noxssh 0.1.11

Lightweight SSH-2 client in Rust using NoxTLS cryptographic primitives.
name: Publish Crate

# Tag push `v*`: runs real `cargo publish` (publish job only; verify is skipped because event is `push`).
# workflow_dispatch: dry-run by default; set `publish_to_crates_io` to true to run real publish from the selected ref.
# pull_request: dry-run only.
on:
  workflow_dispatch:
    inputs:
      publish_to_crates_io:
        description: "If true, run cargo publish (requires CARGO_REGISTRY_TOKEN). If false, dry-run only."
        type: boolean
        default: false
  pull_request:
  push:
    tags:
      - "v*"

permissions:
  contents: read

jobs:
  verify-publish:
    name: Verify publish (dry-run)
    # Skipped on tag pushes: those only run the real publish job below.
    if: github.event_name != 'push'
    runs-on: ubuntu-latest
    steps:
      - name: Checkout
        uses: actions/checkout@v4

      - name: Setup Rust
        uses: dtolnay/rust-toolchain@stable

      - name: Cargo package check
        run: cargo package

      - name: Cargo publish dry-run
        run: cargo publish --locked --dry-run

  publish:
    name: Publish to crates.io
    # Runs on version tags, OR manual workflow with publish flag (branch ref is not refs/tags/v*).
    if: |
      (github.event_name == 'push' && startsWith(github.ref, 'refs/tags/v')) ||
      (github.event_name == 'workflow_dispatch' && github.event.inputs.publish_to_crates_io == 'true')
    runs-on: ubuntu-latest
    steps:
      - name: Checkout
        uses: actions/checkout@v4

      - name: Setup Rust
        uses: dtolnay/rust-toolchain@stable

      - name: Cargo package check
        run: cargo package

      - name: Publish crate
        env:
          CARGO_REGISTRY_TOKEN: ${{ secrets.CARGO_REGISTRY_TOKEN }}
        run: cargo publish --locked