name: Publish

# Publishes to crates.io on a version tag push (e.g. `v0.1.1`).
# Auth uses a crates.io API token stored as the CARGO_REGISTRY_TOKEN secret.
# One-time setup: crates.io → Account Settings → API Tokens → create a token
# scoped to publish, then add it in GitHub → repo Settings → Secrets and
# variables → Actions → New repository secret named CARGO_REGISTRY_TOKEN.

on:
  push:
    tags:
      - "v*"

env:
  CARGO_TERM_COLOR: always

jobs:
  verify:
    # macOS: the apple-native keychain and LocalAuthentication paths only
    # compile there, so the crate is built and verified on macOS. Touch ID /
    # live-server tests are #[ignore]d, so this suite needs no prompts/network.
    runs-on: macos-latest
    steps:
      - uses: actions/checkout@v7
      - uses: dtolnay/rust-toolchain@stable
        with:
          components: rustfmt, clippy
      - uses: Swatinem/rust-cache@v2
      - name: Verify tag matches Cargo.toml version
        run: |
          version=$(cargo metadata --no-deps --format-version=1 | jq -r '.packages[0].version')
          tag="${GITHUB_REF_NAME#v}"
          echo "Cargo.toml version: $version | tag: $tag"
          if [ "$version" != "$tag" ]; then
            echo "::error::tag $GITHUB_REF_NAME does not match Cargo.toml version $version"
            exit 1
          fi
      - name: Format
        run: cargo fmt --check
      - name: Clippy
        run: cargo clippy --locked --all-targets -- -D warnings
      - name: Test
        run: cargo test --locked
      - name: Build (release)
        run: cargo build --locked --release

  publish:
    needs: verify
    runs-on: macos-latest
    steps:
      - uses: actions/checkout@v7
      - uses: dtolnay/rust-toolchain@stable
      - uses: Swatinem/rust-cache@v2
      - name: Publish
        run: cargo publish --locked
        env:
          CARGO_REGISTRY_TOKEN: ${{ secrets.CARGO_REGISTRY_TOKEN }}
