name: Release-plz

# Runs on every push to main. Two jobs:
#   1. `release-pr`  opens/updates a "Release PR" that bumps the version
#                    and CHANGELOG based on conventional commits since the
#                    last release. Safe to run on every push — it only
#                    creates/updates a PR, never ships anything.
#   2. `release`     when the Release PR is merged (i.e. another push to
#                    main lands with the version bump committed), this
#                    runs `cargo publish` and creates the GitHub Release.
#
# Required secrets (set via Settings → Secrets and variables → Actions):
#   - CARGO_REGISTRY_TOKEN: crates.io API token
#                           (https://crates.io/me → New Token, scope = publish-update)

on:
  push:
    branches: [main]

# A single concurrency group prevents two release jobs racing if multiple
# merges land in quick succession.
concurrency:
  group: release-plz-${{ github.ref }}

jobs:
  # Opens/updates the Release PR. Merging that PR is what triggers the
  # actual publish in the `release` job below.
  release-pr:
    name: Release PR
    runs-on: ubuntu-latest
    permissions:
      contents: write
      pull-requests: write
    steps:
      - name: Checkout
        uses: actions/checkout@v4
        with:
          fetch-depth: 0

      - name: Install Rust toolchain
        uses: dtolnay/rust-toolchain@stable

      - name: Run release-plz
        uses: MarcoIeni/release-plz-action@v0.5
        with:
          command: release-pr
        env:
          # Use PAT instead of default GITHUB_TOKEN so:
          #   1. release-plz can create PRs (default token is blocked
          #      by the "Actions can't create PRs" policy), AND
          #   2. the Release PR it opens DOES trigger CI (PRs opened
          #      via GITHUB_TOKEN don't trigger downstream workflows).
          GITHUB_TOKEN: ${{ secrets.PERSONAL_ACCESS_TOKEN }}
          CARGO_REGISTRY_TOKEN: ${{ secrets.CARGO_REGISTRY_TOKEN }}

  # Publishes to crates.io + cuts the GitHub Release. No-ops if the current
  # main HEAD's version is already published (release-plz checks the
  # registry first).
  release:
    name: Publish
    runs-on: ubuntu-latest
    permissions:
      contents: write
    steps:
      - name: Checkout
        uses: actions/checkout@v4
        with:
          fetch-depth: 0

      - name: Install Rust toolchain
        uses: dtolnay/rust-toolchain@stable

      - name: Run release-plz
        uses: MarcoIeni/release-plz-action@v0.5
        with:
          command: release
        env:
          # Use PAT instead of default GITHUB_TOKEN so:
          #   1. release-plz can create PRs (default token is blocked
          #      by the "Actions can't create PRs" policy), AND
          #   2. the Release PR it opens DOES trigger CI (PRs opened
          #      via GITHUB_TOKEN don't trigger downstream workflows).
          GITHUB_TOKEN: ${{ secrets.PERSONAL_ACCESS_TOKEN }}
          CARGO_REGISTRY_TOKEN: ${{ secrets.CARGO_REGISTRY_TOKEN }}
