name: publish-rust-crate
description: Publish a Rust crate to JFrog Artifactory.

inputs:
  working-directory:
    description: Directory containing Cargo.toml
    required: false
    default: "."
  rust-version:
    description: Rust toolchain version
    required: false
    default: "1.95.0"
  jfrog-token:
    description: JFrog token for the Artifactory Cargo registry
    required: true
  registry-name:
    description: Cargo registry name
    required: false
    default: artifactory
  registry-index:
    description: Cargo registry index URL
    required: false
    default: "sparse+https://schmalz.jfrog.io/artifactory/api/cargo/schmalz-cargo-local/index/"

runs:
  using: composite
  steps:
    # Pinned to commit SHA instead of a tag to prevent supply chain attacks.
    # dtolnay/rust-toolchain v1 (2026-03-27) — https://github.com/dtolnay/rust-toolchain/commit/3c5f7ea28cd621ae0bf5283f0e981fb97b8a7af9
    - name: Setup Rust toolchain
      uses: dtolnay/rust-toolchain@3c5f7ea28cd621ae0bf5283f0e981fb97b8a7af9
      with:
        toolchain: ${{ inputs.rust-version }}

    - name: Configure Cargo registry (JFrog Artifactory)
      shell: bash
      env:
        JFROG_TOKEN: ${{ inputs.jfrog-token }}
        REGISTRY_NAME: ${{ inputs.registry-name }}
        REGISTRY_INDEX: ${{ inputs.registry-index }}
      run: |
        set -euo pipefail

        CARGO_HOME_DIR="${CARGO_HOME:-$HOME/.cargo}"
        mkdir -p "${CARGO_HOME_DIR}"

        cat >> "${CARGO_HOME_DIR}/config.toml" <<EOF
        [registries.${REGISTRY_NAME}]
        index = "${REGISTRY_INDEX}"
        [registry]
        global-credential-providers = ["cargo:token"]
        EOF

        cat >> "${CARGO_HOME_DIR}/credentials.toml" <<EOF
        [registries.${REGISTRY_NAME}]
        token = "Bearer ${JFROG_TOKEN}"
        EOF

    - name: Publish
      shell: bash
      working-directory: ${{ inputs.working-directory }}
      env:
        REGISTRY_NAME: ${{ inputs.registry-name }}
      run: cargo publish --registry "${REGISTRY_NAME}"