Auto-trigger CD when CI passes and the gem version is bumped

Previously the CD workflow only ran via workflow_dispatch. Wire it to
fire automatically after CI succeeds on main, but only when the version
in lib/code_ownership/version.rb isn't already on RubyGems.

ci.yml:
- Add a check-release gate job that reads CodeOwnership::VERSION and
  queries the RubyGems API; sets should_release=true only when the
  version is unpublished. Runs only on push to main.
- Add a release job that calls cd.yml as a reusable workflow
  (secrets: inherit), gated on should_release and on the test jobs
  passing via needs.
- Add a notify_on_release Slack notification on successful release,
  mirroring the existing notify_on_failure hook.
- Add top-level contents: write so the reusable workflow's token can
  create the GitHub Release.

cd.yml:
- Add a dry_run input to workflow_call/workflow_dispatch that skips the
  irreversible gem push (logs "would push" instead), so the full
  build + job graph can be exercised on a branch without publishing.
  The GitHub Release step is already gated on new_version, so it skips
  automatically in dry-run.

workflow_dispatch remains as a manual fallback.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

Author: perryqh

.github/workflows/cd.yml

@@ -3,7 +3,16 @@
 
   on:
     workflow_call:
+      inputs:
+        dry_run:
+          type: boolean
+          default: false
     workflow_dispatch:
+      inputs:
+        dry_run:
+          type: boolean
+          default: false
+          description: "Build gems but don't publish or release"
 
   concurrency:
     group: ${{ github.workflow }}-${{ github.ref }}
@@ -129,6 +138,11 @@
             for i in *.gem; do
               if [ -f "$i" ]; then
                 echo "⏳ Attempting to push $i..."
+                if [ "${{ inputs.dry_run }}" = "true" ]; then
+                  echo "🧪 dry-run: would push $i (skipping)"
+                  SKIPPED_GEMS+=("$i")
+                  continue
+                fi
                 if ! gem push "$i" >push.out 2>&1; then
                   gemerr=$?
                   if grep -q "Repushing of gem" push.out; then

.github/workflows/ci.yml

@@ -6,6 +6,9 @@ on:
       - main
   pull_request:
 
+permissions:
+  contents: write
+
 jobs:
   ci-data:
     runs-on: ubuntu-latest
@@ -80,3 +83,51 @@ jobs:
             {
               "text": "${{ github.repository }}/${{ github.ref }}: FAILED\n${{ github.server_url }}/${{ github.repository }}/actions/runs/${{ github.run_id }}"
             }
+
+  check-release:
+    name: Check if release needed
+    runs-on: ubuntu-latest
+    needs: [rspec, rspec_ruby_version_file, static_type_check]
+    if: github.event_name == 'push' && github.ref == 'refs/heads/main'
+    outputs:
+      should_release: ${{ steps.check.outputs.should_release }}
+      version: ${{ steps.check.outputs.version }}
+    steps:
+      - uses: actions/checkout@v6
+      - id: check
+        run: |
+          VERSION=$(ruby -r ./lib/code_ownership/version.rb -e "puts CodeOwnership::VERSION")
+          echo "version=${VERSION}" >> "$GITHUB_OUTPUT"
+          STATUS=$(curl -s -o /dev/null -w "%{http_code}" \
+            "https://rubygems.org/api/v2/rubygems/code_ownership/versions/${VERSION}.json")
+          if [ "$STATUS" = "200" ]; then
+            echo "should_release=false" >> "$GITHUB_OUTPUT"
+            echo "::notice::code_ownership ${VERSION} already on RubyGems — skipping release."
+          else
+            echo "should_release=true" >> "$GITHUB_OUTPUT"
+            echo "::notice::code_ownership ${VERSION} not published — will release."
+          fi
+
+  release:
+    name: Release
+    needs: check-release
+    if: needs.check-release.outputs.should_release == 'true'
+    permissions:
+      contents: write
+    uses: ./.github/workflows/cd.yml
+    secrets: inherit
+
+  notify_on_release:
+    runs-on: ubuntu-latest
+    needs: [check-release, release]
+    if: ${{ github.ref == 'refs/heads/main' && needs.release.result == 'success' }}
+    env:
+      SLACK_WEBHOOK_URL: ${{ secrets.SLACK_WEBHOOK_URL }}
+      SLACK_WEBHOOK_TYPE: INCOMING_WEBHOOK
+    steps:
+      - uses: slackapi/slack-github-action@v1.25.0
+        with:
+          payload: |
+            {
+              "text": "🎉 Released ${{ github.repository }} v${{ needs.check-release.outputs.version }}"
+            }