on:
  push:
    tags:
      - '*'
  
name: Publish
  
jobs:
  audit:
    name: Audit
    runs-on: ubuntu-latest
    timeout-minutes: 10
    steps:
    - uses: actions/checkout@v4
    - uses: actions-rust-lang/audit@v1
  
  crates_io_publish:
    name: Publish (crates.io)
    needs:
    - audit
  
    runs-on: ubuntu-latest
    timeout-minutes: 25
    steps:
    - uses: actions/checkout@v4
    - uses: actions-rust-lang/setup-rust-toolchain@v1
  
    - name: cargo-release Cache
      id: cargo_release_cache
      uses: actions/cache@v4
      with:
        path: ~/.cargo/bin/cargo-release
        key: ${{ runner.os }}-cargo-release

    - run: cargo install cargo-release
      if: steps.cargo_release_cache.outputs.cache-hit != 'true'

    - run: cargo package

    - run: cargo release publish --no-confirm --execute --allow-branch HEAD
      env:
        CARGO_REGISTRY_TOKEN: ${{ secrets.CARGO_REGISTRY_TOKEN }}