name: release-2-cargo-publish

permissions:
  contents: write
  id-token: write
  attestations: write

on:
  workflow_dispatch:
    inputs:
      ref:
        description: "The ref (branch or SHA) to process"
        required: false
        type: string
        default: "latest"
      update-main:
        description: "Should the branch `main` be updated?"
        required: false
        type: boolean
        default: true
      extra-args:
        description: "Extra args to be used with cargo publish e.g. --no-verify"
        type: string
        required: false
        default: ""
      skip_latest:
        description: "skip_latest: Tag latest will be pushed unless skip_latest=true"
        required: true
        type: boolean
        default: false

defaults:
  run:
    shell: bash -xe {0}

jobs:
  cargo-publish:
    runs-on: ubuntu-24.04
    steps:
      - uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8
        with:
          ref: ${{ github.event.inputs.ref }} # Use the ref if provided, otherwise defaults to the current branch/commit
          fetch-depth: 0

      - uses: nixbuild/nix-quick-install-action@2c9db80fb984ceb1bcaa77cdda3fdf8cfba92035
        with:
          github_access_token: ${{ secrets.GITHUB_TOKEN }}

      - name: Configure git before push
        run: |
          git config user.name "github-actions[bot]"
          git config user.email "github-actions[bot]@users.noreply.github.com"

      - name: Run cargo publish
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
          CARGO_REGISTRY_TOKEN: ${{ secrets.CRATES_TOKEN }}
        run: |
          nix develop --command ./scripts/cargo-publish-workspace.sh --locked ${{ github.event.inputs.extra-args }}

      - name: Update `main` branch
        if: ${{ github.event.inputs.update-main }}
        run: |
          git push origin HEAD:main

  call_child:
    needs: cargo-publish
    uses: ./.github/workflows/release-3-create-github-release.yml
    secrets: inherit
    with:
      skip_latest: "${{inputs.skip_latest}}"
