name: Publish Rust crate

on:
  push:
    branches: [main]
    paths: ['Cargo.toml']
  # Manual fallback: retry a publish that failed after the version was
  # already merged (a plain re-push won't register as a version change).
  workflow_dispatch:

permissions:
  contents: read

env:
  CARGO_TERM_COLOR: always

jobs:
  check-version:
    name: Check version change
    # Guard manual dispatches: crates.io trusted publishing matches
    # repo+workflow+environment but NOT branch, so without this a
    # workflow_dispatch from any branch could publish unmerged code.
    if: github.ref == 'refs/heads/main'
    runs-on: ubuntu-latest
    outputs:
      changed: ${{ steps.check.outputs.changed }}
      published: ${{ steps.check.outputs.published }}
      version: ${{ steps.check.outputs.version }}
    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          fetch-depth: 2

      - name: Check package version sync
        run: python3 scripts/version.py --check

      - name: Check if version changed
        id: check
        run: |
          NEW_VERSION=$(python3 -c 'import pathlib, tomllib; print(tomllib.loads(pathlib.Path("Cargo.toml").read_text())["package"]["version"])')
          echo "version=$NEW_VERSION" >> "$GITHUB_OUTPUT"

          if [ "${{ github.event_name }}" = "workflow_dispatch" ]; then
            # Manual dispatch publishes the current version regardless of the
            # previous commit; the crates.io check below still prevents
            # double-publishing an already-released version.
            echo "manual dispatch: publishing v$NEW_VERSION"
            echo "changed=true" >> "$GITHUB_OUTPUT"
          else
            OLD_VERSION=$(git show HEAD~1:Cargo.toml | python3 -c 'import sys, tomllib; print(tomllib.loads(sys.stdin.read())["package"]["version"])')
            echo "old=$OLD_VERSION new=$NEW_VERSION"

            if [ "$NEW_VERSION" = "$OLD_VERSION" ]; then
              echo "changed=false" >> "$GITHUB_OUTPUT"
              echo "published=false" >> "$GITHUB_OUTPUT"
              exit 0
            fi

            echo "changed=true" >> "$GITHUB_OUTPUT"
          fi

          HTTP_STATUS=$(curl --silent --show-error --output /tmp/crate-version.json --write-out "%{http_code}" \
            -H "User-Agent: firecrawl/pdf-inspector publish workflow (https://github.com/firecrawl/pdf-inspector)" \
            "https://crates.io/api/v1/crates/pdf-inspector/$NEW_VERSION")

          case "$HTTP_STATUS" in
            200)
              echo "published=true" >> "$GITHUB_OUTPUT"
              echo "pdf-inspector v$NEW_VERSION is already published"
              ;;
            404)
              echo "published=false" >> "$GITHUB_OUTPUT"
              ;;
            *)
              cat /tmp/crate-version.json
              echo "Unexpected crates.io response: $HTTP_STATUS" >&2
              exit 1
              ;;
          esac

  publish:
    name: Publish to crates.io
    needs: check-version
    if: needs.check-version.outputs.changed == 'true' && needs.check-version.outputs.published == 'false'
    runs-on: ubuntu-latest
    environment: crates-io
    permissions:
      contents: read
      id-token: write
    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1

      - name: Install Rust
        uses: dtolnay/rust-toolchain@4cda84d5c5c54efe2404f9d843567869ab1699d4 # stable
        with:
          toolchain: stable

      - name: Verify package
        run: cargo publish --dry-run

      - name: Authenticate with crates.io
        id: auth
        uses: rust-lang/crates-io-auth-action@c6f97d42243bad5fab37ca0427f495c86d5b1a18 # v1.0.5

      - name: Publish crate
        run: cargo publish
        env:
          CARGO_REGISTRY_TOKEN: ${{ steps.auth.outputs.token }}