.github/workflows/release_rust.yml

#
# Licensed to the Apache Software Foundation (ASF) under one
# or more contributor license agreements. See the NOTICE file
# distributed with this work for additional information
# regarding copyright ownership. The ASF licenses this file
# to you under the Apache License, Version 2.0 (the
# "License"); you may not use this file except in compliance
# with the License. You may obtain a copy of the License at
#
#   http://www.apache.org/licenses/LICENSE-2.0
#
# Unless required by applicable law or agreed to in writing,
# software distributed under the License is distributed on an
# "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
# KIND, either express or implied. See the License for the
# specific language governing permissions and limitations
# under the License.
#

name: Release Rust Packages

on:
  release:
    types: [published]
  pull_request:
    branches:
      - master
    paths:
      - ".github/workflows/release_rust.yml"
  workflow_dispatch:

jobs:
  dry-run:
    runs-on: ubuntu-latest
    permissions:
      contents: read
    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          persist-credentials: false

      - name: Install Rust 1.85
        # The repo-pinned toolchain (rust-toolchain: 1.83) predates edition2024 support
        # required by transitive dependencies (getrandom >= 0.4); 1.85 is the minimum
        # that passes. Pin explicitly for reproducibility.
        run: rustup toolchain install 1.85 --profile minimal

      - name: Dry run
        working-directory: lib/rs
        run: cargo publish --dry-run
        env:
          RUSTUP_TOOLCHAIN: "1.85"

  publish:
    runs-on: ubuntu-latest
    if: ${{ github.event_name == 'release' && !github.event.release.prerelease }}
    environment: release
    permissions:
      contents: read
      id-token: write
    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          persist-credentials: false

      - name: Verify crate version matches release tag
        env:
          RELEASE_TAG: ${{ github.event.release.tag_name }}
        run: |
          CRATE_VERSION=$(awk -F'"' '/^version/{print $2; exit}' lib/rs/Cargo.toml)
          TAG_VERSION=$(echo "$RELEASE_TAG" | sed 's/^v//')
          if [ "$CRATE_VERSION" != "$TAG_VERSION" ]; then
            echo "Version mismatch: Cargo.toml=$CRATE_VERSION, tag=$TAG_VERSION"
            exit 1
          fi
          echo "Version check passed: $CRATE_VERSION"

      - name: Install Rust 1.85
        run: rustup toolchain install 1.85 --profile minimal

      - name: Authenticate to crates.io
        id: crates-io-auth
        uses: rust-lang/crates-io-auth-action@c6f97d42243bad5fab37ca0427f495c86d5b1a18 # v1.0.5

      - name: Publish
        working-directory: lib/rs
        run: cargo publish
        env:
          RUSTUP_TOOLCHAIN: "1.85"
          CARGO_REGISTRY_TOKEN: ${{ steps.crates-io-auth.outputs.token }}