name: Publish
on:
  # Trigger this workflow when a tag is pushed in the format `v1.2.3`.
  push:
    tags:
      # Pattern syntax: https://docs.github.com/en/actions/using-workflows/workflow-syntax-for-github-actions#filter-pattern-cheat-sheet
      - "v[0-9]*.[0-9]*.[0-9]*"
  # Trigger this workflow manually via workflow dispatch.
  workflow_dispatch:
    inputs:
      version:
        description: 'Version number in the format `v1.2.3`'
        required: true
        type: string
jobs:
  audit:
    name: Audit
    timeout-minutes: 10
    steps:
      - uses: actions/checkout@v5
      - uses: actions-rust-lang/audit@v1
        with:
          token: ${{ secrets.GITHUB_TOKEN }}
  crates_io_publish:
    name: Publish (crates.io)
    needs:
      - audit
    runs-on: ubuntu-latest
    timeout-minutes: 25
    env:
      SCCACHE_GHA_ENABLED: "true"
      RUSTC_WRAPPER: "sccache"
    steps:
      - uses: actions/checkout@v5
      - uses: dtolnay/rust-toolchain@stable
        with:
          toolchain: stable
          components: clippy, rustfmt
      - name: Run sccache-cache
        uses: mozilla-actions/sccache-action@v0.0.9
      - name: cargo-release Cache
        id: cargo_release_cache
        uses: actions/cache@v4
        with:
          path: ~/.cargo/bin/cargo-release
          key: ${{ runner.os }}-cargo-release
      - run: cargo install cargo-release
        if: steps.cargo_release_cache.outputs.cache-hit != 'true'
      - name: cargo login
        run: cargo login ${{ secrets.CRATES_IO_API_TOKEN }}
      # Publishing is currently messy, because:
      #
      # * `peace_rt_model_core` exports `NativeError` or `WebError` depending on the target.
      # * `peace_rt_model_web` fails to build when publishing the workspace for a native target.
      # * `peace_rt_model_web` still needs its dependencies to be published before it can be
      #    published.
      # * `peace_rt_model_hack` needs `peace_rt_model_web` to be published before it can be
      #    published.
      #
      # We *could* pass through `--no-verify` so `cargo` doesn't build the crate before publishing,
      # which is reasonable, since this job only runs after the Linux, Windows, and WASM builds
      # have passed.
      - name: "cargo release publish"
        # allow-branch HEAD is because GitHub actions switches
        # to the tag while building, which is a detached head

        run: |
          cargo release publish --workspace --all-features --allow-branch HEAD --no-confirm --no-verify --execute