Rework release workflow

.github/workflows/publish-crates.yml

@@ -7,44 +7,91 @@ on:
   release:
     types: [published]
 
+  workflow_dispatch:
+    inputs:
+      version:
+        description: "Release tag to publish (E.G. v0.10.0-rc.1, v0.10.0). Corresponding GitHub release must already exist."
+        required: true
+        type: string
+
+concurrency:
+  group: "${{ github.workflow }} @ ${{ inputs.version || github.event.release.tag_name }}"
+  cancel-in-progress: false
+
+env:
+  RELEASE_TAG: ${{ inputs.version || github.event.release.tag_name }}
+
 jobs:
   publish-release:
     name: Cargo publish release
-    runs-on: Linux-ARM64-Runner
+    runs-on: warp-ubuntu-latest-x64-8x
     if: ${{ github.repository_owner == '0xMiden' }}
     environment: publish-crates
     steps:
+      - name: Validate release tag
+        run: |
+          set -euo pipefail
+
+          if [[ ! "${RELEASE_TAG}" =~ ^v[0-9]+\.[0-9]+\.[0-9]+(-[0-9A-Za-z][0-9A-Za-z.-]*)?$ ]]; then
+            echo "::error::Release tags must look like v1.2.3 or v1.2.3-rc.1"
+            exit 1
+          fi
+
       - name: Checkout repository
         uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1
         with:
           fetch-depth: 0
           persist-credentials: false
-          ref: ${{ github.event.release.tag_name }}
-      - uses: ./.github/actions/install-rocksdb
-      - uses: ./.github/actions/install-protobuf-compiler
-      - name: Log release info
-        env:
-          RELEASE_TAG: ${{ github.event.release.tag_name }}
-        run: |
-          echo "Publishing release ${RELEASE_TAG}"
-          echo "Commit: $(git rev-parse HEAD)"
-      - name: Cleanup large tools for build space
-        uses: ./.github/actions/cleanup-runner
+          ref: ${{ env.RELEASE_TAG }}
+
       - name: Install dependencies
         run: sudo apt-get update && sudo apt-get install -y jq
-      - name: Update Rust toolchain
+
+      - name: Verify GitHub release exists
+        env:
+          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+        run: |
+          set -euo pipefail
+
+          if ! gh release view "${RELEASE_TAG}" --repo "${GITHUB_REPOSITORY}" >/dev/null; then
+            echo "::error::GitHub release ${RELEASE_TAG} does not exist. Refusing to publish crates."
+            exit 1
+          fi
+
+      - name: Rustup
         run: rustup toolchain install --no-self-update
-      - uses: Swatinem/rust-cache@e18b497796c12c097a38f9edb9d0641fb99eee32 # v2
-      - uses: taiki-e/install-action@055f5df8c3f65ea01cd41e9dc855becd88953486 # v2.75.18
-        with:
-          tool: cargo-binstall@1.16.6
-      # - name: Install cargo-msrv
-      #   run: cargo binstall --no-confirm --force cargo-msrv
-      # - name: Check MSRV for each workspace member
-      #   run: |
-      #     export PATH="$HOME/.cargo/bin:$PATH"
-      #     ./scripts/check-msrv.sh
-      - name: Run cargo publish
-        run: cargo publish --workspace
+
+      - name: Publish unpublished crates
         env:
           CARGO_REGISTRY_TOKEN: ${{ secrets.CARGO_REGISTRY_TOKEN }}
+        run: |
+          set -euo pipefail
+
+          version="${RELEASE_TAG#v}"
+          metadata="$(cargo metadata --no-deps --format-version 1)"
+
+          mapfile -t publishable_crates < <(
+            jq -r '[.packages[] | select(.publish != []) | .name] | sort | .[]' <<< "${metadata}"
+          )
+
+          exclude_args=()
+          remaining_crates=()
+
+          for crate in "${publishable_crates[@]}"; do
+            if cargo info --quiet "${crate}@${version}" >/dev/null 2>&1; then
+              echo "${crate} ${version} already exists on crates.io; excluding it."
+              exclude_args+=(--exclude "${crate}")
+            else
+              remaining_crates+=("${crate}")
+            fi
+          done
+
+          if [[ "${#remaining_crates[@]}" -eq 0 ]]; then
+            echo "All publishable crates already exist on crates.io for ${version}."
+            exit 0
+          fi
+
+          echo "Publishing crates that are not yet on crates.io:"
+          printf '  %s\n' "${remaining_crates[@]}"
+
+          cargo publish --workspace --no-verify --locked "${exclude_args[@]}"