wasm-pack 0.15.1

on:
  push:
    tags:
      - 'v*' # Run when tag matches v*, i.e. v1.0, v20.15.10

name: Release
permissions:
  contents: read

env:
  RELEASE_BIN: wasm-pack
  RELEASE_DIR: artifacts
  GITHUB_REF: '${{ github.ref }}'
  WINDOWS_AMD64_TARGET: x86_64-pc-windows-msvc
  WINDOWS_ARM64_TARGET: aarch64-pc-windows-msvc
  MACOS_AMD64_TARGET: x86_64-apple-darwin
  MACOS_ARM64_TARGET: aarch64-apple-darwin
  LINUX_AMD64_TARGET: x86_64-unknown-linux-musl
  LINUX_ARM64_TARGET: aarch64-unknown-linux-musl

  # Space separated paths to include in the archive.
  RELEASE_ADDS: README.md LICENSE-APACHE LICENSE-MIT

jobs:
  build:
    name: Build artifacts
    runs-on: ${{ matrix.os }}
    strategy:
      matrix:
        include:
          - target: x86_64-unknown-linux-musl
            os: ubuntu-latest
            rust: stable
          - target: aarch64-unknown-linux-musl
            os: ubuntu-latest
            rust: stable
          - target: x86_64-apple-darwin
            os: macos-latest
            rust: stable
          - target: aarch64-apple-darwin
            os: macos-latest
            rust: stable
          - target: x86_64-pc-windows-msvc
            arch: amd64
            os: windows-latest
            rust: stable
          - target: aarch64-pc-windows-msvc
            arch: arm64
            os: windows-latest
            rust: stable

    steps:
      - uses: actions/checkout@v3
      - uses: dtolnay/rust-toolchain@stable
        with:
          toolchain: ${{ matrix.rust }}
          targets: wasm32-unknown-unknown

      - name: Query version number
        id: get_version
        shell: bash
        run: |
          echo "using version tag ${GITHUB_REF:10}"
          echo ::set-output name=version::"${GITHUB_REF:10}"

      - name: Install C compilation tooling (Linux)
        if: matrix.os == 'ubuntu-latest'
        run: |
          sudo apt-get update -y
          sudo apt-get install clang gcc-aarch64-linux-gnu musl-tools -y

      - name: Install p7zip (MacOS)
        if: matrix.os == 'macos-latest'
        run: brew install p7zip

      - name: Add rustup target
        run: rustup target add ${{ matrix.target }}

      - uses: taiki-e/install-action@v2
        with:
          tool: cross

      - name: Build
        run: cross build --release --target ${{ matrix.target }}

      - name: Set RUSTFLAGS (Windows)
        if: matrix.os == 'windows-latest'
        run: echo "RUSTFLAGS=-Ctarget-feature=+crt-static" >> $GITHUB_ENV

      - name: Create artifact directory
        run: |
          mkdir ${{ env.RELEASE_DIR }}
          mkdir -p ${{ env.RELEASE_DIR }}/${{ env.RELEASE_BIN }}-${{ steps.get_version.outputs.VERSION }}-${{ matrix.target }}

      - name: Move binaries (Linux/MacOS)
        if: matrix.os == 'ubuntu-latest' || matrix.os == 'macos-latest'
        run: |
          mv ./target/${{ matrix.target }}/release/${{ env.RELEASE_BIN }} ${{ env.RELEASE_DIR }}/${{ env.RELEASE_BIN }}-${{ steps.get_version.outputs.VERSION }}-${{ matrix.target }}/${{ env.RELEASE_BIN }}
          mv ${{ env.RELEASE_ADDS }} ./${{ env.RELEASE_DIR }}/${{ env.RELEASE_BIN }}-${{ steps.get_version.outputs.VERSION }}-${{ matrix.target }}

      - name: Move binaries (Windows)
        if: matrix.os == 'windows-latest'
        shell: bash
        run: |
          cp ./target/${{ matrix.target }}/release/${{ env.RELEASE_BIN }}.exe ./${{ env.RELEASE_DIR }}/${{ env.RELEASE_BIN }}-${{ steps.get_version.outputs.VERSION }}-${{ matrix.target }}/${{ env.RELEASE_BIN }}.exe
          cp ./target/${{ matrix.target }}/release/${{ env.RELEASE_BIN }}.exe wasm-pack-init-${{ matrix.arch }}.exe
          mv ${{ env.RELEASE_ADDS }} ./${{ env.RELEASE_DIR }}/${{ env.RELEASE_BIN }}-${{ steps.get_version.outputs.VERSION }}-${{ matrix.target }}
          mv wasm-pack-init-${{ matrix.arch }}.exe ${{ env.RELEASE_DIR }}

      - name: Create tarball
        shell: bash
        run: 7z a -ttar -so -an ./${{ env.RELEASE_DIR }}/${{ env.RELEASE_BIN }}-${{ steps.get_version.outputs.VERSION }}-${{ matrix.target }} | 7z a -si ./${{ env.RELEASE_DIR }}/${{ env.RELEASE_BIN }}-${{ steps.get_version.outputs.VERSION }}-${{ matrix.target }}.tar.gz

      - name: Upload Zip
        uses: actions/upload-artifact@v4
        with:
          name: ${{ matrix.target }}
          path: ./${{ env.RELEASE_DIR }}

  release:
    name: GitHub Release
    needs: build
    permissions:
      contents: write
    runs-on: ubuntu-latest
    steps:
      - name: Query version number
        id: get_version
        shell: bash
        run: |
          echo "using version tag ${GITHUB_REF:10}"
          echo ::set-output name=version::"${GITHUB_REF:10}"

      - uses: actions/checkout@v4

      # The npm package downloads its binary by this version, and npm is
      # published last, after the crate and release can no longer change.
      - name: Check npm package version
        shell: bash
        run: |
          set -euo pipefail
          version=$(jq -r .version npm/package.json)
          if [ "v$version" != "$GITHUB_REF_NAME" ]; then
            echo "::error::npm/package.json is at $version, but the tag is $GITHUB_REF_NAME"
            exit 1
          fi

      - name: Read release notes
        id: notes
        shell: bash
        run: |
          set -euo pipefail
          version=${GITHUB_REF_NAME#v}
          heading=$(grep -m1 -E "^## [^ ]+ ${version//./\\.}\$" CHANGELOG.md)
          awk -v h="$heading" '$0 == h {f = 1; next} f && /^## /{exit} f' CHANGELOG.md \
            | sed '/./,$!d' > "$RUNNER_TEMP/notes.md"
          test -s "$RUNNER_TEMP/notes.md"
          emoji=$(cut -d' ' -f2 <<< "$heading")
          echo "name=$emoji $GITHUB_REF_NAME" >> "$GITHUB_OUTPUT"

      # Published on approval, after which it's immutable.
      - name: Create Release
        id: create_release
        uses: actions/create-release@v1
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
        with:
          tag_name: ${{ steps.get_version.outputs.VERSION }}
          release_name: ${{ steps.notes.outputs.name }}
          body_path: ${{ runner.temp }}/notes.md
          draft: true

      - name: Download Linux amd64 tarball
        uses: actions/download-artifact@v4.1.7
        with:
          name: ${{ env.LINUX_AMD64_TARGET }}

      - name: Download Linux arm64 tarball
        uses: actions/download-artifact@v4.1.7
        with:
          name: ${{ env.LINUX_ARM64_TARGET }}

      - name: Download Windows amd64 tarball
        uses: actions/download-artifact@v4.1.7
        with:
          name: ${{ env.WINDOWS_AMD64_TARGET }}

      - name: Download Windows arm64 tarball
        uses: actions/download-artifact@v4.1.7
        with:
          name: ${{ env.WINDOWS_ARM64_TARGET }}

      - name: Download ARM64 MacOS tarball
        uses: actions/download-artifact@v4.1.7
        with:
          name: ${{ env.MACOS_ARM64_TARGET }}

      - name: Download AMD64 MacOS tarball
        uses: actions/download-artifact@v4.1.7
        with:
          name: ${{ env.MACOS_AMD64_TARGET }}

      - name: Release Linux amd64 tarball
        uses: actions/upload-release-asset@v1
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
        with:
          upload_url: ${{ steps.create_release.outputs.upload_url }}
          asset_path: ./wasm-pack-${{ steps.get_version.outputs.VERSION }}-${{ env.LINUX_AMD64_TARGET }}.tar.gz
          asset_content_type: application/gzip
          asset_name: wasm-pack-${{ steps.get_version.outputs.VERSION }}-${{ env.LINUX_AMD64_TARGET }}.tar.gz

      - name: Release Linux arm64 tarball
        uses: actions/upload-release-asset@v1
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
        with:
          upload_url: ${{ steps.create_release.outputs.upload_url }}
          asset_path: ./wasm-pack-${{ steps.get_version.outputs.VERSION }}-${{ env.LINUX_ARM64_TARGET }}.tar.gz
          asset_content_type: application/gzip
          asset_name: wasm-pack-${{ steps.get_version.outputs.VERSION }}-${{ env.LINUX_ARM64_TARGET }}.tar.gz

      - name: Release Windows amd64 tarball
        uses: actions/upload-release-asset@v1
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
        with:
          upload_url: ${{ steps.create_release.outputs.upload_url }}
          asset_path: ./wasm-pack-${{ steps.get_version.outputs.VERSION }}-${{ env.WINDOWS_AMD64_TARGET }}.tar.gz
          asset_content_type: application/gzip
          asset_name: wasm-pack-${{ steps.get_version.outputs.VERSION }}-${{ env.WINDOWS_AMD64_TARGET }}.tar.gz

      - name: Release Windows arm64 tarball
        uses: actions/upload-release-asset@v1
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
        with:
          upload_url: ${{ steps.create_release.outputs.upload_url }}
          asset_path: ./wasm-pack-${{ steps.get_version.outputs.VERSION }}-${{ env.WINDOWS_ARM64_TARGET }}.tar.gz
          asset_content_type: application/gzip
          asset_name: wasm-pack-${{ steps.get_version.outputs.VERSION }}-${{ env.WINDOWS_ARM64_TARGET }}.tar.gz

      - name: Release Windows init amd64 exe
        uses: actions/upload-release-asset@v1
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
        with:
          upload_url: ${{ steps.create_release.outputs.upload_url }}
          asset_path: ./wasm-pack-init-amd64.exe
          asset_content_type: application/vnd.microsoft.portable-executable
          # don't change the file name for the 0 people that install via some script that hardcodes this file name
          asset_name: wasm-pack-init.exe

      - name: Release Windows init ARM64 exe
        uses: actions/upload-release-asset@v1
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
        with:
          upload_url: ${{ steps.create_release.outputs.upload_url }}
          asset_path: ./wasm-pack-init-arm64.exe
          asset_content_type: application/vnd.microsoft.portable-executable
          asset_name: wasm-pack-init-arm64.exe

      - name: Release AMD64 MacOS tarball
        uses: actions/upload-release-asset@v1
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
        with:
          upload_url: ${{ steps.create_release.outputs.upload_url }}
          asset_path: ./wasm-pack-${{ steps.get_version.outputs.VERSION }}-${{ env.MACOS_AMD64_TARGET }}.tar.gz
          asset_content_type: application/gzip
          asset_name: wasm-pack-${{ steps.get_version.outputs.VERSION }}-${{ env.MACOS_AMD64_TARGET }}.tar.gz
      - name: Release ARM64 MacOS tarball
        uses: actions/upload-release-asset@v1
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
        with:
          upload_url: ${{ steps.create_release.outputs.upload_url }}
          asset_path: ./wasm-pack-${{ steps.get_version.outputs.VERSION }}-${{ env.MACOS_ARM64_TARGET }}.tar.gz
          asset_content_type: application/gzip
          asset_name: wasm-pack-${{ steps.get_version.outputs.VERSION }}-${{ env.MACOS_ARM64_TARGET }}.tar.gz

      # Releases are immutable once published, so check the draft has every
      # asset before it goes for approval.
      - name: Check release assets
        shell: bash
        env:
          GH_TOKEN: ${{ github.token }}
        run: |
          set -euo pipefail
          for target in $LINUX_AMD64_TARGET $LINUX_ARM64_TARGET $WINDOWS_AMD64_TARGET \
              $WINDOWS_ARM64_TARGET $MACOS_AMD64_TARGET $MACOS_ARM64_TARGET; do
            echo "wasm-pack-$GITHUB_REF_NAME-$target.tar.gz"
          done > expected
          printf '%s\n' wasm-pack-init.exe wasm-pack-init-arm64.exe >> expected
          sort -o expected expected
          gh release view "$GITHUB_REF_NAME" --repo "$GITHUB_REPOSITORY" --json isDraft,assets \
            --jq 'if .isDraft then .assets[].name else error("not a draft") end' | sort > uploaded
          diff expected uploaded

  # One approval publishes everything, the crate first, so the release, which
  # is immutable once published, stays a draft if that fails, and npm last,
  # since its package downloads the binary from the public release.
  publish:
    name: Publish
    environment:
      name: publish
      deployment: false
    permissions:
      contents: write
      id-token: write
    if: github.repository == 'wasm-bindgen/wasm-pack'
    needs: release
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
        with:
          persist-credentials: false
      - uses: dtolnay/rust-toolchain@stable
      - uses: rust-lang/crates-io-auth-action@v1
        id: auth
      # Skipped when a re-run of a later step finds it already published.
      - shell: bash
        env:
          CARGO_REGISTRY_TOKEN: ${{ steps.auth.outputs.token }}
        run: |
          if curl -fsS -o /dev/null -A "wasm-pack release (github.com/wasm-bindgen/wasm-pack)" \
              "https://crates.io/api/v1/crates/wasm-pack/${GITHUB_REF_NAME#v}"; then
            echo "wasm-pack ${GITHUB_REF_NAME#v} is already published"
          else
            cargo publish
          fi

      - run: gh release edit "$GITHUB_REF_NAME" --repo "$GITHUB_REPOSITORY" --draft=false --latest
        env:
          GH_TOKEN: ${{ github.token }}

      - uses: actions/setup-node@v4
        with:
          node-version: '24'
          registry-url: 'https://registry.npmjs.org'
      # Trusted publishing needs npm 11.5.1 or later.
      - run: npm install -g npm@11.6.2
      - name: Publish to npm
        working-directory: npm
        run: npm publish --access public