name: "Install NSS for nss-rs"
description: >
  Read the NSS version and release tarball SHA256 required by nss-rs via
  nss-metadata, then install that NSS via mozilla/actions/nss.

inputs:
  working-directory:
    description: "Directory containing the Cargo.toml to read."
    default: "."
  target:
    description: "Target for cross-compilation."
    default: ""
  token:
    description: "A GitHub PAT, or the default workflow token if omitted; used to avoid rate limits when fetching build scripts."
    required: false

outputs:
  min-version:
    description: "Minimum NSS version required by nss-rs."
    value: ${{ steps.meta.outputs.min-version }}
  sha256:
    description: "SHA256 of the matching NSS release tarball."
    value: ${{ steps.meta.outputs.sha256 }}
  crate-version:
    description: "Version of the nss-rs crate."
    value: ${{ steps.meta.outputs.crate-version }}

runs:
  using: composite
  steps:
    - id: meta
      uses: $/.github/actions/nss-metadata
      with:
        working-directory: ${{ inputs.working-directory }}

    - uses: mozilla/actions/nss@2152d1412122b04d838d6341aa3b4d6160b3de32 # v2.0.5
      with:
        minimum-version: ${{ steps.meta.outputs.min-version }}
        sha256: ${{ steps.meta.outputs.sha256 }}
        target: ${{ inputs.target }}
        token: ${{ inputs.token || github.token }}