release.yml

name: Release

# Publishes every crate of the workspace to crates.io using Trusted Publishing.
#
# Must be triggered on the release tag
#
# Design decisions:
# - not using --workspace but specifying crates to be able to restart in case of any issue
# - --no-verify in publish: it holds a temp crates.io token
#   - valid only 30 minutes, so no time to build everything
#   - build scripts are ran on verify, so don't run them with the token available
# - check does basic validation: the tag matches the crate version and it isn't already published, and a dry-run

on:
  workflow_dispatch:
    inputs:
      skip_verify:
        description: "Publish without the dry run. Faster, but nothing checks that the crates build"
        type: boolean
        default: false
      crates:
        description: "Space separated crates to publish. Empty: every crate of the workspace not yet published"
        type: string
        default: ""
      features:
        description: "Features to enable for the dry run, for crates that don't build with their default features"
        type: string
        default: "bevy_image/zstd_rust"

permissions: {}

concurrency:
  group: release
  cancel-in-progress: false

env:
  CARGO_TERM_COLOR: always

jobs:
  check:
    name: Check release
    if: github.repository == 'bevyengine/bevy'
    runs-on: ubuntu-latest
    permissions:
      contents: read
    timeout-minutes: 120
    outputs:
      version: ${{ steps.version.outputs.version }}
    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          persist-credentials: false

      - uses: $/.github/actions/install-rust

      - name: Check version and ref
        id: version
        env:
          REF: ${{ github.ref }}
        run: |
          version=$(cargo metadata --no-deps --format-version 1 | jq -r '.packages[] | select(.name == "bevy") | .version')

          # tag matches the version
          if [ "$REF" != "refs/tags/v$version" ]; then
            echo "::error::This workflow must run on the tag v$version, not on $REF"
            exit 1
          fi

          echo "version=$version" >> "$GITHUB_OUTPUT"

      - name: Install Linux dependencies
        uses: $/.github/actions/install-linux-deps

      - name: List crates to publish
        id: crates
        env:
          CRATES: ${{ inputs.crates }}
          SKIP_VERIFY: ${{ inputs.skip_verify }}
        run: |
          set -f # the input is a list of crates, don't expand it as globs
          crates=$(.github/scripts/unpublished-crates.sh $CRATES)
          echo "packages=$(echo "$crates" | sed '/^$/d' | sed 's/^/-p /' | tr '\n' ' ')" >> "$GITHUB_OUTPUT"

          {
            echo "### Crates to publish"
            echo "$crates" | sed '/^$/d' | sed 's/^/- /'
            if [ "$SKIP_VERIFY" = "true" ]; then
              echo "### :warning: dry run skipped, these crates are not verified"
            fi
          } >> "$GITHUB_STEP_SUMMARY"

      - name: Package and build (dry run)
        if: steps.crates.outputs.packages != '' && !inputs.skip_verify
        env:
          PACKAGES: ${{ steps.crates.outputs.packages }}
          FEATURES: ${{ inputs.features }}
          CARGO_INCREMENTAL: 0
          CARGO_PROFILE_DEV_DEBUG: 0
        run: |
          cargo publish --dry-run $PACKAGES ${FEATURES:+--features "$FEATURES"}

  publish:
    name: Publish to crates.io
    needs: check
    if: github.repository == 'bevyengine/bevy'
    runs-on: ubuntu-latest
    environment:
      name: release
      url: https://crates.io/crates/bevy/${{ needs.check.outputs.version }}
    permissions:
      contents: read
      id-token: write
    timeout-minutes: 25
    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          persist-credentials: false

      - uses: $/.github/actions/install-rust

      - name: List crates to publish
        id: crates
        env:
          CRATES: ${{ inputs.crates }}
        run: |
          set -f # the input is a list of crates, don't expand it as globs
          crates=$(.github/scripts/unpublished-crates.sh $CRATES)
          echo "packages=$(echo "$crates" | sed '/^$/d' | sed 's/^/-p /' | tr '\n' ' ')" >> "$GITHUB_OUTPUT"

      - name: Authenticate with crates.io
        if: steps.crates.outputs.packages != ''
        id: auth
        uses: rust-lang/crates-io-auth-action@3268eb413133e2960fa4ae0e963ca76380c54cd9 # v1.0.6

      - name: Publish
        if: steps.crates.outputs.packages != ''
        env:
          CARGO_REGISTRY_TOKEN: ${{ steps.auth.outputs.token }}
          PACKAGES: ${{ steps.crates.outputs.packages }}
        run: |
          cargo publish --no-verify $PACKAGES