[paracycle]

Stacked on #107.

Motivation

Releases of Oktakit need a maintainer who runs bundle exec rake release locally with a RubyGems API key. Trusted publishing lets GitHub Actions publish the gem through OIDC, so the repository needs no long-lived RubyGems credential.

Changes

• Add a Release workflow that starts when a vX.Y.Z tag is pushed. The workflow has two jobs:
  • release_gem runs in the release environment and publishes the gem with rubygems/release-gem. That action gets a short-lived API key through trusted publishing and adds Sigstore attestations to the gem.
  • release_github runs after release_gem and creates a GitHub release for the tag, with generated release notes.
• Pin all actions to commit SHAs. The workflow uses the Ruby version from .ruby-version.
• Update the README to describe the tag-based release process.

Setup before the first release

• Create the release environment in the repository settings.
• On RubyGems.org, add a trusted publisher for oktakit with repository Shopify/oktakit, workflow release.yml and environment release.

Notes

#106 also adds a trusted publishing workflow. Only one of the two PRs must merge, because both workflows start on the same tags and push the same gem version.