release.yml

name: Release

on:
  push:
    tags:
      - "v*"

jobs:
  # Build all gems using the reusable workflow
  build:
    uses: ./.github/workflows/build.yml
    with:
      upload-artifacts: true

  # Publish all gems to RubyGems
  publish:
    name: Publish gems to RubyGems
    needs: build
    runs-on: ubuntu-latest
    permissions:
      contents: write
      id-token: write
    environment: release
    steps:
      - uses: actions/checkout@v4

      - name: Set up Ruby
        uses: ruby/setup-ruby@v1
        with:
          ruby-version: "3.3"
          bundler-cache: true

      - name: Download all gem artifacts
        uses: actions/download-artifact@v4
        with:
          path: pkg
          pattern: "*-gem*"
          merge-multiple: true

      - name: Install jq
        run: sudo apt-get update && sudo apt-get install -y jq

      - name: List gems to publish
        run: ls -la pkg/

      - name: Publish gems to RubyGems (with trusted publishing)
        run: |
          set -ex

          # Get OIDC token from GitHub
          OIDC_TOKEN=$(curl -sS -H "Authorization: bearer $ACTIONS_ID_TOKEN_REQUEST_TOKEN" "$ACTIONS_ID_TOKEN_REQUEST_URL&audience=rubygems.org" | jq -r '.value')

          # Exchange OIDC token for RubyGems API token
          RESPONSE=$(curl -sS -X POST \
            -H "Content-Type: application/json" \
            -H "Accept: application/json" \
            -d "{\"jwt\": \"$OIDC_TOKEN\"}" \
            https://rubygems.org/api/v1/oidc/trusted_publisher/exchange_token)

          echo "Exchange response received"

          # Extract the API key from response
          API_TOKEN=$(echo "$RESPONSE" | jq -r 'if has("rubygems_api_key") then .rubygems_api_key else empty end')

          if [ -z "$API_TOKEN" ] || [ "$API_TOKEN" = "null" ]; then
            echo "Error: Failed to extract API token from response"
            echo "Response: $RESPONSE"
            exit 1
          fi

          echo "API token obtained successfully (length: ${#API_TOKEN})"

          # Configure gem credentials
          mkdir -p ~/.gem
          cat > ~/.gem/credentials << EOF
          ---
          :rubygems_api_key: ${API_TOKEN}
          EOF
          chmod 0600 ~/.gem/credentials

          echo "Credentials configured"

          # Push each gem
          for gem in pkg/*.gem; do
            echo "================================"
            echo "Publishing: $gem"
            gem push "$gem" --verbose
          done