Add CI workflow to release gems via Trusted Publishing

[soutaro]

Why

The rbs gem currently ships two platform variants — the default ruby gem (C extension) and the java/JRuby gem (bundling the WebAssembly parser + Chicory jars). rake release only handles the former, so the java gem must be built and pushed by hand. That manual step (plus version typos and releasing from a local environment) is exactly where release mistakes happen.

This adds a CI release workflow so publishing is reproducible and hard to get wrong.

What

New .github/workflows/release-gems.yml, triggered manually via workflow_dispatch:

• Branch = version selection. Run it against master; the version is read from lib/rbs/version.rb (single source of truth — no free-form version input to mistype).
• expected_version input — you type the version you intend to ship; CI fails if it doesn't match lib/rbs/version.rb. Guards against running on the wrong commit.
• dry_run input (default true) — builds and verifies both gems but does not push. Lets you rehearse safely; flip to false for the real release.
• Builds both platform gems before pushing either, so a release is all-or-nothing instead of leaving one platform behind.
• Refuses to run if the vX.Y.Z tag already exists.
• Trusted Publishing (OIDC) via rubygems/configure-rubygems-credentials — no long-lived RubyGems API token stored as a secret.
• On a real run, pushes both gems and then the vX.Y.Z git tag.

The name is release-gems.yml (plural) to leave room for a separate crates.io release workflow later.

Scope: master only

Maintenance releases (e.g. 4.0.x cut from aaa-4.0.x) intentionally stay manual via rake release. They're infrequent, and keeping this workflow on master only avoids having to backport the workflow file to each maintenance branch (a workflow_dispatch run uses the workflow definition from the selected branch).

⚠️ One-time prerequisite before the first real run

Configure a Trusted Publisher for the rbs gem on RubyGems.org:

• RubyGem: rbs
• Owner: ruby
• Repository: rbs
• Workflow filename: release-gems.yml

Until that's set up, use dry_run: true (which never touches RubyGems).

Notes / possible follow-ups

• The GitHub draft-release note generation (rake release:note, built from CHANGELOG.md) is not included here yet; it can be wired in as a follow-up if desired.
• WASI SDK version is pinned to match wasm.yml / jruby.yml (33.0).

🤖 Generated with Claude Code

---

Generated by Claude Code