Publish the smbcloud-email gem

.github/workflows/ci.yml

@@ -8,7 +8,7 @@ name: Tests
 #   - smbcloud-auth-sdk-wasm (wasm32-unknown-unknown cargo check)
 #   - sdk/python  → maturin wheel build  (smbcloud-sdk-auth)
 #   - sdk/npm     → wasm-pack + prepare-package.mjs  (@smbcloud/sdk-auth)
-#   - sdk/gems    → smbcloud-auth and smbcloud-model, cross-built for
+#   - sdk/gems    → smbcloud-auth, smbcloud-model and smbcloud-email, cross-built for
 #                   x86_64-linux, aarch64-linux, arm64-darwin and x86_64-darwin
 #                   against the workspace crates (oldest and newest shipped
 #                   Ruby), then installed and required on native runners; the
@@ -258,6 +258,7 @@ jobs:
             gems:
               - "sdk/gems/auth/**"
               - "sdk/gems/model/**"
+              - "sdk/gems/email/**"
               - "crates/**"
               - "Cargo.toml"
               - "Cargo.lock"
@@ -276,7 +277,7 @@ jobs:
     strategy:
       fail-fast: false
       matrix:
-        gem: [auth, model]
+        gem: [auth, model, email]
         platform: [x86_64-linux, aarch64-linux, arm64-darwin, x86_64-darwin]
     steps:
       - name: Checkout
@@ -349,7 +350,7 @@ jobs:
     strategy:
       fail-fast: false
       matrix:
-        gem: [auth, model]
+        gem: [auth, model, email]
         ruby: ["3.1", "4.0"]
         platform: [x86_64-linux, aarch64-linux, arm64-darwin]
         include:
@@ -363,6 +364,8 @@ jobs:
             constant: SmbCloud::Auth
           - gem: model
             constant: Model
+          - gem: email
+            constant: SmbCloud::Email
     steps:
       - name: Setup Ruby
         uses: ruby/setup-ruby@v1
@@ -395,7 +398,7 @@ jobs:
     strategy:
       fail-fast: false
       matrix:
-        gem: [auth, model]
+        gem: [auth, model, email]
     steps:
       - name: Checkout
         uses: actions/checkout@v6

.github/workflows/release-sdk-gem.yml

@@ -1,7 +1,7 @@
 name: SDK Ruby Gem Release
 
-# Publishes the smbcloud-auth (sdk/gems/auth) and smbcloud-model
-# (sdk/gems/model) Ruby gems to RubyGems.
+# Publishes the smbcloud-auth (sdk/gems/auth), smbcloud-model (sdk/gems/model)
+# and smbcloud-email (sdk/gems/email) Ruby gems to RubyGems.
 # Native gems are cross-compiled on Linux with rb-sys-dock, so the darwin gems
 # get the generic `arm64-darwin` / `x86_64-darwin` platforms (a gem built with a
 # runner's Ruby gets e.g. `arm64-darwin-23`, which only matches that macOS
@@ -12,9 +12,12 @@ name: SDK Ruby Gem Release
 # Gem and crate changes are covered by ci.yml, which builds against the
 # workspace crates.
 #
-# Required secrets:
-#   RUBYGEMS_API_KEY — RubyGems.org API key with push access to smbcloud-auth and
-#                         smbcloud-model
+# Gems are pushed with RubyGems trusted publishing (OIDC), so there is no API
+# key secret. Each gem needs a trusted publisher on rubygems.org for repository
+# smbcloudXYZ/smbcloud-cli, workflow release-sdk-gem.yml, with no environment.
+# A gem that does not exist yet (smbcloud-email) needs a *pending* trusted
+# publisher, created from the owner's profile; the first push turns it into a
+# normal one. See https://guides.rubygems.org/trusted-publishing/
 
 on:
   workflow_dispatch:
@@ -49,7 +52,7 @@ jobs:
     strategy:
       fail-fast: false
       matrix:
-        gem: [auth, model]
+        gem: [auth, model, email]
         platform: [x86_64-linux, aarch64-linux, arm64-darwin, x86_64-darwin]
 
     steps:
@@ -75,7 +78,7 @@ jobs:
         if: github.event_name != 'pull_request'
         shell: bash
         run: |
-          for crate_name in smbcloud-auth-sdk smbcloud-model smbcloud-network; do
+          for crate_name in smbcloud-auth-sdk smbcloud-email-sdk smbcloud-model smbcloud-network; do
             for attempt in 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20; do
               if curl -fsS -H "User-Agent: smbcloud-cli-release" "https://crates.io/api/v1/crates/${crate_name}/${RELEASE_VERSION}" >/dev/null 2>&1; then
                 echo "${crate_name} ${RELEASE_VERSION} is available on crates.io"
@@ -142,7 +145,7 @@ jobs:
     strategy:
       fail-fast: false
       matrix:
-        gem: [auth, model]
+        gem: [auth, model, email]
     steps:
       - name: Checkout
         uses: actions/checkout@v6
@@ -204,10 +207,13 @@ jobs:
     needs: [build-gems, build-source-gem]
     if: github.event_name == 'workflow_dispatch'
     runs-on: ubuntu-latest
+    permissions:
+      contents: read
+      id-token: write
     strategy:
       fail-fast: false
       matrix:
-        gem: [auth, model]
+        gem: [auth, model, email]
 
     steps:
       - name: Checkout
@@ -240,12 +246,10 @@ jobs:
         with:
           ruby-version: .ruby-version
 
+      # Exchanges this job's OIDC token for a short-lived RubyGems API key and
+      # exports it as GEM_HOST_API_KEY, which `gem push` reads.
       - name: Configure RubyGems credentials
-        shell: bash
-        run: |
-          mkdir -p "${HOME}/.gem"
-          echo ":rubygems_api_key: ${{ secrets.RUBYGEMS_API_KEY }}" > "${HOME}/.gem/credentials"
-          chmod 0600 "${HOME}/.gem/credentials"
+        uses: rubygems/configure-rubygems-credentials@v2.1.0
 
       # Push each .gem file individually. A file that is already published (a
       # re-run, or completing a partial release) is skipped; any other failure

scripts/check-release-versions.mjs

@@ -68,7 +68,11 @@ for (const path of [
 // must be the release's major.minor, or a gem can silently wrap an older crate.
 const [expectedMajor, expectedMinor] = expectedVersion.split(".");
 const expectedRequirement = `${expectedMajor}.${expectedMinor}`;
-for (const path of ["sdk/gems/auth/ext/auth/Cargo.toml", "sdk/gems/model/ext/model/Cargo.toml"]) {
+for (const path of [
+  "sdk/gems/auth/ext/auth/Cargo.toml",
+  "sdk/gems/email/ext/email/Cargo.toml",
+  "sdk/gems/model/ext/model/Cargo.toml",
+]) {
   for (const match of read(path).matchAll(/^(smbcloud-[\w-]+)\s*=\s*\{\s*version\s*=\s*"([^"]+)"/gm)) {
     if (match[2] !== expectedRequirement) {
       mismatches.push(`${path} dependency ${match[1]}: ${match[2]} (expected ${expectedRequirement})`);

scripts/sync-release-version.mjs

@@ -269,6 +269,9 @@ if (
       /^version\s*=\s*"[^"]+"/m,
       `version = "${releaseVersion}"`,
       `${emailGemCargoTomlPath} package version`,
+    ).replace(
+      /(smbcloud-email-sdk\s*=\s*\{\s*version\s*=\s*")([^"]+)("\s*\})/,
+      `$1${rubySdkRequirement}$3`,
     ),
   )
 ) {