auto-release.yml

name: Auto Release

# Fires when Cargo.toml version changes on main (e.g. after a version-bump PR merges).
# If the corresponding tag doesn't yet exist, this workflow dispatches release.yml with
# the detected version. release.yml creates the tag itself on workflow_dispatch, then
# runs the full test + multi-target build + publish pipeline.
#
# Why dispatch instead of pushing a tag here?
#   Tag pushes authenticated by GITHUB_TOKEN do not trigger downstream workflows (GitHub's
#   recursion-prevention rule). That silently breaks the tag -> release.yml chain, even
#   though the tag shows up on the remote. workflow_dispatch is an explicit API call, not
#   a push event, so the recursion block does not apply -- release.yml runs as intended.

on:
  push:
    branches: [main]
    paths:
      - 'Cargo.toml'

permissions:
  contents: read
  actions: write  # required to dispatch release.yml

jobs:
  maybe-release:
    runs-on: ubuntu-24.04
    steps:
      - uses: actions/checkout@v5
        with:
          fetch-depth: 0

      - name: Extract version from Cargo.toml
        id: version
        run: |
          VERSION=$(grep -m1 '^version' Cargo.toml | sed 's/.*"\(.*\)".*/\1/')
          TAG="v${VERSION}"
          echo "version=${VERSION}" >> "$GITHUB_OUTPUT"
          echo "tag=${TAG}" >> "$GITHUB_OUTPUT"
          echo "Detected version: ${VERSION}"

      - name: Validate version format
        env:
          TAG: ${{ steps.version.outputs.tag }}
        run: |
          if ! echo "$TAG" | grep -qE '^v[0-9]+\.[0-9]+\.[0-9]+(-[a-zA-Z0-9.]+)?$'; then
            echo "::error::Invalid version format: $TAG (expected vX.Y.Z)"
            exit 1
          fi

      - name: Check if release tag already exists on the remote
        id: check
        env:
          GH_TOKEN: ${{ github.token }}
          TAG: ${{ steps.version.outputs.tag }}
        run: |
          # Query the API directly: a tag can exist locally in the fetched history
          # without being the canonical release tag on GitHub, and vice versa. The API
          # is the source of truth for "has this release already been cut".
          if gh api "repos/${GITHUB_REPOSITORY}/git/refs/tags/${TAG}" >/dev/null 2>&1; then
            echo "exists=true" >> "$GITHUB_OUTPUT"
            echo "Tag $TAG already exists on remote, skipping"
          else
            echo "exists=false" >> "$GITHUB_OUTPUT"
            echo "Tag $TAG is new -- will dispatch release.yml"
          fi

      - name: Dispatch release workflow
        if: steps.check.outputs.exists == 'false'
        env:
          GH_TOKEN: ${{ github.token }}
          VERSION: ${{ steps.version.outputs.version }}
          TAG: ${{ steps.version.outputs.tag }}
        run: |
          gh workflow run release.yml \
            --ref "$GITHUB_SHA" \
            -f version="$VERSION"
          echo "::notice::Dispatched release.yml for $TAG"