name: Publish

on:
  release:
    types: [ published ]

jobs:
  publish:
    runs-on: ubuntu-latest
    permissions:
      contents: read
      id-token: write
    if: startsWith(github.event.release.tag_name, 'v')
    steps:
      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7

      - uses: dtolnay/rust-toolchain@stable

      - name: Parse version from tag
        run: |
          TAG="${{ github.event.release.tag_name }}"
          VERSION="${TAG#v}"
          echo "TAG_VERSION=$VERSION" >> $GITHUB_ENV

      - name: Check version matches Cargo.toml
        run: |
          CARGO_VERSION=$(cargo metadata --no-deps --format-version 1 | jq -r '.packages[0].version')
          if [ "$TAG_VERSION" != "$CARGO_VERSION" ]; then
            echo "Tag v$TAG_VERSION does not match Cargo.toml version $CARGO_VERSION"
            exit 1
          fi

      - name: Run tests
        run: cargo test

      - name: Dry run publish
        run: cargo publish --dry-run

      - name: Publish to crates.io
        run: cargo publish
        env:
          CARGO_REGISTRY_TOKEN: ${{ secrets.CRATES_IO_TOKEN }}