Restructure release workflows to adopt Trusted Publisher for tag releases

Author: kateinoigakukun

.github/workflows/build.yml

@@ -2,7 +2,6 @@ name: Build ruby.wasm
 on:
   push:
     branches: [main]
-    tags: ["*"]
     paths-ignore:
       - "*.md"
       - "docs/**"
@@ -12,13 +11,14 @@ on:
       publish:
         type: boolean
         description: "Whether to publish or not"
-        default: true
+        default: false
       prerel_name:
         type: string
         description: "Pre-release name to be released"
-        required: true
+        default: ""
 
 jobs:
+
   lint:
     runs-on: ubuntu-24.04
     if: ${{ github.event_name == 'pull_request' }}

.github/workflows/nightly-release.yml .github/workflows/release.yml.github/workflows/nightly-release.yml renamed to .github/workflows/release.yml

@@ -1,17 +1,22 @@
-name: Nightly release
+name: Release ruby.wasm
 on:
   schedule:
-    - cron: '0 15 * * *'
+    - cron: "0 15 * * *"
   workflow_dispatch:
     inputs:
       tag-name:
         type: string
-        description: 'Nightly release tag'
+        description: "Nightly release tag"
         required: true
+  push:
+    tags: ["*"]
 
 jobs:
   create-nightly-tag:
+    if: ${{ github.event_name != 'push' }}
     runs-on: ubuntu-24.04
+    permissions:
+      contents: write
     outputs:
       tag-name: ${{ steps.generate-tag.outputs.TAG_NAME }}
     steps:
@@ -26,9 +31,27 @@ jobs:
           echo "TAG_NAME=${MANUAL_TAG:-$(date +'%Y-%m-%d')-a}" >> $GITHUB_OUTPUT
       - run: git tag "${{ steps.generate-tag.outputs.TAG_NAME }}"
       - run: git push origin "${{ steps.generate-tag.outputs.TAG_NAME }}"
-  build-and-publish:
-    needs: [create-nightly-tag]
+
+  release-nightly:
+    if: ${{ github.event_name != 'push' }}
+    needs:
+      - create-nightly-tag
+    permissions:
+      contents: write
+      id-token: write
     uses: ./.github/workflows/build.yml
     with:
       publish: true
       prerel_name: ${{ needs.create-nightly-tag.outputs.tag-name }}
+    secrets: inherit
+
+  release-tag:
+    if: ${{ github.event_name == 'push' && github.actor != 'github-actions[bot]' }}
+    permissions:
+      contents: write
+      id-token: write
+    uses: ./.github/workflows/build.yml
+    with:
+      publish: true
+      prerel_name: ${{ github.ref_name }}
+    secrets: inherit