# Publish a release to crates.io.
#
# Assumed to run as a subworkflow of .github/workflows/release.yml; specifically, as a publish job
# within `cargo-dist`.
name: "Publish to crates.io"

on:
  workflow_call:
    inputs:
      plan:
        required: true
        type: string

jobs:
  crates-publish-uv:
    name: Upload uv to crates.io
    runs-on: ubuntu-latest
    environment:
      name: release
    permissions:
      contents: read
      id-token: write
    steps:
      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
        with:
          persist-credentials: false
      - uses: rust-lang/crates-io-auth-action@c6f97d42243bad5fab37ca0427f495c86d5b1a18 # v1.0.5
        id: auth
      - name: Install nightly toolchain
        # Nightly is required for the unstable `-Zpublish-timeout` flag, which lets us
        # raise the per-crate wait above the 60s default. crates.io indexing has been
        # known to lag long enough to exceed that during workspace publishes.
        run: rustup toolchain install nightly-2026-06-12 --profile minimal --no-self-update
      - name: Publish workspace crates
        # Note `--no-verify` is safe because we do a publish dry-run elsewhere in CI
        run: python3 scripts/publish-crates.py --cargo cargo +nightly-2026-06-12 --no-verify -- -Zpublish-timeout --config 'publish.timeout=600'
        env:
          CARGO_REGISTRY_TOKEN: ${{ steps.auth.outputs.token }}
