uninum 0.1.1

name: Release

on:
  push:
    tags:
      - '0.*'

permissions:
  contents: read

concurrency:
  group: release-${{ github.ref }}
  cancel-in-progress: true

jobs:
  check:
    name: Lint and test
    runs-on: ubuntu-latest
    steps:
      - name: Checkout
        uses: actions/checkout@v4
        with:
          fetch-depth: 0

      - name: Install toolchain
        uses: dtolnay/rust-toolchain@stable
        with:
          components: rustfmt, clippy

      - name: fmt
        run: cargo fmt -- --check

      - name: clippy
        run: cargo clippy --all-features --all-targets --locked -- -D warnings

      - name: test
        run: cargo test --all-features --locked

  publish:
    name: Publish to crates.io
    runs-on: ubuntu-latest
    needs: check
    environment: crates-io-release
    steps:
      - name: Checkout
        uses: actions/checkout@v4
        with:
          fetch-depth: 0

      - name: Ensure tag commit is on main
        run: |
          git fetch origin main --quiet
          TAG_COMMIT=$(git rev-parse "$GITHUB_SHA")
          MAIN_COMMIT=$(git rev-parse origin/main)
          if [ "$TAG_COMMIT" != "$MAIN_COMMIT" ]; then
            echo "Tag must point to the HEAD of origin/main"
            exit 1
          fi

      - name: Install toolchain
        uses: dtolnay/rust-toolchain@stable
        with:
          components: rustfmt, clippy

      - name: Verify tag matches crate version
        run: |
          TAG="${GITHUB_REF_NAME#v}"
          CRATE_VERSION=$(cargo metadata --locked --no-deps --format-version 1 | jq -r '.packages[] | select(.name=="uninum").version')
          if [ "$TAG" != "$CRATE_VERSION" ]; then
            echo "Tag $TAG does not match crate version $CRATE_VERSION"
            exit 1
          fi

      - name: Dry-run publish (checks package contents)
        run: cargo publish --locked --dry-run

      - name: Publish
        env:
          CARGO_REGISTRY_TOKEN: ${{ secrets.CRATES_IO_TOKEN }}
        run: cargo publish --locked