release-rust.yml

# release-rust — publish rust/ to crates.io on a `rust/v*` tag, via crates.io
# Trusted Publishing (OIDC): configure the publisher once on crates.io for the
# `chtypes` crate (repo Wave-RF/chtypes, workflow release-rust.yml).
name: release-rust
on:
  push:
    tags: ["rust/v*"]
permissions:
  contents: read
jobs:
  publish:
    runs-on: ubuntu-latest
    environment: crates-io
    permissions:
      id-token: write
      contents: read
    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
      - uses: dtolnay/rust-toolchain@6bed0761d98439e5a578e2877258200ad565ba87 # stable branch
      - name: the tag and the crate agree on the version
        run: |
          tag="${GITHUB_REF_NAME#rust/v}"
          ver="$(cd rust && cargo metadata --no-deps --format-version 1 | python3 -c 'import json,sys;print(json.load(sys.stdin)["packages"][0]["version"])')"
          [ "$tag" = "$ver" ] || { echo "::error::tag rust/v$tag but Cargo.toml says $ver"; exit 1; }
      - run: cd rust && cargo build --locked && cargo test --locked --lib
      - uses: rust-lang/crates-io-auth-action@c6f97d42243bad5fab37ca0427f495c86d5b1a18 # v1.0.5
        id: auth
      - run: cd rust && cargo publish --locked
        env:
          CARGO_REGISTRY_TOKEN: ${{ steps.auth.outputs.token }}
      # A publish step exiting 0 does not mean anyone can install the package.
      # Measured on ts/v0.1.1 (issue #10): the job went green ~7 minutes before
      # npm served the tarball, and for ~2 of those minutes `latest` resolved to
      # a version that 404'd. This installs the real thing from the public
      # registry, with no credentials, and makes it report its ABI revision.
      - name: it installs from the public registry and speaks ABI revision
        run: scripts/verify-published.sh rust "${GITHUB_REF_NAME#rust/v}"