auto-publish.yml

name: Auto Publish

on:
  push:
    branches: [main]
  workflow_dispatch:

permissions:
  contents: write

concurrency:
  group: auto-publish-${{ github.workflow }}-${{ github.ref }}
  cancel-in-progress: false

jobs:
  publish:
    name: Publish Rust Crates
    runs-on: ubuntu-latest
    if: ${{ github.ref == 'refs/heads/main' }}
    steps:
      - name: Checkout
        uses: actions/checkout@v6
        with:
          # Keep checkout auth separate so tag push uses GH_TOKEN credentials.
          persist-credentials: false

      - name: Install Rust toolchain
        uses: dtolnay/rust-toolchain@v1
        with:
          toolchain: nightly-2026-01-01

      - name: Cache Rust dependencies
        uses: Swatinem/rust-cache@v2

      - name: Validate registry token
        shell: bash
        env:
          CARGO_REGISTRY_TOKEN: ${{ secrets.CARGO_REGISTRY_TOKEN }}
        run: |
          set -euo pipefail

          if [ -z "${CARGO_REGISTRY_TOKEN:-}" ]; then
            echo "::error::CARGO_REGISTRY_TOKEN is required for auto-publish."
            exit 1
          fi

      - name: Publish workspace crates
        env:
          CARGO_REGISTRY_TOKEN: ${{ secrets.CARGO_REGISTRY_TOKEN }}
        run: cargo run -p cargo-mono -- publish

      - name: Push release tags
        shell: bash
        env:
          GH_TOKEN: ${{ secrets.GH_TOKEN }}
        run: |
          set -euo pipefail

          if [ -z "${GH_TOKEN:-}" ]; then
            echo "::error::GH_TOKEN is required for auto-publish tag push."
            exit 1
          fi

          echo "Preparing tag push for repository: ${{ github.repository }}"
          echo "Clearing checkout-injected github.com auth header."
          git config --local --unset-all "http.https://github.com/.extraheader" || true

          remote_url="https://x-access-token:${GH_TOKEN}@github.com/${{ github.repository }}.git"
          git remote set-url origin "$remote_url"

          echo "Pushing all local tags to origin."
          git push --tags
          echo "Tag push finished."