publish-crates.yml

name: Publish to crates.io

# Reusable workflow invoked by cargo-dist's release pipeline as a
# user_publish_job. cargo-dist gates this on tag releases (and skips it
# for pre-releases unless publish_prereleases is enabled in
# dist-workspace.toml).
on:
  workflow_call:
    inputs:
      plan:
        description: dist-manifest JSON for this announcement
        required: true
        type: string

# Reusable workflows mint their own GITHUB_TOKEN with only the permissions
# declared here (NOT inherited from the caller). On a private/internal
# repo, actions/checkout needs `contents: read` or it gets a 404. The
# caller must also grant this — see dist-workspace.toml's
# github-custom-job-permissions block.
permissions:
  contents: read

jobs:
  publish:
    runs-on: ubuntu-22.04
    steps:
      - uses: actions/checkout@v4

      - name: Verify the bumped Cargo.toml version matches the release tag
        env:
          PLAN: ${{ inputs.plan }}
        run: |
          tag_version=$(echo "$PLAN" | jq -r '.releases[0].app_version')
          cargo_version=$(cargo metadata --no-deps --format-version 1 \
            | jq -r '.packages[] | select(.name == "quicknode-cli") | .version')
          if [[ "$tag_version" != "$cargo_version" ]]; then
            echo "Error: tag version ($tag_version) does not match Cargo.toml version ($cargo_version)." >&2
            echo "This indicates the release-bump step was skipped or the wrong commit was tagged." >&2
            exit 1
          fi
          echo "Version check passed: $tag_version"

      - uses: dtolnay/rust-toolchain@stable

      - name: cargo publish
        env:
          CARGO_REGISTRY_TOKEN: ${{ secrets.CARGO_REGISTRY_TOKEN }}
        run: cargo publish -p quicknode-cli