From a63e1c6e764834df54f81193d3b4c7626573645e Mon Sep 17 00:00:00 2001
From: Douglas Eichelberger <doug.eichelberger@gusto.com>
Date: Thu, 24 Sep 2026 21:33:18 -0700
Subject: [PATCH] Adopt shared-config CD and bump to 0.1.24
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

`main` has been at 0.1.23 while RubyGems still serves 0.1.0 from 2025-03-27.
The cause was `release.yml`, whose `release` job has failed every run since at
least 2026-07-24:

    No trusted publisher configured for this workflow found on
    https://rubygems.org for audience rubygems.org

Its `tag` job kept working, auto-bumping and tagging on every merge, so tags
climbed to v0.1.23 while nothing was ever published. That job also had no
`needs: tag`, so it raced the bump commit it was supposed to publish.

Replace it with the `cd.yml` that rubocop-packs and packwerk-extensions use:
CI completes on main, then shared-config's reusable CD runs `rake release` via
`discourse/publish-rubygems-action`, authenticating with the org-level
`RUBYGEMS_API_KEY` rather than OIDC trusted publishing. All four secrets that
workflow needs are org-level with `visibility=all`, so `secrets: inherit`
resolves them here.

Bumping to 0.1.24 is required, not cosmetic. That action gates on the git tag,
not on RubyGems:

    if git fetch origin "refs/tags/v$gem_version"; then new_version=false

`v0.1.23` already exists, so leaving the version alone would make every CD run
report "Tag already exists" and publish nothing — the same silent no-op this
change is meant to fix. 0.1.24 is the first untagged version.

Dropping `release.yml` also ends per-merge automatic version bumps; releases
now need a deliberate bump, matching the other gems. That is why 23 patch
versions accumulated from dependency bumps.

Verified: 60 examples pass, rubocop clean across 30 files.
---
 .github/workflows/cd.yml      | 14 +++++++
 .github/workflows/release.yml | 71 -----------------------------------
 Gemfile.lock                  |  2 +-
 lib/query_packwerk/version.rb |  2 +-
 4 files changed, 16 insertions(+), 73 deletions(-)
 create mode 100644 .github/workflows/cd.yml
 delete mode 100644 .github/workflows/release.yml

diff --git a/.github/workflows/cd.yml b/.github/workflows/cd.yml
new file mode 100644
index 0000000..4c9ab97
--- /dev/null
+++ b/.github/workflows/cd.yml
@@ -0,0 +1,14 @@
+name: CD
+
+on:
+  workflow_run:
+    workflows: [CI]
+    types: [completed]
+    branches: [main]
+
+jobs:
+  call-workflow-from-shared-config:
+    permissions:
+      contents: write
+    uses: rubyatscale/shared-config/.github/workflows/cd.yml@main
+    secrets: inherit
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
deleted file mode 100644
index 26e61d3..0000000
--- a/.github/workflows/release.yml
+++ /dev/null
@@ -1,71 +0,0 @@
-name: Tag and Release Gem
-
-env:
-  GEM_NAME: query_packwerk
-  GEM_CLASS_NAME: QueryPackwerk
-
-on:
-  pull_request:
-    types: [closed]
-    branches: [main]
-
-permissions:
-  contents: write
-  actions: read
-
-jobs:
-  tag:
-    if: github.event.pull_request.merged == true
-    runs-on: ubuntu-latest
-    steps:
-      - uses: actions/checkout@v7.0.1
-
-      - name: Set up Ruby
-        uses: ruby/setup-ruby@v1
-        with:
-          ruby-version: 3.3
-
-      - name: Determine release type
-        id: version
-        run: |
-          if [[ "${{ github.event.pull_request.labels[*] }}" == *"major"* ]]; then
-            echo "bump=major" >> $GITHUB_OUTPUT
-          elif [[ "${{ github.event.pull_request.labels[*] }}" == *"minor"* ]]; then
-            echo "bump=minor" >> $GITHUB_OUTPUT
-          else
-            echo "bump=patch" >> $GITHUB_OUTPUT
-          fi
-
-      - name: Bump version
-        run: |
-          gem install bump
-          bump ${{ steps.version.outputs.bump }}
-
-      - name: Commit and tag version bump
-        run: |
-          # Attribute commits to the last committer on HEAD
-          git config --global user.email "$(git log -1 --pretty=format:'%ae')"
-          git config --global user.name "$(git log -1 --pretty=format:'%an')"
-          git remote set-url origin "https://x-access-token:${{ github.token }}@github.com/$GITHUB_REPOSITORY"
-          VERSION=$(ruby -e "require './lib/${{ env.GEM_NAME }}/version'; puts ${{ env.GEM_CLASS_NAME }}::VERSION")
-          git commit -am "Bump version to $VERSION"
-          git tag "v$VERSION"
-          git push origin main "v$VERSION"
-  release:
-    if: github.repository == 'rubyatscale/query_packwerk'
-    runs-on: ubuntu-latest
-    environment: release
-    permissions:
-      contents: write
-      id-token: write
-
-    steps:
-      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
-      - name: Set up Ruby
-        uses: ruby/setup-ruby@354a1ad156761f5ee2b7b13fa8e09943a5e8d252 # v1.229.0
-        with:
-          bundler-cache: true
-          ruby-version: ruby
-
-      # Release
-      - uses: rubygems/release-gem@7f9650160c1a4e7989fdc9855807bdbd421d8b6b # v1
diff --git a/Gemfile.lock b/Gemfile.lock
index 50b88aa..1fb2a5b 100644
--- a/Gemfile.lock
+++ b/Gemfile.lock
@@ -1,7 +1,7 @@
 PATH
   remote: .
   specs:
-    query_packwerk (0.1.23)
+    query_packwerk (0.1.24)
       coderay
       packwerk
       parse_packwerk
diff --git a/lib/query_packwerk/version.rb b/lib/query_packwerk/version.rb
index 83f37ef..1e64a57 100644
--- a/lib/query_packwerk/version.rb
+++ b/lib/query_packwerk/version.rb
@@ -2,5 +2,5 @@
 # frozen_string_literal: true
 
 module QueryPackwerk
-  VERSION = '0.1.23'
+  VERSION = '0.1.24'
 end