trusted publishing

.github/workflows/build.yml

@@ -1,37 +1,11 @@
 ---
 name: Build
 'on':
-  push:
-    branches:
-    - main
-    tags:
-    - "**"
-  pull_request_target:
+  pull_request:
 jobs:
   build:
     name: Build
-    runs-on: ubuntu-22.04
-    permissions:
-      contents: write
+    runs-on: ubuntu-latest
     steps:
-    - name: Checkout
-      uses: actions/checkout@v3
-      with:
-        submodules: recursive
-    - uses: ruby/setup-ruby@v1
-      with:
-        ruby-version: '3.1'
-        bundler-cache: true
-    - name: Build
-      run: bundle exec rake
-    - name: Release
-      if: github.ref_type == 'tag'
-      run: bundle exec rake release
-      env:
-        GEM_HOST_API_KEY: "${{ secrets.GEM_HOST_API_KEY }}"
-    - name: Post to hook-exporter
-      run: "./.github/exporter.sh"
-      env:
-        EXPORTER_TOKEN: "${{ secrets.EXPORTER_TOKEN }}"
-        JOB_STATUS: "${{ job.status }}"
-      if: always() && github.ref == 'refs/heads/main'
+    - name: Run base CI
+      uses: akerl/.github/actions/base-ruby@main

.github/workflows/release.yml

@@ -0,0 +1,24 @@
+---
+name: Release
+'on':
+  push:
+    branches:
+    - main
+jobs:
+  release:
+    name: Release
+    runs-on: ubuntu-latest
+    permissions:
+      contents: write
+      id-token: write
+    steps:
+    - name: Run base CI
+      uses: akerl/.github/actions/base-ruby@main
+    - name: Release
+      uses: rubygems/release-gem@v1
+    - name: Post to hook-exporter
+      uses: akerl/.github/actions/hook-exporter@main
+      with:
+        token: ${{ secrets.EXPORTER_TOKEN }}
+        status: ${{ job.status }}
+      if: always()