publish.yml

# Ultralytics 🚀 AGPL-3.0 License - https://ultralytics.com/license

# Publish crate to crates.io https://crates.io/crates/ultralytics-inference

name: Publish to crates.io

on:
  push:
    branches: [main]
  workflow_dispatch:
    inputs:
      publish:
        type: boolean
        description: Publish to crates.io
        default: false

jobs:
  check:
    if: github.repository == 'ultralytics/inference' && github.ref == 'refs/heads/main'
    runs-on: ubuntu-latest
    permissions:
      contents: write
    outputs:
      increment: ${{ steps.check_version.outputs.increment }}
      current_tag: ${{ steps.check_version.outputs.current_tag }}
      previous_tag: ${{ steps.check_version.outputs.previous_tag }}
      crate_url: https://crates.io/crates/ultralytics-inference
    steps:
      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
        with:
          fetch-depth: 0
      - uses: actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1 # v6.3.0
        with:
          python-version: "3.x"
      - uses: astral-sh/setup-uv@11f9893b081a58869d3b5fccaea48c9e9e46f990 # v8.3.2
        with:
          enable-cache: false
      - name: Install ultralytics-actions
        run: uv pip install --system --no-cache ultralytics-actions
      - name: Fetch tags
        run: git fetch --tags --force
      - id: check_version
        shell: python
        run: |
          import os
          import re
          import subprocess
          from pathlib import Path

          version = None
          with open("Cargo.toml") as f:
            for line in f:
              m = re.search(r'version\s*=\s*"([^"]+)"', line)
              if m:
                version = m.group(1)
                break
          if not version:
            raise SystemExit("Version not found in Cargo.toml")

          current_tag = f"v{version}"
          tags = subprocess.run(
            ["git", "tag", "--sort=-creatordate"],
            text=True,
            capture_output=True,
            check=True,
          ).stdout.strip().splitlines()
          previous_tag = next((t for t in tags if t != current_tag), "")

          remote = subprocess.run(
            ["git", "ls-remote", "--exit-code", "--tags", "origin", f"refs/tags/{current_tag}"],
            text=True,
            capture_output=True,
          )
          if remote.returncode not in (0, 2):
            raise SystemExit(remote.stderr.strip() or "Failed to check remote tag")
          tag_exists = current_tag in tags or remote.returncode == 0
          increment = str(not tag_exists)

          print(f"Local version: {version}")
          print(f"Current tag: {current_tag}")
          print(f"Previous tag: {previous_tag or '<none>'}")
          print(f"Tag exists: {tag_exists}")

          with Path(os.environ["GITHUB_OUTPUT"]).open("a") as f:
            print(f"increment={increment}", file=f)
            print(f"current_tag={current_tag}", file=f)
            print(f"previous_tag={previous_tag}", file=f)
          if increment == "True":
            print("Ready to publish new version to crates.io ✅.")
      - name: Tag and Release
        if: steps.check_version.outputs.increment == 'True' && (github.event_name == 'push' || inputs.publish == true)
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
          CURRENT_TAG: ${{ steps.check_version.outputs.current_tag }}
          PREVIOUS_TAG: ${{ steps.check_version.outputs.previous_tag }}
          OPENAI_API_KEY: ${{ secrets.OPENAI_API_KEY }}
        run: |
          git config --global user.name "UltralyticsAssistant"
          git config --global user.email "web@ultralytics.com"
          git tag -a "$CURRENT_TAG" -m "$(git log -1 --pretty=%B)"
          git push origin "$CURRENT_TAG"
          ultralytics-actions-summarize-release
          uv cache prune --ci

  build:
    needs: check
    if: needs.check.outputs.increment == 'True' && (github.event_name == 'push' || inputs.publish == true)
    runs-on: ubuntu-latest
    permissions:
      contents: read
    steps:
      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
      - uses: dtolnay/rust-toolchain@stable
        with:
          components: rustfmt, clippy
      - uses: Swatinem/rust-cache@c19371144df3bb44fab255c43d04cbc2ab54d1c4 # v2.9.1
      - run: cargo fmt --all -- --check
      - run: cargo clippy --all-targets --no-default-features --features annotate -- -D warnings
      - run: cargo test --no-default-features --features annotate
      - run: cargo package --locked --list
      - run: cargo publish --dry-run --locked

  publish:
    needs: [check, build]
    if: needs.check.outputs.increment == 'True' && (github.event_name == 'push' || inputs.publish == true)
    runs-on: ubuntu-latest
    environment:
      name: Release - crates.io
      url: ${{ needs.check.outputs.crate_url }}
    permissions:
      contents: read
    steps:
      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
      - uses: dtolnay/rust-toolchain@stable
      - uses: Swatinem/rust-cache@c19371144df3bb44fab255c43d04cbc2ab54d1c4 # v2.9.1
      - run: cargo publish --locked
        env:
          CARGO_REGISTRY_TOKEN: ${{ secrets.CARGO_REGISTRY_TOKEN }}

  sbom:
    needs: [check, build, publish]
    if: needs.check.outputs.increment == 'True' && (github.event_name == 'push' || inputs.publish == true)
    runs-on: ubuntu-latest
    permissions:
      contents: write
    steps:
      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
      - uses: dtolnay/rust-toolchain@stable
      - uses: Swatinem/rust-cache@c19371144df3bb44fab255c43d04cbc2ab54d1c4 # v2.9.1
      - name: Generate Cargo.lock for SBOM
        run: cargo generate-lockfile
      - uses: anchore/sbom-action@e22c389904149dbc22b58101806040fa8d37a610 # v0.24.0
        with:
          format: spdx-json
          output-file: sbom.spdx.json
          path: .
      - run: gh release upload ${{ needs.check.outputs.current_tag }} sbom.spdx.json --clobber
        env:
          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}

  notify:
    needs: [check, build, publish, sbom]
    if: always() && needs.check.outputs.increment == 'True' && (github.event_name == 'push' || inputs.publish == true)
    runs-on: ubuntu-latest
    permissions: {}
    steps:
      - name: Notify Success
        if: needs.build.result == 'success' && needs.publish.result == 'success' && needs.sbom.result == 'success'
        uses: slackapi/slack-github-action@0d95c9a7becc1e6e297d76df9bc735c44f4cbcbc # v3.0.5
        with:
          webhook-type: incoming-webhook
          webhook: ${{ secrets.SLACK_WEBHOOK_URL_YOLO }}
          payload: |
            text: "<!subteam^S082BPCRAJ3> *${{ github.workflow }}* ✅ `${{ github.repository }}` ${{ needs.check.outputs.current_tag }}  <https://github.com/${{ github.repository }}/releases/tag/${{ needs.check.outputs.current_tag }}|*Release*>  ·  <https://github.com/${{ github.repository }}/actions/runs/${{ github.run_id }}|*Run*>"
      - name: Notify Failure
        if: needs.build.result != 'success' || needs.publish.result != 'success' || needs.sbom.result != 'success'
        uses: slackapi/slack-github-action@0d95c9a7becc1e6e297d76df9bc735c44f4cbcbc # v3.0.5
        with:
          webhook-type: incoming-webhook
          webhook: ${{ secrets.SLACK_WEBHOOK_URL_YOLO }}
          payload: |
            text: "<!subteam^S082BPCRAJ3> *${{ github.workflow }}* ❌ `${{ github.repository }}` ${{ needs.check.outputs.current_tag }}  <https://github.com/${{ github.repository }}/actions/runs/${{ github.run_id }}|*Run*>"