fix(publish): push each matrix variant to its own repo #85
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: CI | |
| on: | |
| push: | |
| branches: [main] | |
| pull_request: | |
| permissions: | |
| contents: read | |
| env: | |
| CARGO_TERM_COLOR: always | |
| jobs: | |
| build: | |
| name: Build (${{ matrix.name }}) | |
| runs-on: ubuntu-latest | |
| strategy: | |
| matrix: | |
| include: | |
| - name: sqlite | |
| artifact: component-sqlite.wasm | |
| - name: sqlite-vec | |
| artifact: component-sqlite-vec.wasm | |
| steps: | |
| - uses: actions/checkout@v7 | |
| - uses: moonrepo/setup-rust@v1 | |
| with: | |
| bins: wkg, just | |
| env: | |
| GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} | |
| - uses: bytecodealliance/setup-wasi-sdk-action@main | |
| with: | |
| version: "33" | |
| - run: just init | |
| # `pack` (not `build`): the e2e job runs this artifact as-is, and an | |
| # unpacked wasm carries no act:component section — no declared capability | |
| # ceiling, so every wasi:filesystem access is denied whatever --grant says. | |
| # Packing also applies the variant's std.name (sqlite-vec). | |
| - run: just pack ${{ matrix.name }} | |
| - run: cp target/wasm32-wasip2/release/component_sqlite.wasm ${{ matrix.artifact }} | |
| - uses: actions/upload-artifact@v7 | |
| with: | |
| name: ${{ matrix.name }} | |
| path: ${{ matrix.artifact }} | |
| e2e: | |
| name: E2E (${{ matrix.name }}) | |
| needs: build | |
| runs-on: ubuntu-latest | |
| strategy: | |
| matrix: | |
| include: | |
| - name: sqlite | |
| artifact: component-sqlite.wasm | |
| hurl: "e2e/*.hurl" | |
| - name: sqlite-vec | |
| artifact: component-sqlite-vec.wasm | |
| hurl: "e2e/*.hurl e2e/vec/*.hurl" | |
| steps: | |
| - uses: actions/checkout@v7 | |
| - uses: actions/download-artifact@v8 | |
| with: | |
| name: ${{ matrix.name }} | |
| - name: Test | |
| run: | | |
| DB_DIR=$(mktemp -d) | |
| GRANT="{\"wasi:filesystem\":{\"mode\":\"allowlist\",\"allow\":[{\"path\":\"/dev/urandom\",\"mode\":\"rw\"},{\"path\":\"$DB_DIR\",\"mode\":\"rw\"}]}}" | |
| # sqlite is a session-provider (per-session DB connection); pre-open a | |
| # session-of-1 so the stateless hurl tool calls resolve to it. | |
| SESSION_ARGS="{\"database_path\":\"$DB_DIR/test.db\"}" | |
| npx @actcore/act run --http --listen 3000 ${{ matrix.artifact }} --grant "$GRANT" --session-args "$SESSION_ARGS" & | |
| curl --retry 60 --retry-connrefused --retry-delay 1 -fsS -o /dev/null http://[::1]:3000/info | |
| npx @orangeopensource/hurl --test \ | |
| --variable "baseurl=http://[::1]:3000" \ | |
| --variable "db_path=$DB_DIR/test.db" \ | |
| ${{ matrix.hurl }} | |
| clippy: | |
| name: Clippy (${{ matrix.name }}) | |
| runs-on: ubuntu-latest | |
| strategy: | |
| matrix: | |
| include: | |
| - name: sqlite | |
| - name: sqlite-vec | |
| steps: | |
| - uses: actions/checkout@v7 | |
| - uses: moonrepo/setup-rust@v1 | |
| with: | |
| bins: wkg, just | |
| env: | |
| GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} | |
| - uses: bytecodealliance/setup-wasi-sdk-action@main | |
| with: | |
| version: "33" | |
| - run: just init | |
| - run: just clippy ${{ matrix.name }} | |
| fmt: | |
| name: Format | |
| runs-on: ubuntu-latest | |
| steps: | |
| - uses: actions/checkout@v7 | |
| - uses: moonrepo/setup-rust@v1 | |
| - run: cargo fmt -- --check | |
| publish: | |
| name: Publish (${{ matrix.name }}) | |
| if: github.ref == 'refs/heads/main' && github.event_name == 'push' | |
| needs: [e2e, clippy, fmt] | |
| runs-on: ubuntu-latest | |
| permissions: | |
| contents: read # checkout | |
| id-token: write # keyless cosign signing via GitHub OIDC | |
| strategy: | |
| matrix: | |
| include: | |
| - name: sqlite | |
| - name: sqlite-vec | |
| steps: | |
| - uses: actions/checkout@v7 | |
| - uses: actions/download-artifact@v8 | |
| with: | |
| name: ${{ matrix.name }} | |
| - run: mkdir -p target/wasm32-wasip2/release && mv component-*.wasm target/wasm32-wasip2/release/component_sqlite.wasm | |
| - uses: moonrepo/setup-rust@v1 | |
| with: | |
| bins: wkg, just | |
| env: | |
| GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} | |
| - uses: bytecodealliance/setup-wasi-sdk-action@main | |
| with: | |
| version: "33" | |
| - uses: sigstore/cosign-installer@v4.1.2 # defaults to cosign 3.x → OCI 1.1 referrer signatures | |
| - run: just init | |
| - name: Publish | |
| id: publish | |
| env: | |
| # actpkg.dev PAT (any username; the registry detects the PAT by prefix). | |
| OCI_USERNAME: __token__ | |
| OCI_PASSWORD: ${{ secrets.ACTPKG_TOKEN }} | |
| # Source repo URL for org.opencontainers.image.source (read by act-build). | |
| ACT_SOURCE: ${{ github.server_url }}/${{ github.repository }} | |
| run: just publish ${{ matrix.name }} | |
| - name: Sign (keyless via GitHub OIDC) | |
| if: steps.publish.outputs.digest != '' | |
| env: | |
| ACTPKG_TOKEN: ${{ secrets.ACTPKG_TOKEN }} | |
| SUBJECT: ${{ steps.publish.outputs.image }}@${{ steps.publish.outputs.digest }} | |
| run: | | |
| echo "$ACTPKG_TOKEN" | cosign login actpkg.dev -u __token__ --password-stdin | |
| cosign sign --yes "$SUBJECT" |