release.yml

# Publish the RubyTree gem to RubyGems.org on a release tag.
#
# Uses RubyGems trusted publishing (OIDC) instead of a stored API key, so
# there is no long-lived RubyGems credential held by this repository or by
# any maintainer's machine for automated releases.
#
# A Trusted Publisher must be configured for the `rubytree` gem at
# rubygems.org (Manage Gem > Trusted Publishers), pointing at this
# repository and this workflow file name.
#
# Tag push triggers cannot be scoped to a branch directly (a tag ref has no
# branch of its own), so a release tag pushed from anywhere still fires this
# workflow. The "Verify tag is reachable from master" step guards against
# that: it fails the job before anything is published if the tagged commit
# is not on master, so an accidental release tag on another branch is
# harmless.
#
# This runs as a Github Action.

name: Release to RubyGems

on:
  push:
    tags:
      - "R*"

permissions:
  contents: read
  id-token: write

jobs:
  release:
    runs-on: ubuntu-latest
    steps:
      - name: Clone Repository
        uses: actions/checkout@v7
        with:
          fetch-depth: 0

      - name: Verify tag is reachable from master
        run: |
          if ! git merge-base --is-ancestor "$GITHUB_SHA" origin/master; then
            echo "::error::Tag $GITHUB_REF_NAME (commit $GITHUB_SHA) is not on master. Refusing to publish."
            exit 1
          fi

      - name: Setup Ruby and bundler dependencies
        uses: ruby/setup-ruby@v1
        with:
          bundler-cache: true
          ruby-version: ".ruby-version"

      - name: Configure RubyGems trusted-publishing credentials
        uses: rubygems/configure-rubygems-credentials@main

      - name: Build gem package
        run: bundle exec rake gem:package

      - name: Push to RubyGems.org
        run: gem push pkg/*.gem