[ioquatix]

Summary

• Migrate maintenance dependencies to bake-gem-github ~> 0.7.0 using bake-modernize 0.66.0.
• Generate release preparation, validation, publishing workflows and native rulesets using the existing stable Ruby, coverage, RuboCop, and documentation check names.
• Refresh copyrights in the version-increment hook and remove the redundant GitHub publishing hook.
• Remove the legacy RubyGems certificate and gemspec signing fields. Publishing uses Trusted Publishing and Sigstore/GitHub provenance attestations.
• Update the README release command.

The modernization task migrated dependencies; its Ollama-based hook merge was unavailable, so the small hook update was applied directly from the generated template.

Verification

• bundle exec bake test — 787 tests, 1,587 assertions passed.
• bundle exec rubocop — 135 files, no offenses.
• bundle exec bake decode:index:coverage lib — 475/475 public definitions documented.
• bundle exec bake gem:build — unsigned build succeeds.
• bundle exec bake gem:github:setup:update — no additional changes.
• bundle exec bake gem:github:release:validate base=origin/main — passed.
• Reviewed gem:github:setup:plan.

Publishing setup

Register or confirm the RubyGems Trusted Publisher from this branch with:

bundle exec bake gem:github:setup:publisher key=rubygems

It uses socketry/protocol-http, release-publish.yaml, and the rubygems environment. The RubyGems owner may need to complete MFA. Create the rubygems environment restricted to main. After merge and successful CI, review gem:github:setup:plan and apply the release rules with gem:github:setup:apply.

[ioquatix]

Publishing environment setup is complete: rubygems now exists and permits deployments only from the main branch. The RubyGems owner registration command can be run now; the managed rulesets should be applied after this PR is merged and the new release-validation check is available.