name: Publish to crates.io

# Publish the crate. Triggered two ways:
#   * `workflow_call` from auto-release.yml on a version bump (automated path).
#     That commit already passed lint/test before landing on main (via
#     cut-release.yml's `needs: [version, lint, test]` gate and/or PR branch
#     protection), so re-running here would be redundant — skipped below.
#   * a manual `v*` tag push (escape hatch for hotfixes cut by hand). Unlike
#     the automated path, this can tag *any* commit, verified or not, so this
#     is where the gap was (see #260): publish ran without ever checking
#     cargo test/fmt/clippy. Fixed by calling lint.yml/test.yml (already
#     workflow_call-callable) and gating `publish` on them via `needs:`.

on:
  push:
    tags:
      - 'v*'
  workflow_call:
    inputs:
      tag:
        description: Tag to publish (e.g. v0.14.0)
        required: true
        type: string

# Restrict the default GITHUB_TOKEN to read-only; this workflow only checks
# out the repo to build and publish to crates.io (via CARGO_REGISTRY_TOKEN,
# a separate secret) — it never pushes back to GitHub.
permissions:
  contents: read

jobs:
  # Gate for the manual `push: tags` escape hatch only — see #260. Skipped
  # entirely on the `workflow_call` path since that commit is already verified
  # (see header comment above).
  lint:
    name: Lint tagged commit
    if: github.event_name == 'push'
    uses: ./.github/workflows/lint.yml

  test:
    name: Test tagged commit
    if: github.event_name == 'push'
    uses: ./.github/workflows/test.yml

  publish:
    name: Publish
    needs: [lint, test]
    # Run if lint/test passed (push path) or were skipped (workflow_call path).
    # Do NOT use the default `success()` here: a skipped need would otherwise
    # make this job skip too.
    if: always() && (needs.lint.result == 'success' || needs.lint.result == 'skipped') && (needs.test.result == 'success' || needs.test.result == 'skipped')
    runs-on: ubuntu-latest
    permissions:
      id-token: write # required for crates.io Trusted Publishing (OIDC)
      contents: read
    env:
      TAG: ${{ inputs.tag || github.ref_name }}
    steps:
      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0

      - name: Install Rust
        uses: dtolnay/rust-toolchain@e97e2d8cc328f1b50210efc529dca0028893a2d9 # v1
        with:
          toolchain: stable
          targets: wasm32-unknown-unknown

      - name: Cache cargo registry (registry only, not target)
        uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
        with:
          path: |
            ~/.cargo/registry
            ~/.cargo/git
          key: ${{ runner.os }}-cargo-${{ hashFiles('**/Cargo.lock') }}
          restore-keys: ${{ runner.os }}-cargo-

      - name: Install trunk
        run: cargo install --locked trunk

      - name: Build UI
        run: cargo check
        # Runs build.rs fresh (no target cache) → trunk inlines Yew UI → writes prebuilt.html
        # at the package root (not ui/): ui/ is a separate workspace member and
        # cargo publish strips it from the moadim tarball.

      - name: Verify prebuilt UI was generated
        run: test -s prebuilt.html || (echo "prebuilt.html missing or empty" && exit 1)

      - name: Verify prebuilt UI ships in the published tarball
        run: cargo package --list --allow-dirty | grep -qx prebuilt.html || (echo "prebuilt.html not in package tarball" && exit 1)

      - name: Commit prebuilt UI so cargo publish includes it
        run: |
          git config user.email "actions@github.com"
          git config user.name "GitHub Actions"
          git add prebuilt.html
          git commit -m "ci: bundle prebuilt UI"

      - name: Verify tag matches Cargo.toml version
        run: |
          CARGO_VERSION=$(grep '^version' Cargo.toml | head -1 | sed 's/version = "\(.*\)"/\1/')
          TAG_VERSION=${TAG#v}
          if [ "$CARGO_VERSION" != "$TAG_VERSION" ]; then
            echo "Version mismatch: Cargo.toml=$CARGO_VERSION, tag=$TAG_VERSION"
            exit 1
          fi

      - name: Authenticate with crates.io (Trusted Publishing)
        uses: rust-lang/crates-io-auth-action@c6f97d42243bad5fab37ca0427f495c86d5b1a18 # v1.0.5
        id: auth

      - name: Publish
        run: cargo publish --allow-dirty
        env:
          CARGO_REGISTRY_TOKEN: ${{ steps.auth.outputs.token }}
