name: Publish runtime Wasm
on:
push:
tags:
- v*
workflow_dispatch:
inputs:
release_tag:
description: Release tag to build from
required: false
type: string
workflow_call:
inputs:
release_tag:
description: Release tag to build from
required: true
type: string
env:
CARGO_TERM_COLOR: always
RELEASE_TAG: ${{ inputs.release_tag || github.ref_name }}
IMAGE_NAME: ${{ github.repository }}
COMPONENT_SOURCE: https://github.com/${{ github.repository }}
COMPONENT_HOMEPAGE: https://github.com/${{ github.repository }}
COMPONENT_LICENSES: Apache-2.0
WASM_FILE: dist/componentize_qjs_runtime.wasm
WASM_FILE_OPT_SIZE: dist/componentize_qjs_runtime_opt_size.wasm
WASM_FILE_SYNC: dist/componentize_qjs_runtime_sync.wasm
WASM_FILE_OPT_SIZE_SYNC: dist/componentize_qjs_runtime_opt_size_sync.wasm
SBOM_FILE: dist/componentize_qjs_runtime.wasm.cdx.json
SBOM_FILE_OPT_SIZE: dist/componentize_qjs_runtime_opt_size.wasm.cdx.json
SBOM_FILE_SYNC: dist/componentize_qjs_runtime_sync.wasm.cdx.json
SBOM_FILE_OPT_SIZE_SYNC: dist/componentize_qjs_runtime_opt_size_sync.wasm.cdx.json
jobs:
build:
name: Build runtime Wasm
runs-on: ubuntu-latest
outputs:
version: ${{ steps.version.outputs.version }}
permissions:
contents: read
steps:
- name: Checkout
uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 with:
persist-credentials: false
ref: ${{ env.RELEASE_TAG }}
- name: Install Rust
uses: dtolnay/rust-toolchain@29eef336d9b2848a0b548edc03f92a220660cdb8 with:
targets: wasm32-wasip2
- name: Install cargo-binstall
uses: cargo-bins/cargo-binstall@aaa84a43aec4955a42c5ffc65d258961e39f276e
- name: Compute runtime version
id: version
shell: bash
run: |
version="${RELEASE_TAG#v}"
test -n "$version" || { echo "ERROR: release tag is empty"; exit 1; }
echo "version=${version}" >> "$GITHUB_OUTPUT"
- name: Install build tools
run: |
cargo binstall cargo-auditable --force
cargo binstall auditable2cdx --force
- name: Build auditable runtime
shell: bash
run: |
bash .github/scripts/prepare-runtime-artifacts.sh \
target/runtime-publish \
dist \
runtime.wasm=componentize_qjs_runtime.wasm \
runtime-opt-size.wasm=componentize_qjs_runtime_opt_size.wasm \
runtime-sync.wasm=componentize_qjs_runtime_sync.wasm \
runtime-opt-size-sync.wasm=componentize_qjs_runtime_opt_size_sync.wasm
- name: Upload runtime artifacts
uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a with:
name: componentize-qjs-runtime
path: |
${{ env.WASM_FILE }}
${{ env.WASM_FILE }}.sha256
${{ env.SBOM_FILE }}
${{ env.WASM_FILE_OPT_SIZE }}
${{ env.WASM_FILE_OPT_SIZE }}.sha256
${{ env.SBOM_FILE_OPT_SIZE }}
${{ env.WASM_FILE_SYNC }}
${{ env.WASM_FILE_SYNC }}.sha256
${{ env.SBOM_FILE_SYNC }}
${{ env.WASM_FILE_OPT_SIZE_SYNC }}
${{ env.WASM_FILE_OPT_SIZE_SYNC }}.sha256
${{ env.SBOM_FILE_OPT_SIZE_SYNC }}
if-no-files-found: error
publish:
name: Publish ${{ matrix.runtime.name }} runtime (${{ matrix.channel }})
if: github.event_name != 'workflow_dispatch'
needs: build
runs-on: ubuntu-latest
permissions:
actions: read
id-token: write
packages: write
contents: read
strategy:
fail-fast: false
matrix:
runtime:
- name: default
wasm: dist/componentize_qjs_runtime.wasm
sbom: dist/componentize_qjs_runtime.wasm.cdx.json
oci: componentize-qjs-runtime
description: QuickJS runtime for componentize-qjs
- name: opt-size
wasm: dist/componentize_qjs_runtime_opt_size.wasm
sbom: dist/componentize_qjs_runtime_opt_size.wasm.cdx.json
oci: componentize-qjs-runtime-opt-size
description: QuickJS runtime for componentize-qjs optimized for size
- name: sync
wasm: dist/componentize_qjs_runtime_sync.wasm
sbom: dist/componentize_qjs_runtime_sync.wasm.cdx.json
oci: componentize-qjs-runtime-sync
description: Non-async QuickJS runtime for componentize-qjs
- name: opt-size-sync
wasm: dist/componentize_qjs_runtime_opt_size_sync.wasm
sbom: dist/componentize_qjs_runtime_opt_size_sync.wasm.cdx.json
oci: componentize-qjs-runtime-opt-size-sync
description: Non-async QuickJS runtime for componentize-qjs optimized for size
channel: [versioned, latest]
steps:
- name: Checkout
uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 with:
persist-credentials: false
ref: ${{ env.RELEASE_TAG }}
- name: Download runtime artifacts
uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c with:
name: componentize-qjs-runtime
path: dist
- name: Install Rust
uses: dtolnay/rust-toolchain@29eef336d9b2848a0b548edc03f92a220660cdb8
- name: Install cargo-binstall
uses: cargo-bins/cargo-binstall@aaa84a43aec4955a42c5ffc65d258961e39f276e
- name: Install wkg
run: cargo binstall wkg --force
- name: Login to GitHub Container Registry
uses: docker/login-action@650006c6eb7dba73a995cc03b0b2d7f5ca915bee with:
registry: ghcr.io
username: ${{ github.actor }}
password: ${{ github.token }}
- name: Install cosign
uses: sigstore/cosign-installer@6f9f17788090df1f26f669e9d70d6ae9567deba6
- name: Publish runtime
uses: ./.github/actions/publish-runtime
with:
file: ${{ matrix.runtime.wasm }}
sbom-file: ${{ matrix.runtime.sbom }}
oci-reference-without-tag: ghcr.io/${{ env.IMAGE_NAME }}/${{ matrix.runtime.oci }}
version: ${{ matrix.channel == 'versioned' && needs.build.outputs.version || 'latest' }}
description: ${{ matrix.runtime.description }}
source: ${{ env.COMPONENT_SOURCE }}
homepage: ${{ env.COMPONENT_HOMEPAGE }}
licenses: ${{ env.COMPONENT_LICENSES }}