release.yml

name: Release

on:
  push:
    tags:
      - 'v*'
  # Manual "Run workflow" button to (re)publish the current version
  # without pushing a new tag or bumping the version.
  workflow_dispatch:

env:
  CARGO_TERM_COLOR: always

jobs:
  release:
    name: Release
    runs-on: ubuntu-22.04
    permissions:
      contents: write
    steps:
      - uses: actions/checkout@v4

      - uses: dtolnay/rust-toolchain@stable

      - uses: Swatinem/rust-cache@v2

      - name: install dependencies (ubuntu)
        run: |
          sudo apt-get update
          sudo apt-get install -y libwebkit2gtk-4.1-dev libappindicator3-dev librsvg2-dev patchelf

      # PyO3 (default backend) embeds CPython, so a Python interpreter must be
      # available to build & run the verification build / tests.
      - uses: actions/setup-python@v5
        with:
          python-version: '3.x'

      - name: build release
        run: cargo build --release --all-targets

      - name: test
        run: cargo test --release

      # Only create a GitHub Release for real tag pushes, not manual re-runs.
      - name: Create GitHub Release
        if: startsWith(github.ref, 'refs/tags/')
        uses: softprops/action-gh-release@v2
        with:
          generate_release_notes: true
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}

  publish-crates-io:
    name: Publish to crates.io
    runs-on: ubuntu-22.04
    needs: release
    environment: release
    permissions:
      # Required for crates.io Trusted Publishing (OIDC).
      contents: read
      id-token: write
    steps:
      - uses: actions/checkout@v4

      - uses: dtolnay/rust-toolchain@stable

      - uses: Swatinem/rust-cache@v2

      - name: install dependencies (ubuntu)
        run: |
          sudo apt-get update
          sudo apt-get install -y libwebkit2gtk-4.1-dev libappindicator3-dev librsvg2-dev patchelf

      # cargo publish runs a verification build; PyO3 needs a Python interpreter.
      - uses: actions/setup-python@v5
        with:
          python-version: '3.x'

      # Exchange the GitHub OIDC token for a short-lived crates.io token.
      # Sets CARGO_REGISTRY_TOKEN in the environment for subsequent steps.
      - name: Authenticate to crates.io (Trusted Publishing)
        uses: rust-lang/crates-io-auth-action@v1
        id: auth

      # Skip if this version is already on crates.io so re-running the
      # workflow (or moving the tag) doesn't fail on a duplicate publish.
      - name: Publish to crates.io
        run: |
          NAME=$(cargo metadata --no-deps --format-version=1 | python3 -c "import json,sys; print(json.load(sys.stdin)['packages'][0]['name'])")
          VERSION=$(cargo metadata --no-deps --format-version=1 | python3 -c "import json,sys; print(json.load(sys.stdin)['packages'][0]['version'])")
          if curl -sf "https://crates.io/api/v1/crates/$NAME/$VERSION" > /dev/null; then
            echo "crates.io already has $NAME@$VERSION — skipping publish."
          else
            cargo publish
          fi
        env:
          CARGO_REGISTRY_TOKEN: ${{ steps.auth.outputs.token }}

  publish-npm:
    name: Publish to npm
    runs-on: ubuntu-22.04
    needs: release
    environment: release
    permissions:
      # Required for npm Trusted Publishing (OIDC): GitHub mints a short-lived
      # identity token that npm verifies — no NPM_TOKEN/OTP needed.
      contents: read
      id-token: write
    steps:
      - uses: actions/checkout@v4

      - uses: pnpm/action-setup@v4

      - uses: actions/setup-node@v4
        with:
          node-version: lts/*
          registry-url: 'https://registry.npmjs.org'

      # Trusted Publishing (OIDC) requires npm >= 11.5.1; the version bundled
      # with the LTS Node release is older.
      - name: Upgrade npm
        run: npm install -g npm@latest

      - name: install dependencies
        run: pnpm install

      # npm publish runs `prepublishOnly` (pnpm build) to produce dist-js/.
      # Use the npm CLI (not pnpm) so OIDC trusted publishing is used.
      # Skip if this version is already on npm so re-running doesn't fail
      # on a duplicate publish.
      - name: Publish to npm
        run: |
          NAME=$(node -p "require('./package.json').name")
          VERSION=$(node -p "require('./package.json').version")
          if [ -n "$(npm view "$NAME@$VERSION" version 2>/dev/null)" ]; then
            echo "npm already has $NAME@$VERSION — skipping publish."
          else
            npm publish --access public
          fi