anza-cryptography-source/.github/workflows/publish-rust.yml

name: Publish Crate

on:
  workflow_dispatch:
    inputs:
      package_path:
        description: Path to directory with package to release
        required: true
        type: string
      level:
        description: Level
        required: true
        default: patch
        type: choice
        options:
          - patch
          - minor
          - major
          - version
      version:
        description: Version (used with level "version")
        required: false
        type: string
      dry_run:
        description: Dry run
        required: true
        default: true
        type: boolean
      create_release:
        description: Create a GitHub release
        required: true
        type: boolean
        default: true
      dependent_version:
        description: |
          How workspace dependencies should be handled.
          - "fix": (Default) Only bumps the workspace for semver-breakage - prefer this option
          - "upgrade": Bumps workspace version regardless - only use if another crate requires new code          
        required: true
        default: fix
        type: choice
        options:
          - fix
          - upgrade
      run_semver:
        description: |
          Run semver checks.
          Only disable checks if you are sure of the semver impact of your change and have a good reason
          to skip it.          
        required: true
        type: boolean
        default: true

jobs:
  format:
    name: Format
    runs-on: ubuntu-latest
    steps:
      - name: Git Checkout
        uses: actions/checkout@v4

      - name: Install Rust
        uses: dtolnay/rust-toolchain@nightly
        with:
          components: rustfmt

      - name: Cache
        uses: Swatinem/rust-cache@v2

      - name: Check formatting
        run: cargo fmt --all -- --check

  clippy:
    name: Clippy
    runs-on: ubuntu-latest
    steps:
      - name: Git Checkout
        uses: actions/checkout@v4

      - name: Install Rust
        uses: dtolnay/rust-toolchain@stable
        with:
          components: clippy

      - name: Cache
        uses: Swatinem/rust-cache@v2

      - name: Run clippy
        run: cargo clippy --workspace --all-targets -- -D warnings

  semver:
    name: Check Semver
    runs-on: ubuntu-latest
    steps:
      - name: Git checkout
        uses: actions/checkout@v4

      - name: Install Rust
        uses: dtolnay/rust-toolchain@stable

      - name: Cache
        uses: Swatinem/rust-cache@v2

      - name: Install tools
        uses: taiki-e/install-action@v2
        with:
          tool: toml-cli,cargo-semver-checks,cargo-release

      - name: Check if crate is a procedural macro
        id: is_proc_macro
        shell: bash
        run: |
          set +e # toml crashes the whole shell if it fails to find the key
          result=$(toml get "${{ inputs.package_path }}/Cargo.toml" lib.proc-macro)
          if [[ "$result" == *"true"* ]]; then
            echo "is_proc_macro=true" >> "$GITHUB_OUTPUT"
          else
            echo "is_proc_macro=false" >> "$GITHUB_OUTPUT"
          fi          

      - name: Set Git Author (required for cargo-release)
        if: ${{ steps.is_proc_macro.outputs.is_proc_macro == 'false' }}
        run: |
          git config --global user.email "41898282+github-actions[bot]@users.noreply.github.com"
          git config --global user.name "github-actions[bot]"          

      - name: Set Version
        if: ${{ steps.is_proc_macro.outputs.is_proc_macro == 'false' }}
        run: |
          if [ "${{ inputs.level }}" == "version" ]; then
            LEVEL=${{ inputs.version }}
          else
            LEVEL=${{ inputs.level }}
          fi
          cargo release $LEVEL --manifest-path "${{ inputs.package_path }}/Cargo.toml" --no-tag --no-publish --no-push --no-confirm --execute          

      - name: Check semver
        if: ${{ steps.is_proc_macro.outputs.is_proc_macro == 'false' && github.event.inputs.run_semver == 'true'}}
        run: cargo semver-checks --manifest-path "${{ inputs.package_path }}/Cargo.toml"

  publish-crate:
    name: Publish crate
    runs-on: ubuntu-latest
    needs: [format, clippy, semver]
    permissions:
      contents: write
    steps:
      - name: Git Checkout
        uses: actions/checkout@v4
        with:
          token: ${{ secrets.ANZA_TEAM_PAT }}
          fetch-depth: 0 # get the whole history for git-cliff

      - name: Install Rust
        uses: dtolnay/rust-toolchain@stable

      - name: Cache
        uses: Swatinem/rust-cache@v2

      - name: Install cargo-release
        uses: taiki-e/install-action@v2
        with:
          tool: cargo-release

      - name: Ensure CARGO_REGISTRY_TOKEN variable is set
        env:
          token: ${{ secrets.CARGO_REGISTRY_TOKEN }}
        if: ${{ env.token == '' }}
        run: |
          echo "The CARGO_REGISTRY_TOKEN secret variable is not set"
          echo "Go to \"Settings\" -> \"Secrets and variables\" -> \"Actions\" -> \"New repository secret\"."
          exit 1          

      - name: Set Git Author
        run: |
          git config --global user.email "41898282+github-actions[bot]@users.noreply.github.com"
          git config --global user.name "github-actions[bot]"          

      - name: Rebase (in case any changes landed after)
        run: git pull --rebase origin

      - name: Publish Crate
        id: publish
        env:
          CARGO_REGISTRY_TOKEN: ${{ secrets.CARGO_REGISTRY_TOKEN }}
        run: |
          if [ "${{ inputs.level }}" == "version" ]; then
            LEVEL=${{ inputs.version }}
          else
            LEVEL=${{ inputs.level }}
          fi

          if [ "${{ inputs.dry_run }}" == "true" ]; then
            OPTIONS="--dry-run"
          else
            OPTIONS=""
          fi

          ./scripts/publish-rust.sh "${{ inputs.package_path }}" $LEVEL "${{ inputs.dependent_version }}" $OPTIONS          

      - name: Generate a changelog
        if: github.event.inputs.create_release == 'true'
        uses: orhun/git-cliff-action@v4
        with:
          config: "scripts/cliff.toml"
          args: ${{ steps.publish.outputs.old_git_tag }}..HEAD --include-path "${{ inputs.package_path }}/**" --github-repo ${{ github.repository }}
        env:
          OUTPUT: TEMP_CHANGELOG.md
          GITHUB_REPO: ${{ github.repository }}

      - name: Create GitHub release
        if: github.event.inputs.create_release == 'true' && github.event.inputs.dry_run != 'true'
        uses: ncipollo/release-action@v1
        with:
          tag: ${{ steps.publish.outputs.new_git_tag }}
          bodyFile: TEMP_CHANGELOG.md