From 176a64490580d9abd4980529a53cb7929fd3c9e1 Mon Sep 17 00:00:00 2001
From: Joakim Antman <antmanj@gmail.com>
Date: Fri, 14 Aug 2026 22:04:00 +0300
Subject: [PATCH 1/3] ci: Migrate from the defunct release-please app to
 release-please-action

The release-please GitHub App was turned down by Google on 2025-08-14
(googleapis/release-please#2569), so the .github/release-please.yml app
config no longer does anything and no release PRs get opened.

Replace it with a release-please workflow using
googleapis/release-please-action@v4, which reads the existing
release-please-config.json and .release-please-manifest.json unchanged.
Because tags created with the workflow GITHUB_TOKEN cannot trigger the
tag-based gem-push workflow, the gem publish steps run as a second job
in the same workflow, gated on a release having been created.
---
 .github/release-please.yml           |  2 -
 .github/workflows/release-please.yml | 56 ++++++++++++++++++++++++++++
 2 files changed, 56 insertions(+), 2 deletions(-)
 delete mode 100644 .github/release-please.yml
 create mode 100644 .github/workflows/release-please.yml

diff --git a/.github/release-please.yml b/.github/release-please.yml
deleted file mode 100644
index 19c4910..0000000
--- a/.github/release-please.yml
+++ /dev/null
@@ -1,2 +0,0 @@
-handleGHRelease: true
-manifest: true
diff --git a/.github/workflows/release-please.yml b/.github/workflows/release-please.yml
new file mode 100644
index 0000000..df62c01
--- /dev/null
+++ b/.github/workflows/release-please.yml
@@ -0,0 +1,56 @@
+---
+  on:
+    push:
+      branches:
+      - main
+
+  name: release-please
+  jobs:
+    release-please:
+      runs-on: ubuntu-latest
+      permissions:
+        contents: write
+        pull-requests: write
+      outputs:
+        release_created: ${{ steps.release.outputs.release_created }}
+        tag_name: ${{ steps.release.outputs.tag_name }}
+      steps:
+      - uses: googleapis/release-please-action@45996ed1f6d02564a971a2fa1b5860e934307cf7 # v5.0.0
+        id: release
+
+    push-gem:
+      needs: release-please
+      if: ${{ needs.release-please.outputs.release_created == 'true' }}
+      runs-on: ubuntu-latest
+      permissions:
+        contents: write
+        id-token: write
+      steps:
+      - uses: rubygems/configure-rubygems-credentials@dc5a8d8553e6ee01fc26761a49e99e733d17954a # v2.1.0
+        with:
+          role-to-assume: rg_oidc_akr_d5dztzq4ywp3y7rd7vfp
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
+      - name: Set remote URL
+        run: |
+          # Attribute commits to the last committer on HEAD
+          git config --global user.email "$(git log -1 --pretty=format:'%ae')"
+          git config --global user.name "$(git log -1 --pretty=format:'%an')"
+          git remote set-url origin "https://x-access-token:${{ secrets.GITHUB_TOKEN }}@github.com/$GITHUB_REPOSITORY"
+      - name: Set up Ruby
+        uses: ruby/setup-ruby@95ef2b042f9d7a56d8268cba8559e2842e2ad01b # v1.321.0
+        with:
+          bundler-cache: true
+          ruby-version: ruby
+      - name: Release
+        run: bundle exec rake release
+      - name: Wait for release to propagate
+        run: |
+          gem install rubygems-await
+          gem_tuple="$(ruby -rbundler/setup -rbundler -e '
+              spec = Bundler.definition.specs.find {|s| s.name == ARGV[0] }
+              raise "No spec for #{ARGV[0]}" unless spec
+              print [spec.name, spec.version, spec.platform].join(":")
+            ' "jwt-eddsa")"
+          gem await "${gem_tuple}"

From aeb684973583c6856421df00f9335542e0c5f7df Mon Sep 17 00:00:00 2001
From: Joakim Antman <antmanj@gmail.com>
Date: Fri, 14 Aug 2026 22:07:08 +0300
Subject: [PATCH 2/3] ci: Fix zizmor findings in the existing workflows

Pin all actions to commit SHAs, disable git credential persistence on
checkouts, add read-only default permissions to test and pr-title
workflows, and stop using the bundler cache in the gem publishing jobs
(cache poisoning hardening, matching ruby-jwt's push_gem.yml).
---
 .github/workflows/gem-push.yml       | 12 ++++++++----
 .github/workflows/pr-title.yml       |  5 ++++-
 .github/workflows/release-please.yml |  4 +++-
 .github/workflows/test.yml           | 14 ++++++++++----
 4 files changed, 25 insertions(+), 10 deletions(-)

diff --git a/.github/workflows/gem-push.yml b/.github/workflows/gem-push.yml
index 7b8caf9..8f9b1bd 100644
--- a/.github/workflows/gem-push.yml
+++ b/.github/workflows/gem-push.yml
@@ -12,10 +12,12 @@
         contents: write
         id-token: write
       steps:
-      - uses: rubygems/configure-rubygems-credentials@main
+      - uses: rubygems/configure-rubygems-credentials@dc5a8d8553e6ee01fc26761a49e99e733d17954a # v2.1.0
         with:
           role-to-assume: rg_oidc_akr_d5dztzq4ywp3y7rd7vfp
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
       - name: Set remote URL
         run: |
           # Attribute commits to the last committer on HEAD
@@ -23,10 +25,12 @@
           git config --global user.name "$(git log -1 --pretty=format:'%an')"
           git remote set-url origin "https://x-access-token:${{ secrets.GITHUB_TOKEN }}@github.com/$GITHUB_REPOSITORY"
       - name: Set up Ruby
-        uses: ruby/setup-ruby@v1
+        uses: ruby/setup-ruby@95ef2b042f9d7a56d8268cba8559e2842e2ad01b # v1.321.0
         with:
-          bundler-cache: true
+          bundler-cache: false
           ruby-version: ruby
+      - name: Install dependencies
+        run: bundle install
       - name: Extract version number
         run: echo "GEM_VERSION=${GITHUB_REF#refs/tags/v}" >> $GITHUB_ENV
       - name: Release
diff --git a/.github/workflows/pr-title.yml b/.github/workflows/pr-title.yml
index 4899031..20e7257 100644
--- a/.github/workflows/pr-title.yml
+++ b/.github/workflows/pr-title.yml
@@ -1,5 +1,8 @@
 name: PR Conventional Commit Validation
 
+permissions:
+  contents: read
+
 on:
   pull_request:
     types: [opened, synchronize, reopened, edited]
@@ -9,7 +12,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: PR Conventional Commit Validation
-        uses:  ytanikin/PRConventionalCommits@1.2.0
+        uses: ytanikin/PRConventionalCommits@8d258b54939f6769fcd935a52b96d6b0383a00c5 # 1.2.0
         with:
           task_types: '["feat","fix","docs","test","ci","refactor","perf","chore","revert"]'
           add_label: 'false'
diff --git a/.github/workflows/release-please.yml b/.github/workflows/release-please.yml
index df62c01..94d0585 100644
--- a/.github/workflows/release-please.yml
+++ b/.github/workflows/release-please.yml
@@ -41,8 +41,10 @@
       - name: Set up Ruby
         uses: ruby/setup-ruby@95ef2b042f9d7a56d8268cba8559e2842e2ad01b # v1.321.0
         with:
-          bundler-cache: true
+          bundler-cache: false
           ruby-version: ruby
+      - name: Install dependencies
+        run: bundle install
       - name: Release
         run: bundle exec rake release
       - name: Wait for release to propagate
diff --git a/.github/workflows/test.yml b/.github/workflows/test.yml
index 637b4df..4273a0f 100644
--- a/.github/workflows/test.yml
+++ b/.github/workflows/test.yml
@@ -1,5 +1,7 @@
 ---
 name: test
+permissions:
+  contents: read
 on:
   push:
     branches:
@@ -13,9 +15,11 @@ jobs:
     timeout-minutes: 30
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
       - name: Set up Ruby
-        uses: ruby/setup-ruby@v1
+        uses: ruby/setup-ruby@95ef2b042f9d7a56d8268cba8559e2842e2ad01b # v1.321.0
         with:
           ruby-version: ruby
           bundler-cache: true
@@ -37,10 +41,12 @@ jobs:
           - "3.3"
           - "3.4"
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
 
       - name: Set up Ruby
-        uses: ruby/setup-ruby@v1
+        uses: ruby/setup-ruby@95ef2b042f9d7a56d8268cba8559e2842e2ad01b # v1.321.0
         with:
           ruby-version: ${{ matrix.ruby }}
           bundler-cache: true

From f3e7d39bad2793d205eb0b2990fed44cb6cf44af Mon Sep 17 00:00:00 2001
From: Joakim Antman <antmanj@gmail.com>
Date: Fri, 14 Aug 2026 22:10:24 +0300
Subject: [PATCH 3/3] ci: Add Ruby 4.0 to the test matrix

---
 .github/workflows/test.yml | 1 +
 1 file changed, 1 insertion(+)

diff --git a/.github/workflows/test.yml b/.github/workflows/test.yml
index 4273a0f..3708768 100644
--- a/.github/workflows/test.yml
+++ b/.github/workflows/test.yml
@@ -40,6 +40,7 @@ jobs:
           - "3.2"
           - "3.3"
           - "3.4"
+          - "4.0"
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with: