publish.yml

# Publish eb_stack to crates.io with Trusted Publishing, then register the
# MCP server. crates.io hands this workflow a token only once
# stackhands/eb-stack is configured as a Trusted Publisher for eb_stack;
# until then the publish step is skipped and the crate goes out from a
# maintainer's machine (cargo publish --locked), as CONTRIBUTING.md says.
name: publish

on:
  push:
    tags: ["v*"]
  workflow_dispatch:

permissions:
  contents: read

jobs:
  crates:
    runs-on: ubuntu-24.04
    permissions:
      contents: read
      id-token: write
    steps:
      - uses: actions/checkout@v7
      - name: The tag is the crate version
        if: startsWith(github.ref, 'refs/tags/v')
        env:
          TAG: ${{ github.ref_name }}
        run: |
          set -eu
          crate=$(python3 -c 'import tomllib; print(tomllib.load(open("Cargo.toml", "rb"))["package"]["version"])')
          if [ "v$crate" != "$TAG" ]; then
            echo "Cargo.toml says $crate and the tag says $TAG" >&2
            exit 1
          fi
      - name: Is this version on crates.io already
        id: present
        run: |
          set -eu
          version=$(python3 -c 'import tomllib; print(tomllib.load(open("Cargo.toml", "rb"))["package"]["version"])')
          if curl -fsS -A 'stackhands/eb-stack publish workflow' "https://crates.io/api/v1/crates/eb_stack/$version" > /dev/null; then
            echo "eb_stack $version is on crates.io already"
            echo "skip=true" >> "$GITHUB_OUTPUT"
          fi
      - uses: dtolnay/rust-toolchain@stable
        if: steps.present.outputs.skip != 'true'
      - uses: rust-lang/crates-io-auth-action@v1.0.5
        id: auth
        if: steps.present.outputs.skip != 'true'
        continue-on-error: true
      - name: No Trusted Publishing configuration
        if: steps.present.outputs.skip != 'true' && steps.auth.outcome != 'success'
        run: |
          echo "crates.io gave no token for this repository; publish by hand with cargo publish --locked" >&2
          exit 1
      - name: Publish eb_stack
        if: steps.present.outputs.skip != 'true' && steps.auth.outcome == 'success'
        env:
          CARGO_REGISTRY_TOKEN: ${{ steps.auth.outputs.token }}
        run: cargo publish --locked

  mcp-registry:
    needs: crates
    permissions:
      contents: read
      id-token: write
    uses: ./.github/workflows/mcp_registry.yml