name: Release

# Tags publish the crate to crates.io, attach the compiled binary to a
# GitHub Release, and push the release image to GHCR.
on:
  push:
    tags:
      - "v*"

jobs:
  release:
    runs-on: ubuntu-latest
    permissions:
      contents: write
      packages: write
    steps:
      - uses: actions/checkout@v7
      - uses: dtolnay/rust-toolchain@stable
      - uses: Swatinem/rust-cache@v2.9.1
      - run: cargo test --locked
      - name: Publish crate to crates.io
        run: cargo publish --locked --token "$CARGO_REGISTRY_TOKEN"
        env:
          CARGO_REGISTRY_TOKEN: ${{ secrets.CARGO_REGISTRY_TOKEN }}
      - run: cargo build --release --locked
      - uses: softprops/action-gh-release@v3.0.1
        with:
          files: target/release/bitbucket-dc-mcp
      # Publishes the Dockerfile's image to GHCR, versioned by the release
      # tag — a real, pullable artifact of the release, not just the CI
      # build-validation docker-build.yml does on every push/PR. Uses the
      # built-in GITHUB_TOKEN, so no extra secret is needed.
      - uses: docker/setup-buildx-action@v4.2.0
      - uses: docker/login-action@v4.4.0
        with:
          registry: ghcr.io
          username: ${{ github.actor }}
          password: ${{ secrets.GITHUB_TOKEN }}
      - name: Compute image name
        id: image
        # GHCR image names must be lowercase, but github.repository isn't
        # guaranteed to be (e.g. a mixed-case GitHub username/org).
        run: echo "name=ghcr.io/$(echo '${{ github.repository }}' | tr '[:upper:]' '[:lower:]')" >> "$GITHUB_OUTPUT"
      - uses: docker/build-push-action@v7.3.0
        with:
          context: .
          push: true
          tags: |
            ${{ steps.image.outputs.name }}:${{ github.ref_name }}
            ${{ steps.image.outputs.name }}:latest
