Merge pull request #543 from mrmoney10010-design/movement #198
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: Release | ||
|
Check failure on line 1 in .github/workflows/release.yml
|
||
| on: | ||
| push: | ||
| tags: | ||
| - 'v*.*.*' | ||
| workflow_dispatch: | ||
| permissions: | ||
| contents: write | ||
| packages: write | ||
| id-token: write | ||
| jobs: | ||
| release: | ||
| name: Build and Release WASM Artifacts | ||
| runs-on: ubuntu-latest | ||
| steps: | ||
| - name: Checkout | ||
| uses: actions/checkout@v4 | ||
| with: | ||
| fetch-depth: 0 | ||
| - name: Install Rust | ||
| uses: dtolnay/rust-toolchain@stable | ||
| with: | ||
| targets: wasm32-unknown-unknown | ||
| components: rustfmt, clippy | ||
| - name: Install wasm_opt (Binaryen) | ||
| run: | | ||
| sudo apt-get update | ||
| sudo apt-get install -y binaryen | ||
| - name: Build contracts | ||
| run: | | ||
| chmod +x scripts/build.sh | ||
| ./scripts/build.sh | ||
| - name: Prepare artifacts | ||
| shell: bash | ||
| run: | | ||
| set -euo pipefail | ||
| TAG="${GITHUB_REF_NAME}" | ||
| mkdir -p dist artifacts | ||
| shopt -s nullglob | ||
| # Copy WASM files | ||
| for wasm in target/wasm32-unknown-unknown/release/*.wasm; do | ||
| base="$(basename "$wasm")" | ||
| name="${base%.wasm}" | ||
| cp "$wasm" "dist/$base" | ||
| done | ||
| for wasm in target/wasm32-unknown-unknown/release/*.optimized.wasm; do | ||
| base="$(basename "$wasm")" | ||
| cp "$wasm" "dist/$base" | ||
| done | ||
| # Generate checksums | ||
| if compgen -G "dist/*" > /dev/null; then | ||
| if command -v sha256sum >/dev/null 2>&1; then | ||
| (cd dist && sha256sum * > SHA256SUMS.txt) | ||
| else | ||
| (cd dist && shasum -a 256 * > SHA256SUMS.txt) | ||
| fi | ||
| fi | ||
| echo "Artifacts prepared in dist/" | ||
| - name: Generate SBOM | ||
| run: | | ||
| set -euo pipefail | ||
| # Install Syft for SBOM generation | ||
| curl -sSfL https://raw.githubusercontent.com/anchore/syft/main/install.sh | sh -s -- -b /usr/local/bin | ||
| syft version | ||
| # Generate SBOM for the entire repository including build artifacts | ||
| mkdir -p dist | ||
| syft packages . -o spdx-json --file dist/sbom.spdx.json | ||
| # Also generate SBOM for just the WASM artifacts | ||
| if compgen -G "dist/*.wasm" > /dev/null; then | ||
| syft packages dist/*.wasm -o spdx-json --file dist/sbom-wasm.spdx.json | ||
| fi | ||
| echo "SBOM generated successfully" | ||
| ls -la dist/*.spdx.json | ||
| - name: Upload CI Artifacts (structured) | ||
| uses: actions/upload-artifact@v4 | ||
| with: | ||
| name: wasm-artifacts-${{ github.ref_name }} | ||
| path: | | ||
| artifacts/** | ||
| dist/** | ||
| if-no-files-found: error | ||
| - name: Generate changelog | ||
| id: changelog | ||
| shell: bash | ||
| run: | | ||
| set -euo pipefail | ||
| TAG="${GITHUB_REF_NAME}" | ||
| BODY="" | ||
| if [ -f .git-cliff.toml ]; then | ||
| if ! command -v git-cliff >/dev/null 2>&1; then | ||
| cargo install git-cliff --locked | ||
| fi | ||
| BODY=$(git-cliff --tag "$TAG" --config .git-cliff.toml 2>/dev/null || echo "") | ||
| fi | ||
| if [ -z "$BODY" ]; then | ||
| BODY="Release $TAG\n\nSee the attached artifacts for compiled WASM files and SBOM." | ||
| fi | ||
| echo "body<<EOF" >> "$GITHUB_OUTPUT" | ||
| echo "$BODY" >> "$GITHUB_OUTPUT" | ||
| echo "EOF" >> "$GITHUB_OUTPUT" | ||
| - name: Create GitHub Release | ||
| uses: softprops/action-gh-release@v2 | ||
| with: | ||
| tag_name: ${{ github.ref_name }} | ||
| name: ${{ github.ref_name }} | ||
| body: ${{ steps.changelog.outputs.body }} | ||
| draft: false | ||
| prerelease: ${{ contains(github.ref_name, '-') }} | ||
| files: | | ||
| dist/* | ||
| artifacts/** | ||
| include_assets_pattern: | | ||
| dist/*.wasm | ||
| dist/*.spdx.json | ||
| dist/*.sig | ||
| dist/SHA256SUMS.txt | ||
| artifacts/** | ||
| - name: Set up Cosign | ||
| if: ${{ secrets.COSIGN_PRIVATE_KEY != '' }} | ||
| uses: sigstore/cosign-installer@v3.7.0 | ||
| - name: Sign artifacts with Cosign | ||
| if: ${{ secrets.COSIGN_PRIVATE_KEY != '' }} | ||
| env: | ||
| COSIGN_PRIVATE_KEY: ${{ secrets.COSIGN_PRIVATE_KEY }} | ||
| COSIGN_PASSWORD: ${{ secrets.COSIGN_PASSWORD }} | ||
| run: | | ||
| set -euo pipefail | ||
| echo "Signing all release artifacts including SBOM..." | ||
| # Sign WASM artifacts and checksums | ||
| for f in $(find dist artifacts -type f ! -name "*.txt" ! -name "*.sig"); do | ||
| echo "Signing: $f" | ||
| cosign sign-blob --key cosign.key "$f" --output-signature "$f.sig" | ||
| done | ||
| # Sign SBOM files specifically | ||
| for sbom in dist/*.spdx.json; do | ||
| if [ -f "$sbom" ]; then | ||
| echo "Signing SBOM: $sbom" | ||
| cosign sign-blob --key cosign.key "$sbom" --output-signature "$sbom.sig" | ||
| fi | ||
| done | ||
| # List all signed files | ||
| echo "Signed files:" | ||
| find dist artifacts -name "*.sig" -type f | ||
| rm -f cosign.key | ||
