on:
  push:
    tags:
      - "*"

name: Publish to Crates.io

jobs:
  audit:
    name: Cargo audit
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - uses: actions-rust-lang/audit@v1

  build-and-test-linux:
    name: Build and Test (Linux/stable)
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - uses: dtolnay/rust-toolchain@stable

      - uses: taiki-e/install-action@nextest
      - name: 'Build and test'
        run: cargo nextest run --workspace --all-features

  publish-crates-io:
    name: Publish to Crates.io
    runs-on: ubuntu-latest
    needs:
      - audit
      - build-and-test-linux

    steps:
      - uses: actions/checkout@v4
      - uses: dtolnay/rust-toolchain@stable

      - name: retrieve cargo-release from cache
        id: cargo_release_cache
        uses: actions/cache@v4
        with:
          path: ~/.cargo/bin/cargo-release
          key: ${{ runner.os }}-cargo-release

      - name: cargo install release
        if: steps.cargo_release_cache.outputs.cache-hit != 'true'
        run: cargo install cargo-release

      - name: cargo login
        run: cargo login ${{ secrets.CRATES_IO_API_TOKEN }}

      - name: cargo release
        run: |
          cargo release \
            publish \
            --workspace \
            --all-features \
            --allow-branch HEAD \
            --no-confirm \
            --no-verify \
            --execute