Publish new ecosystems dependabot-rust_toolchain and depenadbot-vcpkg on rubygems.org

[markhallen]

We need to publish two new ecosystems, however we are blocked since trusted publisher signing was introduced for rubygems.org in #12025

The new ecosystem gems are:

• dependabot-rust_toolchain
• depenadbot-vcpkg

We created the trusted publisher placeholders on rubygems.org:

However, we still have an issue publishing the new gems:

gem push pkg/dependabot-rust_toolchain-0.320.1.gem --attestation pkg/dependabot-rust_toolchain-0.320.1.sigstore.json
Pushing gem to https://rubygems.org.../
You are not allowed to push this gem.
gem exec sigstore-cli:0.2.1 sign pkg/dependabot-rust_toolchain-0.320.1.gem --bundle pkg/dependabot-rust_toolchain-0.320.1.sigstore.json
! `gem push` failed with error: Command failed with status (1): [gem push pkg/dependabot-rust_toolchain-0.320.1.gem --attestation pkg/dependabot-rust_toolchain-0.320.1.sigstore.json]
> Releasing pkg/dependabot-rust_toolchain-0.320.1.gem

[steiza]

I don't see anything obviously wrong with this configuration. I haven't used trusted publishing with Ruby Gems myself, maybe @jeffwidman has some insight?

Otherwise, if we think it's a problem on RubyGems side, we should open up something in https://github.com/rubygems/rubygems/issues.

[jkylekelly]

Just a shot in the dark, but I don't believe the workflow should include configure-rubygems-credentials. Maybe there's a chance the gem push is trying to use the API key instead of the OIDC authentication?

[JamieMagee]

Created an issue with Rubygems:

• New gem push with trusted publishing fails with You are not allowed to push this gem rubygems/rubygems.org#5808

[jeffwidman]

Just a shot in the dark, but I don't believe the workflow should include configure-rubygems-credentials. Maybe there's a chance the gem push is trying to use the API key instead of the OIDC authentication?

My memory is fallible, but I think I recall this is necessary because this handles the OIDC handshakes in order to create a token and expose it to RubyGems/Bundler CLI tooling... that also matches the repo description: https://github.com/rubygems/configure-rubygems-credentials