name: publish

on:
  workflow_dispatch:
    inputs:
      confirm:
        description: "Type 'publish' to publish to crates.io"
        required: true
        default: "dry-run"

permissions:
  contents: read
  id-token: write

env:
  CARGO_TERM_COLOR: always

jobs:
  publish:
    runs-on: ubuntu-latest
    steps:
      - name: Guard
        run: |
          if [ "${{ inputs.confirm }}" != "publish" ]; then
            echo "Refusing to publish: set workflow input confirm=publish"
            exit 1
          fi

      - uses: actions/checkout@v6
      - uses: dtolnay/rust-toolchain@stable
      - uses: Swatinem/rust-cache@v2

      - name: cargo-semver-checks
        uses: obi1kenobi/cargo-semver-checks-action@v2

      - name: Authenticate (Trusted Publishing)
        id: auth
        uses: rust-lang/crates-io-auth-action@v1

      - name: cargo publish (fynch)
        env:
          CARGO_REGISTRY_TOKEN: ${{ steps.auth.outputs.token }}
        run: cargo publish
