gitorii 0.7.2

A human-first Git client with simplified commands, snapshots, multi-platform mirrors and built-in secret scanning
name: Release

on:
  push:
    tags:
      # Stable: v1.2.3
      - 'v[0-9]+.[0-9]+.[0-9]+'
      # Pre-release: v1.2.3-rc.1, v1.2.3-beta.2, v1.2.3-alpha.5
      - 'v[0-9]+.[0-9]+.[0-9]+-[a-z]+.[0-9]+'

jobs:
  release:
    name: Create GitHub Release
    runs-on: ubuntu-latest
    permissions:
      contents: write
    steps:
      - name: Checkout
        uses: actions/checkout@v4

      - name: Detect prerelease
        id: prerelease
        run: |
          TAG="${GITHUB_REF_NAME}"
          if [[ "$TAG" =~ -(rc|beta|alpha)\. ]]; then
            echo "value=true" >> $GITHUB_OUTPUT
          else
            echo "value=false" >> $GITHUB_OUTPUT
          fi

      - name: Extract changelog for this version
        id: changelog
        run: |
          TAG="${GITHUB_REF_NAME#v}"
          NOTES=$(awk "/^## \[${TAG}\]/{found=1; next} found && /^## \[/{exit} found{print}" CHANGELOG.md)
          echo "notes<<EOF" >> $GITHUB_OUTPUT
          echo "$NOTES" >> $GITHUB_OUTPUT
          echo "EOF" >> $GITHUB_OUTPUT

      - name: Create GitHub Release
        uses: softprops/action-gh-release@v2
        with:
          name: "Torii ${{ github.ref_name }}"
          body: ${{ steps.changelog.outputs.notes }}
          draft: false
          prerelease: ${{ steps.prerelease.outputs.value }}

  publish-crates:
    name: Publish to crates.io
    runs-on: ubuntu-latest
    permissions:
      id-token: write
      contents: read
    steps:
      - name: Checkout
        uses: actions/checkout@v4

      - name: Install Rust
        # Pinned to 1.94.0 to avoid rustc 1.95.0's ICE in mono-item
        # partitioning that the russh→rsa-rc→crypto-bigint-rc chain
        # triggers. Keep in sync with `rust-toolchain.toml`.
        # TODO: revert to @stable once a fixed stable rustc lands.
        uses: dtolnay/rust-toolchain@1.94.0

      - name: Authenticate with crates.io
        uses: rust-lang/crates-io-auth-action@v1

      - name: Publish to crates.io
        # --locked respects the committed Cargo.lock so the verify-build
        # uses the exact dep graph that compiled locally. Extra stack
        # and reduced parallelism mirror the README "Known issue"
        # workarounds for the codegen-pressure path.
        run: cargo publish --locked
        env:
          CARGO_REGISTRY_TOKEN: ${{ env.CRATES_IO_TOKEN }}
          RUST_MIN_STACK: "16777216"
          CARGO_BUILD_JOBS: "2"