name: Publish

on:
  release:
    types: [ published ]

jobs:
  publish:
    runs-on: ubuntu-latest
    permissions:
      contents: read
      id-token: write
    if: startsWith(github.event.release.tag_name, 'v')
    steps:
      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7

      - uses: dtolnay/rust-toolchain@stable

      - name: Check version matches tag
        run: |
          TAG="${{ github.event.release.tag_name }}"
          VERSION="${TAG#v}"
          CARGO_VERSION=$(cargo metadata --no-deps --format-version 1 | jq -r '.packages[0].version')
          if [ "$VERSION" != "$CARGO_VERSION" ]; then
            echo "Tag v$VERSION does not match Cargo.toml version $CARGO_VERSION"
            exit 1
          fi

      - name: Run tests
        run: cargo test

      - name: Authenticate with crates.io
        id: auth
        uses: rust-lang/crates-io-auth-action@v1

      - name: Publish to crates.io
        run: cargo publish
        env:
          CARGO_REGISTRY_TOKEN: ${{ steps.auth.outputs.token }}