-appsec-request_ruby32","datadog_lambda:X.X.X","dd_trace:2.XX.X"],"v":1}
 {"e":XXXX,"m":"aws.lambda.enhanced.invocations","t":["dd_lambda_layer:datadog-ruby32","functionname:integration-tests-rb-XXXX-appsec-request_ruby32","region:eu-west-1","account_id:XXXX","memorysize:1024","cold_start:false","runtime:Ruby 3.2.X","resource:integration-tests-rb-XXXX-appsec-request_ruby32","datadog_lambda:X.X.X","dd_trace:2.XX.X"],"v":1}

integration_tests/snapshots/logs/appsec-request_ruby33.log

@@ -11,7 +11,7 @@ START
 START
 START
 START
-W, [XXXX]  WARN XXXX[datadog] Unable to patch Datadog::Tracing::Contrib::Aws::Integration (Available?: true, Loaded? false, Compatible? true, Patchable? false)
+W, [XXXX]  WARN XXXX[datadog] Unable to patch Datadog::Tracing::Contrib::Aws::Integration (Available?: X, Loaded? X, Compatible? X, Patchable? X)
 {"e":XXXX,"m":"aws.lambda.enhanced.invocations","t":["dd_lambda_layer:datadog-ruby33","functionname:integration-tests-rb-XXXX-appsec-request_ruby33","region:eu-west-1","account_id:XXXX","memorysize:1024","cold_start:false","runtime:Ruby 3.3.X","resource:integration-tests-rb-XXXX-appsec-request_ruby33","datadog_lambda:X.X.X","dd_trace:2.XX.X"],"v":1}
 {"e":XXXX,"m":"aws.lambda.enhanced.invocations","t":["dd_lambda_layer:datadog-ruby33","functionname:integration-tests-rb-XXXX-appsec-request_ruby33","region:eu-west-1","account_id:XXXX","memorysize:1024","cold_start:false","runtime:Ruby 3.3.X","resource:integration-tests-rb-XXXX-appsec-request_ruby33","datadog_lambda:X.X.X","dd_trace:2.XX.X"],"v":1}
 {"e":XXXX,"m":"aws.lambda.enhanced.invocations","t":["dd_lambda_layer:datadog-ruby33","functionname:integration-tests-rb-XXXX-appsec-request_ruby33","region:eu-west-1","account_id:XXXX","memorysize:1024","cold_start:false","runtime:Ruby 3.3.X","resource:integration-tests-rb-XXXX-appsec-request_ruby33","datadog_lambda:X.X.X","dd_trace:2.XX.X"],"v":1}

integration_tests/snapshots/logs/appsec-request_ruby34.log

@@ -11,7 +11,7 @@ START
 START
 START
 START
-W, [XXXX]  WARN XXXX[datadog] Unable to patch Datadog::Tracing::Contrib::Aws::Integration (Available?: true, Loaded? false, Compatible? true, Patchable? false)
+W, [XXXX]  WARN XXXX[datadog] Unable to patch Datadog::Tracing::Contrib::Aws::Integration (Available?: X, Loaded? X, Compatible? X, Patchable? X)
 {"e":XXXX,"m":"aws.lambda.enhanced.invocations","t":["dd_lambda_layer:datadog-ruby34","functionname:integration-tests-rb-XXXX-appsec-request_ruby34","region:eu-west-1","account_id:XXXX","memorysize:1024","cold_start:false","runtime:Ruby 3.4.X","resource:integration-tests-rb-XXXX-appsec-request_ruby34","datadog_lambda:X.X.X","dd_trace:2.XX.X"],"v":1}
 {"e":XXXX,"m":"aws.lambda.enhanced.invocations","t":["dd_lambda_layer:datadog-ruby34","functionname:integration-tests-rb-XXXX-appsec-request_ruby34","region:eu-west-1","account_id:XXXX","memorysize:1024","cold_start:false","runtime:Ruby 3.4.X","resource:integration-tests-rb-XXXX-appsec-request_ruby34","datadog_lambda:X.X.X","dd_trace:2.XX.X"],"v":1}
 {"e":XXXX,"m":"aws.lambda.enhanced.invocations","t":["dd_lambda_layer:datadog-ruby34","functionname:integration-tests-rb-XXXX-appsec-request_ruby34","region:eu-west-1","account_id:XXXX","memorysize:1024","cold_start:false","runtime:Ruby 3.4.X","resource:integration-tests-rb-XXXX-appsec-request_ruby34","datadog_lambda:X.X.X","dd_trace:2.XX.X"],"v":1}

integration_tests/snapshots/logs/appsec-request_ruby40.log

@@ -11,7 +11,7 @@ START
 START
 START
 START
-W, [XXXX]  WARN XXXX[datadog] Unable to patch Datadog::Tracing::Contrib::Aws::Integration (Available?: true, Loaded? false, Compatible? true, Patchable? false)
+W, [XXXX]  WARN XXXX[datadog] Unable to patch Datadog::Tracing::Contrib::Aws::Integration (Available?: X, Loaded? X, Compatible? X, Patchable? X)
 {"e":XXXX,"m":"aws.lambda.enhanced.invocations","t":["dd_lambda_layer:datadog-ruby40","functionname:integration-tests-rb-XXXX-appsec-request_ruby40","region:eu-west-1","account_id:XXXX","memorysize:1024","cold_start:false","runtime:Ruby 4.0.X","resource:integration-tests-rb-XXXX-appsec-request_ruby40","datadog_lambda:X.X.X","dd_trace:2.XX.X"],"v":1}
 {"e":XXXX,"m":"aws.lambda.enhanced.invocations","t":["dd_lambda_layer:datadog-ruby40","functionname:integration-tests-rb-XXXX-appsec-request_ruby40","region:eu-west-1","account_id:XXXX","memorysize:1024","cold_start:false","runtime:Ruby 4.0.X","resource:integration-tests-rb-XXXX-appsec-request_ruby40","datadog_lambda:X.X.X","dd_trace:2.XX.X"],"v":1}
 {"e":XXXX,"m":"aws.lambda.enhanced.invocations","t":["dd_lambda_layer:datadog-ruby40","functionname:integration-tests-rb-XXXX-appsec-request_ruby40","region:eu-west-1","account_id:XXXX","memorysize:1024","cold_start:false","runtime:Ruby 4.0.X","resource:integration-tests-rb-XXXX-appsec-request_ruby40","datadog_lambda:X.X.X","dd_trace:2.XX.X"],"v":1}

integration_tests/snapshots/logs/async-metrics_ruby32.log

@@ -16,7 +16,7 @@ START
 START
 START
 START
-W, [XXXX]  WARN XXXX[datadog] Unable to patch Datadog::Tracing::Contrib::Aws::Integration (Available?: true, Loaded? false, Compatible? true, Patchable? false)
+W, [XXXX]  WARN XXXX[datadog] Unable to patch Datadog::Tracing::Contrib::Aws::Integration (Available?: X, Loaded? X, Compatible? X, Patchable? X)
 {"e":XXXX,"m":"aws.lambda.enhanced.invocations","t":["dd_lambda_layer:datadog-ruby32","functionname:integration-tests-rb-XXXX-async-metrics_ruby32","region:eu-west-1","account_id:XXXX","memorysize:1024","cold_start:false","runtime:Ruby 3.2.X","resource:integration-tests-rb-XXXX-async-metrics_ruby32","datadog_lambda:X.X.X","dd_trace:2.XX.X"],"v":1}
 {"e":XXXX,"m":"aws.lambda.enhanced.invocations","t":["dd_lambda_layer:datadog-ruby32","functionname:integration-tests-rb-XXXX-async-metrics_ruby32","region:eu-west-1","account_id:XXXX","memorysize:1024","cold_start:false","runtime:Ruby 3.2.X","resource:integration-tests-rb-XXXX-async-metrics_ruby32","datadog_lambda:X.X.X","dd_trace:2.XX.X"],"v":1}
 {"e":XXXX,"m":"aws.lambda.enhanced.invocations","t":["dd_lambda_layer:datadog-ruby32","functionname:integration-tests-rb-XXXX-async-metrics_ruby32","region:eu-west-1","account_id:XXXX","memorysize:1024","cold_start:false","runtime:Ruby 3.2.X","resource:integration-tests-rb-XXXX-async-metrics_ruby32","datadog_lambda:X.X.X","dd_trace:2.XX.X"],"v":1}

integration_tests/snapshots/logs/async-metrics_ruby33.log

@@ -16,7 +16,7 @@ START
 START
 START
 START
-W, [XXXX]  WARN XXXX[datadog] Unable to patch Datadog::Tracing::Contrib::Aws::Integration (Available?: true, Loaded? false, Compatible? true, Patchable? false)
+W, [XXXX]  WARN XXXX[datadog] Unable to patch Datadog::Tracing::Contrib::Aws::Integration (Available?: X, Loaded? X, Compatible? X, Patchable? X)
 {"e":XXXX,"m":"aws.lambda.enhanced.invocations","t":["dd_lambda_layer:datadog-ruby33","functionname:integration-tests-rb-XXXX-async-metrics_ruby33","region:eu-west-1","account_id:XXXX","memorysize:1024","cold_start:false","runtime:Ruby 3.3.X","resource:integration-tests-rb-XXXX-async-metrics_ruby33","datadog_lambda:X.X.X","dd_trace:2.XX.X"],"v":1}
 {"e":XXXX,"m":"aws.lambda.enhanced.invocations","t":["dd_lambda_layer:datadog-ruby33","functionname:integration-tests-rb-XXXX-async-metrics_ruby33","region:eu-west-1","account_id:XXXX","memorysize:1024","cold_start:false","runtime:Ruby 3.3.X","resource:integration-tests-rb-XXXX-async-metrics_ruby33","datadog_lambda:X.X.X","dd_trace:2.XX.X"],"v":1}
 {"e":XXXX,"m":"aws.lambda.enhanced.invocations","t":["dd_lambda_layer:datadog-ruby33","functionname:integration-tests-rb-XXXX-async-metrics_ruby33","region:eu-west-1","account_id:XXXX","memorysize:1024","cold_start:false","runtime:Ruby 3.3.X","resource:integration-tests-rb-XXXX-async-metrics_ruby33","datadog_lambda:X.X.X","dd_trace:2.XX.X"],"v":1}

integration_tests/snapshots/logs/async-metrics_ruby34.log

@@ -16,7 +16,7 @@ START
 START
 START
 START
-W, [XXXX]  WARN XXXX[datadog] Unable to patch Datadog::Tracing::Contrib::Aws::Integration (Available?: true, Loaded? false, Compatible? true, Patchable? false)
+W, [XXXX]  WARN XXXX[datadog] Unable to patch Datadog::Tracing::Contrib::Aws::Integration (Available?: X, Loaded? X, Compatible? X, Patchable? X)
 {"e":XXXX,"m":"aws.lambda.enhanced.invocations","t":["dd_lambda_layer:datadog-ruby34","functionname:integration-tests-rb-XXXX-async-metrics_ruby34","region:eu-west-1","account_id:XXXX","memorysize:1024","cold_start:false","runtime:Ruby 3.4.X","resource:integration-tests-rb-XXXX-async-metrics_ruby34","datadog_lambda:X.X.X","dd_trace:2.XX.X"],"v":1}
 {"e":XXXX,"m":"aws.lambda.enhanced.invocations","t":["dd_lambda_layer:datadog-ruby34","functionname:integration-tests-rb-XXXX-async-metrics_ruby34","region:eu-west-1","account_id:XXXX","memorysize:1024","cold_start:false","runtime:Ruby 3.4.X","resource:integration-tests-rb-XXXX-async-metrics_ruby34","datadog_lambda:X.X.X","dd_trace:2.XX.X"],"v":1}
 {"e":XXXX,"m":"aws.lambda.enhanced.invocations","t":["dd_lambda_layer:datadog-ruby34","functionname:integration-tests-rb-XXXX-async-metrics_ruby34","region:eu-west-1","account_id:XXXX","memorysize:1024","cold_start:false","runtime:Ruby 3.4.X","resource:integration-tests-rb-XXXX-async-metrics_ruby34","datadog_lambda:X.X.X","dd_trace:2.XX.X"],"v":1}

integration_tests/snapshots/logs/async-metrics_ruby40.log

@@ -16,7 +16,7 @@ START
 START
 START
 START
-W, [XXXX]  WARN XXXX[datadog] Unable to patch Datadog::Tracing::Contrib::Aws::Integration (Available?: true, Loaded? false, Compatible? true, Patchable? false)
+W, [XXXX]  WARN XXXX[datadog] Unable to patch Datadog::Tracing::Contrib::Aws::Integration (Available?: X, Loaded? X, Compatible? X, Patchable? X)
 {"e":XXXX,"m":"aws.lambda.enhanced.invocations","t":["dd_lambda_layer:datadog-ruby40","functionname:integration-tests-rb-XXXX-async-metrics_ruby40","region:eu-west-1","account_id:XXXX","memorysize:1024","cold_start:false","runtime:Ruby 4.0.X","resource:integration-tests-rb-XXXX-async-metrics_ruby40","datadog_lambda:X.X.X","dd_trace:2.XX.X"],"v":1}
 {"e":XXXX,"m":"aws.lambda.enhanced.invocations","t":["dd_lambda_layer:datadog-ruby40","functionname:integration-tests-rb-XXXX-async-metrics_ruby40","region:eu-west-1","account_id:XXXX","memorysize:1024","cold_start:false","runtime:Ruby 4.0.X","resource:integration-tests-rb-XXXX-async-metrics_ruby40","datadog_lambda:X.X.X","dd_trace:2.XX.X"],"v":1}
 {"e":XXXX,"m":"aws.lambda.enhanced.invocations","t":["dd_lambda_layer:datadog-ruby40","functionname:integration-tests-rb-XXXX-async-metrics_ruby40","region:eu-west-1","account_id:XXXX","memorysize:1024","cold_start:false","runtime:Ruby 4.0.X","resource:integration-tests-rb-XXXX-async-metrics_ruby40","datadog_lambda:X.X.X","dd_trace:2.XX.X"],"v":1}

integration_tests/snapshots/logs/http-requests_ruby32.log

@@ -16,7 +16,7 @@ Snapshot test http requests successfully made to URLs: ["ip-ranges.datadoghq.com
 Snapshot test http requests successfully made to URLs: ["ip-ranges.datadoghq.com", "ip-ranges.datadoghq.eu"]
 Snapshot test http requests successfully made to URLs: ["ip-ranges.datadoghq.com", "ip-ranges.datadoghq.eu"]
 Snapshot test http requests successfully made to URLs: ["ip-ranges.datadoghq.com", "ip-ranges.datadoghq.eu"]
-W, [XXXX]  WARN XXXX[datadog] Unable to patch Datadog::Tracing::Contrib::Aws::Integration (Available?: true, Loaded? false, Compatible? true, Patchable? false)
+W, [XXXX]  WARN XXXX[datadog] Unable to patch Datadog::Tracing::Contrib::Aws::Integration (Available?: X, Loaded? X, Compatible? X, Patchable? X)
 {"e":XXXX,"m":"aws.lambda.enhanced.invocations","t":["dd_lambda_layer:datadog-ruby32","functionname:integration-tests-rb-XXXX-http-requests_ruby32","region:eu-west-1","account_id:XXXX","memorysize:1024","cold_start:false","runtime:Ruby 3.2.X","resource:integration-tests-rb-XXXX-http-requests_ruby32","datadog_lambda:X.X.X","dd_trace:2.XX.X"],"v":1}
 {"e":XXXX,"m":"aws.lambda.enhanced.invocations","t":["dd_lambda_layer:datadog-ruby32","functionname:integration-tests-rb-XXXX-http-requests_ruby32","region:eu-west-1","account_id:XXXX","memorysize:1024","cold_start:false","runtime:Ruby 3.2.X","resource:integration-tests-rb-XXXX-http-requests_ruby32","datadog_lambda:X.X.X","dd_trace:2.XX.X"],"v":1}
 {"e":XXXX,"m":"aws.lambda.enhanced.invocations","t":["dd_lambda_layer:datadog-ruby32","functionname:integration-tests-rb-XXXX-http-requests_ruby32","region:eu-west-1","account_id:XXXX","memorysize:1024","cold_start:false","runtime:Ruby 3.2.X","resource:integration-tests-rb-XXXX-http-requests_ruby32","datadog_lambda:X.X.X","dd_trace:2.XX.X"],"v":1}

integration_tests/snapshots/logs/http-requests_ruby33.log

@@ -16,7 +16,7 @@ Snapshot test http requests successfully made to URLs: ["ip-ranges.datadoghq.com
 Snapshot test http requests successfully made to URLs: ["ip-ranges.datadoghq.com", "ip-ranges.datadoghq.eu"]
 Snapshot test http requests successfully made to URLs: ["ip-ranges.datadoghq.com", "ip-ranges.datadoghq.eu"]
 Snapshot test http requests successfully made to URLs: ["ip-ranges.datadoghq.com", "ip-ranges.datadoghq.eu"]
-W, [XXXX]  WARN XXXX[datadog] Unable to patch Datadog::Tracing::Contrib::Aws::Integration (Available?: true, Loaded? false, Compatible? true, Patchable? false)
+W, [XXXX]  WARN XXXX[datadog] Unable to patch Datadog::Tracing::Contrib::Aws::Integration (Available?: X, Loaded? X, Compatible? X, Patchable? X)
 {"e":XXXX,"m":"aws.lambda.enhanced.invocations","t":["dd_lambda_layer:datadog-ruby33","functionname:integration-tests-rb-XXXX-http-requests_ruby33","region:eu-west-1","account_id:XXXX","memorysize:1024","cold_start:false","runtime:Ruby 3.3.X","resource:integration-tests-rb-XXXX-http-requests_ruby33","datadog_lambda:X.X.X","dd_trace:2.XX.X"],"v":1}
 {"e":XXXX,"m":"aws.lambda.enhanced.invocations","t":["dd_lambda_layer:datadog-ruby33","functionname:integration-tests-rb-XXXX-http-requests_ruby33","region:eu-west-1","account_id:XXXX","memorysize:1024","cold_start:false","runtime:Ruby 3.3.X","resource:integration-tests-rb-XXXX-http-requests_ruby33","datadog_lambda:X.X.X","dd_trace:2.XX.X"],"v":1}
 {"e":XXXX,"m":"aws.lambda.enhanced.invocations","t":["dd_lambda_layer:datadog-ruby33","functionname:integration-tests-rb-XXXX-http-requests_ruby33","region:eu-west-1","account_id:XXXX","memorysize:1024","cold_start:false","runtime:Ruby 3.3.X","resource:integration-tests-rb-XXXX-http-requests_ruby33","datadog_lambda:X.X.X","dd_trace:2.XX.X"],"v":1}