cap_access 0.3.0

name: Release

on:
  push:
    tags:
      - 'v*.*.*'
      - 'v*.*.*-pre.*'

permissions:
  contents: write

jobs:
  check:
    uses: ./.github/workflows/check.yml

  test:
    uses: ./.github/workflows/test.yml

  create-release:
    name: Create GitHub Release
    runs-on: ubuntu-latest
    needs: [check, test]

    steps:
      - name: Checkout code
        uses: actions/checkout@v4
        with:
          fetch-depth: 0

      - name: Validate tag is on main branch
        shell: bash
        run: |
          set -e

          TAG="${{ github.ref_name }}"
          TAG_COMMIT=$(git rev-list -n 1 "$TAG")

          git fetch origin main

          MAIN_HEAD=$(git rev-parse origin/main)

          echo "Tag:        $TAG"
          echo "Tag commit: $TAG_COMMIT"
          echo "main HEAD:  $MAIN_HEAD"

          if [ "$TAG_COMMIT" != "$MAIN_HEAD" ]; then
            echo "❌ release tag must be created from main HEAD"
            exit 1
          fi
          echo "✅ release tag validated on main"

      - name: Validate version consistency
        shell: bash
        run: |
          set -e

          TAG="${{ github.ref_name }}"
          # Remove 'v' prefix from tag
          TAG_VERSION="${TAG#v}"

          # Get version from Cargo.toml
          CARGO_VERSION=$(grep '^version' Cargo.toml | head -1 | sed 's/.*"\(.*\)".*/\1/')

          echo "Tag version:   $TAG_VERSION"
          echo "Cargo version: $CARGO_VERSION"

          if [ "$TAG_VERSION" != "$CARGO_VERSION" ]; then
            echo "❌ Tag version ($TAG_VERSION) does not match Cargo.toml version ($CARGO_VERSION)"
            exit 1
          fi
          echo "✅ Version consistency validated"

      - name: Create GitHub Release
        uses: softprops/action-gh-release@v2
        with:
          draft: false
          prerelease: ${{ contains(github.ref_name, '-pre.') }}
          body: |
            ## ${{ github.ref_name }}

            - [Documentation](https://docs.rs/cap_access)
            - [crates.io](https://crates.io/crates/cap_access)
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}

  publish-crates:
    name: Publish to crates.io
    runs-on: ubuntu-latest
    needs: [check, test]

    steps:
      - name: Checkout code
        uses: actions/checkout@v4
        with:
          fetch-depth: 0

      - name: Validate tag is on main branch
        shell: bash
        run: |
          set -e

          TAG="${{ github.ref_name }}"
          TAG_COMMIT=$(git rev-list -n 1 "$TAG")

          git fetch origin main

          MAIN_HEAD=$(git rev-parse origin/main)

          echo "Tag:        $TAG"
          echo "Tag commit: $TAG_COMMIT"
          echo "main HEAD:  $MAIN_HEAD"

          if [ "$TAG_COMMIT" != "$MAIN_HEAD" ]; then
            echo "❌ release tag must be created from main HEAD"
            exit 1
          fi
          echo "✅ release tag validated on main"

      - name: Validate version consistency
        shell: bash
        run: |
          set -e

          TAG="${{ github.ref_name }}"
          # Remove 'v' prefix from tag
          TAG_VERSION="${TAG#v}"

          # Get version from Cargo.toml
          CARGO_VERSION=$(grep '^version' Cargo.toml | head -1 | sed 's/.*"\(.*\)".*/\1/')

          echo "Tag version:   $TAG_VERSION"
          echo "Cargo version: $CARGO_VERSION"

          if [ "$TAG_VERSION" != "$CARGO_VERSION" ]; then
            echo "❌ Tag version ($TAG_VERSION) does not match Cargo.toml version ($CARGO_VERSION)"
            exit 1
          fi
          echo "✅ Version consistency validated"

      - name: Install Rust toolchain
        uses: dtolnay/rust-toolchain@nightly

      - name: Publish to crates.io
        run: cargo publish --token ${{ secrets.CARGO_REGISTRY_TOKEN }}