[AbuMareBear]

Summary

• script/release now accepts --otp CODE (or --otp=CODE) and exports it as GEM_HOST_OTP_CODE, which gem push reads as the MFA code. Passing a TOTP code skips the WebAuthn browser handoff that RubyGems otherwise requires when MFA is enabled on the account. Omitting the flag preserves the existing WebAuthn flow.
• A bare --otp or any unrecognised argument prints usage and exits before the npm whoami preflight, the test suite, or the gem push run.
• CHANGELOG has an entry under Unreleased.

Background

With MFA set to "UI and API" on rubygems.org, gem push opens a localhost port, prints a webauthn_verification URL, and waits up to 5 minutes for the browser to complete a passkey and redirect back. That handoff is fragile (passkey in the wrong browser, blocked localhost redirect, or the window expiring while script/cibuild runs). RubyGems already honours GEM_HOST_OTP_CODE as an alternative, so the script just surfaces it as a flag.

Test plan

• sh -n script/release passes.
• Option parsing exercised in isolation: --otp 123456 and --otp=654321 set the variable, no argument leaves it unset, and --otp alone or a bogus argument exit 1 with the usage line.
• Real release with script/release --otp <code> on the next version bump.

Notes

• TOTP codes rotate every 30 seconds and the script runs the full test suite before pushing, so grab the code once the tests are nearly done.
• This only covers RubyGems. If npm 2FA is on for publishing, npm publish still prompts for its own code interactively.

🤖 Generated with Claude Code