release: use Trusted Publishing

Author: kou

.github/workflows/ci.yml

@@ -61,24 +61,6 @@ jobs:
           name: gem-${{ matrix.os }}-${{ matrix.ruby }}
           path: pkg/
 
-      - name: Release
-        if: >-
-          startsWith(github.ref, 'refs/tags/') &&
-            matrix.os == 'ubuntu-latest' &&
-            (matrix.ruby == needs.ruby-version.outputs.latest || matrix.ruby == 'jruby')
-        run: |
-          ruby \
-            -e 'print("## strscan "); \
-                puts(ARGF.read.split(/^## /)[1].gsub(/ {.+?}/, ""))' \
-            NEWS.md > release-note.md
-          gh release create \
-            ${GITHUB_REF_NAME} \
-            --discussion-category Announcements \
-            --notes-file release-note.md || :
-          gh release upload ${GITHUB_REF_NAME} pkg/*.gem
-        env:
-          GH_TOKEN: ${{ github.token }}
-
       - run: bundle exec rake test
 
       - run: gem install --verbose --backtrace pkg/*.gem

.github/workflows/release.yml

@@ -0,0 +1,53 @@
+name: Release
+on:
+  push:
+    tags:
+      - "*"
+jobs:
+  github:
+    name: GitHub
+    runs-on: ubuntu-latest
+    timeout-minutes: 10
+    steps:
+      - uses: actions/checkout@v4
+      - name: Release
+        run: |
+          ruby \
+            -e 'print("## strscan "); \
+                puts(ARGF.read.split(/^## /)[1].gsub(/ {.+?}/, ""))' \
+            NEWS.md > release-note.md
+          title="$(head -n 1 release-note.md | sed -e 's/^## //')"
+          tail -n +2 release-note.md > release-note-without-version.md
+          gh release create \
+            ${GITHUB_REF_NAME} \
+            --discussion-category Announcements \
+            --notes-file release-note-without-version.md \
+            --title "${title}"
+        env:
+          GH_TOKEN: ${{ github.token }}
+
+  rubygems:
+    name: RubyGems
+    runs-on: ubuntu-latest
+    timeout-minutes: 10
+    permissions:
+      id-token: write
+    environment: release
+    strategy:
+      matrix:
+        ruby:
+          - ruby
+          - jruby
+    steps:
+      - uses: actions/checkout@v4
+      - uses: ruby/setup-ruby@v1
+        with:
+          ruby-version: ${{ matrix.ruby }}
+          bundler-cache: true
+      - name: Build
+        run: |
+          bundle exec rake build
+      - uses: rubygems/configure-rubygems-credentials@v1.0.0
+      - name: Push gems
+        run: |
+          bundle exec rake release:rubygem_push