release.yml

# yaml-language-server: $schema=https://www.schemastore.org/github-workflow.json

name: Release

on:
  push:
    tags:
      - "v*.*.*"
  workflow_dispatch:
    inputs:
      version:
        description: "Release version (e.g., v1.0.0)"
        required: true
      dry_run:
        description: "Dry run (don't actually publish)"
        type: boolean
        default: false

permissions:
  contents: write
  id-token: write

env:
  CARGO_TERM_COLOR: always

jobs:
  # Validate the release
  validate:
    name: Validate Release
    runs-on: ubuntu-latest
    outputs:
      version: ${{ steps.get_version.outputs.version }}
    steps:
      - name: Harden the runner (Audit all outbound calls)
        uses: step-security/harden-runner@20cf305ff2072d973412fa9b1e3a4f227bda3c76 # v2.14.0
        with:
          egress-policy: audit

      - name: Checkout code
        uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1

      - name: Get version from tag
        id: get_version
        env:
          INPUT_VERSION: ${{ github.event.inputs.version }}
          REF_NAME: ${{ github.ref_name }}
          EVENT_NAME: ${{ github.event_name }}
        run: |
          if [ "$EVENT_NAME" = "workflow_dispatch" ]; then
            echo "version=$INPUT_VERSION" >> "$GITHUB_OUTPUT"
          else
            echo "version=$REF_NAME" >> "$GITHUB_OUTPUT"
          fi

      - name: Install Rust toolchain
        uses: dtolnay/rust-toolchain@881ba7bf39a41cda34ac9e123fb41b44ed08232f # stable

      - name: Install development tools via Mise
        uses: step-security/mise-action@2fa1b2b4fa1577588d8ac75f4dfa0f67c266d2a0 # v3.4.1
        with:
          install_args: protobuf
          cache: true

      - name: Verify Cargo.toml version matches tag
        env:
          TAG_VERSION: ${{ steps.get_version.outputs.version }}
        run: |
          CARGO_VERSION=$(cargo metadata --no-deps --format-version 1 | jq -r '.packages[] | select(.name == "inferadb") | .version')
          TAG_VERSION_CLEAN="${TAG_VERSION#v}"
          if [ "$CARGO_VERSION" != "$TAG_VERSION_CLEAN" ]; then
            echo "Version mismatch: Cargo.toml has $CARGO_VERSION but tag is $TAG_VERSION_CLEAN"
            exit 1
          fi
          echo "Version validated: $CARGO_VERSION"

      - name: Run tests
        run: cargo test --lib --all-features

      - name: Check documentation builds
        env:
          RUSTDOCFLAGS: -D warnings
        run: cargo doc --workspace --no-deps --all-features

  # Create GitHub release
  create-release:
    name: Create GitHub Release
    needs: validate
    runs-on: ubuntu-latest
    if: github.event.inputs.dry_run != 'true'
    permissions:
      contents: write
    steps:
      - name: Harden the runner (Audit all outbound calls)
        uses: step-security/harden-runner@20cf305ff2072d973412fa9b1e3a4f227bda3c76 # v2.14.0
        with:
          egress-policy: audit

      - name: Checkout code
        uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1

      - name: Create Release
        uses: step-security/action-gh-release@5f6a6ab53a5a2c000ff3a16fad038291e5b97ce7 # v2.4.2
        with:
          tag_name: ${{ needs.validate.outputs.version }}
          name: ${{ needs.validate.outputs.version }}
          draft: false
          prerelease: ${{ contains(needs.validate.outputs.version, '-') }}
          generate_release_notes: true

  # Publish to crates.io
  publish:
    name: Publish to crates.io
    needs: [validate, create-release]
    runs-on: ubuntu-latest
    environment: release
    if: github.event.inputs.dry_run != 'true'
    steps:
      - name: Harden the runner (Audit all outbound calls)
        uses: step-security/harden-runner@20cf305ff2072d973412fa9b1e3a4f227bda3c76 # v2.14.0
        with:
          egress-policy: audit

      - name: Checkout code
        uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1

      - name: Install Rust toolchain
        uses: dtolnay/rust-toolchain@881ba7bf39a41cda34ac9e123fb41b44ed08232f # stable

      - name: Install development tools via Mise
        uses: step-security/mise-action@2fa1b2b4fa1577588d8ac75f4dfa0f67c266d2a0 # v3.4.1
        with:
          install_args: protobuf
          cache: true

      - name: Cache Rust dependencies
        uses: step-security/rust-cache@f8fba7098297c8c53a7c9a30575ec2ad4ad85056 # v2.8.2

      # Use OIDC-based trusted publishing
      - name: Authenticate with crates.io
        uses: rust-lang/crates-io-auth-action@b7e9a28eded4986ec6b1fa40eeee8f8f165559ec # v1.0.3
        id: auth

      # Publish inferadb-derive first (if it exists and is a dependency)
      - name: Publish inferadb-derive
        env:
          CARGO_REGISTRY_TOKEN: ${{ steps.auth.outputs.token }}
        run: |
          if [ -d "inferadb-derive" ]; then
            cd inferadb-derive
            cargo publish --token "$CARGO_REGISTRY_TOKEN" --allow-dirty || echo "inferadb-derive may already be published"
            cd ..
            # Wait for crates.io to index
            sleep 30
          fi

      # Publish main crate
      - name: Publish inferadb
        env:
          CARGO_REGISTRY_TOKEN: ${{ steps.auth.outputs.token }}
        run: cargo publish --token "$CARGO_REGISTRY_TOKEN" --allow-dirty

  # Build and publish documentation
  docs:
    name: Build Documentation
    needs: [validate, publish]
    runs-on: ubuntu-latest
    if: github.event.inputs.dry_run != 'true'
    permissions:
      contents: write
    steps:
      - name: Harden the runner (Audit all outbound calls)
        uses: step-security/harden-runner@20cf305ff2072d973412fa9b1e3a4f227bda3c76 # v2.14.0
        with:
          egress-policy: audit

      - name: Checkout code
        uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1

      - name: Install Rust toolchain
        uses: dtolnay/rust-toolchain@881ba7bf39a41cda34ac9e123fb41b44ed08232f # nightly

      - name: Install development tools via Mise
        uses: step-security/mise-action@2fa1b2b4fa1577588d8ac75f4dfa0f67c266d2a0 # v3.4.1
        with:
          install_args: protobuf
          cache: true

      - name: Cache Rust dependencies
        uses: step-security/rust-cache@f8fba7098297c8c53a7c9a30575ec2ad4ad85056 # v2.8.2

      - name: Build documentation
        env:
          RUSTDOCFLAGS: --cfg docsrs
        run: cargo +nightly doc --workspace --no-deps --all-features

      - name: Add index redirect
        run: |
          echo '<meta http-equiv="refresh" content="0; url=inferadb">' > target/doc/index.html

      - name: Upload documentation artifact
        uses: actions/upload-artifact@b7c566a772e6b6bfb58ed0dc250532a479d7789f # v6.0.0
        with:
          name: documentation
          path: target/doc
          retention-days: 30