name: Release-plz

on:
  push:
    branches: [master]

permissions:
  # Open/update the release PR and create GitHub Releases.
  contents: write
  pull-requests: write

# Don't run two release-plz jobs in parallel.
concurrency:
  group: release-plz-${{ github.ref }}
  cancel-in-progress: false

jobs:
  release-plz-release:
    name: Release-plz release
    runs-on: ubuntu-latest
    steps:
      # `token:` is the RELEASE_PLZ_TOKEN (a user PAT / fine-grained token)
      # so that:
      #   1. release-plz can push the release tag and the GitHub Release,
      #   2. those push/release events actually trigger downstream workflows.
      # GitHub suppresses workflow triggers for events created by the default
      # GITHUB_TOKEN (anti-recursion); a user-owned PAT is not subject to that
      # rule, so `release-binaries.yml` (`on: release: types: [published]`)
      # fires on its own and we don't need an explicit `gh workflow run` chain.
      - name: Checkout
        uses: actions/checkout@v6
        with:
          fetch-depth: 0
          token: ${{ secrets.RELEASE_PLZ_TOKEN }}

      - name: Install Rust
        uses: dtolnay/rust-toolchain@stable

      # release-plz runs `cargo publish` which compiles the crate against
      # all default features (including `pam` on Linux). The `pam-client2`
      # dep links libpam, so we need the dev package available.
      - name: Install libpam
        run: sudo apt-get update && sudo apt-get install -y libpam0g-dev

      - name: Run release-plz
        uses: release-plz/action@v0.5
        with:
          command: release
        env:
          GITHUB_TOKEN: ${{ secrets.RELEASE_PLZ_TOKEN }}
          CARGO_REGISTRY_TOKEN: ${{ secrets.CARGO_REGISTRY_TOKEN }}

  release-plz-pr:
    name: Release-plz PR
    runs-on: ubuntu-latest
    steps:
      # See the matching note in the `release-plz-release` job above —
      # using the PAT here means the release-PR's branch pushes trigger
      # CI on the PR (the default GITHUB_TOKEN would suppress them).
      - name: Checkout
        uses: actions/checkout@v6
        with:
          fetch-depth: 0
          token: ${{ secrets.RELEASE_PLZ_TOKEN }}

      - name: Install Rust
        uses: dtolnay/rust-toolchain@stable

      # See the matching note in the `release-plz-release` job above —
      # libpam is needed for the `cargo publish`-style preflight build.
      - name: Install libpam
        run: sudo apt-get update && sudo apt-get install -y libpam0g-dev

      - name: Run release-plz
        uses: release-plz/action@v0.5
        with:
          command: release-pr
        env:
          GITHUB_TOKEN: ${{ secrets.RELEASE_PLZ_TOKEN }}
