rust-release.yml

#
# Copyright 2023 The Sigstore Authors.
#
# Licensed under the Apache License, Version 2.0 (the "License");
# you may not use this file except in compliance with the License.
# You may obtain a copy of the License at
#
#     http://www.apache.org/licenses/LICENSE-2.0
#
# Unless required by applicable law or agreed to in writing, software
# distributed under the License is distributed on an "AS IS" BASIS,
# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
# See the License for the specific language governing permissions and
# limitations under the License.

on:
  push:
    tags:
      - 'release/rust/v*'

name: release Rust crate

jobs:
  publish:
    name: Publish to crates.io
    runs-on: ubuntu-latest

    steps:
    - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
      with:
        persist-credentials: false

    - name: Authenticate to Google Cloud
      uses: google-github-actions/auth@71f986410dfbc7added4569d411d040a91dc6935 # v2.1.8
      with:
        workload_identity_provider: projects/306323169285/locations/global/workloadIdentityPools/github-actions-pool/providers/github-actions-provider
        service_account: protobuf-specs-releaser@sigstore-secrets.iam.gserviceaccount.com

    - uses: google-github-actions/get-secretmanager-secrets@a8440875e1c2892062aef9061228d4f1af8f919b # v2.2.3
      id: secrets
      with:
        secrets: |-
          cargo_registry_token:sigstore-secrets/protobuf-specs-cargo-registry-token

    - run: RUST_ACTION='publish -p sigstore_protobuf_specs' make rust
      env:
        CARGO_REGISTRY_TOKEN: "${{ steps.secrets.outputs.cargo_registry_token }}"