bake-gem-github 0.0.3

checksums.yaml

@@ -0,0 +1,7 @@
+---
+SHA256:
+  metadata.gz: 0643ea73beb64b3061e5ab768d1426e9220ec384ae07cb71c7e31239b671adf9
+  data.tar.gz: 05b9f8624c05fc27ec1197bd1097df44ec3ab2e0b802c9fbc94204e4bc73b8cf
+SHA512:
+  metadata.gz: 1467cb16603f373a45d019f62010d0e49165a072a9cdf00cd64831404008a980343e388fd7b20d04cbe92d323ebdefdd3795ac63662e84d2b2569921285e76d8
+  data.tar.gz: 3114b8df86c511ee0a471f5482adf98bdc2769689ef6c94dcc6cf4611542935537217880bdea9f6adc73a7b65ef63f7c2682cac30ec2f9a7bd4d5a92029a200e

data/agents.md

@@ -0,0 +1,437 @@
+# Agent
+
+## Context
+
+This section provides links to documentation from installed packages. It is automatically generated and may be updated by running `bake agent:context:install`.
+
+**Important:** Before performing any code, documentation, or analysis tasks, always read and apply the full content of any relevant documentation referenced in the following sections. These context files contain authoritative standards and best practices for documentation, code style, and project-specific workflows. **Do not proceed with any actions until you have read and incorporated the guidance from relevant context files.**
+
+**Setup Instructions:** If the referenced files are not present or if dependencies have been updated, run `bake agent:context:install` to install the latest context files.
+
+### agent-context
+
+Install and manage context files from Ruby gems.
+
+#### [Getting Started](.context/agent-context/getting-started.md)
+
+This guide explains how to use `agent-context`, a tool for discovering and installing contextual information from Ruby gems to help AI agents.
+
+### async
+
+A concurrency framework for Ruby.
+
+#### [Getting Started](.context/async/getting-started.md)
+
+This guide shows how to add async to your project and run code asynchronously.
+
+#### [Scheduler](.context/async/scheduler.md)
+
+This guide gives an overview of how the scheduler is implemented.
+
+#### [Tasks](.context/async/tasks.md)
+
+This guide explains how asynchronous tasks work and how to use them.
+
+#### [Best Practices](.context/async/best-practices.md)
+
+This guide gives an overview of best practices for using Async.
+
+#### [Debugging](.context/async/debugging.md)
+
+This guide explains how to debug issues with programs that use Async.
+
+#### [Thread safety](.context/async/thread-safety.md)
+
+This guide explains thread safety in Ruby, focusing on fibers and threads, common pitfalls, and best practices to avoid problems like data corruption, race conditions, and deadlocks.
+
+### async-container
+
+Abstract container-based parallelism using threads and processes where appropriate.
+
+#### [Getting Started](.context/async-container/getting-started.md)
+
+This guide explains how to use `async-container` to build basic scalable systems.
+
+#### [Container Policies](.context/async-container/policies.md)
+
+This guide explains how to use policies to monitor container health and implement custom failure handling strategies.
+
+#### [Systemd Integration](.context/async-container/systemd-integration.md)
+
+This guide explains how to use `async-container` with systemd to manage your application as a service.
+
+#### [Kubernetes Integration](.context/async-container/kubernetes-integration.md)
+
+This guide explains how to use `async-container` with Kubernetes to manage your application as a containerized service.
+
+### async-http
+
+A HTTP client and server library.
+
+#### [Getting Started](.context/async-http/getting-started.md)
+
+This guide explains how to make HTTP requests and serve HTTP responses with `Async::HTTP`.
+
+#### [Choosing a Client](.context/async-http/choosing-a-client.md)
+
+This guide explains how to choose between ruby:`Async::HTTP::Internet`, ruby:`Async::HTTP::Client`, and higher-level interfaces for libraries.
+
+#### [Concurrent Requests and Connection Pooling](.context/async-http/concurrent-requests.md)
+
+This guide explains how to run HTTP requests concurrently while keeping request fan-out, connection usage, and resource life cycles bounded.
+
+#### [Testing](.context/async-http/testing.md)
+
+This guide explains how to test `Async::HTTP` clients and servers without depending on external HTTP services.
+
+### async-http-cache
+
+Standard-compliant cache for async-http.
+
+#### [Getting Started](.context/async-http-cache/getting-started.md)
+
+This guide explains how to get started with `async-http-cache`, a cache middleware for `Async::HTTP` clients and servers.
+
+### async-service
+
+A service layer for Async.
+
+#### [Getting Started](.context/async-service/getting-started.md)
+
+This guide explains how to get started with `async-service` to create and run services in Ruby.
+
+#### [Container Policies](.context/async-service/policies.md)
+
+This guide explains how to configure container policies for your services and understand the default failure handling behavior.
+
+#### [Service Architecture](.context/async-service/service-architecture.md)
+
+This guide explains the key architectural components of `async-service` and how they work together to provide a clean separation of concerns.
+
+#### [Best Practices](.context/async-service/best-practices.md)
+
+This guide outlines recommended patterns and practices for building robust, maintainable services with `async-service`.
+
+#### [Deployment](.context/async-service/deployment.md)
+
+This guide explains how to deploy `async-service` applications using systemd and Kubernetes. We'll use a simple example service to demonstrate deployment configurations.
+
+### bake
+
+A replacement for rake with a simpler syntax.
+
+#### [Getting Started](.context/bake/getting-started.md)
+
+This guide gives a general overview of `bake` and how to use it.
+
+#### [Command Line Interface](.context/bake/command-line-interface.md)
+
+The `bake` command is broken up into two main functions: `list` and `call`.
+
+#### [Project Integration](.context/bake/project-integration.md)
+
+This guide explains how to add `bake` to a Ruby project.
+
+#### [Gem Integration](.context/bake/gem-integration.md)
+
+This guide explains how to add `bake` to a Ruby gem and export standardised tasks for use by other gems and projects.
+
+#### [Input and Output](.context/bake/input-and-output.md)
+
+`bake` has built in tasks for reading input and writing output in different formats. While this can be useful for general processing, there are some limitations, notably that rich object representations like `json` and `yaml` often don't support stream processing.
+
+### bake-gem
+
+Release management for Ruby gems.
+
+#### [Getting Started](.context/bake-gem/getting-started.md)
+
+This guide explains how to use `bake-gem` to release gems safely and efficiently.
+
+### bake-releases
+
+Releases document management.
+
+#### [Getting Started](.context/bake-releases/getting-started.md)
+
+This guide explains how to use `bake-releases` to manage release documentation for your Ruby gem.
+
+### console
+
+Beautiful logging for Ruby.
+
+#### [Getting Started](.context/console/getting-started.md)
+
+This guide explains how to use `console` for logging.
+
+#### [Command Line](.context/console/command-line.md)
+
+This guide explains how the `console` gem can be controlled using environment variables.
+
+#### [Configuration](.context/console/configuration.md)
+
+This guide explains how to implement per-project configuration for the `console` gem.
+
+#### [Integration](.context/console/integration.md)
+
+This guide explains how to integrate the `console` output into different systems.
+
+#### [Events](.context/console/events.md)
+
+This guide explains how to log structured events with a well-defined schema.
+
+### decode
+
+Code analysis for documentation generation.
+
+#### [Getting Started](.context/decode/getting-started.md)
+
+This guide explains how to use `decode` for source code analysis.
+
+#### [Documentation Coverage](.context/decode/documentation-coverage.md)
+
+This guide explains how to test and monitor documentation coverage in your Ruby projects using the Decode gem's built-in bake tasks.
+
+#### [Ruby Documentation](.context/decode/ruby-documentation.md)
+
+This guide covers documentation practices and pragmas supported by the Decode gem for documenting Ruby code. These pragmas provide structured documentation that can be parsed and used to generate API documentation and achieve complete documentation coverage.
+
+### falcon
+
+A fast, asynchronous, rack-compatible web server.
+
+#### [Getting Started](.context/falcon/getting-started.md)
+
+This guide gives an overview of how to use Falcon for running Ruby web applications.
+
+#### [Rails Integration](.context/falcon/rails-integration.md)
+
+This guide explains how to host Rails applications with Falcon.
+
+#### [Deployment](.context/falcon/deployment.md)
+
+This guide explains how to deploy applications using the Falcon web server. It covers the recommended deployment methods, configuration options, and examples for different environments, including systemd and kubernetes.
+
+#### [Dynamic Clusters with Envoy](.context/falcon/cluster-deployment.md)
+
+This guide explains how to run Falcon workers with independently bound endpoints, publish them dynamically using xDS, and balance requests according to their current load using ORCA.
+
+#### [Performance Tuning](.context/falcon/performance-tuning.md)
+
+This guide explains the performance characteristics of Falcon.
+
+#### [WebSockets](.context/falcon/websockets.md)
+
+This guide explains how to use WebSockets with Falcon.
+
+#### [Interim Responses](.context/falcon/interim-responses.md)
+
+This guide explains how to use interim responses in Falcon to send early hints to the client.
+
+#### [How It Works](.context/falcon/how-it-works.md)
+
+This guide gives an overview of how Falcon handles an incoming web request.
+
+### io-endpoint
+
+Provides a separation of concerns interface for IO endpoints.
+
+#### [Getting Started](.context/io-endpoint/getting-started.md)
+
+This guide explains how to get started with `io-endpoint`, a library that provides a separation of concerns interface for network I/O endpoints.
+
+#### [Named Endpoints](.context/io-endpoint/named-endpoints.md)
+
+This guide explains how to use `IO::Endpoint::NamedEndpoints` to manage multiple endpoints by name, enabling scenarios like running the same application on different protocols or ports.
+
+### io-event
+
+An event loop.
+
+#### [Getting Started](.context/io-event/getting-started.md)
+
+This guide explains how to use `io-event` for non-blocking IO.
+
+### io-stream
+
+Provides a generic stream wrapper for IO instances.
+
+#### [Getting Started](.context/io-stream/getting-started.md)
+
+This guide explains how to use `io-stream` to add efficient buffering to Ruby IO objects.
+
+#### [High Performance IO](.context/io-stream/high-performance-io.md)
+
+This guide explains how to achieve optimal performance when using `io-stream` by understanding and controlling flush behavior.
+
+### markly
+
+CommonMark parser and renderer. Written in C, wrapped in Ruby.
+
+#### [Getting Started](.context/markly/getting-started.md)
+
+This guide explains now to install and use Markly.
+
+#### [Extensions](.context/markly/extensions.md)
+
+This guide explains how to enable and use Markly's Markdown extensions.
+
+#### [Abstract Syntax Tree](.context/markly/abstract-syntax-tree.md)
+
+This guide explains how to use Markly's abstract syntax tree (AST) to parse and manipulate Markdown documents.
+
+#### [Headings](.context/markly/headings.md)
+
+This guide explains how to work with headings in Markly, including extracting them for navigation and handling duplicate heading text.
+
+### protocol-http
+
+Provides abstractions to handle HTTP protocols.
+
+#### [Getting Started](.context/protocol-http/getting-started.md)
+
+This guide explains how to use `protocol-http` for building abstract HTTP interfaces.
+
+#### [Message Body](.context/protocol-http/message-body.md)
+
+This guide explains how to work with HTTP request and response message bodies using `Protocol::HTTP::Body` classes.
+
+#### [Headers](.context/protocol-http/headers.md)
+
+This guide explains how to work with HTTP headers using `protocol-http`.
+
+#### [Middleware](.context/protocol-http/middleware.md)
+
+This guide explains how to build and use HTTP middleware with `Protocol::HTTP::Middleware`.
+
+#### [Streaming](.context/protocol-http/streaming.md)
+
+This guide gives an overview of how to implement streaming requests and responses.
+
+#### [Design Overview](.context/protocol-http/design-overview.md)
+
+This guide explains the high level design of `protocol-http` in the context of wider design patterns that can be used to implement HTTP clients and servers.
+
+### protocol-http1
+
+A low level implementation of the HTTP/1 protocol.
+
+#### [Getting Started](.context/protocol-http1/getting-started.md)
+
+This guide explains how to get started with `protocol-http1`, a low-level implementation of the HTTP/1 protocol for building HTTP clients and servers.
+
+### protocol-http2
+
+A low level implementation of the HTTP/2 protocol.
+
+#### [Getting Started](.context/protocol-http2/getting-started.md)
+
+This guide explains how to use the `protocol-http2` gem to implement a basic HTTP/2 client.
+
+### protocol-rack
+
+An implementation of the Rack protocol/specification.
+
+#### [Getting Started](.context/protocol-rack/getting-started.md)
+
+This guide explains how to get started with `protocol-rack` and integrate Rack applications with `Protocol::HTTP` servers.
+
+#### [Request and Response Handling](.context/protocol-rack/request-response.md)
+
+This guide explains how to work with requests and responses when bridging between Rack and `Protocol::HTTP`, covering advanced use cases and edge cases.
+
+### samovar
+
+Samovar is a flexible option parser excellent support for sub-commands and help documentation.
+
+#### [Getting Started](.context/samovar/getting-started.md)
+
+This guide explains how to use `samovar` to build command-line tools and applications.
+
+#### [Completion](.context/samovar/completion.md)
+
+This guide explains how to add shell completion to commands built with `samovar`.
+
+### sus
+
+A fast and scalable test runner.
+
+#### [Getting Started](.context/sus/getting-started.md)
+
+This guide explains how to use the `sus` gem to write tests for your Ruby projects.
+
+#### [Mocking](.context/sus/mocking.md)
+
+This guide explains how to use mocking in sus to isolate dependencies and verify interactions in your tests.
+
+#### [Shared Test Behaviors and Fixtures](.context/sus/shared-contexts.md)
+
+This guide explains how to use shared test contexts and fixtures in sus to reduce duplication and ensure consistent test behavior across your test suite.
+
+### traces
+
+Application instrumentation and tracing.
+
+#### [Getting Started](.context/traces/getting-started.md)
+
+This guide explains how to use `traces` for tracing code execution.
+
+#### [Context Propagation](.context/traces/context-propagation.md)
+
+This guide explains how to propagate trace context between different execution contexts within your application using `Traces.current_context` and `Traces.with_context`.
+
+#### [Testing](.context/traces/testing.md)
+
+This guide explains how to test traces in your code.
+
+#### [Capture](.context/traces/capture.md)
+
+This guide explains how to use `traces` for exporting traces from your application. This can be used to document all possible traces.
+
+### utopia
+
+Utopia is a framework for building dynamic content-driven websites.
+
+#### [Getting Started](.context/utopia/getting-started.md)
+
+This guide explains how to set up a `utopia` website for local development and deployment.
+
+#### [Middleware](.context/utopia/middleware.md)
+
+This guide gives an overview of the different middleware used by Utopia.
+
+#### [Server Setup](.context/utopia/server-setup.md)
+
+This guide explains how to deploy a `utopia` web application.
+
+#### [Integrating with JavaScript](.context/utopia/integrating-with-javascript.md)
+
+This guide explains how to integrate JavaScript into your Utopia application.
+
+#### [What is XNode?](.context/utopia/what-is-xnode.md)
+
+This guide explains the `xnode` view layer and how it can be used to build efficient websites.
+
+#### [Updating Utopia](.context/utopia/updating-utopia.md)
+
+This guide explains how to update existing `utopia` websites.
+
+### utopia-project
+
+A project documentation tool based on Utopia.
+
+#### [Getting Started](.context/utopia-project/getting-started.md)
+
+This guide explains how to use `utopia-project` to add documentation to your project.
+
+#### [Documentation Guides](.context/utopia-project/documentation-guidelines.md)
+
+This guide explains how to create and maintain documentation for your project using `utopia-project`.
+
+#### [Mermaid Diagrams](.context/utopia-project/mermaid-diagrams.md)
+
+This guide explains how to use Mermaid diagrams in your documentation to visualize complex relationships, flows, and architectures.
+
+#### [GitHub Pages Integration](.context/utopia-project/github-pages-integration.md)
+
+This guide shows you how to use `utopia-project` with GitHub Pages to deploy documentation.

data/bake/gem/github/release.rb

@@ -0,0 +1,51 @@
+# frozen_string_literal: true
+
+# Released under the MIT License.
+# Copyright, 2026, by Samuel Williams.
+
+require_relative "../../../lib/bake/gem/github/publisher"
+
+# Prepare a patch release and open its PR.
+def patch
+	Bake::Gem::GitHub::Project.new(context.root).prepare(context, "patch")
+end
+
+# Prepare a minor release and open its PR.
+def minor
+	Bake::Gem::GitHub::Project.new(context.root).prepare(context, "minor")
+end
+
+# Prepare a major release and open its PR.
+def major
+	Bake::Gem::GitHub::Project.new(context.root).prepare(context, "major")
+end
+
+# Resolve and validate a merged PR, emitting a commit output for the publishing job.
+def resolve(number: ENV.fetch("RELEASE_PR"))
+	result = Bake::Gem::GitHub::Project.new(context.root).inspect_release(number)
+	if path = ENV["GITHUB_OUTPUT"]
+		File.open(path, "a") do |file|
+			file.puts "release=#{!result.nil?}"
+			file.puts "commit=#{result.fetch(:commit)}" if result
+		end
+	end
+	result
+end
+
+# Build or restore the exact artifact for a merged release PR.
+def build(number: ENV.fetch("RELEASE_PR"))
+	Bake::Gem::GitHub::Publisher.new(context.root).build(number)
+end
+
+# Verify, upload and finalize a merged release using its retained artifact.
+def publish(number: ENV.fetch("RELEASE_PR"))
+	Bake::Gem::GitHub::Publisher.new(context.root).publish(number)
+end
+
+# Rerun the original publishing workflow, preserving event identity and artifact bytes.
+def resume(run:)
+	project = Bake::Gem::GitHub::Project.new(context.root)
+	details = project.api("actions/runs/#{Integer(run)}")
+	raise "Expected a release-publish workflow run." unless details.fetch("path") == ".github/workflows/release-publish.yaml"
+	project.system("gh", "run", "rerun", run.to_s, "--repo", project.config.fetch("repository"), chdir: context.root)
+end

data/bake/gem/github/setup.rb

@@ -0,0 +1,15 @@
+# frozen_string_literal: true
+
+# Released under the MIT License.
+# Copyright, 2026, by Samuel Williams.
+
+# Inspect external settings before applying the generated policy.
+def plan
+	context.lookup("gem:github:doctor").call
+end
+
+# Apply the four managed rulesets using the current gh administrator credentials.
+def apply
+	require_relative "../../../lib/bake/gem/github/project"
+	Bake::Gem::GitHub::Project.new(context.root).apply
+end

data/bake/gem/github.rb

@@ -0,0 +1,31 @@
+# frozen_string_literal: true
+
+# Released under the MIT License.
+# Copyright, 2026, by Samuel Williams.
+
+# Generate local release workflows, policy, and documentation for review.
+# @parameter checks [Array(String)] Required CI check names, including matrix entries.
+# @parameter repository [String] Canonical owner/repository.
+# @parameter branch [String] Default branch name.
+# @parameter approvals [Integer] Number of approving reviews.
+# @parameter signing [Boolean] Require legacy certificate signing.
+# @parameter ruby [String] Ruby version for release workflows.
+def setup(checks:, repository: nil, branch: nil, approvals: 2, signing: nil, ruby: "3.4")
+	require_relative "../../lib/bake/gem/github/setup"
+	require "bake/gem/shell"
+	helper = Object.new.extend(Bake::Gem::Shell)
+	remote = if repository && branch
+		{}
+	else
+		JSON.parse(helper.readlines("gh", "repo", "view", "--json", "nameWithOwner,defaultBranchRef", chdir: context.root).join)
+	end
+	options = {repository: repository || remote.fetch("nameWithOwner"), branch: branch || remote.fetch("defaultBranchRef").fetch("name"), checks: checks, approvals: approvals, ruby: ruby}
+	options[:signing] = signing unless signing.nil?
+	Bake::Gem::GitHub::Setup.new(context.root).generate(**options)
+end
+
+# Show the desired rules, existing rules, environments, and RubyGems bootstrap values.
+def doctor
+	require_relative "../../lib/bake/gem/github/project"
+	Bake::Gem::GitHub::Project.new(context.root).doctor
+end

data/context/getting-started.md

@@ -0,0 +1,106 @@
+# GitHub Releases
+
+This guide sets up reviewed Ruby gem releases with `bake-gem-github`, native GitHub rules, RubyGems Trusted Publishing, and retained release artifacts.
+
+## Installation
+
+Add `bake-gem-github` and `agent-context` to your maintenance bundle. This companion requires `bake-gem` 0.15 or later for branch preparation and regeneration validation. Install the maintenance group in CI with `BUNDLE_WITH=maintenance`.
+
+Use one gemspec, a stable three-part version in `lib/.../version.rb`, and repeatable `after_gem_release_version_increment` hooks. Hooks run from a clean base during validation. Commit dependency locks when practical; changing generation tools or using live network/time inputs can make old release content fail validation.
+
+## Setup and migration
+
+Run setup in each repository. It discovers the canonical repository and default branch through `gh` and generates reviewable local files. Supply the actual required CI job names, including supported matrix entries:
+
+``` bash
+bundle exec bake gem:github:setup checks="Test Ruby 3.3,Test Ruby 3.4,RuboCop"
+bundle exec bake agent:context:install
+bundle exec bake gem:github:setup:plan
+```
+
+Setup adds three pinned workflows, `config/release.yaml`, native ruleset payloads, and `.github/releasing.md`. Identical reruns do nothing; conflicting existing files stop before any file is written. For later policy changes, edit the configuration and review the generated workflow/policy changes explicitly. Setup does not replace other publishers: remove conflicting release workflows during migration.
+
+The default is two approvals with explicit administrator bypass, dismissed stale reviews, approval of the last push, strict up-to-date CI, and immutable default-branch history/release tags. These branch rules affect **all PRs** into the default branch. Ordinary administrator reviews count as one review. A human who dispatches a bot-authored PR is not its author under GitHub's native rules.
+
+Review `gem:github:setup:plan`, merge the setup PR, and confirm that **Release validation** and every selected check run. Then apply the four managed rulesets using an administrator's `gh` login:
+
+``` bash
+bundle exec bake gem:github:setup:apply
+```
+
+This command changes remote rulesets and preserves unrelated rulesets. Existing rulesets with the four managed names are updated. Organization rules and other existing protections still apply. Check names in configuration must exactly match GitHub checks; a partial selection does not mean all CI is required. Keep rebase merging and merge queues disabled for the initial rollout.
+
+Create a `rubygems` GitHub environment restricted to the default branch. Do not add a second routine reviewer gate. On RubyGems, an owner must configure a Trusted Publisher with the owner/repository, workflow filename **`release-publish.yaml`**, and environment **`rubygems`** shown by `doctor`. Ownership/MFA and environment/signing bootstrap are deliberate manual steps in this first implementation; `doctor` prints desired and observed GitHub settings, not a claim that RubyGems ownership or publisher trust has been verified. See [RubyGems Trusted Publishing](https://guides.rubygems.org/trusted-publishing/).
+
+If `release.cert` exists, setup enables legacy signing. Keep this public certificate in Git and install its matching **private key** as the Actions secret `GEM_SIGNING_KEY`. Use the `rubygems` environment or an organization secret available to the release repositories. The workflow checks the certificate validity, key match, and resulting package signatures. To opt out explicitly, pass `signing=false` during setup. No long-lived RubyGems publishing key is required.
+
+Before enabling releases, confirm two people can administer the repository and recover the RubyGems account/signing key, and enough maintainers can satisfy the review policy. Pilot on one low-risk gem and prove publishing, administrator bypass, fork merges, and recovery before rolling out broadly. No organization-wide migration or live publisher setup is performed by these tasks.
+
+## Request and review
+
+``` bash
+# Local branch and commit only:
+bundle exec bake gem:release:branch:patch
+
+# From the current default branch: prepare, validate, push and open PR:
+bundle exec bake gem:github:release:patch
+
+# Remote request (also available in the Actions UI):
+gh workflow run release-prepare.yaml -f bump=patch
+```
+
+Replace `patch` with `minor` or `major`. The wrapper fetches the default branch and tags, refuses a stale local checkout, and reports an existing release PR instead of opening another. GitHub's built-in token may require a writer to approve running workflows for its created PR; enable Actions' permission to create PRs. An organization-owned App token can be adopted later if automatic CI triggering is needed.
+
+All release changes belong in the PR. Core preparation commits additions and deletions from release hooks but never pushes, tags or publishes. Validation independently generates the expected tree from the current base. A changed base SHA alone is fine; changed generated notes are not. Ordinary PRs with no version change pass release validation and still build unsigned.
+
+If regeneration fails, prepare a new branch from the current default branch and review the new diff. Preserve manual release-branch edits separately. Automatic refresh/force-push is not implemented. A failure during preparation leaves the branch and generated changes available for inspection.
+
+## Publish and verify
+
+After merge/squash, the publishing workflow verifies GitHub's merged PR record and ancestry, then checks out the exact merged commit. Later development on the default branch is allowed. It regenerates against the merged commit's **first parent**, builds in a clean worktree, optionally certificate-signs, and creates two attestations over the final bytes:
+
+- A Sigstore bundle submitted explicitly with `gem push --attestation` using RubyGems 4.0.21.
+- GitHub's native SLSA provenance covering both the gem and `release.json`. This signed receipt binds the gem digest to the exact release commit, even when the workflow's own default-branch revision is newer.
+
+The workflow retains the gem, receipt and attestations before obtaining RubyGems publishing credentials. It verifies both attestations, checks the uploaded bytes and registry bundle, then pushes the specific version tag and creates the GitHub release. Existing tags/assets are checked and never overwritten. The old `after_gem_release` GitHub hook is not called by this pipeline, so there is one owner for release creation.
+
+``` bash
+set -e
+for file in example-1.2.3.gem release.json; do
+  gh attestation verify "$file" \
+    --repo OWNER/REPOSITORY --bundle provenance.sigstore.json \
+    --cert-identity https://github.com/OWNER/REPOSITORY/.github/workflows/release-publish.yaml@refs/heads/main \
+    --source-ref refs/heads/main --deny-self-hosted-runners
+done
+
+jq -e --arg commit MERGED_SHA \
+  --arg digest "$(shasum -a 256 example-1.2.3.gem | cut -d ' ' -f1)" \
+  '.commit == $commit and .sha256 == $digest' release.json
+
+gem exec sigstore-cli:0.2.3 verify example-1.2.3.gem \
+  --bundle example-1.2.3.gem.sigstore.json \
+  --certificate-identity https://github.com/OWNER/REPOSITORY/.github/workflows/release-publish.yaml@refs/heads/main \
+  --certificate-oidc-issuer https://token.actions.githubusercontent.com
+```
+
+Download `release.json` and `provenance.sigstore.json` alongside the gem. Verify both subjects before reading the receipt's source commit and digest. GitHub CLI's `--source-digest` checks the workflow revision, which may differ from the release commit recorded in the signed receipt. Replace `main` with the configured default branch in these commands.
+
+Native GitHub records the merge and any bypass; the signed artifact receipt includes the PR and merging actor. This version does not export organization audit-log evidence or infer bypass reasons from review counts.
+
+## Recovery
+
+Use **Re-run all jobs** on the original publishing run, or:
+
+``` bash
+bundle exec bake gem:github:release:resume run=RUN_ID
+```
+
+Rerunning keeps the original event identity. A retained artifact is downloaded and its source identity/digest checked. A matching registry version resumes tag/release finalization; different bytes or a conflicting tag stop. There is no automatic yank, retag, or rebuild of an already-published version. If failure occurs before artifact retention, rebuilding is safe because uploading has not started.
+
+Artifacts are retained for 90 days and copied to GitHub release assets on success. If the workflow artifact expires before finalization, manual recovery from the preserved bytes is required; do not dispatch a replacement build. GitHub concurrency does not guarantee a durable FIFO queue: rerun any publishing run displaced while pending. Resume reruns all jobs, including integrity checks; it does not repeat or second-guess the native review policy or a permitted administrator bypass.
+
+## Development and current limits
+
+The implementation has local repository and transport-fake tests. A real GitHub/RubyGems pilot remains necessary before enabling it across Socketry. Public single-gem repositories, ordinary stable versions, merge/squash, GitHub-hosted Linux runners, and RubyGems.org are the supported starting point. Native build matrices, reusable publisher workflows, merge queues, automated RubyGems ownership/MFA setup, cross-run artifact recovery, and organization-wide rollout are deferred.
+
+Edit this guide and regenerate `context/` with `bake utopia:project:agent:context:update`. Consumers install the generated guidance using `agent-context`.

data/context/index.yaml

@@ -0,0 +1,10 @@
+# Automatically generated context index for Utopia::Project guides.
+# Do not edit then files in this directory directly, instead edit the guides and then run `bake utopia:project:agent:context:update`.
+---
+description: Reviewable GitHub releases for Ruby gems.
+metadata: {}
+files:
+- path: getting-started.md
+  title: GitHub Releases
+  description: This guide sets up reviewed Ruby gem releases with `bake-gem-github`,
+    native GitHub rules, RubyGems Trusted Publishing, and retained release artifacts.