on:
  push:
    tags:
      - "*"

name: Publish

permissions:
  contents: read
  checks: write
  security-events: write
  actions: read

jobs:
  audit:
    name: Audit
    runs-on: ubuntu-latest
    timeout-minutes: 10
    steps:
      - uses: actions/checkout@v4
      - name: "Generate Cargo.lock"
        run: cargo generate-lockfile

      - name: cargo-audit cache restore
        id: cargo-audit_cache_restore
        uses: actions/cache/restore@v4
        with:
          path: ~/.cargo/bin/cargo-audit
          key: ${{ runner.os }}-cargo-audit

      - run: cargo install cargo-audit
        if: steps.cargo-audit_cache_restore.outputs.cache-hit != 'true'

      - name: cargo-audit cache save
        id: cargo-audit_cache_save
        uses: actions/cache/save@v4
        if: always() && steps.cargo-audit_cache_restore.outputs.cache-hit != 'true'
        with:
          path: ~/.cargo/bin/cargo-audit
          key: ${{ runner.os }}-cargo-audit

      - uses: rustsec/audit-check@v2
        with:
          token: ${{ secrets.GITHUB_TOKEN }}

  crates_io_publish:
    name: Publish (crates.io)
    needs:
      - audit

    runs-on: ubuntu-latest
    timeout-minutes: 25
    steps:
      - uses: actions/checkout@v4
      - uses: dtolnay/rust-toolchain@stable

      - name: cargo-release cache restore
        id: cargo_release_cache_restore
        uses: actions/cache/restore@v4
        with:
          path: ~/.cargo/bin/cargo-release
          key: ${{ runner.os }}-cargo-release

      - run: cargo install cargo-release
        if: steps.cargo_release_cache_restore.outputs.cache-hit != 'true'

      - name: cargo-release cache save
        id: cargo_release_cache_save
        uses: actions/cache/save@v4
        if: always() && steps.cargo_release_cache_restore.outputs.cache-hit != 'true'
        with:
          path: ~/.cargo/bin/cargo-release
          key: ${{ runner.os }}-cargo-release

      - name: cargo login
        run: |-
          echo "${{ secrets.CARGO_REGISTRY_TOKEN }}" | cargo login

      # allow-branch HEAD is because GitHub actions switches
      # to the tag while building, which is a detached head

      # Publishing is currently messy, because:
      #
      # * `peace_rt_model_core` exports `NativeError` or `WebError` depending on the target.
      # * `peace_rt_model_web` fails to build when publishing the workspace for a native target.
      # * `peace_rt_model_web` still needs its dependencies to be published before it can be
      #    published.
      # * `peace_rt_model_hack` needs `peace_rt_model_web` to be published before it can be
      #    published.
      #
      # We *could* pass through `--no-verify` so `cargo` doesn't build the crate before publishing,
      # which is reasonable, since this job only runs after the Linux, Windows, and WASM builds
      # have passed.
      - name: "cargo release publish"
        run: |-
          cargo release \
            publish \
            --workspace \
            --all-features \
            --allow-branch HEAD \
            --no-confirm \
            --no-verify \
            --execute
