rust-release.yml

# Licensed to the Apache Software Foundation (ASF) under one
# or more contributor license agreements.  See the NOTICE file
# distributed with this work for additional information
# regarding copyright ownership.  The ASF licenses this file
# to you under the Apache License, Version 2.0 (the
# "License"); you may not use this file except in compliance
# with the License.  You may obtain a copy of the License at
#
#   http://www.apache.org/licenses/LICENSE-2.0
#
# Unless required by applicable law or agreed to in writing,
# software distributed under the License is distributed on an
# "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
# KIND, either express or implied.  See the License for the
# specific language governing permissions and limitations
# under the License.

# Publish the fluss Rust crate to crates.io.
# Trigger: push tag only (e.g. v0.1.0).
# Pre-release tags (containing '-') do not publish; release tags publish to crates.io.
# A pre-release tag still authenticates, to prove the publish path before release day.
#
# Auth: crates.io Trusted Publishing (OIDC). The crate's Trusted Publishing config on
# crates.io must name this repository and this workflow file; no secret is involved.

name: Release Rust

on:
  push:
    tags:
      - "v*"  # Only version-like tags (e.g. v0.1.0, v0.1.0-rc1); avoids running on arbitrary tags

defaults:
  run:
    working-directory: fluss-rust

jobs:
  publish:
    runs-on: ubuntu-latest
    permissions:
      contents: read
      id-token: write  # mint the short-lived crates.io publish token
    steps:
      - uses: actions/checkout@v6

      - uses: ./.github/actions/verify-tag-version

      # cargo packs only the crate directory, so the LICENSE/NOTICE above it
      # never reach the .crate.
      - name: Verify LICENSE, NOTICE and the dependency inventory in the crate
        run: |
          FILES=$(cargo package --list --allow-dirty -p fluss-rs)
          for f in LICENSE NOTICE DEPENDENCIES.rust.tsv; do
            if ! echo "$FILES" | grep -qx "$f"; then
              echo "Error: ${f} is missing from the fluss-rs crate"
              exit 1
            fi
          done

      - name: Dry run (crates/fluss)
        run: cargo publish -p fluss-rs --dry-run --locked

      # crates.io trades the job's OIDC identity for a publish token that lasts
      # about 30 minutes; the action revokes it when the job ends.
      #
      # This runs on pre-release tags too, even though they never publish. The dry run
      # above never contacts the registry, so without this the Trusted Publishing config
      # is first exercised on the release tag itself. Authenticating during the RC turns a
      # misconfigured publisher (wrong repository, renamed workflow file) into an RC
      # failure rather than a release-day one.
      - name: Authenticate with crates.io
        id: auth
        if: startsWith(github.ref, 'refs/tags/')
        uses: rust-lang/crates-io-auth-action@c6f97d42243bad5fab37ca0427f495c86d5b1a18 # v1.0.5

      - name: Publish fluss-rs to crates.io
        if: startsWith(github.ref, 'refs/tags/') && !contains(github.ref, '-')
        run: cargo publish -p fluss-rs --locked
        env:
          CARGO_REGISTRY_TOKEN: ${{ steps.auth.outputs.token }}