Add RubyGems trusted publishing release workflow

.github/workflows/release.yml

@@ -0,0 +1,60 @@
+# Publish the RubyTree gem to RubyGems.org on a release tag.
+#
+# Uses RubyGems trusted publishing (OIDC) instead of a stored API key, so
+# there is no long-lived RubyGems credential held by this repository or by
+# any maintainer's machine for automated releases.
+#
+# A Trusted Publisher must be configured for the `rubytree` gem at
+# rubygems.org (Manage Gem > Trusted Publishers), pointing at this
+# repository and this workflow file name.
+#
+# Tag push triggers cannot be scoped to a branch directly (a tag ref has no
+# branch of its own), so a release tag pushed from anywhere still fires this
+# workflow. The "Verify tag is reachable from master" step guards against
+# that: it fails the job before anything is published if the tagged commit
+# is not on master, so an accidental release tag on another branch is
+# harmless.
+#
+# This runs as a Github Action.
+
+name: Release to RubyGems
+
+on:
+  push:
+    tags:
+      - "R*"
+
+permissions:
+  contents: read
+  id-token: write
+
+jobs:
+  release:
+    runs-on: ubuntu-latest
+    steps:
+      - name: Clone Repository
+        uses: actions/checkout@v4
+        with:
+          fetch-depth: 0
+
+      - name: Verify tag is reachable from master
+        run: |
+          if ! git merge-base --is-ancestor "$GITHUB_SHA" origin/master; then
+            echo "::error::Tag $GITHUB_REF_NAME (commit $GITHUB_SHA) is not on master. Refusing to publish."
+            exit 1
+          fi
+
+      - name: Setup Ruby and bundler dependencies
+        uses: ruby/setup-ruby@v1
+        with:
+          bundler-cache: true
+          ruby-version: ".ruby-version"
+
+      - name: Configure RubyGems trusted-publishing credentials
+        uses: rubygems/configure-rubygems-credentials@main
+
+      - name: Build gem package
+        run: bundle exec rake gem:package
+
+      - name: Push to RubyGems.org
+        run: gem push pkg/*.gem