bake-gem-github 0.0.3

data/lib/bake/gem/github/project.rb

@@ -0,0 +1,111 @@
+# frozen_string_literal: true
+
+# Released under the MIT License.
+# Copyright, 2026, by Samuel Williams.
+
+require "bake/gem/release"
+require "yaml"
+require "tempfile"
+require_relative "setup"
+
+module Bake
+	module Gem
+		module GitHub
+			# GitHub operations invoked by local tasks and repository workflows.
+			class Project
+				include Shell
+				
+				# Load the reviewed repository release policy.
+				def initialize(root)
+					@root = File.expand_path(root)
+					@config = YAML.safe_load_file(File.join(@root, "config/release.yaml"))
+					raise "Unsupported release configuration." unless @config.fetch("schema") == 1
+					@repository = @config.fetch("repository")
+					@release = Release.new(@root)
+				end
+				
+				# @attribute [Hash] Reviewed desired policy.
+				attr_reader :config
+				
+				# Execute a GitHub API read. Failures never imply that a resource is absent.
+				def api(path)
+					JSON.parse(readlines("gh", "api", "repos/#{@repository}/#{path}", chdir: @root).join)
+				end
+				
+				# Prepare a release through core Bake tasks, then push and create its pull request.
+				def prepare(context, bump)
+					Release::BUMPS.fetch(bump)
+					helper = Helper.new(@root)
+					helper.guard_clean
+					branch = @config.fetch("branch")
+					raise "Prepare releases from #{branch}." unless helper.current_branch == branch
+					system("git", "fetch", "origin", branch, "--tags", chdir: @root)
+					raise "Local branch differs from origin/#{branch}." unless @release.resolve("HEAD") == @release.resolve("origin/#{branch}")
+					pulls = JSON.parse(readlines("gh", "pr", "list", "--repo", @repository, "--base", branch, "--state", "open", "--json", "headRefName,url", "--limit", "1000", chdir: @root).join)
+					if existing = pulls.find{|pr| pr.fetch("headRefName").start_with?("releases/v")}
+						return existing.fetch("url")
+					end
+					base = @release.resolve("HEAD")
+					result = context.lookup("gem:release:branch:#{bump}").call
+					@release.validate(base: base)
+					system("git", "-c", "credential.helper=", "-c", "credential.helper=!gh auth git-credential", "push", "--set-upstream", "origin", result.fetch(:branch), chdir: @root)
+					body = "Release #{helper.gemspec.name} #{result.fetch(:version)}.\n\nPrepared from #{base}. The complete release tree is regenerated during validation. Merging publishes the resulting commit through release-publish.yaml after native reviews and required CI (or explicit administrator bypass).\n"
+					Tempfile.create("release-pr") do |file|
+						file.write(body)
+						file.flush
+						readlines("gh", "pr", "create", "--repo", @repository, "--base", branch, "--head", result.fetch(:branch), "--title", "Release v#{result.fetch(:version)}", "--body-file", file.path, chdir: @root).join.strip
+					end
+				end
+				
+				# Resolve a merged PR through GitHub, and require its actual merge commit in default-branch history.
+				def merged(number)
+					raise "Expected a PR number." unless number.to_s.match?(/\A[1-9]\d*\z/)
+					pr = api("pulls/#{number}")
+					raise "PR must be merged into the configured branch." unless pr["merged"] && pr.dig("base", "ref") == @config.fetch("branch") && pr.dig("base", "repo", "full_name") == @repository
+					commit = pr.fetch("merge_commit_sha")
+					raise "Invalid merged commit." unless commit.match?(/\A[0-9a-f]{40,64}\z/)
+					system("git", "fetch", "origin", @config.fetch("branch"), "--tags", chdir: @root)
+					system("git", "merge-base", "--is-ancestor", commit, "origin/#{@config.fetch('branch')}", chdir: @root)
+					pr
+				end
+				
+				# Resolve release identity; ordinary merged PRs do not publish.
+				def inspect_release(number)
+					pr = merged(number)
+					commit = pr.fetch("merge_commit_sha")
+					metadata = @release.validate(base: "#{commit}^1", candidate: commit, optional: true)
+					if metadata
+						metadata.merge(repository: @repository, pull_request: pr.fetch("number"), merged_by: pr.dig("merged_by", "login"), pull_request_url: pr.fetch("html_url"))
+					end
+				end
+				
+				# Return a read-only comparison of managed settings and current repository settings.
+				def doctor
+					{
+						desired_rules: Setup.rules(@config),
+						existing_rules: api("rulesets?per_page=100"),
+						environments: api("environments"),
+						trusted_publisher: {repository_owner: @repository.split("/").first, repository_name: @repository.split("/").last, workflow_filename: "release-publish.yaml", environment: @config.fetch("environment")}
+					}
+				end
+				
+				# Apply only the named rulesets generated by setup. Invoke after reviewing doctor output.
+				def apply
+					existing = api("rulesets?per_page=100")
+					Setup.rules(@config).each_value do |rule|
+						matches = existing.select{|current| current.fetch("name") == rule.fetch(:name)}
+						raise "Multiple rulesets match #{rule[:name]}." if matches.size > 1
+						current = matches.first
+						path = "repos/#{@repository}/rulesets"
+						path += "/#{current.fetch('id')}" if current
+						Tempfile.create("release-rule") do |file|
+							file.write(JSON.generate(rule))
+							file.flush
+							system("gh", "api", path, "--method", current ? "PUT" : "POST", "--input", file.path, chdir: @root)
+						end
+					end
+				end
+			end
+		end
+	end
+end

data/lib/bake/gem/github/publisher.rb

@@ -0,0 +1,215 @@
+# frozen_string_literal: true
+
+# Released under the MIT License.
+# Copyright, 2026, by Samuel Williams.
+
+require_relative "project"
+require "digest"
+require "net/http"
+require "openssl"
+
+module Bake
+	module Gem
+		module GitHub
+			# Builds one artifact, preserves it before upload, and resumes without moving existing tags.
+			class Publisher < Project
+				# Build or restore this workflow run's artifact, after validating the actual merged commit.
+				def build(number)
+					guard_environment
+					evidence = inspect_release(number) or raise "PR does not change the version."
+					raise "Checkout must match the merged commit." unless @release.resolve("HEAD") == evidence.fetch(:commit)
+					path = File.join(@root, "pkg")
+					FileUtils.mkdir_p(path)
+					artifact = "release-#{evidence.fetch(:commit)}"
+					run = ENV.fetch("GITHUB_RUN_ID")
+					artifacts = api("actions/runs/#{run}/artifacts?per_page=100").fetch("artifacts")
+					if retained = artifacts.find{|entry| entry.fetch("name") == artifact}
+						raise "Retained artifact expired; restore it from the GitHub release before retrying." if retained.fetch("expired")
+						system("gh", "run", "download", run, "--repo", @repository, "--name", artifact, "--dir", path, chdir: @root)
+						receipt = load_receipt
+						[:name, :version, :commit, :repository, :pull_request].each do |key|
+							raise "Retained artifact has different #{key}." unless receipt[key] == evidence[key]
+						end
+						return output(receipt, restored: true)
+					end
+					filename = "#{evidence.fetch(:name)}-#{evidence.fetch(:version)}.gem"
+					if registry_digest(evidence.fetch(:name), evidence.fetch(:version))
+						raise "Version is already published but this run has no retained artifact. Restore the original artifact; do not rebuild."
+					end
+					package = build_package(path)
+					raise "Unexpected package filename." unless File.basename(package) == filename
+					receipt = evidence.merge(file: filename, sha256: Digest::SHA256.file(package).hexdigest, run_id: run, signing: @config.fetch("signing"))
+					File.write(File.join(path, "release.json"), JSON.pretty_generate(receipt) + "\n")
+					output(receipt, restored: false)
+				end
+				
+				# Verify both attestations, upload exactly those bytes, then create only the intended tag and release.
+				def publish(number)
+					guard_environment
+					receipt = load_receipt
+					pr = merged(number)
+					raise "Artifact is not for this merged PR." unless receipt[:commit] == pr.fetch("merge_commit_sha") && receipt[:pull_request] == pr.fetch("number") && receipt[:repository] == @repository
+					raise "Checkout must match the artifact source." unless @release.resolve("HEAD") == receipt[:commit]
+					metadata = @release.validate(base: "#{receipt[:commit]}^1", candidate: receipt[:commit])
+					[:name, :version, :commit].each do |key|
+						raise "Artifact #{key} differs from the merged source." unless receipt[key] == metadata[key]
+					end
+					package = File.join(@root, "pkg", receipt.fetch(:file))
+					verify_certificate(package) if @config.fetch("signing")
+					bundle = "#{package}.sigstore.json"
+					identity = "https://github.com/#{@repository}/.github/workflows/release-publish.yaml@refs/heads/#{@config.fetch('branch')}"
+					gem_command("exec", "sigstore-cli:0.2.3", "verify", package, "--bundle", bundle, "--certificate-identity", identity, "--certificate-oidc-issuer", "https://token.actions.githubusercontent.com")
+					verify_provenance(package)
+					tag = "v#{receipt.fetch(:version)}"
+					guard_tag(tag, receipt.fetch(:commit))
+					remote_digest = registry_digest(receipt.fetch(:name), receipt.fetch(:version))
+					if remote_digest
+						raise "Published version has different bytes." unless remote_digest == receipt.fetch(:sha256)
+					else
+						gem_command("push", package, "--host", "https://rubygems.org", "--attestation", bundle)
+					end
+					# A failed read after upload is recoverable by rerunning the same workflow.
+					raise "Registry artifact does not match; retry after registry propagation." unless registry_digest(receipt.fetch(:name), receipt.fetch(:version)) == receipt.fetch(:sha256)
+					attestations = registry_get("https://rubygems.org/api/v1/attestations/#{receipt.fetch(:name)}-#{receipt.fetch(:version)}.json")
+					raise "Registry attestation is missing." unless attestations
+					registry_bundles = JSON.parse(attestations)
+					local_bundle = JSON.parse(File.read(bundle))
+					raise "Registry does not contain this artifact's Sigstore bundle." unless contains_bundle?(registry_bundles, local_bundle)
+					unless readlines("git", "tag", "--list", tag, chdir: @root).any?
+						system("git", "tag", tag, receipt.fetch(:commit), chdir: @root)
+					end
+					system("git", "-c", "credential.helper=", "-c", "credential.helper=!gh auth git-credential", "push", "origin", "refs/tags/#{tag}", chdir: @root)
+					releases = JSON.parse(readlines("gh", "release", "list", "--repo", @repository, "--limit", "1000", "--json", "tagName", chdir: @root).join)
+					unless releases.any?{|entry| entry.fetch("tagName") == tag}
+						Tempfile.create("release-notes") do |file|
+							file.write("#{receipt.fetch(:pull_request_url)}\n\nSource: #{receipt.fetch(:commit)}\nSHA256: #{receipt.fetch(:sha256)}\n\nSee releases.md at the release tag for release notes.\n")
+							file.flush
+							system("gh", "release", "create", tag, "--repo", @repository, "--verify-tag", "--title", "#{receipt.fetch(:name)} #{tag}", "--notes-file", file.path, chdir: @root)
+						end
+					end
+					# Existing immutable assets are checked before upload; never clobber them.
+					assets = api("releases/tags/#{tag}").fetch("assets")
+					[package, bundle, File.join(@root, "pkg", "release.json"), File.join(@root, "pkg", "provenance.sigstore.json")].each do |file|
+						if existing = assets.find{|asset| asset.fetch("name") == File.basename(file)}
+							digest = existing.fetch("digest")
+							raise "Existing release asset differs: #{file}" unless digest == "sha256:#{Digest::SHA256.file(file).hexdigest}"
+						else
+							system("gh", "release", "upload", tag, file, "--repo", @repository, chdir: @root)
+						end
+					end
+					receipt
+				end
+				
+				# Load artifact evidence and verify the stored digest and filename.
+				def load_receipt
+					receipt = JSON.parse(File.read(File.join(@root, "pkg", "release.json")), symbolize_names: true)
+					filename = receipt.fetch(:file)
+					raise "Invalid artifact filename." unless filename == File.basename(filename) && filename.end_with?(".gem")
+					raise "Artifact digest mismatch." unless Digest::SHA256.file(File.join(@root, "pkg", filename)).hexdigest == receipt.fetch(:sha256)
+					receipt
+				end
+				
+				# Refuse local or remote tag collisions before uploading a package.
+				def guard_tag(tag, commit)
+					local = readlines("git", "tag", "--list", tag, chdir: @root)
+					raise "Release tag points to another commit." if local.any? && @release.resolve(tag) != commit
+					remote = readlines("git", "ls-remote", "--tags", "origin", "refs/tags/#{tag}", "refs/tags/#{tag}^{}", chdir: @root).map{|line| line.split}
+					peeled = remote.find{|sha, ref| ref.end_with?("^{}")} || remote.first
+					raise "Remote release tag points to another commit." if peeled && peeled.first != commit
+				end
+				
+				private
+				
+				def gem_command(*arguments)
+					if defined?(::Bundler)
+						::Bundler.with_unbundled_env{system("gem", *arguments, chdir: @root)}
+					else
+						system("gem", *arguments, chdir: @root)
+					end
+				end
+				
+				def guard_environment
+					raise "Publishing requires the configured GitHub repository." unless ENV["GITHUB_REPOSITORY"] == @repository
+					raise "Publishing requires the default branch workflow." unless ENV["GITHUB_REF"] == "refs/heads/#{@config.fetch('branch')}"
+				end
+				
+				def contains_bundle?(value, bundle)
+					return true if value == bundle
+					case value
+					when Hash then value.values.any?{|child| contains_bundle?(child, bundle)}
+					when Array then value.any?{|child| contains_bundle?(child, bundle)}
+					else false
+					end
+				end
+				
+				def verify_certificate(path)
+					policy = ::Gem::Security::Policy.new("Release", only_trusted: false)
+					package = ::Gem::Package.new(path, policy)
+					package.verify
+					signer = OpenSSL::X509::Certificate.new(package.spec.cert_chain.last)
+					expected = OpenSSL::X509::Certificate.new(File.read(File.join(@root, "release.cert")))
+					raise "Package signer differs from release.cert." unless signer.to_der == expected.to_der
+				end
+				
+				def build_package(path)
+					unless @config.fetch("signing")
+						return @release.worktree("HEAD"){|source| @release.bake(source, "gem:build", root: path, signing_key: false)}
+					end
+					certificate = OpenSSL::X509::Certificate.new(File.read(File.join(@root, "release.cert")))
+					key = OpenSSL::PKey.read(ENV.fetch("GEM_SIGNING_KEY"))
+					raise "Signing key does not match release.cert." unless certificate.check_private_key(key)
+					raise "Signing certificate is not currently valid." unless (certificate.not_before..certificate.not_after).cover?(Time.now)
+					Tempfile.create("gem-signing-key") do |file|
+						file.chmod(0600)
+						file.write(ENV.fetch("GEM_SIGNING_KEY"))
+						file.flush
+						package = @release.worktree("HEAD"){|source| @release.bake(source, "gem:build", root: path, signing_key: file.path)}
+						verify_certificate(package)
+						package
+					end
+				end
+				
+				def output(receipt, restored:)
+					if path = ENV["GITHUB_OUTPUT"]
+						File.open(path, "a") do |file|
+							file.puts "package=pkg/#{receipt.fetch(:file)}"
+							file.puts "artifact=release-#{receipt.fetch(:commit)}"
+							file.puts "restored=#{restored}"
+						end
+					end
+					receipt
+				end
+				
+				def verify_provenance(package)
+					ref = "refs/heads/#{@config.fetch('branch')}"
+					identity = "https://github.com/#{@repository}/.github/workflows/release-publish.yaml@#{ref}"
+					# The signed receipt binds the package digest to the release commit, independently of the workflow revision.
+					[package, File.join(@root, "pkg", "release.json")].each do |file|
+						system("gh", "attestation", "verify", file, "--repo", @repository, "--bundle", File.join(@root, "pkg", "provenance.sigstore.json"), "--cert-identity", identity, "--source-ref", ref, "--deny-self-hosted-runners", chdir: @root)
+					end
+				end
+				
+				def registry_digest(name, version)
+					# Missing downloads can return 403; use the version API to establish absence.
+					return nil unless registry_get("https://rubygems.org/api/v2/rubygems/#{name}/versions/#{version}.json?platform=ruby")
+					body = registry_get("https://rubygems.org/downloads/#{name}-#{version}.gem")
+					raise "Published gem download is missing; retry after registry propagation." unless body
+					Digest::SHA256.hexdigest(body)
+				end
+				
+				def registry_get(url, redirects: 5)
+					uri = URI(url)
+					raise "Registry redirect requires HTTPS." unless uri.scheme == "https"
+					response = Net::HTTP.start(uri.host, uri.port, use_ssl: true, open_timeout: 15, read_timeout: 60){|http| http.get(uri.request_uri)}
+					return nil if response.is_a?(Net::HTTPNotFound)
+					if response.is_a?(Net::HTTPRedirection)
+						raise "Too many registry redirects." unless redirects > 0
+						return registry_get(URI.join(url, response.fetch("location")).to_s, redirects: redirects - 1)
+					end
+					raise "Registry request failed: #{response.code}" unless response.is_a?(Net::HTTPSuccess)
+					response.body
+				end
+			end
+		end
+	end
+end

data/lib/bake/gem/github/setup.rb

@@ -0,0 +1,62 @@
+# frozen_string_literal: true
+
+# Released under the MIT License.
+# Copyright, 2026, by Samuel Williams.
+
+require "erb"
+require "yaml"
+require "json"
+require "fileutils"
+
+module Bake
+	module Gem
+		module GitHub
+			# Generates reviewable repository files without changing remote settings.
+			class Setup
+				# @parameter root [String] Destination repository.
+				def initialize(root)
+					@root = File.expand_path(root)
+				end
+				
+				# Generate workflows, policy payloads, and maintainer instructions. Refuse conflicting existing files.
+				def generate(repository:, branch: "main", checks:, approvals: 2, signing: File.file?(File.join(@root, "release.cert")), ruby: "3.4")
+					raise "Expected owner/repository." unless repository.match?(/\A[\w.-]+\/[\w.-]+\z/)
+					raise "Unsupported branch name." unless branch.match?(/\A[\w.\/-]+\z/)
+					raise "Select the required CI check names." if checks.empty?
+					raise "Review count must be between 1 and 6." unless (1..6).include?(approvals)
+					config = {"schema" => 1, "repository" => repository, "branch" => branch, "checks" => (checks + ["Release validation"]).uniq, "approvals" => approvals, "signing" => signing, "ruby" => ruby, "environment" => "rubygems"}
+					templates = File.expand_path("../../../../templates", __dir__)
+					files = {"config/release.yaml" => YAML.dump(config)}
+					Dir.glob("*.erb", base: templates).each do |name|
+						files[".github/workflows/#{name.delete_suffix('.erb')}"] = ERB.new(File.read(File.join(templates, name)), trim_mode: "-").result(binding)
+					end
+					self.class.rules(config).each do |name, rule|
+						files[".github/release-rules/#{name}.json"] = JSON.pretty_generate(rule) + "\n"
+					end
+					files[".github/releasing.md"] = File.read(File.join(templates, "releasing.md"))
+					conflicts = files.keys.select{|name| File.exist?(File.join(@root, name)) && File.read(File.join(@root, name)) != files[name]}
+					raise "Existing files differ; review them before regenerating: #{conflicts.join(', ')}" unless conflicts.empty?
+					files.each do |name, content|
+						path = File.join(@root, name)
+						FileUtils.mkdir_p(File.dirname(path))
+						File.write(path, content) unless File.exist?(path)
+					end
+					files.keys
+				end
+				
+				# Native review/check rules allow PR-only administrator bypass; history rules have no bypass.
+				def self.rules(config)
+					conditions = {ref_name: {include: ["refs/heads/#{config.fetch('branch')}"], exclude: []}}
+					common = {target: "branch", enforcement: "active", conditions: conditions}
+					bypass = [{actor_id: 5, actor_type: "RepositoryRole", bypass_mode: "pull_request"}]
+					{
+						"reviews" => common.merge(name: "Gem release reviews", bypass_actors: bypass, rules: [{type: "pull_request", parameters: {required_approving_review_count: config.fetch("approvals"), dismiss_stale_reviews_on_push: true, require_last_push_approval: true, required_review_thread_resolution: true, require_code_owner_review: false, allowed_merge_methods: ["merge", "squash"]}}]),
+						"checks" => common.merge(name: "Gem release checks", bypass_actors: bypass, rules: [{type: "required_status_checks", parameters: {strict_required_status_checks_policy: true, do_not_enforce_on_create: false, required_status_checks: config.fetch("checks").map{|name| {context: name}}}}]),
+						"history" => common.merge(name: "Gem release history", bypass_actors: [], rules: [{type: "deletion"}, {type: "non_fast_forward"}]),
+						"tags" => {name: "Gem release tags", target: "tag", enforcement: "active", bypass_actors: [], conditions: {ref_name: {include: ["refs/tags/v*"], exclude: []}}, rules: [{type: "deletion"}, {type: "non_fast_forward"}]}
+					}
+				end
+			end
+		end
+	end
+end

data/lib/bake/gem/github/version.rb

@@ -0,0 +1,15 @@
+# frozen_string_literal: true
+
+# Released under the MIT License.
+# Copyright, 2026, by Samuel Williams.
+
+# @namespace
+module Bake
+	# @namespace
+	module Gem
+		# GitHub pull request and release orchestration for bake-gem.
+		module GitHub
+			VERSION = "0.0.3"
+		end
+	end
+end

data/license.md

@@ -0,0 +1,22 @@
+# MIT License
+
+Copyright, 2021-2026, by Samuel Williams.  
+Copyright, 2025, by Copilot.  
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

data/readme.md

@@ -0,0 +1,12 @@
+# Bake::Gem::GitHub
+
+Reviewed GitHub releases for Ruby gems, using `bake-gem` for branch preparation, independent content validation, and clean builds.
+
+- `gem:github:release:patch` / `minor` / `major`: prepare, push and open a release PR.
+- `gem:github:setup`: generate the three workflows and native review/CI policy.
+- `gem:github:setup:plan` / `apply`: inspect and apply the managed GitHub rulesets.
+- `gem:github:release:resume run=ID`: retry with the original artifact.
+
+Read [the setup, release and recovery guide](guides/getting-started/readme.md) before enabling publishing. Context is distributed through `agent-context`. This initial implementation requires `bake-gem` 0.15 or later and a live pilot before wider rollout.
+
+For this gem's releases, follow [the maintainer instructions](.github/releasing.md). Release workflows use the source checkout through Bundler's `gemspec` dependency, so the first release does not require an already published copy of `bake-gem-github`.

data/release.cert

@@ -0,0 +1,24 @@
+-----BEGIN CERTIFICATE-----
+MIIEFDCCAnygAwIBAgIBATANBgkqhkiG9w0BAQsFADAwMREwDwYDVQQKDAhTb2Nr
+ZXRyeTEbMBkGA1UEAwwSU29ja2V0cnkgUnVieSBHZW1zMB4XDTI2MDkyMTA3NTgx
+NFoXDTI3MDkyMTA3NTgxNFowMDERMA8GA1UECgwIU29ja2V0cnkxGzAZBgNVBAMM
+ElNvY2tldHJ5IFJ1YnkgR2VtczCCAaIwDQYJKoZIhvcNAQEBBQADggGPADCCAYoC
+ggGBAM/QgjVgDzDo/xJEQoFvAzcVFP7msnswkhPJB2UDsbxXCZmers5jV512TM5s
+NwLHfzJiC4DcI5ax9ZYKM9Q+dS21YYagNqjtg3YPyDqR6phoibEA0VoMuInUQW68
+i5OkCJzYKGD2pYYVZnuFNqyM2ECUvXh/fBmvPoHbncAHhWPaCBH8mQJ8sRNc6+RV
+SoZZu1Yo/aW1zQ+SpZwad7s1ZmigfDNHKhJ22KwZHk+/5Zw1QXVfcajjswV0Mm2P
+irgjKN3fyNVkwlly63EBlR4VydT+g9QtJtqh7ee0ThhI+v4wYovf4dbLNcEBTHu1
+x1pGbXGx/2fBAST5eVwaXIx1V8VU22AJcBk1H2o5/1F0HfbD2HQjmFOA112KUwBW
+9TtspZD3g6rCQFX53XvL9h6j2y1ukl7s5AdEzOe/x6r1MO8tSDtgcYoF89wgF/88
+Q/Eski0FckQ+znfESZcFcpzs2sPDoYW6SNVX4tZcNty85Y6WBHfHKio14x63PeyC
+CG1gMwIDAQABozkwNzAJBgNVHRMEAjAAMAsGA1UdDwQEAwIEsDAdBgNVHQ4EFgQU
+SuMc0x24Xshtaa8SQVkBr2Z5WzIwDQYJKoZIhvcNAQELBQADggGBABI62ey5lDWm
+j8jsTQaNBMBb7LbKS3XkBwyL1UNGEwlicp399rJDeuNgVSHqBCZ/nE4yleNjgW9Y
+N6DKdxXCvXmFUoHvUINeAvThHxmlEGhSfXl1x55xHEig0rEP4jgdjnYdQI4fqeOM
+zIDN0F3ruArke4Y62SQgWVN7vspdAA41hBIRl1vsvs0KWG8DIVQ8cmR+TG6zjOmK
+iUiUZGNPnStV1O1xW83c+Ba4Am0krP6/forxDPhRvTehqkVYvMdPfYcICNb5IM58
+5vaYvuj5AtfZuZWN0F/0KtSphhNC17rh6h8QmuYdMJ1clvlrkiEaO1UjPVwjgtxC
+x/ARh5X6q0/YTXl4r7EfSJEeqW7qhgu9EUj3mGIPHYdX0Dqih/NgK20F3GvQtTfB
+7sse0duKBHXONYVwKAsceUVvqtCfyF608bCilCkbhw3QaInRj+BkRQKJ5Tuj2PZR
+76a/hwaV2wWn5RtAFBaUQzQdo/xTqJ7IkwaFjOZe/QyvyoRjCK9Rdg==
+-----END CERTIFICATE-----

data/releases.md

@@ -0,0 +1,5 @@
+# Releases
+
+## v0.0.1
+
+  - Initial implementation.

data/templates/release-prepare.yaml.erb

@@ -0,0 +1,45 @@
+name: Prepare release
+
+on:
+  workflow_dispatch:
+    inputs:
+      bump:
+        description: Version increment
+        required: true
+        type: choice
+        options: [patch, minor, major]
+
+permissions:
+  contents: write
+  pull-requests: write
+
+concurrency:
+  group: release-prepare
+  cancel-in-progress: false
+
+env:
+  BUNDLE_WITH: maintenance
+
+jobs:
+  prepare:
+    if: github.ref == 'refs/heads/<%= branch %>'
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6
+        with:
+          ref: <%= branch %>
+          fetch-depth: 0
+          persist-credentials: false
+      - uses: ruby/setup-ruby@a0102e0972be65f351c307e2d64b9314a57c8073 # v1
+        with:
+          ruby-version: <%= ruby.to_json %>
+          bundler-cache: true
+      - name: Create release PR
+        env:
+          GH_TOKEN: ${{ github.token }}
+          BUMP: ${{ inputs.bump }}
+        run: |
+          git config user.name 'github-actions[bot]'
+          git config user.email '41898282+github-actions[bot]@users.noreply.github.com'
+          case "$BUMP" in patch|minor|major) ;; *) exit 1 ;; esac
+          bundle exec bake "gem:github:release:$BUMP"

data/templates/release-publish.yaml.erb

@@ -0,0 +1,103 @@
+name: Publish release
+
+# Only merged source is executed. Validation of unmerged PRs lives in its own
+# read-only pull_request workflow. This trigger also supports reviewed fork PRs.
+on:
+  pull_request_target:
+    types: [closed]
+    branches: [<%= branch.to_json %>]
+
+permissions:
+  contents: read
+  pull-requests: read
+
+concurrency:
+  group: release-publish
+  cancel-in-progress: false
+
+env:
+  BUNDLE_WITH: maintenance
+  RELEASE_PR: ${{ github.event.pull_request.number }}
+
+jobs:
+  inspect:
+    if: github.event.pull_request.merged == true
+    runs-on: ubuntu-latest
+    outputs:
+      release: ${{ steps.inspect.outputs.release }}
+      commit: ${{ steps.inspect.outputs.commit }}
+    steps:
+      - uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6
+        with:
+          fetch-depth: 0
+          persist-credentials: false
+      - uses: ruby/setup-ruby@a0102e0972be65f351c307e2d64b9314a57c8073 # v1
+        with:
+          ruby-version: <%= ruby.to_json %>
+          bundler-cache: true
+      - id: inspect
+        env:
+          GH_TOKEN: ${{ github.token }}
+        run: bundle exec bake gem:github:release:resolve
+
+  publish:
+    needs: inspect
+    if: needs.inspect.outputs.release == 'true'
+    runs-on: ubuntu-latest
+    environment: rubygems
+    permissions:
+      contents: write
+      pull-requests: read
+      actions: read
+      id-token: write
+      attestations: write
+    steps:
+      - uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6
+        with:
+          ref: ${{ needs.inspect.outputs.commit }}
+          fetch-depth: 0
+          persist-credentials: false
+      - uses: ruby/setup-ruby@a0102e0972be65f351c307e2d64b9314a57c8073 # v1
+        with:
+          ruby-version: <%= ruby.to_json %>
+          rubygems: '4.0.21'
+          bundler-cache: true
+      - name: Build or restore artifact
+        id: build
+        env:
+          GH_TOKEN: ${{ github.token }}
+<% if signing -%>
+          GEM_SIGNING_KEY: ${{ secrets.GEM_SIGNING_KEY }}
+<% end -%>
+        run: bundle exec bake gem:github:release:build
+      - name: Sign RubyGems attestation
+        if: steps.build.outputs.restored != 'true'
+        env:
+          PACKAGE: ${{ steps.build.outputs.package }}
+        run: gem exec sigstore-cli:0.2.3 sign "$PACKAGE" --bundle "$PACKAGE.sigstore.json"
+      - name: Attest gem and release receipt
+        if: steps.build.outputs.restored != 'true'
+        id: attest
+        uses: actions/attest@1e69f48acb82d1966a394da916b4c1698aa569d6 # v4
+        with:
+          subject-path: |
+            ${{ steps.build.outputs.package }}
+            pkg/release.json
+      - name: Retain provenance bundle
+        if: steps.build.outputs.restored != 'true'
+        env:
+          ATTESTATION_BUNDLE: ${{ steps.attest.outputs.bundle-path }}
+        run: cp "$ATTESTATION_BUNDLE" pkg/provenance.sigstore.json
+      - name: Preserve release before upload
+        if: steps.build.outputs.restored != 'true'
+        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4
+        with:
+          name: ${{ steps.build.outputs.artifact }}
+          path: pkg/
+          if-no-files-found: error
+          retention-days: 90
+      - uses: rubygems/configure-rubygems-credentials@2a7221c7c44c30ebc68eda38fa25c60b918245c7
+      - name: Verify, publish, and finalize
+        env:
+          GH_TOKEN: ${{ github.token }}
+        run: bundle exec bake gem:github:release:publish

data/templates/release-validate.yaml.erb

@@ -0,0 +1,32 @@
+name: Validate release
+
+on:
+  pull_request:
+    branches: [<%= branch.to_json %>]
+
+permissions:
+  contents: read
+
+env:
+  BUNDLE_WITH: maintenance
+
+jobs:
+  validate:
+    name: Release validation
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6
+        with:
+          ref: ${{ github.event.pull_request.head.sha }}
+          fetch-depth: 0
+          persist-credentials: false
+      - uses: ruby/setup-ruby@a0102e0972be65f351c307e2d64b9314a57c8073 # v1
+        with:
+          ruby-version: <%= ruby.to_json %>
+          bundler-cache: true
+      - name: Regenerate release content
+        env:
+          RELEASE_BASE: ${{ github.event.pull_request.base.sha }}
+        run: bundle exec bake gem:release:validate "base=$RELEASE_BASE" optional=true
+      - name: Build unsigned package
+        run: bundle exec bake gem:build signing_key=false