name: Publish Crate

on:
  workflow_call:
    inputs:
      tag:
        required: true
        type: string

permissions:
  id-token: write
  contents: read

jobs:
  publish-crate:
    runs-on: ubuntu-latest
    environment: release
    steps:
      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
        with:
          ref: ${{ inputs.tag }}
          persist-credentials: false
      - uses: dtolnay/rust-toolchain@3c5f7ea28cd621ae0bf5283f0e981fb97b8a7af9 # master (2026-03-27)
        with:
          toolchain: stable
      - name: Authenticate with crates.io
        uses: rust-lang/crates-io-auth-action@bbd81622f20ce9e2dd9622e3218b975523e45bbe # v1.0.4
        id: auth
      - name: Publish crate
        run: cargo publish --no-verify
        env:
          CARGO_REGISTRY_TOKEN: ${{ steps.auth.outputs.token }}
