Update release workflow to configure RubyGems credentials and remove API key requirement

Author: niwo

.github/workflows/release.yml

@@ -17,6 +17,7 @@ on:
 
 permissions:
   contents: write
+  id-token: write
 
 concurrency:
   group: release-${{ github.event.inputs.tag || github.ref_name || github.sha }}
@@ -111,14 +112,17 @@ jobs:
             echo 'exists=false' >> "$GITHUB_OUTPUT"
           fi
 
+      - name: Configure RubyGems credentials
+        if: steps.rubygems.outputs.exists != 'true'
+        uses: rubygems/configure-rubygems-credentials@main
+
       - name: Publish gem to RubyGems
         if: steps.rubygems.outputs.exists != 'true'
         env:
-          GEM_HOST_API_KEY: ${{ secrets.RUBYGEMS_AUTH_TOKEN }}
           RELEASE_VERSION: ${{ steps.release.outputs.version }}
         run: |
           if [ -z "$GEM_HOST_API_KEY" ]; then
-            echo 'Missing RUBYGEMS_AUTH_TOKEN secret.'
+            echo 'RubyGems trusted publishing did not provide GEM_HOST_API_KEY.'
             exit 1
           fi
 

README.md

@@ -211,7 +211,7 @@ The `Update bundle` workflow runs monthly and can also be started manually from
 
 The `Release gem` workflow publishes to RubyGems when a tag like `v1.6.12` is pushed. It also runs when `lib/cloudstack-cli/version.rb` changes on `main`, creates the matching tag automatically, verifies the gem loads and builds, and publishes that version. You can also trigger it manually from the Actions tab with a release tag like `v1.6.12`; if the tag does not exist yet, the workflow creates it from the selected branch before publishing, and if it already exists the workflow reuses that tag.
 
-Add the `RUBYGEMS_API_KEY` repository secret before using the release workflow.
+The release workflow uses RubyGems trusted publishing via GitHub OIDC, so no RubyGems API key secret is required. The gem must already be configured with this repository as a trusted publisher on RubyGems.org.
 
 Typical release flow: