add trusted publishers (#599)

Author: mensfeld

.github/workflows/push.yml

@@ -0,0 +1,31 @@
+name: Push Gem
+
+on:
+  push:
+    tags:
+      - v*
+
+permissions:
+  contents: read
+
+jobs:
+  push:
+    if: github.repository_owner == 'karafka'
+    runs-on: ubuntu-latest
+
+    permissions:
+      contents: write
+      id-token: write
+
+    steps:
+      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
+        with:
+          fetch-depth: 0
+
+      - name: Set up Ruby
+        uses: ruby/setup-ruby@84684c07c1965536eb4802c8daf1a77968df0cb1 # v1.239.0
+        with:
+          bundler-cache: true
+
+      # Release
+      - uses: rubygems/release-gem@9e85cb11501bebc2ae661c1500176316d3987059 # v1

CHANGELOG.md

@@ -7,6 +7,7 @@
 - [Enhancement] Roll out experimental jruby support.
 - [Fix] Fix issue where post-closed producer C topics refs would not be cleaned.
 - [Fix] Fiber causes Segmentation Fault.
+- [Change] Move to trusted-publishers and remove signing since no longer needed.
 
 ## 0.21.0 (2025-02-13)
 - [Enhancement] Bump librdkafka to `2.8.0`

certs/cert.pem

@@ -17,11 +17,6 @@ Gem::Specification.new do |gem|
   gem.version = Rdkafka::VERSION
   gem.required_ruby_version = '>= 3.1'
   gem.extensions = %w(ext/Rakefile)
-  gem.cert_chain = %w[certs/cert.pem]
-
-  if $PROGRAM_NAME.end_with?('gem')
-    gem.signing_key = File.expand_path('~/.ssh/gem-private_key.pem')
-  end
 
   gem.add_dependency 'ffi', '~> 1.15'
   gem.add_dependency 'mini_portile2', '~> 2.6'