name: Release-plz publish

# Publishes crates to crates.io and creates GitHub releases/tags.
#
# Under the open-source release process (see docs/release-process.md), crates
# are published ONLY from release-line branches -- never from `main` (which is
# nightly-like and intentionally unpublished) and never from release-candidate
# branches (which bake before promotion). A push to a release-line branch
# happens when a release-plz release PR (see release-pr.yml) is merged.
#
# release-plz creates the `c2pa-v*` and `c2patool-v*` tags here; those tags then
# drive the binary builds in library-release.yml and c2patool-release.yml. This
# workflow no longer builds binaries itself -- keeping binary builds tag-driven
# means release-candidate builds (which never reach this workflow) produce the
# same binaries via release-rc.yml's tags.

permissions:
  pull-requests: write
  contents: write

on:
  push:
    branches:
      - stable # currently-active release line
      - 'v0.*' # long-lived per-line branches (backports to retired lines)

jobs:
  # Refuse to publish if a [patch]/git dependency is present. Such deps are used
  # only transiently while co-developing an extracted crate (e.g.
  # c2pa_cbor); they must be settled to a published version before any
  # release, because crates.io requires every dependency to resolve to a
  # published version.
  guard-no-patch-deps:
    name: Guard against patch/git dependencies
    uses: ./.github/workflows/check-no-patch-deps.yml

  release-plz:
    name: Release-plz
    runs-on: ubuntu-latest
    needs: guard-no-patch-deps
    # Defense in depth: release-candidate branches must never publish, even if
    # one were ever added to the triggers above. RC branches are named
    # `<version>-rc` (no numeric suffix), so match on `-rc` rather than `-rc.`.
    if: ${{ !contains(github.ref_name, '-rc') }}

    steps:
      - name: Checkout repository
        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
        with:
          fetch-depth: 0
          token: ${{ secrets.RELEASE_PLZ_TOKEN }}

      - name: Install Rust toolchain
        uses: dtolnay/rust-toolchain@fa04a1451ff1842e2626ccb99004d0195b455a88 # master@2026-06-30
        with:
          toolchain: stable

      # Make cargo-semver-checks available so release-plz uses it as an extra
      # guard against an accidental breaking change shipping as an additive
      # (0.x.y) release. (The hard gate is semver-checks.yml on the release PR.)
      - name: Install cargo-semver-checks
        uses: taiki-e/install-action@4684b8405694ae9dd42c9f39ba901a70ae83f4a3 # v2.82.9
        with:
          tool: cargo-semver-checks

      - name: Run release-plz (publish)
        id: release-plz
        uses: MarcoIeni/release-plz-action@064f4d1e36c843611ddf013be726beaa4ad804db # v0.5.129
        with:
          command: release
          verbose: true
        env:
          GITHUB_TOKEN: ${{ secrets.RELEASE_PLZ_TOKEN }}
          CARGO_REGISTRY_TOKEN: ${{ secrets.CRATES_IO_ORG_TOKEN }}

      - name: Debug release-plz outputs
        env:
          RELEASES: ${{ steps.release-plz.outputs.releases }}
        run: |
          echo "=== Release-plz releases ==="
          echo "$RELEASES"
          echo "==========================="
