From 6148fc67da01af076b731a074ba7017f210b08b8 Mon Sep 17 00:00:00 2001
From: Ajay Krishnan <ajay@krishnan.ca>
Date: Sun, 19 Jul 2026 04:30:50 -0700
Subject: [PATCH 1/2] Run gem releases only on GitHub

---
 .github/workflows/release.yml | 1 +
 1 file changed, 1 insertion(+)

diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index 0aa5267..cb16d70 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -7,6 +7,7 @@ on:
 
 jobs:
   push:
+    if: ${{ github.server_url == 'https://github.com' }}
     runs-on: ubuntu-latest
     permissions:
       contents: write

From 75e4435d9d4d987358f7f2d090a897e8135a59af Mon Sep 17 00:00:00 2001
From: Ajay Krishnan <ajay@krishnan.ca>
Date: Sun, 19 Jul 2026 06:50:51 -0700
Subject: [PATCH 2/2] Test GitHub-only gem release boundary

---
 test/release_workflow_test.rb | 33 +++++++++++++++++++++++++++++++++
 1 file changed, 33 insertions(+)
 create mode 100644 test/release_workflow_test.rb

diff --git a/test/release_workflow_test.rb b/test/release_workflow_test.rb
new file mode 100644
index 0000000..e9afa84
--- /dev/null
+++ b/test/release_workflow_test.rb
@@ -0,0 +1,33 @@
+# frozen_string_literal: true
+
+require "minitest/autorun"
+require "yaml"
+
+class ReleaseWorkflowTest < Minitest::Test
+  ROOT = File.expand_path("..", __dir__)
+  WORKFLOW_PATH = File.join(ROOT, ".github", "workflows", "release.yml")
+
+  def workflow
+    @workflow ||= YAML.safe_load(File.read(WORKFLOW_PATH), aliases: false)
+  end
+
+  def push_job
+    workflow.fetch("jobs").fetch("push")
+  end
+
+  def test_release_job_is_inert_on_non_github_runners
+    assert_equal "${{ github.server_url == 'https://github.com' }}", push_job.fetch("if")
+  end
+
+  def test_release_job_keeps_the_trusted_publisher_boundary
+    assert_equal "release", push_job.fetch("environment")
+    assert_equal(
+      { "contents" => "write", "id-token" => "write" },
+      push_job.fetch("permissions")
+    )
+
+    steps = push_job.fetch("steps")
+    assert_equal 1, steps.count { |step| step["uses"] == "rubygems/release-gem@v1" }
+    refute steps.any? { |step| step.fetch("run", "").match?(/\bgem\s+push\b/) }
+  end
+end