From 54465a1aa0552b74f5a831cd39817f5afe94fecf Mon Sep 17 00:00:00 2001 From: Szymon Kurcab Date: Fri, 18 Sep 2026 20:42:09 +0200 Subject: [PATCH] build: require MFA for a manual push, and link the metadata Releases go through trusted publishing, so no API key is stored anywhere and a push from CI needs no secret. That leaves the other door open: anyone holding a RubyGems credential for an owner of this gem can `gem push` from a laptop, and a leaked or reused token is enough. rubygems_mfa_required refuses that without a second factor. It costs nothing here, because the automated path does not use credentials at all. Also adds bug_tracker_uri and documentation_uri, so the RubyGems page points at the issue tracker and the README rather than only at the repo root. homepage_uri is deliberately not set: it would duplicate source_code_uri, and `gem build --strict` -- which the release workflow runs -- fails on that warning. Verified with `rake release:build`, which is the strict build the release workflow performs. Co-Authored-By: Claude Opus 5 (1M context) --- CHANGELOG.md | 8 ++++++++ ruby_decision_model.gemspec | 8 ++++++++ 2 files changed, 16 insertions(+) diff --git a/CHANGELOG.md b/CHANGELOG.md index 846df76..12582d8 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -1,5 +1,13 @@ # Changelog +## Unreleased + +- The gemspec sets `rubygems_mfa_required`, so a push with someone's RubyGems + credentials is refused without a second factor. Releases already go through + trusted publishing, which needs no stored key; this closes the other door. +- Added `bug_tracker_uri` and `documentation_uri` to the gemspec metadata, so + the RubyGems page links to the issue tracker and the README. + ## 0.1.0 - 2026-09-18 Provider-neutral release. One `Client`, two providers behind it. diff --git a/ruby_decision_model.gemspec b/ruby_decision_model.gemspec index aa567ed..b019c27 100644 --- a/ruby_decision_model.gemspec +++ b/ruby_decision_model.gemspec @@ -19,8 +19,16 @@ Gem::Specification.new do |spec| spec.license = "MIT" spec.required_ruby_version = ">= 3.2" + # homepage_uri is left out on purpose: it would duplicate source_code_uri, + # and `gem build --strict` in the release workflow fails on that warning. spec.metadata["source_code_uri"] = spec.homepage spec.metadata["changelog_uri"] = "#{spec.homepage}/blob/main/CHANGELOG.md" + spec.metadata["bug_tracker_uri"] = "#{spec.homepage}/issues" + spec.metadata["documentation_uri"] = "#{spec.homepage}/blob/main/README.md" + # Releases go through trusted publishing, which needs no stored key. This + # closes the other door: a push with someone's RubyGems credentials, from a + # laptop or a leaked token, is refused without a second factor. + spec.metadata["rubygems_mfa_required"] = "true" spec.files = Dir["lib/**/*.rb"] + %w[README.md CHANGELOG.md LICENSE.txt] spec.require_paths = ["lib"]