publish.yml

name: Publish

on:
  release:
    types: [published]
  workflow_dispatch:
    inputs:
      tag:
        description: 'Release tag to publish'
        required: true

permissions:
  contents: read
  id-token: write

jobs:
  crates-io:
    name: crates.io
    # The site releases as `site@2026.8.18` and has nothing to publish here.
    # Without this, every site release fired this workflow against server
    # artefacts and failed.
    if: startsWith(github.event.release.tag_name, 'v') || github.event_name == 'workflow_dispatch'
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
        with:
          ref: ${{ inputs.tag || github.event.release.tag_name }}
          persist-credentials: false

      - uses: dtolnay/rust-toolchain@89b12181fb390509a0842a86cc55eeb8eb928c1d # stable

      # Mints a 30-minute crates.io token from this run's OIDC identity. Both
      # crates carry a Trusted Publishing config naming this repository and this
      # workflow filename, and one exchange covers both.
      - uses: rust-lang/crates-io-auth-action@c6f97d42243bad5fab37ca0427f495c86d5b1a18 # v1.0.5
        id: crates-io-auth

      - name: Publish
        env:
          CARGO_REGISTRY_TOKEN: ${{ steps.crates-io-auth.outputs.token }}
        run: |
          set -euo pipefail

          publish() {
            version=$(cargo metadata --no-deps --format-version 1 | jq -r --arg crate "$1" '.packages[] | select(.name == $crate) | .version')
            if curl -fsS -A lfsx-publish -o /dev/null "https://crates.io/api/v1/crates/$1/$version"; then
              echo "$1 $version is already on crates.io, skipping"
            else
              cargo publish -p "$1"
            fi
          }

          publish lfsx-server
          publish lfsx