ci: automate gem releases

Publish tagged releases through RubyGems trusted publishing after every database and static check passes. Keep the OIDC publisher in ci.yml so it matches the registered workflow identity.

Author: cardmagic

.github/workflows/ci.yml

@@ -78,3 +78,38 @@ jobs:
           ruby-version: "3.3"
           bundler-cache: true
       - run: bundle exec rake standard rubocop rbs steep security
+
+  release:
+    if: startsWith(github.ref, 'refs/tags/v')
+    needs:
+      - sqlite
+      - postgresql
+      - mysql
+      - static
+    runs-on: ubuntu-latest
+    permissions:
+      contents: write
+      id-token: write
+    steps:
+      - uses: actions/checkout@v7
+        with:
+          persist-credentials: false
+      - uses: ruby/setup-ruby@v1
+        with:
+          ruby-version: "3.3"
+          bundler-cache: true
+      - name: Verify release tag
+        run: |
+          version=$(ruby -Ilib -e 'require "solid_objects/version"; print SolidObjects::VERSION')
+          test "$GITHUB_REF_NAME" = "v$version"
+      - name: Build gem
+        run: gem build solid_objects.gemspec
+      - name: Configure RubyGems credentials
+        uses: rubygems/configure-rubygems-credentials@dc5a8d8553e6ee01fc26761a49e99e733d17954a
+      - name: Push to RubyGems
+        run: gem push solid_objects-*.gem
+      - name: Create GitHub release
+        uses: softprops/action-gh-release@v2
+        with:
+          files: solid_objects-*.gem
+          generate_release_notes: true