wasmcloud.yml

name: wasmcloud

on:
  pull_request:
  merge_group:
  workflow_dispatch:
    inputs:
      crate:
        type: choice
        description: crate to smart-release
        options:
          - wascap
          - wash-cli
          - wash-lib
          - wasmcloud
          - wasmcloud-component
          - wasmcloud-control-interface
          - wasmcloud-core
          - wasmcloud-host
          - wasmcloud-provider-sdk
          - wasmcloud-runtime
          - wasmcloud-secrets-client
          - wasmcloud-secrets-types
          - wasmcloud-test-util
          - wasmcloud-tracing
      do-release:
        type: boolean
        description: Leave unchecked to create a pull request with changes for verification, then check to create a release directly with changes
      additional-args:
        type: string
        description: Advanced; Additional arguments to pass to `smart-release`
  push:
    branches:
      - main
    tags:
      - 'component-v[0-9].[0-9]+.[0-9]+'
      - 'component-v[0-9].[0-9]+.[0-9]+-*'
      - 'control-interface-v[0-9].[0-9]+.[0-9]+'
      - 'control-interface-v[0-9].[0-9]+.[0-9]+-*'
      - 'core-v[0-9].[0-9]+.[0-9]+'
      - 'core-v[0-9].[0-9]+.[0-9]+-*'
      - 'host-sys-v[0-9].[0-9]+.[0-9]+'
      - 'host-sys-v[0-9].[0-9]+.[0-9]+-*'
      - 'host-v[0-9].[0-9]+.[0-9]+'
      - 'host-v[0-9].[0-9]+.[0-9]+-*'
      - 'opentelemetry-nats-v[0-9].[0-9]+.[0-9]+'
      - 'opentelemetry-nats-v[0-9].[0-9]+.[0-9]+-*'
      - 'provider-archive-v[0-9].[0-9]+.[0-9]+'
      - 'provider-archive-v[0-9].[0-9]+.[0-9]+-*'
      - 'provider-blobstore-azure-v[0-9].[0-9]+.[0-9]+'
      - 'provider-blobstore-azure-v[0-9].[0-9]+.[0-9]+-*'
      - 'provider-blobstore-fs-v[0-9].[0-9]+.[0-9]+'
      - 'provider-blobstore-fs-v[0-9].[0-9]+.[0-9]+-*'
      - 'provider-blobstore-s3-v[0-9].[0-9]+.[0-9]+'
      - 'provider-blobstore-s3-v[0-9].[0-9]+.[0-9]+-*'
      - 'provider-http-client-v[0-9].[0-9]+.[0-9]+'
      - 'provider-http-client-v[0-9].[0-9]+.[0-9]+-*'
      - 'provider-http-server-v[0-9].[0-9]+.[0-9]+'
      - 'provider-http-server-v[0-9].[0-9]+.[0-9]+-*'
      - 'provider-keyvalue-nats-v[0-9].[0-9]+.[0-9]+'
      - 'provider-keyvalue-nats-v[0-9].[0-9]+.[0-9]+-*'
      - 'provider-keyvalue-redis-v[0-9].[0-9]+.[0-9]+'
      - 'provider-keyvalue-redis-v[0-9].[0-9]+.[0-9]+-*'
      - 'provider-keyvalue-vault-v[0-9].[0-9]+.[0-9]+'
      - 'provider-keyvalue-vault-v[0-9].[0-9]+.[0-9]+-*'
      - 'provider-messaging-kafka-v[0-9].[0-9]+.[0-9]+'
      - 'provider-messaging-kafka-v[0-9].[0-9]+.[0-9]+-*'
      - 'provider-messaging-nats-v[0-9].[0-9]+.[0-9]+'
      - 'provider-messaging-nats-v[0-9].[0-9]+.[0-9]+-*'
      - 'provider-sdk-v[0-9].[0-9]+.[0-9]+'
      - 'provider-sdk-v[0-9].[0-9]+.[0-9]+-*'
      - 'provider-sqldb-postgres-v[0-9].[0-9]+.[0-9]+'
      - 'provider-sqldb-postgres-v[0-9].[0-9]+.[0-9]+-*'
      - 'runtime-v[0-9].[0-9]+.[0-9]+'
      - 'runtime-v[0-9].[0-9]+.[0-9]+-*'
      - 'secrets-client-v[0-9].[0-9]+.[0-9]+'
      - 'secrets-client-v[0-9].[0-9]+.[0-9]+-*'
      - 'secrets-types-v[0-9].[0-9]+.[0-9]+'
      - 'secrets-types-v[0-9].[0-9]+.[0-9]+-*'
      - 'test-util-v[0-9].[0-9]+.[0-9]+'
      - 'test-util-v[0-9].[0-9]+.[0-9]+-*'
      - 'tracing-v[0-9].[0-9]+.[0-9]+'
      - 'tracing-v[0-9].[0-9]+.[0-9]+-*'
      - 'v[0-9].[0-9]+.[0-9]+'
      - 'v[0-9].[0-9]+.[0-9]+-*'
      - 'wascap-v[0-9].[0-9]+.[0-9]+'
      - 'wascap-v[0-9].[0-9]+.[0-9]+-*'
      - 'wash-cli-v[0-9].[0-9]+.[0-9]+'
      - 'wash-cli-v[0-9].[0-9]+.[0-9]+-*'
      - 'wash-lib-v[0-9].[0-9]+.[0-9]+'
      - 'wash-lib-v[0-9].[0-9]+.[0-9]+-*'

permissions:
  contents: read

concurrency:
  group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.ref }}
  cancel-in-progress: true

jobs:
  build-bin:
    strategy:
      matrix:
        config:
          - target: aarch64-unknown-linux-musl
            test-bin: |
              nix profile install --inputs-from . 'nixpkgs#qemu'
              qemu-aarch64 ./result/bin/wash --version
              qemu-aarch64 ./result/bin/wasmcloud --version
            test-oci: docker load < ./result
            # TODO: Run aarch64 binary within OCI

          - target: aarch64-apple-darwin
            test-bin: |
              file ./result/bin/wash
              file ./result/bin/wasmcloud
            test-oci: docker load < ./result

          - target: aarch64-linux-android
            test-bin: |
              file ./result/bin/wash
              file ./result/bin/wasmcloud
            test-oci: docker load < ./result

          - target: riscv64gc-unknown-linux-gnu-fhs
            test-bin: |
              nix build -L '.#wasmcloud-riscv64gc-unknown-linux-gnu'
              nix shell --inputs-from . 'nixpkgs#qemu' -c qemu-riscv64 ./result/bin/wasmcloud --version

          - target: x86_64-apple-darwin
            test-bin: |
              file ./result/bin/wash
              file ./result/bin/wasmcloud
            test-oci: docker load < ./result

          # TODO: Build for GNU once https://github.com/rust-lang/rust/issues/92212 is resolved
          #- target: x86_64-pc-windows-gnu
          #  test-bin: |
          #    nix profile install --inputs-from . 'nixpkgs#wine64'
          #    wine64 ./result/bin/wash.exe --version
          #    wine64 ./result/bin/wasmcloud.exe --version
          #  test-oci: docker load < ./result
          #  # TODO: Run win64 binary within OCI

          - target: x86_64-unknown-linux-musl
            test-bin: |
              ./result/bin/wash --version
              ./result/bin/wasmcloud --version
            test-oci: |
              docker load < ./result
              docker run --rm wasmcloud:$(nix eval --raw .#wasmcloud-x86_64-unknown-linux-musl-oci.imageTag) wash --version
              docker run --rm wasmcloud:$(nix eval --raw .#wasmcloud-x86_64-unknown-linux-musl-oci.imageTag) wasmcloud --version

    name: wasmcloud-${{ matrix.config.target }}
    runs-on: ubuntu-22.04
    steps:
      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683
      - uses: ./.github/actions/install-nix
        # need to run condition inside job steps so that job will pass if all steps are skipped
        # https://docs.github.com/en/actions/using-workflows/workflow-syntax-for-github-actions#onpull_requestpull_request_targetbranchesbranches-ignore
        with:
          cachixAuthToken: '${{ secrets.CACHIX_AUTH_TOKEN }}'
      - uses: ./.github/actions/build-nix
        with:
          package: wasmcloud-${{ matrix.config.target }}
      - run: ${{ matrix.config.test-bin }}
      - uses: ./.github/actions/build-nix
        if: ${{ !endsWith(matrix.config.target, 'fhs') }}
        with:
          package: wasmcloud-${{ matrix.config.target }}-oci
      - run: ${{ matrix.config.test-oci }}
        if: ${{ !endsWith(matrix.config.target, 'fhs') }}

  build-windows:
    name: wasmcloud-x86_64-pc-windows-msvc
    if: startswith(github.ref, 'refs/tags/') || github.ref == 'refs/heads/main'
    runs-on: windows-latest
    steps:
      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683

      - run: rustup show
      - uses: Swatinem/rust-cache@82a92a6e8fbeee089604da2575dc567ae9ddeaab
        with:
          shared-key: windows-latest-8-cores-shared-cache
        if: ${{ !startswith(github.ref, 'refs/tags/') }}

      - run: cargo build --release -p wash-cli -p wasmcloud
      - run: mkdir "artifact/bin"

      - run: move "target/release/blobstore-azure-provider.exe" "artifact/bin/blobstore-azure-provider.exe"
      - run: move "target/release/blobstore-fs-provider.exe" "artifact/bin/blobstore-fs-provider.exe"
      - run: move "target/release/blobstore-s3-provider.exe" "artifact/bin/blobstore-s3-provider.exe"
      - run: move "target/release/http-client-provider.exe" "artifact/bin/http-client-provider.exe"
      - run: move "target/release/http-server-provider.exe" "artifact/bin/http-server-provider.exe"
      - run: move "target/release/keyvalue-nats-provider.exe" "artifact/bin/keyvalue-nats-provider.exe"
      - run: move "target/release/keyvalue-redis-provider.exe" "artifact/bin/keyvalue-redis-provider.exe"
      - run: move "target/release/keyvalue-vault-provider.exe" "artifact/bin/keyvalue-vault-provider.exe"
      - run: move "target/release/messaging-kafka-provider.exe" "artifact/bin/messaging-kafka-provider.exe"
      - run: move "target/release/messaging-nats-provider.exe" "artifact/bin/messaging-nats-provider.exe"
      - run: move "target/release/sqldb-postgres-provider.exe" "artifact/bin/sqldb-postgres-provider.exe"

      - run: move "target/release/wash.exe" "artifact/bin/wash.exe"
      - run: move "target/release/wasmcloud.exe" "artifact/bin/wasmcloud.exe"

      - uses: actions/upload-artifact@6f51ac03b9356f520e9adb1b1b7802705f340c2b
        with:
          name: wasmcloud-x86_64-pc-windows-msvc
          path: artifact

  build-lipo:
    name: wasmcloud-universal-darwin
    needs: build-bin
    runs-on: macos-13
    steps:
      - uses: actions/download-artifact@fa0a91b85d4f404e444e00e005971372dc801d16
        with:
          name: wasmcloud-aarch64-apple-darwin
          path: aarch64
      - uses: actions/download-artifact@fa0a91b85d4f404e444e00e005971372dc801d16
        with:
          name: wasmcloud-x86_64-apple-darwin
          path: x86_64

      - run: chmod +x ./x86_64/bin/*
      - run: ./x86_64/bin/wash --version
      - run: ./x86_64/bin/wasmcloud --version

      - run: mkdir -p ./artifact/bin
      - run: lipo -create ./aarch64/bin/wash ./x86_64/bin/wash -output ./artifact/bin/wash
      - run: lipo -create ./aarch64/bin/wasmcloud ./x86_64/bin/wasmcloud -output ./artifact/bin/wasmcloud

      - run: chmod +x ./artifact/bin/wash
      - run: ./artifact/bin/wash --version
      - run: chmod +x ./artifact/bin/wasmcloud
      - run: ./artifact/bin/wasmcloud --version

      - uses: actions/upload-artifact@6f51ac03b9356f520e9adb1b1b7802705f340c2b
        with:
          name: wasmcloud-universal-darwin
          path: artifact

  test-linux:
    runs-on: ubuntu-22.04
    needs: build-bin
    steps:
      - uses: actions/download-artifact@fa0a91b85d4f404e444e00e005971372dc801d16
        with:
          name: wasmcloud-x86_64-unknown-linux-musl
      - run: chmod +x ./bin/wash
      - run: chmod +x ./bin/wasmcloud
      - run: ./bin/wash --version
      - run: ./bin/wasmcloud --version

  test-windows:
    runs-on: windows-latest
    needs: build-windows
    steps:
      - uses: actions/download-artifact@fa0a91b85d4f404e444e00e005971372dc801d16
        with:
          name: wasmcloud-x86_64-pc-windows-msvc
      - run: .\bin\wash.exe --version
      - run: .\bin\wasmcloud.exe --version

  cargo:
    strategy:
      matrix:
        check:
          - audit
          - fmt
          - clippy
          - nextest
          - doctest

    name: cargo ${{ matrix.check }}
    runs-on: ubuntu-22.04
    steps:
      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683
      - uses: ./.github/actions/install-nix
        with:
          cachixAuthToken: '${{ secrets.CACHIX_AUTH_TOKEN }}'
      - run: nix build -L .#checks.x86_64-linux.${{ matrix.check }}

  build-doc:
    runs-on: ubuntu-22.04
    steps:
      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683
      - uses: ./.github/actions/install-nix
        with:
          cachixAuthToken: '${{ secrets.CACHIX_AUTH_TOKEN }}'
      - run: nix build -L .#checks.x86_64-linux.doc
      - run: cp --no-preserve=mode -R ./result/share/doc ./doc
      - run: rm -f doc/.lock
      - name: Create `.nojekyll`
        run: touch doc/.nojekyll
      - name: Write `index.html`
        run: |
          cat <<EOF > doc/index.html
            <!DOCTYPE html>
            <meta charset="utf-8">
            <title>Redirecting to wasmcloud_host/index.html</title>
            <meta http-equiv="refresh" content="0; URL=wasmcloud_host/index.html">
            <link rel="canonical" href="https://${{ github.repository_owner }}.github.io/wasmCloud/wasmcloud_host/index.html">
          EOF
      - uses: actions/upload-pages-artifact@56afc609e74202658d3ffba0e8f6dda462b719fa
        with:
          path: doc

  providers:
    if: startswith(github.ref, 'refs/tags/provider-')
    strategy:
      matrix:
        include:
          - name: blobstore-azure
            subject: BLOBSTORE_AZURE_SUBJECT

          - name: blobstore-fs
            subject: BLOBSTORE_FS_SUBJECT

          - name: blobstore-s3
            subject: BLOBSTORE_S3_SUBJECT

          - name: keyvalue-nats
            subject: KEYVALUE_NATS_SUBJECT

          - name: keyvalue-redis
            subject: KEYVALUE_REDIS_SUBJECT

          - name: keyvalue-vault
            subject: KEYVALUE_VAULT_SUBJECT

          - name: http-client
            subject: HTTP_CLIENT_SUBJECT

          - name: http-server
            subject: HTTP_SERVER_SUBJECT

          - name: messaging-kafka
            subject: MESSAGING_KAFKA_SUBJECT

          - name: messaging-nats
            subject: MESSAGING_NATS_SUBJECT

          - name: sqldb-postgres
            subject: SQLDB_POSTGRES_SUBJECT

    needs:
      - build-bin
      - build-windows
      - test-linux
    permissions:
      contents: read
      packages: write
    uses: ./.github/workflows/provider.yml
    with:
      name: ${{ matrix.name }}
    secrets:
      issuer: ${{ secrets.WASMCLOUD_ACCOUNT_OFFICIAL }}
      subject: ${{ secrets[matrix.subject] }}
      azurecr_username: ${{ secrets.AZURECR_PUSH_USER }}
      azurecr_password: ${{ secrets.AZURECR_PUSH_PASSWORD }}

  deploy-doc:
    runs-on: ubuntu-22.04
    needs: build-doc
    permissions:
      contents: read
      pages: write
      id-token: write
    environment:
      name: github-pages
      url: ${{ steps.deployment.outputs.page_url }}
    if: github.ref == 'refs/heads/main'
    steps:
      - uses: actions/deploy-pages@d6db90164ac5ed86f2b6aed7e0febac5b3c0c03e
        id: deployment

  oci:
    runs-on: ubuntu-latest-8-cores
    strategy:
      matrix:
        include:
          - bin: wasmcloud

          - bin: wash
            prefix: wash-cli-
    permissions:
      contents: read
      packages: write
    needs:
      - build-bin
      - test-linux
    steps:
      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683
      - uses: ./.github/actions/install-nix
        with:
          cachixAuthToken: '${{ secrets.CACHIX_AUTH_TOKEN }}'

      - name: Extract tag context
        id: ctx
        run: |
          echo "owner=${GITHUB_REPOSITORY_OWNER,,}" >> "$GITHUB_OUTPUT"
          echo "sha_short=$(git rev-parse --short HEAD)" >> "$GITHUB_OUTPUT"

          version=${GITHUB_REF_NAME#${{ matrix.prefix }}v}
          echo "version=${version}" >> "$GITHUB_OUTPUT"
          echo "version is ${version}"
          if [[ $version == *"-"* ]]; then
            echo "version ${version} is a pre-release"
            echo "prerelease=true" >> "$GITHUB_OUTPUT"
          fi

      - name: Login to AzureCR
        if: startswith(github.ref, format('refs/tags/{0}v', matrix.prefix)) || github.ref == 'refs/heads/main'
        continue-on-error: ${{ github.repository_owner != 'wasmCloud' }}
        uses: azure/docker-login@15c4aadf093404726ab2ff205b2cdd33fa6d054c
        with:
          login-server: ${{ secrets.AZURECR_PUSH_URL }}
          username: ${{ secrets.AZURECR_PUSH_USER }}
          password: ${{ secrets.AZURECR_PUSH_PASSWORD }}

      - name: Login to GitHub Container Registry
        if: startswith(github.ref, format('refs/tags/{0}v', matrix.prefix)) || github.ref == 'refs/heads/main'
        uses: docker/login-action@9780b0c442fbb1117ed29e0efdff1e18412f7567
        with:
          registry: ghcr.io
          username: ${{ github.repository_owner }}
          password: ${{ secrets.GITHUB_TOKEN }}

      - name: Login to DockerHub
        if: startswith(github.ref, format('refs/tags/{0}v', matrix.prefix)) || github.ref == 'refs/heads/main'
        continue-on-error: ${{ github.repository_owner != 'wasmCloud' }}
        uses: docker/login-action@9780b0c442fbb1117ed29e0efdff1e18412f7567
        with:
          username: ${{ secrets.DOCKERHUB_PUSH_USER }}
          password: ${{ secrets.DOCKERHUB_PUSH_PASSWORD }}

      - name: Install `buildah`
        run: nix profile install --inputs-from . 'nixpkgs#buildah'

      - name: Build `${{ matrix.bin }}` image
        run: |
          nix run -L .#build-${{ matrix.bin }}-oci-debian ${{ matrix.bin }}:debian
          nix run -L .#build-${{ matrix.bin }}-oci-wolfi ${{ matrix.bin }}:wolfi

      - name: Test `${{ matrix.bin }}` image
        run: |
          buildah push ${{ matrix.bin }}:debian docker-daemon:${{ matrix.bin }}:debian-test
          buildah push ${{ matrix.bin }}:wolfi docker-daemon:${{ matrix.bin }}:wolfi-test
          docker run --rm ${{ matrix.bin }}:debian-test ${{ matrix.bin }} --version
          docker run --rm ${{ matrix.bin }}:wolfi-test ${{ matrix.bin }} --version

      - name: Push `${{ matrix.bin }}` commit rev tag
        if: startswith(github.ref, format('refs/tags/{0}v', matrix.prefix)) || github.ref == 'refs/heads/main'
        run: |
          buildah manifest push --all --format 'v2s2' ${{ matrix.bin }}:debian docker://ghcr.io/${{ steps.ctx.outputs.owner }}/${{ matrix.bin }}:${{ github.sha }}
          buildah manifest push --all --format 'v2s2' ${{ matrix.bin }}:debian docker://ghcr.io/${{ steps.ctx.outputs.owner }}/${{ matrix.bin }}:${{ steps.ctx.outputs.sha_short }}
          buildah manifest push --all --format 'v2s2' ${{ matrix.bin }}:wolfi docker://ghcr.io/${{ steps.ctx.outputs.owner }}/${{ matrix.bin }}:${{ github.sha }}-wolfi
          buildah manifest push --all --format 'v2s2' ${{ matrix.bin }}:wolfi docker://ghcr.io/${{ steps.ctx.outputs.owner }}/${{ matrix.bin }}:${{ steps.ctx.outputs.sha_short }}-wolfi

          docker run --rm ghcr.io/${{ steps.ctx.outputs.owner }}/${{ matrix.bin }}:${{ github.sha }} ${{ matrix.bin }} --version
          docker run --rm ghcr.io/${{ steps.ctx.outputs.owner }}/${{ matrix.bin }}:${{ steps.ctx.outputs.sha_short }} ${{ matrix.bin }} --version
          docker run --rm ghcr.io/${{ steps.ctx.outputs.owner }}/${{ matrix.bin }}:${{ github.sha }}-wolfi ${{ matrix.bin }} --version
          docker run --rm ghcr.io/${{ steps.ctx.outputs.owner }}/${{ matrix.bin }}:${{ steps.ctx.outputs.sha_short }}-wolfi ${{ matrix.bin }} --version

      - name: Push `${{ matrix.bin }}` `canary` tag
        if: github.ref == 'refs/heads/main'
        continue-on-error: ${{ github.repository_owner != 'wasmCloud' }}
        run: |
          buildah manifest push --all --format 'v2s2' ${{ matrix.bin }}:debian docker://${{ steps.ctx.outputs.owner }}/${{ matrix.bin }}:canary
          buildah manifest push --all --format 'v2s2' ${{ matrix.bin }}:debian docker://ghcr.io/${{ steps.ctx.outputs.owner }}/${{ matrix.bin }}:canary
          buildah manifest push --all --format 'v2s2' ${{ matrix.bin }}:debian docker://wasmcloud.azurecr.io/${{ steps.ctx.outputs.owner }}/${{ matrix.bin }}:canary
          buildah manifest push --all --format 'v2s2' ${{ matrix.bin }}:wolfi docker://${{ steps.ctx.outputs.owner }}/${{ matrix.bin }}:canary-wolfi
          buildah manifest push --all --format 'v2s2' ${{ matrix.bin }}:wolfi docker://ghcr.io/${{ steps.ctx.outputs.owner }}/${{ matrix.bin }}:canary-wolfi
          buildah manifest push --all --format 'v2s2' ${{ matrix.bin }}:wolfi docker://wasmcloud.azurecr.io/${{ steps.ctx.outputs.owner }}/${{ matrix.bin }}:canary-wolfi

          docker run --rm ${{ steps.ctx.outputs.owner }}/${{ matrix.bin }}:canary ${{ matrix.bin }} --version
          docker run --rm ghcr.io/${{ steps.ctx.outputs.owner }}/${{ matrix.bin }}:canary ${{ matrix.bin }} --version
          docker run --rm wasmcloud.azurecr.io/${{ steps.ctx.outputs.owner }}/${{ matrix.bin }}:canary ${{ matrix.bin }} --version
          docker run --rm ${{ steps.ctx.outputs.owner }}/${{ matrix.bin }}:canary-wolfi ${{ matrix.bin }} --version
          docker run --rm ghcr.io/${{ steps.ctx.outputs.owner }}/${{ matrix.bin }}:canary-wolfi ${{ matrix.bin }} --version
          docker run --rm wasmcloud.azurecr.io/${{ steps.ctx.outputs.owner }}/${{ matrix.bin }}:canary-wolfi ${{ matrix.bin }} --version

      - name: Push `${{ matrix.bin }}` version tag
        if: startswith(github.ref, format('refs/tags/{0}v', matrix.prefix))
        continue-on-error: ${{ github.repository_owner != 'wasmCloud' }}
        run: |
          buildah manifest push --all --format 'v2s2' ${{ matrix.bin }}:debian docker://${{ steps.ctx.outputs.owner }}/${{ matrix.bin }}:${{ steps.ctx.outputs.version }}
          buildah manifest push --all --format 'v2s2' ${{ matrix.bin }}:debian docker://ghcr.io/${{ steps.ctx.outputs.owner }}/${{ matrix.bin }}:${{ steps.ctx.outputs.version }}
          buildah manifest push --all --format 'v2s2' ${{ matrix.bin }}:debian docker://wasmcloud.azurecr.io/${{ steps.ctx.outputs.owner }}/${{ matrix.bin }}:${{ steps.ctx.outputs.version }}
          buildah manifest push --all --format 'v2s2' ${{ matrix.bin }}:wolfi docker://${{ steps.ctx.outputs.owner }}/${{ matrix.bin }}:${{ steps.ctx.outputs.version }}-wolfi
          buildah manifest push --all --format 'v2s2' ${{ matrix.bin }}:wolfi docker://ghcr.io/${{ steps.ctx.outputs.owner }}/${{ matrix.bin }}:${{ steps.ctx.outputs.version }}-wolfi
          buildah manifest push --all --format 'v2s2' ${{ matrix.bin }}:wolfi docker://wasmcloud.azurecr.io/${{ steps.ctx.outputs.owner }}/${{ matrix.bin }}:${{ steps.ctx.outputs.version }}-wolfi

          docker run --rm ${{ steps.ctx.outputs.owner }}/${{ matrix.bin }}:${{ steps.ctx.outputs.version }} ${{ matrix.bin }} --version
          docker run --rm ghcr.io/${{ steps.ctx.outputs.owner }}/${{ matrix.bin }}:${{ steps.ctx.outputs.version }} ${{ matrix.bin }} --version
          docker run --rm wasmcloud.azurecr.io/${{ steps.ctx.outputs.owner }}/${{ matrix.bin }}:${{ steps.ctx.outputs.version }} ${{ matrix.bin }} --version
          docker run --rm ${{ steps.ctx.outputs.owner }}/${{ matrix.bin }}:${{ steps.ctx.outputs.version }}-wolfi ${{ matrix.bin }} --version
          docker run --rm ghcr.io/${{ steps.ctx.outputs.owner }}/${{ matrix.bin }}:${{ steps.ctx.outputs.version }}-wolfi ${{ matrix.bin }} --version
          docker run --rm wasmcloud.azurecr.io/${{ steps.ctx.outputs.owner }}/${{ matrix.bin }}:${{ steps.ctx.outputs.version }}-wolfi ${{ matrix.bin }} --version

      - name: Push `${{ matrix.bin }}` `latest` tag
        if: startswith(github.ref, format('refs/tags/{0}v', matrix.prefix)) && !steps.ctx.outputs.prerelease
        continue-on-error: ${{ github.repository_owner != 'wasmCloud' }}
        run: |
          buildah manifest push --all --format 'v2s2' ${{ matrix.bin }}:debian docker://${{ steps.ctx.outputs.owner }}/${{ matrix.bin }}:latest
          buildah manifest push --all --format 'v2s2' ${{ matrix.bin }}:debian docker://ghcr.io/${{ steps.ctx.outputs.owner }}/${{ matrix.bin }}:latest
          buildah manifest push --all --format 'v2s2' ${{ matrix.bin }}:debian docker://wasmcloud.azurecr.io/${{ steps.ctx.outputs.owner }}/${{ matrix.bin }}:latest
          buildah manifest push --all --format 'v2s2' ${{ matrix.bin }}:wolfi docker://${{ steps.ctx.outputs.owner }}/${{ matrix.bin }}:latest-wolfi
          buildah manifest push --all --format 'v2s2' ${{ matrix.bin }}:wolfi docker://ghcr.io/${{ steps.ctx.outputs.owner }}/${{ matrix.bin }}:latest-wolfi
          buildah manifest push --all --format 'v2s2' ${{ matrix.bin }}:wolfi docker://wasmcloud.azurecr.io/${{ steps.ctx.outputs.owner }}/${{ matrix.bin }}:latest-wolfi

          docker run --rm ${{ steps.ctx.outputs.owner }}/${{ matrix.bin }}:latest ${{ matrix.bin }} --version
          docker run --rm ghcr.io/${{ steps.ctx.outputs.owner }}/${{ matrix.bin }}:latest ${{ matrix.bin }} --version
          docker run --rm wasmcloud.azurecr.io/${{ steps.ctx.outputs.owner }}/${{ matrix.bin }}:latest ${{ matrix.bin }} --version
          docker run --rm ${{ steps.ctx.outputs.owner }}/${{ matrix.bin }}:latest-wolfi ${{ matrix.bin }} --version
          docker run --rm ghcr.io/${{ steps.ctx.outputs.owner }}/${{ matrix.bin }}:latest-wolfi ${{ matrix.bin }} --version
          docker run --rm wasmcloud.azurecr.io/${{ steps.ctx.outputs.owner }}/${{ matrix.bin }}:latest-wolfi ${{ matrix.bin }} --version

  release:
    if: startsWith(github.ref, 'refs/tags/v') || startsWith(github.ref, 'refs/tags/wash-cli-v')
    needs:
      - build-bin
      - build-doc
      - build-lipo
      - cargo
      - oci
      - test-linux
      - test-windows
    runs-on: ubuntu-22.04
    permissions:
      contents: write
    steps:
      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683
      - uses: actions/download-artifact@fa0a91b85d4f404e444e00e005971372dc801d16
        with:
          path: artifacts
      - run: |
          for dir in ./artifacts/wasmcloud-*; do
            target=${dir#./artifacts/wasmcloud-}
            for bin_path in $(find ${dir}/bin -type f); do
              chmod +x ${bin_path}
              bin=$(basename ${bin_path})
              case "$bin" in
                *.exe)
                  bin="${bin%.exe}"
                  mkdir -p ./${bin}
                  mv ${bin_path} ./${bin}/${bin}-${target}.exe
                ;;
                *)
                  mkdir -p ./${bin}
                  mv ${bin_path} ./${bin}/${bin}-${target%-fhs}
                ;;
              esac
            done
          done

      - uses: softprops/action-gh-release@7b4da11513bf3f43f9999e90eabced41ab8bb048
        if: startsWith(github.ref, 'refs/tags/v')
        with:
          draft: true
          prerelease: true
          generate_release_notes: true
          files: ./wasmcloud/*

      - uses: softprops/action-gh-release@7b4da11513bf3f43f9999e90eabced41ab8bb048
        if: startsWith(github.ref, 'refs/tags/wash-cli-v')
        with:
          draft: false
          prerelease: true
          generate_release_notes: true
          files: ./wash/*

      - name: Extract version
        if: startsWith(github.ref, 'refs/tags/wash-cli-v')
        run: |
          VERSION=$(echo "${GITHUB_REF##*/}" | sed -e 's/wash-cli-v//')
          echo "wash_version=$VERSION" >> $GITHUB_ENV
      - name: Release homebrew
        uses: peter-evans/repository-dispatch@ff45666b9427631e3450c54a1bcbee4d9ff4d7c0
        if: startsWith(github.ref, 'refs/tags/wash-cli-v')
        with:
          token: ${{ secrets.HOMEBREW_CHOCOLATEY_DISPATCH_TOKEN }}
          repository: wasmCloud/homebrew-wasmcloud
          event-type: brew-formula-update
          client-payload: |
            {"tag_prefix": "wash-cli", "tag_version": "${{ env.wash_version }}"}
      - name: Release chocolatey
        uses: peter-evans/repository-dispatch@ff45666b9427631e3450c54a1bcbee4d9ff4d7c0
        if: startsWith(github.ref, 'refs/tags/wash-cli-v')
        with:
          token: ${{ secrets.HOMEBREW_CHOCOLATEY_DISPATCH_TOKEN }}
          repository: wasmCloud/chocolatey-wash
          event-type: choco-formula-update
          client-payload: |
            {"wash_version": "${{ env.wash_version }}"}

  nfpm:
    if: startsWith(github.ref, 'refs/tags/wash-cli-v')
    env:
      REF: ${{ github.ref }}
      PACKAGECLOUD_TOKEN: ${{ secrets.PACKAGECLOUD_API_TOKEN }}
    needs:
      - cargo
      - build-bin
      - test-linux
    runs-on: ubuntu-22.04
    steps:
      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683

      - uses: ./.github/actions/install-nix
        with:
          cachixAuthToken: '${{ secrets.CACHIX_AUTH_TOKEN }}'
      - name: Install NFPM
        run: nix profile install -L --inputs-from . 'nixpkgs#nfpm'

      - uses: actions/download-artifact@fa0a91b85d4f404e444e00e005971372dc801d16
        with:
          name: wasmcloud-aarch64-unknown-linux-musl
          path: ./crates/wash-cli/aarch64
      - uses: actions/download-artifact@fa0a91b85d4f404e444e00e005971372dc801d16
        with:
          name: wasmcloud-x86_64-unknown-linux-musl
          path: ./crates/wash-cli/x86_64
      - name: Make wash executable
        working-directory: ./crates/wash-cli
        run: |
          chmod +x ./aarch64/bin/wash
          chmod +x ./x86_64/bin/wash

      - name: Build `deb` and `rpm`
        working-directory: ./crates/wash-cli
        run: |
          export VERSION=$(echo $REF| cut -d- -f3 | tr -d "v")
          nfpm pkg --packager deb -f build/nfpm.amd64.yaml
          nfpm pkg --packager deb -f build/nfpm.arm64.yaml
          nfpm pkg --packager rpm -f build/nfpm.amd64.yaml
          nfpm pkg --packager rpm -f build/nfpm.arm64.yaml
      - name: Push `deb`
        working-directory: ./crates/wash-cli
        run: |
          debs=(35 203 206 207 210 215 219 220 221 233 235 237 261 266 278 284)
          for distro_version in "${debs[@]}"; do
            curl -F "package[distro_version_id]=${distro_version}" -F "package[package_file]=@$(ls wash_*_amd64.deb)" https://$PACKAGECLOUD_TOKEN:@packagecloud.io/api/v1/repos/wasmcloud/core/packages.json;
            curl -F "package[distro_version_id]=${distro_version}" -F "package[package_file]=@$(ls wash_*_arm64.deb)" https://$PACKAGECLOUD_TOKEN:@packagecloud.io/api/v1/repos/wasmcloud/core/packages.json;
          done
      - name: Push `rpm`
        working-directory: ./crates/wash-cli
        run: |
          rpms=(194 204 209 216 226 231 236 239 240 244 260 273 279 283 302)
          for distro_version in "${rpms[@]}"; do
            curl -F "package[distro_version_id]=${distro_version}" -F "package[package_file]=@$(ls wash-*.aarch64.rpm)" https://$PACKAGECLOUD_TOKEN:@packagecloud.io/api/v1/repos/wasmcloud/core/packages.json;
            curl -F "package[distro_version_id]=${distro_version}" -F "package[package_file]=@$(ls wash-*.x86_64.rpm)" https://$PACKAGECLOUD_TOKEN:@packagecloud.io/api/v1/repos/wasmcloud/core/packages.json;
          done

  crates:
    strategy:
      matrix:
        include:
          - crate: component
            workspace-dependencies: true

          - crate: control-interface
            workspace-dependencies: true

          - crate: core
            workspace-dependencies: true

          - crate: host
            workspace-dependencies: true

          - crate: host-sys
            workspace-dependencies: true

          - crate: opentelemetry-nats

          - crate: provider-archive
            workspace-dependencies: true

          - crate: provider-sdk
            workspace-dependencies: true

          - crate: runtime
            workspace-dependencies: true

          - crate: test-util
            workspace-dependencies: true

          - crate: tracing
            workspace-dependencies: true

          - crate: secrets-types
            workspace-dependencies: true

          - crate: secrets-client
            workspace-dependencies: true

          - crate: wascap

          - crate: wash-cli
            workspace-dependencies: true

          - crate: wash-lib
            workspace-dependencies: true

    name: publish ${{ matrix.crate }} to crates.io
    needs: cargo
    runs-on: ubuntu-22.04
    steps:
      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683

      - name: Extract tag context
        id: ctx
        run: |
          version=${GITHUB_REF_NAME#${{ matrix.crate }}-v}
          echo "version is ${version}"
          if [[ $version == *"-"* ]]; then
            echo "version ${version} is a pre-release"
            echo "prerelease=true" >> "$GITHUB_OUTPUT"
          fi

      - name: dry-run publish ${{ matrix.crate }} to crates.io
        if: ${{ !startsWith(github.ref, 'refs/tags/') }}
        continue-on-error: ${{ matrix.workspace-dependencies }} # publish may fail due to workspace crates not being published yet
        run: cargo publish --dry-run
        working-directory: ./crates/${{ matrix.crate }}

      - name: publish ${{ matrix.crate }} to crates.io
        if: startsWith(github.ref, format('refs/tags/{0}-v', matrix.crate))
        continue-on-error: ${{ github.repository_owner != 'wasmCloud' }}
        run: cargo publish --token ${{ secrets.CRATES_PUBLISH_TOKEN }}
        working-directory: ./crates/${{ matrix.crate }}

  smart-release:
    if: github.event_name == 'workflow_dispatch'
    runs-on: ubuntu-22.04
    permissions:
      contents: write
      pull-requests: write
    steps:
      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683
        with:
          fetch-depth: 0
          fetch-tags: true
      - name: Install cmake for smart-release
        run: sudo apt update && sudo apt install cmake -y

      - run: rustup show
      - name: install smart-release
        env:
          RUSTFLAGS: ''
        # NOTE(brooksmtownsend): Installing from my fork as updating workspace dependencies is not yet supported in the mainline
        # PR to follow: https://github.com/Byron/cargo-smart-release/pull/17
        run: cargo install cargo-smart-release --git https://github.com/brooksmtownsend/cargo-smart-release --branch feat/update-workspace-dependencies

      - name: dry run release
        if: ${{ !inputs.do-release }}
        run: |
          git config --global user.email "automation@wasmcloud.com"
          git config --global user.name "wasmCloud automation"
          cargo smart-release --update-crates-index --no-publish --execute --no-changelog-preview --no-push ${{ inputs.additional-args }} ${{ inputs.crate }} --allow-dirty

      - name: Create Pull Request
        if: ${{ !inputs.do-release }}
        uses: peter-evans/create-pull-request@5e914681df9dc83aa4e4905692ca88beb2f9e91f
        with:
          branch: release-${{ inputs.crate }}
          signoff: true
          committer: wasmCloud Automation <automation@wasmcloud.com>
          title: Release ${{ inputs.crate }}
          commit-message: 'release(${{ inputs.crate }}): release and update CHANGELOG'

      - name: release
        if: ${{ inputs.do-release }}
        env:
          GH_TOKEN: ${{ github.token }}
          CARGO_REGISTRY_TOKEN: ${{ secrets.CRATES_PUBLISH_TOKEN }}
        run: |
          git config --global user.email "automation@wasmcloud.com"
          git config --global user.name "wasmCloud automation"
          cargo smart-release --update-crates-index --execute --no-changelog-preview --no-changelog ${{ inputs.additional-args }} ${{ inputs.crate }}