auto-publish.yml

name: Auto Publish

on:
  push:
    branches: [main]
  workflow_dispatch:

permissions:
  contents: read

concurrency:
  group: auto-publish-${{ github.workflow }}-${{ github.ref }}
  cancel-in-progress: false

jobs:
  publish:
    name: Publish Rust Crates
    runs-on: ubuntu-latest
    if: ${{ github.ref == 'refs/heads/main' }}
    steps:
      - name: Checkout
        uses: actions/checkout@v4

      - name: Install Rust toolchain
        uses: dtolnay/rust-toolchain@master
        with:
          toolchain: nightly-2026-01-01

      - name: Cache Rust dependencies
        uses: Swatinem/rust-cache@v2

      - name: Validate registry token
        shell: bash
        env:
          CARGO_REGISTRY_TOKEN: ${{ secrets.CARGO_REGISTRY_TOKEN }}
        run: |
          set -euo pipefail

          if [ -z "${CARGO_REGISTRY_TOKEN:-}" ]; then
            echo "::error::CARGO_REGISTRY_TOKEN is required for auto-publish."
            exit 1
          fi

      - name: Publish workspace crates
        env:
          CARGO_REGISTRY_TOKEN: ${{ secrets.CARGO_REGISTRY_TOKEN }}
        run: cargo run -p cargo-mono -- publish