so you would allow that github user A or a group gets rubygems access. then the CI pipeline is able to get a short-lived token