name: Release

permissions:
  pull-requests: write
  contents: write

# Only wake release-plz when something that can land in a published version
# actually changed. A docs-only or CI-only push to main never starts a release
# run; the release PR that release-plz opens edits Cargo.toml (+ Cargo.lock), so
# merging it still matches `paths` and the tag/publish step fires as normal.
#
# `workflow_dispatch` is the manual escape hatch: it bypasses the `paths` filter
# so a maintainer can refresh the release PR (or cut a release) on demand — e.g.
# after tooling changes that the filter intentionally ignores left the open
# release PR stale.
on:
  workflow_dispatch:
  push:
    branches:
      - main
    paths:
      - 'src/**'
      - 'Cargo.toml'
      - 'Cargo.lock'

jobs:
  release-plz:
    name: Release
    runs-on: ubuntu-latest
    concurrency:
      group: release-plz-${{ github.ref }}
      cancel-in-progress: false
    steps:
      - name: Checkout
        uses: actions/checkout@v4
        with:
          fetch-depth: 0

      - name: Install Rust toolchain
        uses: dtolnay/rust-toolchain@stable

      # Mint a short-lived (~1h), repo-scoped token from a GitHub App that has
      # ONLY Contents + Pull-requests write on this repo. This keeps the org's
      # default GITHUB_TOKEN locked to read-only (no org-wide loosening) while
      # still letting release-plz open its release PR and push tags/releases.
      - name: Generate GitHub App token
        id: app-token
        uses: actions/create-github-app-token@v1
        with:
          app-id: ${{ secrets.RELEASE_PLZ_APP_ID }}
          private-key: ${{ secrets.RELEASE_PLZ_APP_PRIVATE_KEY }}

      # release-plz opens/updates the release PR AND, on a release commit, cuts
      # the version + changelog, tags, makes the GitHub release, and publishes
      # `cesr-rs` to crates.io. GITHUB_TOKEN is the App token above; the cargo
      # registry token is the org-level CARGO_REGISTRY_SECRET. No cargo-hakari
      # step — cesr is a single crate, unlike the nexus workspace it's modeled on.
      - name: Run release-plz
        uses: release-plz/action@v0.5
        env:
          GITHUB_TOKEN: ${{ steps.app-token.outputs.token }}
          CARGO_REGISTRY_TOKEN: ${{ secrets.CARGO_REGISTRY_SECRET }}
