ci: Split release workflow since master branch has protection

.github/workflows/push_gem.yml → .github/workflows/create_release.yml

@@ -1,4 +1,4 @@
-name: release
+name: prepare release
 
 on:
   workflow_dispatch:
@@ -9,12 +9,12 @@ on:
 
 jobs:
   push:
-    name: Push gem to RubyGems.org
+    name: Prepare release PR
     runs-on: ubuntu-latest
 
     permissions:
       id-token: write # IMPORTANT: this permission is mandatory for trusted publishing
-      contents: write # IMPORTANT: this permission is required for `rake release` to push the release tag
+      contents: write # required to push release branch and open PR
 
     steps:
       - uses: actions/checkout@v5
@@ -60,16 +60,22 @@ jobs:
           set -euo pipefail
           version="$VERSION_NO_V"
 
+          release_branch="release/v${version}"
+          echo "RELEASE_BRANCH=${release_branch}" >> "$GITHUB_ENV"
+
           git config user.name "github-actions[bot]"
           git config user.email "github-actions[bot]@users.noreply.github.com"
           git commit -am "Bump version to ${version}"
-          git push origin "HEAD:${{ github.event.repository.default_branch }}"
-
-      - uses: rubygems/release-gem@v1
+          git push origin "HEAD:${release_branch}"
 
-      - name: Create GitHub release
-        uses: softprops/action-gh-release@v2
+      - name: Open release PR
+        uses: peter-evans/create-pull-request@v6
         with:
-          tag_name: ${{ env.VERSION_TAG }}
-          name: ${{ env.VERSION_TAG }}
-          generate_release_notes: true
+          token: ${{ secrets.GITHUB_TOKEN }}
+          branch: ${{ env.RELEASE_BRANCH }}
+          title: Release v${{ env.VERSION_NO_V }}
+          commit-message: Bump version to ${{ env.VERSION_NO_V }}
+          body: |
+            Automated release PR created by workflow_dispatch.
+            - Version: v${{ env.VERSION_NO_V }}
+            - Triggered by: ${{ github.actor }}

.github/workflows/publish.yml

@@ -0,0 +1,46 @@
+name: Publish to RubyGems
+
+on:
+  push:
+    tags:
+      - 'v*'
+
+jobs:
+  publish:
+    name: Publish gem and GitHub release
+    runs-on: ubuntu-latest
+
+    permissions:
+      id-token: write   # for RubyGems trusted publishing
+      contents: write   # to create GitHub release
+
+    steps:
+      - uses: actions/checkout@v5
+        with:
+          fetch-depth: 0
+
+      - name: Set up Ruby
+        uses: ruby/setup-ruby@v1
+        with:
+          bundler-cache: true
+          ruby-version: ruby
+
+      - name: Verify tag matches version.rb
+        run: |
+          set -euo pipefail
+          tag="${GITHUB_REF_NAME}"
+          version="${tag#v}"
+          file_version=$(ruby -e "require_relative './lib/rspec/openapi/version'; puts RSpec::OpenAPI::VERSION")
+          if [ "$version" != "$file_version" ]; then
+            echo "Tag version ($version) does not match lib/rspec/openapi/version.rb ($file_version)" >&2
+            exit 1
+          fi
+
+      - uses: rubygems/release-gem@v1
+
+      - name: Create GitHub release
+        uses: softprops/action-gh-release@v2
+        with:
+          tag_name: ${{ github.ref_name }}
+          name: ${{ github.ref_name }}
+          generate_release_notes: true