Releasing & Supply Chain Security

Relevant source files

The following files were used as context for generating this wiki page:

• RELEASING.md
• CLAUDE.md
• README.md
• BENCHMARKING.md
• spec/sidekiq_unique_jobs/sidekiq_unique_jobs_spec.rb

Releasing sidekiq-unique-jobs is a fully automated process managed through GitHub Actions, specifically designed to incorporate modern supply chain security standards. The system ensures that every gem published is verifiable, signed, and originates from a trusted environment without relying on long-lived sensitive credentials.

The release workflow integrates several security layers, including OpenID Connect (OIDC) for identity verification, Sigstore for cryptographic signing, and strict content validation to prevent the inclusion of unnecessary or sensitive development files in the production gem.

Sources: RELEASING.md:1-5

Security Infrastructure

The project utilizes a multi-layered security model to protect the distribution of the gem. This model focuses on removing manual intervention and long-lived secrets, which are common vectors for supply chain attacks.

Key Security Features

Feature	Technical Implementation	Purpose
Trusted Publishing	OpenID Connect (OIDC)	Eliminates RUBYGEMS_API_KEY by verifying GitHub Actions identity.
Sigstore Attestation	Keyless Sigstore signing	Logs signatures in a public transparency log for verification.
Checksum Verification	SHA-256 & SHA-512	Provides independent verification of binary integrity.
Tag-Version Gate	Version match check	Ensures SidekiqUniqueJobs::VERSION matches the git tag.
Content Filtering	Gem unpack inspection	Prevents specs, rake files, and dev tools from being packaged.
MFA Protection	rubygems_mfa_required	Enforces Multi-Factor Authentication for any manual pushes.

Sources: RELEASING.md:7-15, CLAUDE.md:65-68

Automated Release Flow

The following diagram illustrates the lifecycle of a release from the local developer environment through the CI/CD pipeline to public distribution.

This flow ensures that no gem reaches RubyGems.org without passing the full suite of style and functional tests.
Sources: RELEASING.md:25-31, BENCHMARKING.md:148-160

Release Procedures

Release Commands

Maintainers use specific Rake tasks to trigger the release process. The task automates versioning, commits, and the creation of a GitHub release, which serves as the trigger for the secure deployment pipeline.

# Perform a standard stable release
bundle exec rake release[1.2.3]

# Perform a pre-release (e.g., alpha, beta)
bundle exec rake release[1.2.3.alpha1]

# Local verification of gem contents without publishing
bundle exec rake build

Sources: RELEASING.md:17-23, RELEASING.md:68-72, CLAUDE.md:65-68

Pipeline Verification Stages

1. Build: The gem is built using --strict mode. The CI pipeline unpacks the resulting .gem file to ensure that development assets (like spec/ or RELEASING.md) are not included.
2. Publish: The publish-rubygems job requests OIDC credentials from RubyGems.org. It verifies the calculated checksums and attaches a Sigstore bundle to the gem.
3. Assets: The final GitHub release includes the .gem file along with .sha256, .sha512, and .sigstore.json files.

Sources: RELEASING.md:25-34

Verification and Supply Chain Integrity

Users and automated systems can verify the authenticity and integrity of a release using the provided attestations.

Integrity Checks

Integrity is verified by comparing the downloaded gem against the SHA checksums provided in the GitHub release.

# Verify the binary integrity
sha256sum -c sidekiq-unique-jobs-X.Y.Z.gem.sha256
sha512sum -c sidekiq-unique-jobs-X.Y.Z.gem.sha512

Sources: RELEASING.md:52-59

Sigstore Verification

To verify the provenance (that the gem was indeed built in the official repository's workflow), users can use the sigstore-cli.

gem exec sigstore-cli verify-bundle \
  --bundle sidekiq-unique-jobs-X.Y.Z.gem.sigstore.json \
  --certificate-identity "https://github.com/mhenrixon/sidekiq-unique-jobs/.github/workflows/release.yml%40refs/tags/vX.Y.Z%22 \
  --certificate-oidc-issuer "https://token.actions.githubusercontent.com" \
  sidekiq-unique-jobs-X.Y.Z.gem

Sources: RELEASING.md:61-66

Continuous Monitoring and Benchmarking

Before releases, performance is monitored to ensure no regressions in locking speed or memory usage are introduced.

Metric	Target	Verification Tool
IPS	Iterations Per Second	bin/benchmark_improvements
Memory	Allocated vs Retained	bin/benchmark
Branch Comparison	Regression detection	bin/compare_performance

Sources: BENCHMARKING.md:9-40, BENCHMARKING.md:154-160

By combining automated CI/CD, OIDC trusted publishing, and performance benchmarking, sidekiq-unique-jobs maintains a high-integrity release cycle that protects users from unauthorized or malicious package modifications.