|
| 1 | +name: Build and publish a Wasm Component to GitHub Artifacts |
| 2 | + |
| 3 | +on: |
| 4 | + push: |
| 5 | + tags: |
| 6 | + - v* |
| 7 | + workflow_dispatch: |
| 8 | + |
| 9 | +env: |
| 10 | + IMAGE_NAME: ${{ github.repository }} |
| 11 | + CARGO_COMPONENT_VERSION: "0.16.0" |
| 12 | + COMPONENT_NAME: udp-echo-server |
| 13 | + COMPONENT_NAME_UNDERSCORED: udp_echo_server |
| 14 | + |
| 15 | +jobs: |
| 16 | + publish: |
| 17 | + runs-on: ubuntu-latest |
| 18 | + permissions: |
| 19 | + id-token: write |
| 20 | + packages: write |
| 21 | + contents: read |
| 22 | + |
| 23 | + steps: |
| 24 | + - name: Checkout repository |
| 25 | + uses: actions/checkout@v2 |
| 26 | + |
| 27 | + - name: Install cargo-binstall |
| 28 | + uses: cargo-bins/cargo-binstall@v1.10.15 |
| 29 | + |
| 30 | + - name: Docker meta |
| 31 | + id: meta |
| 32 | + uses: docker/metadata-action@v5 |
| 33 | + with: |
| 34 | + images: ghcr.io/${{ github.actor }}/{{ env.COMPONENT_NAME }} |
| 35 | + tags: | |
| 36 | + type=semver,pattern={{version}} |
| 37 | +
|
| 38 | + - name: Login to GitHub Container Registry |
| 39 | + uses: docker/login-action@v3 |
| 40 | + with: |
| 41 | + registry: ghcr.io |
| 42 | + username: ${{ github.actor }} |
| 43 | + password: ${{ secrets.GITHUB_TOKEN }} |
| 44 | + |
| 45 | + - name: Install cosign |
| 46 | + if: github.event_name != 'workflow_dispatch' |
| 47 | + uses: sigstore/cosign-installer@v3.7.0 |
| 48 | + |
| 49 | + - name: Cache cargo bin |
| 50 | + id: cache-cargo |
| 51 | + uses: actions/cache@v3 |
| 52 | + env: |
| 53 | + cache-name: cache-cargo-bin |
| 54 | + with: |
| 55 | + path: ~/.cargo/bin |
| 56 | + key: ${{ runner.os }}-build-${{ env.cache-name }}-${{ hashFiles('scripts/install.sh') }} |
| 57 | + restore-keys: | |
| 58 | + ${{ runner.os }}-build-${{ env.cache-name }}- |
| 59 | + ${{ runner.os }}-build- |
| 60 | + ${{ runner.os }}- |
| 61 | +
|
| 62 | + - if: ${{ steps.cache-cargo.outputs.cache-hit != 'true' }} |
| 63 | + name: Install build dependencies |
| 64 | + continue-on-error: false |
| 65 | + run: | |
| 66 | + cargo binstall cargo-component --force --version ${{ env.CARGO_COMPONENT_VERSION }} |
| 67 | + cargo binstall wkg --force |
| 68 | + cargo binstall cargo-auditable cargo-audit |
| 69 | +
|
| 70 | + - name: Build the component |
| 71 | + run: cargo auditable component build --release |
| 72 | + |
| 73 | + - name: Publish `:<version>` to GitHub Container Registry |
| 74 | + if: github.event_name != 'workflow_dispatch' |
| 75 | + id: publish_versioned |
| 76 | + uses: bytecodealliance/wkg-github-action@v5 |
| 77 | + with: |
| 78 | + file: target/wasm32-wasip1/release/${{ env.COMPONENT_NAME_UNDERSCORED }}.wasm |
| 79 | + oci-reference-without-tag: ghcr.io/${{ env.IMAGE_NAME }}/${{ env.COMPONENT_NAME }} |
| 80 | + version: ${{ fromJSON(steps.meta.outputs.json).labels['org.opencontainers.image.version'] }} |
| 81 | + |
| 82 | + - name: Sign the versioned wasm component |
| 83 | + if: github.event_name != 'workflow_dispatch' |
| 84 | + run: cosign sign --yes ghcr.io/${{ env.IMAGE_NAME }}/${{ env.COMPONENT_NAME }}@${{ steps.publish_versioned.outputs.digest }} |
| 85 | + |
| 86 | + - name: Publish `:latest` release to GitHub Container Registry |
| 87 | + if: github.event_name != 'workflow_dispatch' |
| 88 | + id: publish_latest |
| 89 | + uses: bytecodealliance/wkg-github-action@v5 |
| 90 | + with: |
| 91 | + file: target/wasm32-wasip1/release/${{ env.COMPONENT_NAME_UNDERSCORED }}.wasm |
| 92 | + oci-reference-without-tag: ghcr.io/${{ env.IMAGE_NAME }}/${{ env.COMPONENT_NAME }} |
| 93 | + version: latest |
| 94 | + |
| 95 | + - name: Sign the latest wasm component |
| 96 | + if: github.event_name != 'workflow_dispatch' |
| 97 | + run: cosign sign --yes ghcr.io/${{ env.IMAGE_NAME }}/${{ env.COMPONENT_NAME }}@${{ steps.publish_latest.outputs.digest }} |
| 98 | + |
0 commit comments