release.yml

name: Release

on:
  push:
    tags:
      - "v*"
  workflow_dispatch:
    inputs:
      backfill_github_releases:
        description: Create or update GitHub Releases for every stable tag
        required: false
        default: false
        type: boolean

permissions:
  contents: read
  packages: read

env:
  CARGO_TERM_COLOR: always

jobs:
  verify:
    name: Verify Release Metadata
    runs-on: ubuntu-latest
    outputs:
      release_tag: ${{ steps.release.outputs.release_tag }}
    steps:
      - name: Checkout
        uses: actions/checkout@v7
        with:
          fetch-depth: 0

      - name: Fetch Protected Main
        run: git fetch --no-tags origin +refs/heads/main:refs/remotes/origin/main

      - name: Verify Release Commit Provenance
        run: ./scripts/check-release-provenance.sh "$GITHUB_SHA" origin/main

      - name: Install Rust
        uses: dtolnay/rust-toolchain@stable
        with:
          components: rustfmt

      - name: Cache Cargo Artifacts
        uses: Swatinem/rust-cache@v2

      - name: Resolve Release Tag
        id: release
        run: |
          if [ "${GITHUB_EVENT_NAME}" = "workflow_dispatch" ]; then
            version="$(sed -nE 's/^version = "([^"]+)"/\1/p' Cargo.toml | head -n1)"
            echo "release_tag=v${version}" >> "$GITHUB_OUTPUT"
          else
            echo "release_tag=${GITHUB_REF_NAME}" >> "$GITHUB_OUTPUT"
          fi

      - name: Check Release Metadata
        run: ./scripts/check-release.sh "${{ steps.release.outputs.release_tag }}"

      - name: List hubuum_client Package Contents
        run: cargo package --list -p hubuum_client

  required-checks:
    name: Required Release Checks
    needs: verify
    permissions:
      contents: read
      packages: read
    uses: ./.github/workflows/ci.yml
    with:
      run_semver: true
    secrets: inherit

  publish-hubuum-client:
    name: Publish hubuum_client
    runs-on: ubuntu-latest
    needs:
      - verify
      - required-checks
    if: github.event_name == 'push'
    environment: release
    permissions:
      contents: read
      id-token: write
    steps:
      - name: Checkout
        uses: actions/checkout@v7

      - name: Install Rust
        uses: dtolnay/rust-toolchain@stable

      - name: Cache Cargo Artifacts
        uses: Swatinem/rust-cache@v2

      - name: Authenticate to crates.io
        id: auth
        uses: rust-lang/crates-io-auth-action@v1

      - name: Check whether hubuum_client is already published
        id: published
        run: |
          version="$(sed -nE 's/^version = "([^"]+)"/\1/p' Cargo.toml | head -n1)"
          tmpdir="$(mktemp -d)"
          mkdir -p "${tmpdir}/src"
          printf "" > "${tmpdir}/src/lib.rs"
          printf '%s\n' \
            '[package]' \
            'name = "hubuum-client-release-probe"' \
            'version = "0.0.0"' \
            'edition = "2024"' \
            '' \
            '[dependencies]' \
            "hubuum_client = \"=${version}\"" \
            > "${tmpdir}/Cargo.toml"
          if cargo metadata --manifest-path "${tmpdir}/Cargo.toml" --format-version 1 >/dev/null 2>&1; then
            echo "published=true" >> "$GITHUB_OUTPUT"
          else
            echo "published=false" >> "$GITHUB_OUTPUT"
          fi

      - name: Publish hubuum_client
        if: steps.published.outputs.published != 'true'
        run: |
          set +e
          output="$(cargo publish -p hubuum_client --locked 2>&1)"
          status=$?
          set -e
          printf '%s\n' "$output"
          if [ "$status" -eq 0 ]; then
            exit 0
          fi
          if printf '%s\n' "$output" | grep -Fq "already exists on crates.io index"; then
            exit 0
          fi
          exit "$status"
        env:
          CARGO_REGISTRY_TOKEN: ${{ steps.auth.outputs.token }}

  github-release:
    name: Publish GitHub Release
    runs-on: ubuntu-latest
    needs:
      - verify
      - publish-hubuum-client
    if: >-
      always() &&
      needs.verify.result == 'success' &&
      ((github.event_name == 'push' && needs.publish-hubuum-client.result == 'success') ||
      (github.event_name == 'workflow_dispatch' && inputs.backfill_github_releases))
    permissions:
      contents: write
    steps:
      - name: Checkout All Tags
        uses: actions/checkout@v7
        with:
          fetch-depth: 0

      - name: Create or Update GitHub Release
        if: github.event_name == 'push'
        run: ./scripts/publish-github-release.sh "${{ needs.verify.outputs.release_tag }}" --latest
        env:
          GH_TOKEN: ${{ github.token }}

      - name: Create or Update Stable GitHub Releases
        if: github.event_name == 'workflow_dispatch'
        run: ./scripts/backfill-github-releases.sh
        env:
          GH_TOKEN: ${{ github.token }}