ci(wit): validate and publish wasmCloud WIT interfaces#5149
Conversation
Builds each wit/<pkg>/ with `wash wit build`, embeds provenance via `wasm-tools metadata add`, and on push to main publishes to ghcr.io/wasmcloud/interfaces/<name>:<version> with gh attestation. Stable versions are immutable. Re-pushing an existing tag is a no-op. A new workflow opens weekly PRs to bump pinned wasm-tools since dependabot doesn't cover it. Signed-off-by: Bailey Hayes <bailey@cosmonic.com>
vados-cosmonic
left a comment
There was a problem hiding this comment.
LGTM 🚀
So I think we might be starting to do too much bash in scripts. I dunno if we want to introduce xtask or use JS or Go or something, but I'm sure hoping these scripts don't break often (or at least LLMs will always be good at modifying/updating bash!)
That said, this code seems like the kind that will not change for months if not years if it works just fine!
Yeah I waffled on this one, but like I did for the WASI repo, I think we should lean into JS for actions logic. I have another incoming PR for benching and for that I'll look at xtask since we're essentially building on two different crates (callgrind and criterion). |
- Extract the publish-matrix builder to .github/scripts/build-wit-matrix.mjs. JSON construction via JSON.stringify is harder to get wrong than the prior bash string-concat. - Move `gate` to the bottom and add `publish` to its needs so a publish failure also fails the required check. - Reword the wkg.lock-out-of-sync error to read naturally for >1 file. - Add blank lines between adjacent steps in validate/publish. Signed-off-by: Bailey Hayes <bailey@cosmonic.com>
Builds each wit// with
wash wit build, embeds provenance viawasm-tools metadata add, and on push to main publishes to ghcr.io/wasmcloud/interfaces/: with gh attestation. Stable versions are immutable. Re-pushing an existing tag is a no-op.I took the existing interfaces wasmcloud:messaging and wasmcloud:secrets and added them to the project root.
A new workflow opens weekly PRs to bump pinned wasm-tools since dependabot doesn't cover it.