1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
name: Release
on:
push:
branches:
# Recovery path: when the automatic publish below fails AFTER release-please
# has already cut a GH Release + tag, re-running the workflow does NOT help —
# release-please-action only sets release_created=true on the run that
# actually creates the release, so reruns skip both ci and publish.
#
# Trigger via GH UI: Actions → Release → Run workflow → tag=tkach-vX.Y.Z.
workflow_dispatch:
inputs:
tag:
description: 'Existing release tag to publish to crates.io (e.g. tkach-v0.4.1). Use only when the automatic publish failed after the tag was created.'
required: true
permissions:
contents: write
pull-requests: write
# security-events: write is required so the ci-checks reusable can upload
# clippy SARIF when called as the publish gate.
security-events: write
jobs:
release-please:
name: Release Please
if: github.event_name == 'push'
runs-on: ubuntu-latest
outputs:
release_created: ${{ steps.release.outputs.release_created }}
tag_name: ${{ steps.release.outputs.tag_name }}
steps:
- uses: googleapis/release-please-action@v4
id: release
ci:
name: CI Checks
needs: release-please
if: ${{ needs.release-please.outputs.release_created }}
uses: ./.github/workflows/ci-checks.yml
permissions:
contents: read
security-events: write
secrets: inherit
publish:
name: Publish to crates.io
needs:
if: ${{ needs.release-please.outputs.release_created }}
runs-on: ubuntu-latest
steps:
- uses: actions/checkout@v4
- uses: dtolnay/rust-toolchain@stable
- uses: Swatinem/rust-cache@v2
# The token is a scoped, publish-update-only crates.io API token for
# crate `tkach`. Stored as repo secret CARGO_REGISTRY_TOKEN.
- name: cargo publish
run: cargo publish --token ${{ secrets.CARGO_REGISTRY_TOKEN }}
publish-manual:
name: Manual republish (recovery)
if: github.event_name == 'workflow_dispatch'
runs-on: ubuntu-latest
steps:
# Checks out the tag the user typed into the Run-workflow form, then
# publishes that exact commit. The tag has already passed CI as part
# of the original (failed) auto-run, so we don't re-run the suite —
# this path exists specifically for "publish step alone misfired".
- uses: actions/checkout@v4
with:
ref: ${{ inputs.tag }}
- uses: dtolnay/rust-toolchain@stable
- uses: Swatinem/rust-cache@v2
- name: cargo publish
run: cargo publish --token ${{ secrets.CARGO_REGISTRY_TOKEN }}