Add trusted publishing action

.github/workflows/publish.yml

@@ -0,0 +1,53 @@
+name: Publish gem
+
+on: workflow_dispatch
+
+jobs:
+  # TODO: Prepare release notes
+
+  release-gem:
+    name: Build and push gem to RubyGems.org
+    runs-on: ubuntu-24.04
+    environment: "rubygems" # see: https://github.com/DataDog/dd-trace-rb/settings/environments
+    concurrency: "rubygems" # Only one publish job at a time
+
+    permissions:
+      id-token: write
+      contents: write
+
+    outputs:
+      version: ${{ steps.version.outputs.version }}
+
+    steps:
+      - uses: actions/checkout@v4
+      - name: Set up Ruby
+        uses: ruby/setup-ruby@v1
+        with:
+          ruby-version: '3.3'
+      - id: version
+        run: |
+          echo "version=$(ruby -e 'puts Gem::Specification::load(Dir.glob("*.gemspec").first).version')" >> $GITHUB_OUTPUT
+      - uses: rubygems/release-gem@v1
+
+  github-release:
+    name: Attach gem to GitHub release and publish
+    needs: release-gem
+    runs-on: ubuntu-24.04
+    env:
+      GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+      GH_REPO: ${{ github.repository }}
+      GEM_VERSION: ${{ needs.release-gem.outputs.version }}
+
+    permissions:
+      contents: write
+
+    steps:
+      - name: Download from RubyGems
+        run: |
+          gem fetch datadog --version ${GEM_VERSION} --verbose
+      - name: Attach to existing release draft
+        run: |
+          gh release upload "v${GEM_VERSION}" *.gem --clobber
+          gh release edit "v${GEM_VERSION}" --draft=false
+
+  # TODO: Close existing milestone and create next milestone