# Licensed to the Apache Software Foundation (ASF) under one
# or more contributor license agreements.  See the NOTICE file
# distributed with this work for additional information
# regarding copyright ownership.  The ASF licenses this file
# to you under the Apache License, Version 2.0 (the
# "License"); you may not use this file except in compliance
# with the License.  You may obtain a copy of the License at
#
#   http://www.apache.org/licenses/LICENSE-2.0
#
# Unless required by applicable law or agreed to in writing,
# software distributed under the License is distributed on an
# "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
# KIND, either express or implied.  See the License for the
# specific language governing permissions and limitations
# under the License.

name: Publish

on:
  push:
    tags:
      # Trigger this workflow when tag follows the versioning format: v<major>.<minor>.<patch> OR v<major>.<minor>.<patch>-rc.<release_candidate>
      # Example valid tags: v0.4.0, v0.4.0-rc.1
      - "v[0-9]+.[0-9]+.[0-9]+"
      - "v[0-9]+.[0-9]+.[0-9]+-rc.[0-9]+"
  workflow_dispatch:

permissions:
  contents: read

jobs:
  publish:
    runs-on: ubuntu-latest
    environment: publish
    strategy:
      max-parallel: 1 # Publish package one by one instead of flooding the registry
      matrix:
        # Order here is sensitive, as it will be used to determine the order of publishing
        package:
          - "crates/iceberg"
          - "crates/storage/opendal"
          - "crates/catalog/glue"
          - "crates/catalog/hms"
          - "crates/catalog/rest"
          - "crates/catalog/s3tables"
          - "crates/catalog/sql"
          - "crates/integrations/datafusion"
    steps:
      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
        with:
          persist-credentials: false

      - name: Get MSRV
        id: get-msrv
        uses: ./.github/actions/get-msrv

      - name: Setup Rust toolchain
        uses: ./.github/actions/setup-builder
        with:
          rust-version: ${{ steps.get-msrv.outputs.msrv }}

      - name: Publish ${{ matrix.package }}
        working-directory: ${{ matrix.package }}
        # Only publish if it's a tag and the tag is not a pre-release
        if: ${{ startsWith(github.ref, 'refs/tags/') && !contains(github.ref, '-') }}
        run: cargo publish --all-features # zizmor: ignore[use-trusted-publishing] -- https://github.com/apache/iceberg-rust/issues/1539
        shell: bash
        env:
          CARGO_REGISTRY_TOKEN: ${{ secrets.CARGO_REGISTRY_TOKEN }}

  # Trigger Python release after crate publishing completes.
  # Only runs for tag pushes; for manual Python releases, use workflow_dispatch on release_python.yml directly.
  release-python:
    needs: [publish]
    if: ${{ startsWith(github.ref, 'refs/tags/') }}
    permissions:
      contents: read
      id-token: write # Required for PyPI trusted publishing in the called workflow
    uses: ./.github/workflows/release_python.yml
    with:
      release_tag: ${{ github.ref_name }}
