Use trusted publishing

Author: kou

.github/workflows/release.yml

@@ -0,0 +1,46 @@
+name: Release
+on:
+  push:
+    tags:
+      - "*"
+jobs:
+  github:
+    name: GitHub
+    runs-on: ubuntu-latest
+    timeout-minutes: 10
+    steps:
+      - uses: actions/checkout@v6
+      - name: Extract release note
+        run: |
+          ruby \
+            -e 'print("## Enumerable::Statistics: "); \
+                puts(ARGF.read.split(/^# /)[1].strip)' \
+            CHANGELOG.md > release-note.md
+      - name: Upload to release
+        run: |
+          title=$(head -n1 release-note.md | sed -e 's/^## //')
+          tail -n +2 release-note.md > release-note-without-version.md
+          gh release create ${GITHUB_REF_NAME} \
+            --discussion-category Announcements \
+            --notes-file release-note-without-version.md \
+            --title "${title}"
+        env:
+          GH_TOKEN: ${{ github.token }}
+
+  rubygems:
+    name: RubyGems
+    runs-on: ubuntu-latest
+    timeout-minutes: 10
+    permissions:
+      id-token: write
+    environment: release
+    steps:
+      - uses: actions/checkout@v6
+      - uses: ruby/setup-ruby@v1
+        with:
+          ruby-version: ruby
+          bundler-cache: true
+      - uses: rubygems/[email protected]
+      - name: Push gems
+        run: |
+          bundle exec rake release:rubygem_push

Rakefile

@@ -29,3 +29,13 @@ task :bench do
 end
 
 task default: [:test, :spec]
+
+release_task = Rake.application["release"]
+# We use Trusted Publishing.
+release_task.prerequisites.delete("build")
+release_task.prerequisites.delete("release:rubygem_push")
+release_task_comment = release_task.comment
+if release_task_comment
+  release_task.clear_comments
+  release_task.comment = release_task_comment.gsub(/ and build.*$/, "")
+end