name: publish
on:
  push:
    tags:
      - v[0-9]+.[0-9]+.[0-9]+
      - v[0-9]+.[0-9]+.[0-9]+-[0-9]+
concurrency:
  group: ${{ github.workflow }}-${{ github.ref }}
  cancel-in-progress: true
jobs:
  validate:
    runs-on: ubuntu-latest
    permissions:
      contents: read
      id-token: write
    steps:
      - uses: actions/create-github-app-token@v3
        id: app
        with:
          app-id: ${{ vars.APP_ID }}
          private-key: ${{ secrets.PRIVATE_KEY }}
      - name: app user id
        run: echo "user-id=$(gh api "/users/${{ steps.app.outputs.app-slug }}[bot]" --jq .id)" >> "$GITHUB_OUTPUT"
        id: user-id
        env:
          GH_TOKEN: ${{ steps.app.outputs.token }}
      - name: creds
        run: |
          git config --global url.'https://x-access-token:${{ steps.app.outputs.token }}@github.com/'.insteadOf https://github.com/
          git config --global user.name '${{ steps.app.outputs.app-slug }}[bot]'
          git config --global user.email '${{ steps.user-id.outputs.user-id }}+${{ steps.app.outputs.app-slug }}[bot]@users.noreply.github.com'
      - uses: actions/checkout@v6
        with:
          token: ${{ steps.app.outputs.token }}
          ref: ${{ github.event.repository.default_branch }}
          persist-credentials: false
      - uses: DeterminateSystems/determinate-nix-action@main
      - uses: DeterminateSystems/flakehub-cache-action@main
      - name: build
        run: nix build
      - name: bump
        run: nix develop -c 'bash' -c "cargo set-version '${GITHUB_REF_NAME#v}'"
      - name: push
        run: |
          git add Cargo.{toml,lock}
          git commit -m $'chore: bump version to ${{ github.ref_name }}\n[skip ci]'
          git push
  crates:
    needs: validate
    runs-on: ubuntu-latest
    environment: publish
    permissions:
      contents: read
      id-token: write
    steps:
      - uses: actions/checkout@v6
        with:
          ref: ${{ github.event.repository.default_branch }}
      - id: auth
        uses: rust-lang/crates-io-auth-action@v1
      - uses: DeterminateSystems/determinate-nix-action@main
      - uses: DeterminateSystems/flakehub-cache-action@main
      - run: nix develop -c 'bash' -c 'cargo publish'
        env:
          CARGO_REGISTRY_TOKEN: ${{ steps.auth.outputs.token }}
  fh:
    needs: validate
    runs-on: ubuntu-latest
    permissions:
      contents: read
      id-token: write
    steps:
      - uses: actions/checkout@v6
      - uses: DeterminateSystems/determinate-nix-action@main
      - uses: DeterminateSystems/flakehub-push@main
        with:
          visibility: public
          name: molarmanful/euphrates
          tag: ${{ github.ref_name }}
          include-output-paths: true
