name: Publish

on:
  push:
    tags:
      - "v*"

env:
  CARGO_TERM_COLOR: always

jobs:
  publish:
    name: Publish crate
    runs-on: codeberg-small
    steps:
      - uses: actions/checkout@v4

      - name: Install Rust Toolchain
        uses: https://codeberg.org/PurpleBooth/common-pipelines/actions/install-rust@main
        with:
          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}

      - name: Publish to crates.io
        run: cargo publish --token ${{ secrets.CARGO_TOKEN }}

      - name: Install Cosign
        run: |
          curl -LO https://github.com/sigstore/cosign/releases/latest/download/cosign-linux-amd64
          chmod +x cosign-linux-amd64
          sudo mv cosign-linux-amd64 /usr/local/bin/cosign

      - name: Sign crate with Cosign
        run: |
          echo "${{ secrets.COSIGN_KEY }}" > cosign.key
          chmod 600 cosign.key
          CRATE=$(ls target/package/mit-commit-*.crate | head -n1)
          cosign sign-blob --key cosign.key --yes "$CRATE"
        env:
          COSIGN_PASSWORD: ${{ secrets.COSIGN_PASSWORD }}
