name: Publish

on:
  push:
    tags:
      - 'v*'

jobs:
  publish:
    runs-on: ubuntu-latest
    environment: crates-io
    permissions:
      id-token: write
      contents: read
    steps:
      - uses: actions/checkout@v6

      - name: Install Rust
        uses: dtolnay/rust-toolchain@stable

      - name: Verify version matches tag
        run: |
          TAG="${GITHUB_REF#refs/tags/v}"
          CARGO_VERSION=$(cargo metadata --no-deps --format-version 1 | jq -r '.packages[0].version')
          if [ "$TAG" != "$CARGO_VERSION" ]; then
            echo "Tag v$TAG does not match Cargo.toml version $CARGO_VERSION"
            exit 1
          fi

      - name: Run tests
        run: cargo test

      - name: Dry run
        run: cargo publish --dry-run

      - name: cargo-semver-checks
        uses: obi1kenobi/cargo-semver-checks-action@v2

      - name: Authenticate (OIDC trusted publishing)
        # Pin to a specific tag: rust-lang/crates-io-auth-action does not
        # publish a sliding `v1` major tag, so `@v1` resolves to v1.0.0
        # (Node 20). v1.0.4 uses Node 24 and avoids the deprecation
        # warning enforced June 2026.
        uses: rust-lang/crates-io-auth-action@v1.0.4
        id: auth

      - name: Publish
        run: cargo publish
        env:
          CARGO_REGISTRY_TOKEN: ${{ steps.auth.outputs.token }}
