Skip to content

Commit 21c8a6d

Browse files
andreiltdandreiltd
authored
chore: refactor crates layout (#3)
1 parent bff1743 commit 21c8a6d

22 files changed

Lines changed: 763 additions & 225 deletions

File tree

‎.github/workflows/ci.yml‎

Lines changed: 29 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -14,7 +14,7 @@ env:
1414

1515
jobs:
1616
check:
17-
name: Check (fmt, clippy, build)
17+
name: Check (fmt, clippy)
1818
runs-on: ubuntu-latest
1919
steps:
2020
- uses: actions/checkout@v4
@@ -34,13 +34,14 @@ jobs:
3434
- name: Clippy
3535
run: cargo clippy --all-targets --all-features -- -D warnings
3636

37-
- name: Build
38-
run: cargo build
39-
40-
test:
41-
name: Integration tests
42-
runs-on: ubuntu-latest
37+
build-test:
38+
name: Build and test (${{ matrix.os }})
39+
runs-on: ${{ matrix.os }}
4340
needs: check
41+
strategy:
42+
fail-fast: false
43+
matrix:
44+
os: [ubuntu-latest, macos-latest, windows-latest]
4445
steps:
4546
- uses: actions/checkout@v4
4647

@@ -52,6 +53,18 @@ jobs:
5253
- name: Cache cargo
5354
uses: Swatinem/rust-cache@v2.8.2
5455

56+
- name: Setup sccache
57+
uses: mozilla-actions/sccache-action@v0.0.10
58+
59+
- name: Configure sccache
60+
shell: bash
61+
run: |
62+
echo "SCCACHE_GHA_ENABLED=true" >> "$GITHUB_ENV"
63+
echo "RUSTC_WRAPPER=sccache" >> "$GITHUB_ENV"
64+
65+
- name: Build
66+
run: cargo build
67+
5568
- name: Run tests
5669
run: cargo test
5770

@@ -75,6 +88,15 @@ jobs:
7588
- name: Cache cargo
7689
uses: Swatinem/rust-cache@v2.8.2
7790

91+
- name: Setup sccache
92+
uses: mozilla-actions/sccache-action@v0.0.10
93+
94+
- name: Configure sccache
95+
shell: bash
96+
run: |
97+
echo "SCCACHE_GHA_ENABLED=true" >> "$GITHUB_ENV"
98+
echo "RUSTC_WRAPPER=sccache" >> "$GITHUB_ENV"
99+
78100
- name: Install npm dependencies
79101
working-directory: npm
80102
run: npm install

‎.github/workflows/cli-release.yml‎

Lines changed: 134 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,134 @@
1+
name: Publish CLI release assets
2+
3+
on:
4+
release:
5+
types: [published]
6+
workflow_dispatch:
7+
8+
permissions:
9+
contents: write
10+
id-token: write
11+
attestations: write
12+
13+
concurrency:
14+
group: cli-release-${{ github.event.release.tag_name || github.ref_name }}
15+
cancel-in-progress: false
16+
17+
env:
18+
CARGO_TERM_COLOR: always
19+
RELEASE_TAG: ${{ github.event.release.tag_name || github.ref_name }}
20+
21+
jobs:
22+
build:
23+
name: Build CLI - ${{ matrix.target }}
24+
runs-on: ${{ matrix.os }}
25+
strategy:
26+
fail-fast: false
27+
matrix:
28+
include:
29+
- target: x86_64-unknown-linux-gnu
30+
os: ubuntu-latest
31+
archive: tar.gz
32+
- target: aarch64-unknown-linux-gnu
33+
os: ubuntu-latest
34+
archive: tar.gz
35+
cross: true
36+
- target: x86_64-unknown-linux-musl
37+
os: ubuntu-latest
38+
archive: tar.gz
39+
musl: true
40+
- target: aarch64-unknown-linux-musl
41+
os: ubuntu-latest
42+
archive: tar.gz
43+
cross: true
44+
musl: true
45+
- target: x86_64-apple-darwin
46+
os: macos-13
47+
archive: tar.gz
48+
- target: aarch64-apple-darwin
49+
os: macos-14
50+
archive: tar.gz
51+
- target: x86_64-pc-windows-msvc
52+
os: windows-latest
53+
archive: zip
54+
- target: aarch64-pc-windows-msvc
55+
os: windows-latest
56+
archive: zip
57+
58+
steps:
59+
- name: Checkout
60+
uses: actions/checkout@v4
61+
with:
62+
ref: ${{ github.event.release.tag_name || github.ref }}
63+
64+
- name: Install Rust
65+
uses: dtolnay/rust-toolchain@stable
66+
with:
67+
targets: wasm32-wasip2,${{ matrix.target }}
68+
69+
- name: Cache cargo
70+
uses: Swatinem/rust-cache@v2
71+
72+
- name: Install cargo-binstall
73+
uses: cargo-bins/cargo-binstall@v1.10.15
74+
75+
- name: Install auditable build tool
76+
run: cargo binstall cargo-auditable --force
77+
78+
- name: Install cross-compilation tools
79+
if: matrix.cross
80+
uses: taiki-e/setup-cross-toolchain-action@v1
81+
with:
82+
target: ${{ matrix.target }}
83+
84+
- name: Install musl tools
85+
if: matrix.musl
86+
run: sudo apt-get install -y musl-tools
87+
88+
- name: Build CLI
89+
run: cargo build --release --bin componentize-qjs --target ${{ matrix.target }}
90+
env:
91+
COMPONENTIZE_QJS_RUNTIME_AUDITABLE: 1
92+
93+
- name: Package CLI
94+
shell: bash
95+
run: |
96+
set -euo pipefail
97+
checksum() {
98+
if command -v sha256sum >/dev/null 2>&1; then
99+
sha256sum "$1"
100+
else
101+
shasum -a 256 "$1"
102+
fi
103+
}
104+
105+
version="${RELEASE_TAG#v}"
106+
pkg="componentize-qjs-v${version}-${{ matrix.target }}"
107+
mkdir -p "dist/${pkg}"
108+
if [[ "${{ matrix.target }}" == *windows* ]]; then
109+
cp "target/${{ matrix.target }}/release/componentize-qjs.exe" "dist/${pkg}/"
110+
else
111+
cp "target/${{ matrix.target }}/release/componentize-qjs" "dist/${pkg}/"
112+
fi
113+
cp README.md "dist/${pkg}/"
114+
if [[ "${{ matrix.archive }}" == "zip" ]]; then
115+
(cd dist && 7z a "${pkg}.zip" "${pkg}")
116+
checksum "dist/${pkg}.zip" > "dist/${pkg}.zip.sha256"
117+
else
118+
tar -czf "dist/${pkg}.tar.gz" -C dist "${pkg}"
119+
checksum "dist/${pkg}.tar.gz" > "dist/${pkg}.tar.gz.sha256"
120+
fi
121+
rm -rf "dist/${pkg}"
122+
123+
- name: Attest CLI archives
124+
if: github.event_name == 'release'
125+
uses: actions/attest-build-provenance@v1
126+
with:
127+
subject-path: dist/*
128+
129+
- name: Upload CLI archives to release
130+
if: github.event_name == 'release'
131+
shell: bash
132+
run: gh release upload "${RELEASE_TAG}" dist/* --clobber
133+
env:
134+
GH_TOKEN: ${{ github.token }}

‎.github/workflows/release-plz.yml‎

Lines changed: 63 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,63 @@
1+
name: Release-plz
2+
3+
on:
4+
push:
5+
branches: [main]
6+
7+
permissions:
8+
pull-requests: write
9+
contents: write
10+
11+
concurrency:
12+
group: release-plz-${{ github.ref }}
13+
cancel-in-progress: false
14+
15+
jobs:
16+
release-plz:
17+
name: Release-plz
18+
runs-on: ubuntu-latest
19+
steps:
20+
- name: Checkout
21+
uses: actions/checkout@v4
22+
with:
23+
fetch-depth: 0
24+
25+
- name: Install Rust
26+
uses: dtolnay/rust-toolchain@stable
27+
with:
28+
targets: wasm32-wasip2
29+
30+
- name: Install cargo-binstall
31+
uses: cargo-bins/cargo-binstall@v1.10.15
32+
33+
- name: Cache cargo
34+
uses: Swatinem/rust-cache@v2
35+
36+
- name: Install SBOM tools
37+
run: |
38+
cargo binstall cargo-auditable --force
39+
cargo binstall auditable2cdx --force
40+
41+
- name: Build runtime for packaging
42+
shell: bash
43+
run: |
44+
rm -rf crates/core/prebuilt target/release-plz-package
45+
COMPONENTIZE_QJS_RUNTIME_AUDITABLE=1 cargo build --release -p componentize-qjs --target-dir target/release-plz-package
46+
mkdir -p crates/core/prebuilt
47+
mapfile -t runtimes < <(find target/release-plz-package -path '*/out/runtime.wasm' -type f | sort)
48+
test "${#runtimes[@]}" -eq 1 || { printf 'ERROR: expected exactly one runtime.wasm, found %s\n' "${#runtimes[@]}"; printf '%s\n' "${runtimes[@]}"; exit 1; }
49+
cp "${runtimes[0]}" crates/core/prebuilt/runtime.wasm
50+
test -f crates/core/prebuilt/runtime.wasm || { echo "ERROR: runtime.wasm not found"; exit 1; }
51+
sha256sum crates/core/prebuilt/runtime.wasm > crates/core/prebuilt/runtime.wasm.sha256
52+
auditable2cdx crates/core/prebuilt/runtime.wasm > crates/core/prebuilt/runtime.wasm.cdx.json
53+
test -s crates/core/prebuilt/runtime.wasm.cdx.json || { echo "ERROR: runtime SBOM is empty"; exit 1; }
54+
echo "Pre-built runtime.wasm ready ($(wc -c < crates/core/prebuilt/runtime.wasm) bytes)"
55+
56+
- name: Run release-plz
57+
uses: release-plz/action@v0.5
58+
with:
59+
command: release
60+
backend: github
61+
env:
62+
GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
63+
CARGO_REGISTRY_TOKEN: ${{ secrets.CARGO_REGISTRY_TOKEN }}

‎.github/workflows/runtime-publish.yml‎

Lines changed: 134 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,134 @@
1+
name: Publish runtime Wasm
2+
3+
on:
4+
push:
5+
tags:
6+
- v*
7+
workflow_dispatch:
8+
9+
env:
10+
CARGO_TERM_COLOR: always
11+
IMAGE_NAME: ${{ github.repository }}
12+
COMPONENT_NAME: componentize-qjs-runtime
13+
COMPONENT_DESCRIPTION: QuickJS runtime for componentize-qjs
14+
COMPONENT_SOURCE: https://github.com/${{ github.repository }}
15+
COMPONENT_HOMEPAGE: https://github.com/${{ github.repository }}
16+
COMPONENT_LICENSES: Apache-2.0
17+
WASM_FILE: dist/componentize_qjs_runtime.wasm
18+
SBOM_FILE: dist/componentize_qjs_runtime.wasm.cdx.json
19+
20+
jobs:
21+
publish:
22+
name: Publish runtime Wasm
23+
runs-on: ubuntu-latest
24+
permissions:
25+
id-token: write
26+
packages: write
27+
contents: read
28+
29+
steps:
30+
- name: Checkout
31+
uses: actions/checkout@v4
32+
33+
- name: Install Rust
34+
uses: dtolnay/rust-toolchain@stable
35+
with:
36+
targets: wasm32-wasip2
37+
38+
- name: Install cargo-binstall
39+
uses: cargo-bins/cargo-binstall@v1.10.15
40+
41+
- name: Cache cargo
42+
uses: Swatinem/rust-cache@v2
43+
44+
- name: Docker meta
45+
id: meta
46+
uses: docker/metadata-action@v5
47+
with:
48+
images: ghcr.io/${{ env.IMAGE_NAME }}/${{ env.COMPONENT_NAME }}
49+
tags: |
50+
type=semver,pattern={{version}}
51+
52+
- name: Login to GitHub Container Registry
53+
if: github.event_name != 'workflow_dispatch'
54+
uses: docker/login-action@v3
55+
with:
56+
registry: ghcr.io
57+
username: ${{ github.actor }}
58+
password: ${{ secrets.GITHUB_TOKEN }}
59+
60+
- name: Install cosign
61+
if: github.event_name != 'workflow_dispatch'
62+
uses: sigstore/cosign-installer@v3.7.0
63+
64+
- name: Install publish tools
65+
run: |
66+
cargo binstall wkg --force
67+
cargo binstall cargo-auditable --force
68+
cargo binstall auditable2cdx --force
69+
70+
- name: Build auditable runtime
71+
shell: bash
72+
run: |
73+
rm -rf crates/core/prebuilt dist target/runtime-publish
74+
COMPONENTIZE_QJS_RUNTIME_AUDITABLE=1 cargo build --release -p componentize-qjs --target-dir target/runtime-publish
75+
mkdir -p dist
76+
mapfile -t runtimes < <(find target/runtime-publish -path '*/out/runtime.wasm' -type f | sort)
77+
test "${#runtimes[@]}" -eq 1 || { printf 'ERROR: expected exactly one runtime.wasm, found %s\n' "${#runtimes[@]}"; printf '%s\n' "${runtimes[@]}"; exit 1; }
78+
cp "${runtimes[0]}" "${WASM_FILE}"
79+
sha256sum "${WASM_FILE}" > "${WASM_FILE}.sha256"
80+
auditable2cdx "${WASM_FILE}" > "${SBOM_FILE}"
81+
test -s "${SBOM_FILE}" || { echo "ERROR: runtime SBOM is empty"; exit 1; }
82+
echo "Runtime ready at ${WASM_FILE} ($(wc -c < "${WASM_FILE}") bytes)"
83+
84+
- name: Upload runtime artifacts
85+
uses: actions/upload-artifact@v4
86+
with:
87+
name: componentize-qjs-runtime
88+
path: |
89+
${{ env.WASM_FILE }}
90+
${{ env.WASM_FILE }}.sha256
91+
${{ env.SBOM_FILE }}
92+
if-no-files-found: error
93+
94+
- name: Publish `:<version>` to GitHub Container Registry
95+
if: github.event_name != 'workflow_dispatch'
96+
id: publish_versioned
97+
uses: bytecodealliance/wkg-github-action@v5
98+
with:
99+
file: ${{ env.WASM_FILE }}
100+
oci-reference-without-tag: ghcr.io/${{ env.IMAGE_NAME }}/${{ env.COMPONENT_NAME }}
101+
version: ${{ fromJSON(steps.meta.outputs.json).labels['org.opencontainers.image.version'] }}
102+
description: ${{ env.COMPONENT_DESCRIPTION }}
103+
source: ${{ env.COMPONENT_SOURCE }}
104+
homepage: ${{ env.COMPONENT_HOMEPAGE }}
105+
licenses: ${{ env.COMPONENT_LICENSES }}
106+
107+
- name: Sign the versioned runtime
108+
if: github.event_name != 'workflow_dispatch'
109+
run: cosign sign --yes ghcr.io/${{ env.IMAGE_NAME }}/${{ env.COMPONENT_NAME }}@${{ steps.publish_versioned.outputs.digest }}
110+
111+
- name: Attest the versioned runtime SBOM
112+
if: github.event_name != 'workflow_dispatch'
113+
run: cosign attest --yes --type cyclonedx --predicate "${SBOM_FILE}" ghcr.io/${{ env.IMAGE_NAME }}/${{ env.COMPONENT_NAME }}@${{ steps.publish_versioned.outputs.digest }}
114+
115+
- name: Publish `:latest` to GitHub Container Registry
116+
if: github.event_name != 'workflow_dispatch'
117+
id: publish_latest
118+
uses: bytecodealliance/wkg-github-action@v5
119+
with:
120+
file: ${{ env.WASM_FILE }}
121+
oci-reference-without-tag: ghcr.io/${{ env.IMAGE_NAME }}/${{ env.COMPONENT_NAME }}
122+
version: latest
123+
description: ${{ env.COMPONENT_DESCRIPTION }}
124+
source: ${{ env.COMPONENT_SOURCE }}
125+
homepage: ${{ env.COMPONENT_HOMEPAGE }}
126+
licenses: ${{ env.COMPONENT_LICENSES }}
127+
128+
- name: Sign the latest runtime
129+
if: github.event_name != 'workflow_dispatch'
130+
run: cosign sign --yes ghcr.io/${{ env.IMAGE_NAME }}/${{ env.COMPONENT_NAME }}@${{ steps.publish_latest.outputs.digest }}
131+
132+
- name: Attest the latest runtime SBOM
133+
if: github.event_name != 'workflow_dispatch'
134+
run: cosign attest --yes --type cyclonedx --predicate "${SBOM_FILE}" ghcr.io/${{ env.IMAGE_NAME }}/${{ env.COMPONENT_NAME }}@${{ steps.publish_latest.outputs.digest }}

0 commit comments

Comments
 (0)