bsv-tracker 0.2.1

A transaction evidence state machine with host supplied headers, proofs, hints and time
Documentation
name: release

# Publishes to crates.io from a tag, through trusted publishing (OIDC). No
# token is stored anywhere; nothing publishes from a laptop. See RELEASING.md.
on:
  push:
    tags: ['v*']

permissions:
  contents: read

env:
  CARGO_TERM_COLOR: always

defaults:
  run:
    shell: bash

jobs:
  tag:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0
        with:
          fetch-depth: 0

      - name: The tag equals the manifest version
        run: |
          version=$(cargo metadata --locked --no-deps --format-version 1 | jq -r '.packages[0].version')
          if [ "$GITHUB_REF_NAME" != "v$version" ]; then
            echo "::error::tag $GITHUB_REF_NAME does not match Cargo.toml version $version"
            exit 1
          fi

      # Tags are outside branch protection; refuse one that main does not hold.
      - name: The tagged commit is on main
        run: git merge-base --is-ancestor "$GITHUB_SHA" origin/main

  ci:
    needs: tag
    uses: ./.github/workflows/ci.yml

  publish:
    needs: [tag, ci]
    runs-on: ubuntu-latest
    permissions:
      id-token: write
      contents: read
    steps:
      - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0

      - name: Install Rust
        uses: dtolnay/rust-toolchain@e2a55d2ffb04f378e9626c28d38b36d230d1e12f # master
        with:
          toolchain: stable

      - name: Dry run
        run: cargo publish --locked --dry-run

      - name: Authenticate to crates.io
        id: auth
        uses: rust-lang/crates-io-auth-action@c6f97d42243bad5fab37ca0427f495c86d5b1a18 # v1.0.5

      - name: Publish
        run: cargo publish --locked
        env:
          CARGO_REGISTRY_TOKEN: ${{ steps.auth.outputs.token }}