I'm working towards support for Buildkite being a trusted publisher on rubygems.org, eventually including support for sigstore based attestations for gems built and uploaded using Buildkite.

Based on the release-gem action for GitHub actions, it seems like we'd need sigstore-ruby to support the following command in a CI env:

bundle exec sigstore-cli sign foo-1.0.gem --bundle bundle.sigstore.json

The resulting json file can then be passed it gem push foo-1.0.gem --attestation bundle.sigstore.json