sdk-release.yml

name: Rust SDK Release

on:
  # Manual re-publish only: the automated publish for each release runs as the `publish` job
  # inside release-please.yml, in the same run that cuts the tag (dispatching a workflow here
  # instead would resolve it on the repository's default branch only, which breaks releasing
  # from any other release line). Dispatch this workflow at an existing release tag to re-run
  # a failed or skipped publish. A dispatched run is top-level, so OIDC trusted-publisher
  # claims name this file; register it as an additional trusted publisher only when manual
  # re-publishes are used. Never add a workflow_call trigger here — registries reject
  # publishes from called (reusable) workflows.
  workflow_dispatch:

permissions:
  contents: read
  id-token: write
  packages: write

jobs:
  release:
    runs-on: ubuntu-latest
    env:
      VERSIONING_POLICY: manual
    steps:
      - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1
      - uses: dtolnay/rust-toolchain@29eef336d9b2848a0b548edc03f92a220660cdb8 # stable
        with:
          toolchain: stable
      - run: cargo build --all-features
      - uses: rust-lang/crates-io-auth-action@c6f97d42243bad5fab37ca0427f495c86d5b1a18 # v1.0.5
        id: crates-auth
      - name: Publish to crates.io
        run: |
          VERSION="$(sed -n 's/^version = "\(.*\)"$/\1/p' Cargo.toml | head -n1)"
          if curl -sf -A "scalar-sdk-release" "https://crates.io/api/v1/crates/scalar-rs/${VERSION}" -o /dev/null; then
            echo "scalar-rs@${VERSION} already on crates.io, skipping"
          else
            cargo publish
          fi
        env:
          CARGO_REGISTRY_TOKEN: ${{ steps.crates-auth.outputs.token }}