name: Semver checks

# Enforces the additive-track contract: a change that ships as an additive
# (0.x.y) release must NOT be an accidental breaking change. This runs on every
# PR targeting a release-line branch -- including backport PRs opened by
# backport.yml -- and baselines the public API against the latest crates.io
# release.
#
# This deliberately does NOT run on release-candidate (`*-rc*`) branches: the
# breaking train IS the intended place for breaking changes.

on:
  pull_request:
    branches:
      - stable
      - 'v0.*'

permissions:
  contents: read

jobs:
  semver-checks:
    name: cargo-semver-checks

    # Trusted PRs only: same-repo branch, or a fork PR a maintainer has labeled
    # `safe to test`/`check-release`. cargo-semver-checks compiles the PR's
    # code, so untrusted forks must not run it unreviewed. We key off the PR's
    # head repository rather than `author_association` (see tier-1a.yml).
    if: |
      github.event_name != 'pull_request' ||
      github.event.pull_request.head.repo.full_name == github.repository ||
      contains(github.event.pull_request.labels.*.name, 'safe to test') ||
      contains(github.event.pull_request.labels.*.name, 'check-release')
    runs-on: ubuntu-latest
    steps:
      - name: Checkout repository
        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3

      - name: Install Rust toolchain
        uses: dtolnay/rust-toolchain@fa04a1451ff1842e2626ccb99004d0195b455a88 # master@2026-06-30
        with:
          toolchain: stable

      - name: Run cargo-semver-checks
        uses: obi1kenobi/cargo-semver-checks-action@6b69fcf40e9b5fb17adeb57e4b6ecd020649a239 # v2
        with:
          # Public-API library crates. c2patool is a binary (no API surface).
          package: c2pa, c2pa-c-ffi
