antlr-rust-runtime 0.21.0

name: Publish Crate

on:
  release:
    types:
      - published

concurrency:
  group: ${{ github.workflow }}
  cancel-in-progress: false

permissions:
  contents: read
  id-token: write

env:
  CARGO_TERM_COLOR: always

jobs:
  publish:
    name: Publish to crates.io
    runs-on: ubuntu-latest
    environment: release

    steps:
      - name: Checkout release tag
        uses: actions/checkout@v7
        with:
          fetch-depth: 0
          ref: ${{ github.event.release.tag_name }}

      - name: Install stable Rust
        run: |
          rustup toolchain install stable --profile minimal --no-self-update
          rustup default stable

      - name: Verify release metadata
        env:
          TAG: ${{ github.event.release.tag_name }}
        run: |
          if [[ "$TAG" != v* ]]; then
            echo "::error::Release tag ${TAG} must start with v." >&2
            exit 1
          fi

          VERSION="${TAG#v}"
          PACKAGE_VERSION="$(
            cargo metadata --no-deps --format-version 1 |
              jq -er '.packages[] | select(.name == "antlr-rust-runtime") | .version'
          )"
          if [[ "$PACKAGE_VERSION" != "$VERSION" ]]; then
            echo "::error::Release tag ${TAG} does not match Cargo.toml version ${PACKAGE_VERSION}." >&2
            exit 1
          fi

          TAG_SHA="$(git rev-parse "${TAG}^{commit}")"
          HEAD_SHA="$(git rev-parse HEAD)"
          if [[ "$TAG_SHA" != "$HEAD_SHA" ]]; then
            echo "::error::Checked out ${HEAD_SHA}, but ${TAG} resolves to ${TAG_SHA}." >&2
            exit 1
          fi

      - name: Verify package
        run: cargo publish --dry-run --locked

      - name: Authenticate with crates.io
        id: auth
        uses: rust-lang/crates-io-auth-action@v1.0.5

      - name: Publish to crates.io
        run: cargo publish --locked
        env:
          CARGO_REGISTRY_TOKEN: ${{ steps.auth.outputs.token }}