From 6f6935cdcd6030199ef907f8220987846c3e8f8b Mon Sep 17 00:00:00 2001
From: James Tippett <james.tippett@gmail.com>
Date: Sat, 20 Jun 2026 01:38:57 +0700
Subject: [PATCH] Automate checksum generation + Hex publish in release
 pipeline

Mirrors the ex_monty setup: adds a manual-approval-gated 'publish' job to
release.yml that generates checksum-Elixir.ExBashkit.Native.exs from the
released NIF artifacts and runs 'mix hex.publish'. Gated by the 'hex'
GitHub Environment (required reviewer).

No more manual checksum commits or tag-after-checksum re-tagging.
---
 .github/workflows/release.yml | 49 ++++++++++++++++++++++++++++++++---
 1 file changed, 46 insertions(+), 3 deletions(-)

diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index 538a95e..d35f554 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -1,8 +1,10 @@
 name: Build precompiled NIFs
 
-# Push a tag (v0.1.0, v0.2.0, ...) to build NIFs for every target and attach
-# them to a GitHub release. AFTER this finishes, regenerate the checksum file
-# locally and `mix hex.publish` — see UPDATE_PROCEDURE.md.
+# Push a tag (v0.1.0, v0.2.0, ...) to: build NIFs for every target, attach them
+# to a GitHub release, generate the checksum file from those artifacts, and
+# publish to Hex. The `publish` job is gated by the `hex` environment, so it
+# pauses for a required-reviewer approval before anything ships. See
+# UPDATE_PROCEDURE.md.
 
 on:
   push:
@@ -89,3 +91,44 @@ jobs:
         uses: softprops/action-gh-release@v2
         with:
           files: artifacts/*.tar.gz
+
+  # Generates the precompiled-NIF checksum file from the artifacts just attached
+  # to the GitHub release, then publishes to Hex. Gated by the `hex` environment:
+  # GitHub pauses here for a required reviewer to approve, so you still eyeball
+  # the release before anything ships. No manual checksum commit, no re-tag.
+  publish:
+    name: Publish to Hex
+    needs: release
+    runs-on: ubuntu-latest
+    environment: hex
+    env:
+      # Build the NIF locally so `mix compile` doesn't try to download a NIF
+      # whose checksum isn't generated yet (the classic chicken-and-egg).
+      EXBASHKIT_BUILD: "1"
+      HEX_API_KEY: ${{ secrets.HEX_API_KEY }}
+    steps:
+      - uses: actions/checkout@v5
+
+      - name: Set up Elixir
+        uses: erlef/setup-beam@v1
+        with:
+          otp-version: "27.2"
+          elixir-version: "1.18.0"
+
+      - uses: dtolnay/rust-toolchain@stable
+
+      - name: Fetch dependencies
+        run: mix deps.get
+
+      - name: Generate checksums from the released artifacts
+        # Downloads each target's NIF from the GitHub release created above and
+        # writes checksum-Elixir.ExBashkit.Native.exs — the canonical way, so the
+        # format always matches what rustler_precompiled expects at fetch time.
+        run: mix rustler_precompiled.download ExBashkit.Native --all --print
+
+      - name: Publish package to Hex
+        run: mix hex.publish package --yes
+
+      - name: Publish docs to HexDocs
+        continue-on-error: true
+        run: mix hex.publish docs --yes