zizmor/.github/workflows/release-support-crate.yml

name: Release support crates to crates.io 📦

on:
  push:
    tags:
      # NOTE: additional non-zizmor crate tag patterns get added here
      - "github-actions-expressions/v*"
      - "github-actions-models/v*"
      - "yamlpath/v*"
      - "yamlpatch/v*"
  workflow_dispatch:
    inputs:
      package-name:
        description: "The name of the package to publish"
        required: true

permissions: {}

jobs:
  get-package-name:
    name: Get package name from tag
    runs-on: ubuntu-latest
    outputs:
      package-name: ${{ steps.get-package-name.outputs.package-name }}
    steps:
      - name: Get package name from tag
        id: get-package-name
        run: |
          if [[ -z "${INPUT_PACKAGE_NAME}" ]]; then
            package_name="$(echo ${GITHUB_REF_NAME} | cut -d/ -f1)"
          else
            package_name="${INPUT_PACKAGE_NAME}"
          fi
          echo "::notice::Using package name: ${package_name}"
          echo "package-name=${package_name}" >> ${GITHUB_OUTPUT}
        env:
          INPUT_PACKAGE_NAME: ${{ github.event.inputs.package-name }}

  crates:
    needs: [get-package-name]
    name: Publish support crate to crates.io 📦
    runs-on: ubuntu-latest

    env:
      PACKAGE_NAME: ${{ needs.get-package-name.outputs.package-name }}

    environment:
      name: crates.io
      url: https://crates.io/crates/${{ env.PACKAGE_NAME }}

    permissions:
      id-token: write # for trusted publishing to crates.io
    steps:
      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
        with:
          persist-credentials: false

      - uses: rust-lang/crates-io-auth-action@e919bc7605cde86df457cf5b93c5e103838bd879 # v1.0.1
        id: auth

      - name: publish to crates.io
        run: |
          echo "::notice::Publishing package ${PACKAGE_NAME} (dry-run: ${DRY_RUN})"
          cargo publish ${DRY_RUN} -p ${PACKAGE_NAME}
        env:
          CARGO_REGISTRY_TOKEN: "${{ steps.auth.outputs.token }}"
          # workflow_dispatch always causes a dry run
          DRY_RUN: "${{ github.event_name == 'workflow_dispatch' && '--dry-run' || '' }}"