333 lines
18 KiB
YAML
333 lines
18 KiB
YAML
name: wai command line release
|
|
|
|
# On a tag wai-v<version> (the version wai/wai-rs/Cargo.toml states), builds the quickstart
|
|
# archive (wai/quickstart/build.sh) on each runner and attaches it to the forge release of that
|
|
# tag, each archive with its SHA-256. An archive holds bin/ (wai with the feature quickstart,
|
|
# wai-relay, wai-room, wai-ingest, wai-remote-host, wai-pack, wai-quantum), share/wai/web/ (the
|
|
# room client) and share/wai/studio/ (WAI Studio, which `wai dev` serves at /_wai/), both built
|
|
# once, on the macOS host, which has the WebAssembly toolchain and Node:
|
|
# macOS aarch64-apple-darwin, and x86_64-apple-darwin on the Intel Mac (macos-x86_64);
|
|
# Linux x86_64- and aarch64-unknown-linux-musl, static, so any distribution runs it;
|
|
# Windows x86_64-pc-windows-msvc, as a zip.
|
|
# The first job checks the tag against the crate's version and the installer's, and that each
|
|
# project file schema (wai/schema/) is served at its $id as committed: every project file the
|
|
# release writes names its schema there, so a tag does not build until the site serves it.
|
|
# Before it is attached, each archive runs the quickstart as a new user runs it, from the
|
|
# archive alone on a fresh home directory and a PATH of the system's own directories
|
|
# (wai/quickstart/test/clean-machine.sh; on Windows its PowerShell twin, clean-machine.ps1):
|
|
# the archive checked against its SHA-256 and unpacked, what it holds checked (every binary,
|
|
# each of which runs, the room client and WAI Studio), then wai hello, wai verify,
|
|
# wai create my-room --template video-room and wai dev --check in the project, Studio at /_wai/
|
|
# among what it checks; and on arm64 macOS, the project's page joined in two browser
|
|
# pages, each decoding the other. A cross-built archive, whose binaries this host cannot run,
|
|
# is not run. `wai doctor --json` from the unpacked archive, its bin first on PATH, must pass
|
|
# every install and stack check: this wai, the relay and the room service beside it and of its
|
|
# version, the room client's and Studio's files (wai/quickstart/test/archive_doctor.py). The
|
|
# ports and browsers depend on the runner: they are printed and not required. On macOS this
|
|
# runs where the triple is the host's.
|
|
# A last job writes the Homebrew formula and the Scoop manifest for the archives attached and
|
|
# attaches them too; they go into the tap and the bucket by hand.
|
|
#
|
|
# Uploads go to the forge directly over the private network (FORGE_API), never through the
|
|
# public tunnel. A runner that is down leaves its platform's archive missing: the release lists
|
|
# what each build attached.
|
|
|
|
concurrency:
|
|
group: ${{ github.workflow }}-${{ github.ref }}
|
|
cancel-in-progress: true
|
|
|
|
on:
|
|
push:
|
|
tags: ['wai-v*']
|
|
|
|
permissions:
|
|
contents: write
|
|
|
|
env:
|
|
CARGO_TERM_COLOR: always
|
|
FORGE_API: http://100.64.224.0:3400/api/v1
|
|
FORGE_REPO: Transaction-Science/open-standards
|
|
PUBLIC: https://git.transaction.science/Transaction-Science/open-standards
|
|
|
|
jobs:
|
|
version:
|
|
name: the tag is the crate's version
|
|
runs-on: linux
|
|
outputs:
|
|
version: ${{ steps.v.outputs.version }}
|
|
steps:
|
|
- uses: actions/checkout@v5
|
|
- id: v
|
|
shell: bash
|
|
run: |
|
|
set -euo pipefail
|
|
v="${GITHUB_REF_NAME#wai-v}"
|
|
crate="$(sed -n 's/^version = "\(.*\)"$/\1/p' wai/wai-rs/Cargo.toml | head -1)"
|
|
[ "$v" = "$crate" ] || { echo "::error::the tag says $v, wai/wai-rs/Cargo.toml says $crate"; exit 1; }
|
|
grep -q "WAI_VERSION:-$v}" wai/quickstart/install.sh || { echo "::error::wai/quickstart/install.sh does not install $v"; exit 1; }
|
|
# Every project file, lock and build record this release writes names its schema by URL
|
|
# ($schema), which editors and agents fetch: each committed schema is served at its $id,
|
|
# as committed, before a release writes a file that names it (wai/schema/README.md).
|
|
for f in wai/schema/*.schema.json; do
|
|
python3 - "$f" <<'PY' || exit 1
|
|
import json, sys, urllib.request
|
|
f = sys.argv[1]
|
|
want = json.load(open(f))
|
|
url = want["$id"]
|
|
try:
|
|
with urllib.request.urlopen(urllib.request.Request(url, headers={"User-Agent": "wai-release"}), timeout=30) as r:
|
|
got = json.loads(r.read())
|
|
except Exception as e:
|
|
sys.exit(f"::error::{url} does not serve {f} ({e}): deploy the site with the schema before the release")
|
|
if got != want:
|
|
sys.exit(f"::error::{url} serves a schema other than {f}: deploy the site with the schema before the release")
|
|
print(f"{url} serves {f}")
|
|
PY
|
|
done
|
|
echo "version=$v" >> "$GITHUB_OUTPUT"
|
|
|
|
# The room client and WAI Studio, once: the same files on every platform.
|
|
web:
|
|
name: the room client and WAI Studio
|
|
needs: version
|
|
runs-on: macos
|
|
timeout-minutes: 60
|
|
steps:
|
|
- uses: actions/checkout@v5
|
|
# launchd's PATH omits cargo and node on the macOS host runner.
|
|
- name: Put cargo and node on PATH
|
|
shell: bash
|
|
run: |
|
|
echo "$HOME/.cargo/bin" >> "$GITHUB_PATH"
|
|
echo "/opt/homebrew/bin" >> "$GITHUB_PATH"
|
|
- name: Build and attach them
|
|
shell: bash
|
|
env:
|
|
FORGE_TOKEN: ${{ github.token }}
|
|
run: |
|
|
set -euo pipefail
|
|
rustup target add wasm32-unknown-unknown
|
|
command -v wasm-bindgen >/dev/null && wasm-bindgen --version | grep -q ' 0\.2\.127$' || cargo install --locked wasm-bindgen-cli --version 0.2.127
|
|
v="${{ needs.version.outputs.version }}"
|
|
bash wai/quickstart/build-web.sh "$RUNNER_TEMP/web"
|
|
bash wai/quickstart/build-studio.sh "$RUNNER_TEMP/studio"
|
|
mkdir -p "$RUNNER_TEMP/dist"
|
|
tar -C "$RUNNER_TEMP" -czf "$RUNNER_TEMP/dist/wai-web-$v.tar.gz" web studio
|
|
( cd "$RUNNER_TEMP/dist" && shasum -a 256 "wai-web-$v.tar.gz" > "wai-web-$v.tar.gz.sha256" )
|
|
bash wai/quickstart/publish.sh "$GITHUB_REF_NAME" "wai $v" "$RUNNER_TEMP"/dist/*
|
|
|
|
macos:
|
|
name: macOS · ${{ matrix.triple }}
|
|
needs: [version, web]
|
|
# Each archive on a Mac of its own architecture, so its own `wai` runs before it is
|
|
# attached (the checks below run when the triple is the host's): x86_64 on the Intel Mac.
|
|
runs-on: ${{ matrix.runner }}
|
|
timeout-minutes: 120
|
|
strategy:
|
|
fail-fast: false
|
|
matrix:
|
|
# `browser`: whether the host has the browser and the automation package the
|
|
# quickstart's two-page step drives (the arm64 runner does, as wai-examples.yml uses them;
|
|
# the x86_64 one is not set up for it).
|
|
include:
|
|
- { triple: aarch64-apple-darwin, runner: macos, browser: true }
|
|
- { triple: x86_64-apple-darwin, runner: macos-x86_64, browser: false }
|
|
steps:
|
|
- uses: actions/checkout@v5
|
|
# launchd's PATH omits cargo and node on the macOS host runner, and the browser step below
|
|
# installs its automation package with npm. GITHUB_PATH's last line comes first on the
|
|
# PATH: rustup's toolchain stays ahead of anything Homebrew holds.
|
|
- name: Put cargo and node on PATH
|
|
shell: bash
|
|
run: |
|
|
echo "/opt/homebrew/bin" >> "$GITHUB_PATH"
|
|
echo "$HOME/.cargo/bin" >> "$GITHUB_PATH"
|
|
- name: Build, check and package
|
|
shell: bash
|
|
run: |
|
|
set -euo pipefail
|
|
v="${{ needs.version.outputs.version }}"
|
|
rustup target add "${{ matrix.triple }}"
|
|
curl -fsS -o "$RUNNER_TEMP/web.tar.gz" "${FORGE_API%/api/v1}/$FORGE_REPO/releases/download/$GITHUB_REF_NAME/wai-web-$v.tar.gz"
|
|
tar -C "$RUNNER_TEMP" -xzf "$RUNNER_TEMP/web.tar.gz"
|
|
nice -n 10 bash wai/quickstart/build.sh "$RUNNER_TEMP/dist" --web "$RUNNER_TEMP/web" --studio "$RUNNER_TEMP/studio" --target "${{ matrix.triple }}" --version "$v"
|
|
if [ "${{ matrix.triple }}" = "$(rustc -vV | sed -n 's/^host: //p')" ]; then
|
|
t="$RUNNER_TEMP/try"; mkdir -p "$t"; tar -C "$t" -xzf "$RUNNER_TEMP/dist/wai-$v-${{ matrix.triple }}.tar.gz"
|
|
python3 -I wai/quickstart/test/archive_doctor.py "$t/wai-$v-${{ matrix.triple }}"
|
|
fi
|
|
- name: The quickstart from the archive, as a new user runs it
|
|
shell: bash
|
|
env:
|
|
BROWSER_BIN: /Applications/Google Chrome.app/Contents/MacOS/Google Chrome # allow-name: the macOS runner's browser executable, a file path
|
|
run: |
|
|
set -euo pipefail
|
|
v="${{ needs.version.outputs.version }}"
|
|
if [ "${{ matrix.triple }}" != "$(rustc -vV | sed -n 's/^host: //p')" ]; then
|
|
echo "cross-built for ${{ matrix.triple }}: this host cannot run it"
|
|
exit 0
|
|
fi
|
|
flag=""
|
|
if [ "${{ matrix.browser }}" = true ]; then
|
|
test -x "$BROWSER_BIN" || { echo "::error::this runner has no browser at $BROWSER_BIN"; exit 1; }
|
|
pw="$RUNNER_TEMP/automation"; mkdir -p "$pw"
|
|
cp wai/quickstart/test/package.json wai/quickstart/test/package-lock.json "$pw/"
|
|
(cd "$pw" && npm ci --ignore-scripts --no-audit --no-fund > /dev/null)
|
|
export PLAYWRIGHT_HOST="$pw/node_modules"
|
|
flag=--browser
|
|
fi
|
|
bash wai/quickstart/test/clean-machine.sh "$RUNNER_TEMP/dist/wai-$v-${{ matrix.triple }}.tar.gz" $flag
|
|
- name: Attach to the release
|
|
shell: bash
|
|
env:
|
|
FORGE_TOKEN: ${{ github.token }}
|
|
run: bash wai/quickstart/publish.sh "$GITHUB_REF_NAME" "wai ${{ needs.version.outputs.version }}" "$RUNNER_TEMP"/dist/*
|
|
|
|
linux:
|
|
name: Linux · ${{ matrix.triple }}
|
|
needs: [version, web]
|
|
runs-on: ${{ matrix.runner }}
|
|
timeout-minutes: 120
|
|
strategy:
|
|
fail-fast: false
|
|
matrix:
|
|
include:
|
|
- runner: linux
|
|
triple: x86_64-unknown-linux-musl
|
|
- runner: linux-arm64
|
|
triple: aarch64-unknown-linux-musl
|
|
steps:
|
|
- uses: actions/checkout@v5
|
|
- name: Install Rust 1.99.1, the musl target and musl-gcc
|
|
shell: bash
|
|
run: |
|
|
export PATH="$HOME/.cargo/bin:$PATH"
|
|
command -v rustup >/dev/null 2>&1 || \
|
|
curl --proto '=https' --tlsv1.2 -sSf https://sh.rustup.rs | sh -s -- -y --profile minimal --default-toolchain 1.99.1
|
|
rustup toolchain install 1.99.1 --profile minimal
|
|
rustup default 1.99.1
|
|
rustup target add "${{ matrix.triple }}"
|
|
SUDO=""; [ "$(id -u)" -ne 0 ] && SUDO="sudo"
|
|
$SUDO apt-get update -qq
|
|
$SUDO apt-get install -y -qq musl-tools python3 curl
|
|
echo "$HOME/.cargo/bin" >> "$GITHUB_PATH"
|
|
- name: Build, check and package
|
|
shell: bash
|
|
run: |
|
|
set -euo pipefail
|
|
v="${{ needs.version.outputs.version }}"
|
|
t="${{ matrix.triple }}"
|
|
T="$(echo "$t" | tr 'a-z-' 'A-Z_')"
|
|
# Static, as the quantum command line is built (wai-quantum-cli-release.yml).
|
|
export "CC_${t//-/_}=musl-gcc" "CARGO_TARGET_${T}_LINKER=musl-gcc"
|
|
export RUSTFLAGS="-C target-feature=+crt-static -C relocation-model=static"
|
|
curl -fsS -o "$RUNNER_TEMP/web.tar.gz" "${FORGE_API%/api/v1}/$FORGE_REPO/releases/download/$GITHUB_REF_NAME/wai-web-$v.tar.gz"
|
|
tar -C "$RUNNER_TEMP" -xzf "$RUNNER_TEMP/web.tar.gz"
|
|
bash wai/quickstart/build.sh "$RUNNER_TEMP/dist" --web "$RUNNER_TEMP/web" --studio "$RUNNER_TEMP/studio" --target "$t" --version "$v"
|
|
d="$RUNNER_TEMP/try"; mkdir -p "$d"; tar -C "$d" -xzf "$RUNNER_TEMP/dist/wai-$v-$t.tar.gz"
|
|
python3 -I wai/quickstart/test/archive_doctor.py "$d/wai-$v-$t"
|
|
- name: The quickstart from the archive, as a new user runs it
|
|
shell: bash
|
|
run: bash wai/quickstart/test/clean-machine.sh "$RUNNER_TEMP/dist/wai-${{ needs.version.outputs.version }}-${{ matrix.triple }}.tar.gz"
|
|
- name: Attach to the release
|
|
shell: bash
|
|
env:
|
|
FORGE_TOKEN: ${{ github.token }}
|
|
run: bash wai/quickstart/publish.sh "$GITHUB_REF_NAME" "wai ${{ needs.version.outputs.version }}" "$RUNNER_TEMP"/dist/*
|
|
|
|
windows:
|
|
name: Windows · x86_64-pc-windows-msvc
|
|
needs: [version, web]
|
|
runs-on: windows
|
|
timeout-minutes: 120
|
|
env:
|
|
CI: ""
|
|
steps:
|
|
- uses: actions/checkout@v5
|
|
- name: Build, check and package
|
|
shell: pwsh
|
|
run: |
|
|
$ErrorActionPreference = 'Stop'
|
|
Remove-Item Env:CI -ErrorAction SilentlyContinue
|
|
$v = "${{ needs.version.outputs.version }}"
|
|
$t = "x86_64-pc-windows-msvc"
|
|
$web = Join-Path $env:RUNNER_TEMP 'web.tar.gz'
|
|
curl.exe -fsS -o $web "$($env:FORGE_API -replace '/api/v1$','')/$env:FORGE_REPO/releases/download/$env:GITHUB_REF_NAME/wai-web-$v.tar.gz"
|
|
tar -xzf $web -C $env:RUNNER_TEMP
|
|
$name = "wai-$v-$t"
|
|
$stage = Join-Path $env:RUNNER_TEMP $name
|
|
$dist = Join-Path $env:RUNNER_TEMP 'dist'
|
|
Remove-Item $stage, $dist -Recurse -Force -ErrorAction Ignore
|
|
New-Item -ItemType Directory -Force -Path (Join-Path $stage 'bin'), (Join-Path $stage 'share\wai'), $dist | Out-Null
|
|
$builds = @(
|
|
@{ dir = 'wai\wai-rs'; bin = 'wai'; args = @('--no-default-features', '--features', 'quickstart', '--bin', 'wai') },
|
|
@{ dir = 'joule-code\joule-code-rs'; bin = 'wai-relay'; args = @('-p', 'joule-moq-relay', '--bin', 'wai-relay') },
|
|
@{ dir = 'joule-code\joule-code-rs\crates\joule-moq-room'; bin = 'wai-room'; args = @('--bin', 'wai-room') },
|
|
@{ dir = 'joule-code\joule-code-rs'; bin = 'wai-ingest'; args = @('-p', 'joule-moq-ingest', '--bin', 'wai-ingest') },
|
|
@{ dir = 'joule-code\joule-code-rs\crates\joule-moq-remote'; bin = 'wai-remote-host'; args = @('--bin', 'wai-remote-host') },
|
|
@{ dir = 'wai\wai-pack'; bin = 'wai-pack'; args = @('--bin', 'wai-pack') },
|
|
@{ dir = 'wai\wai-quantum-cli'; bin = 'wai-quantum'; args = @('--bin', 'wai-quantum') }
|
|
)
|
|
foreach ($b in $builds) {
|
|
Push-Location $b.dir
|
|
cargo build --locked --release --target $t @($b.args)
|
|
if ($LASTEXITCODE -ne 0) { throw "the build of $($b.bin) failed" }
|
|
$target = (cargo metadata --format-version 1 --no-deps --locked | ConvertFrom-Json).target_directory
|
|
Copy-Item (Join-Path $target "$t\release\$($b.bin).exe") (Join-Path $stage 'bin')
|
|
Pop-Location
|
|
}
|
|
Copy-Item -Recurse (Join-Path $env:RUNNER_TEMP 'web') (Join-Path $stage 'share\wai\web')
|
|
Copy-Item -Recurse (Join-Path $env:RUNNER_TEMP 'studio') (Join-Path $stage 'share\wai\studio')
|
|
Copy-Item wai\quickstart\README.md, wai\LICENSE $stage
|
|
& (Join-Path $stage 'bin\wai.exe') create --list
|
|
if ($LASTEXITCODE -ne 0) { throw "the packaged wai does not run" }
|
|
& (Join-Path $stage 'bin\wai-quantum.exe') --version
|
|
if ($LASTEXITCODE -ne 0) { throw "the packaged wai-quantum does not run" }
|
|
python -I wai\quickstart\test\archive_doctor.py $stage
|
|
if ($LASTEXITCODE -ne 0) { throw "wai doctor from the archive: an install or stack check did not pass" }
|
|
Compress-Archive -Path $stage -DestinationPath (Join-Path $dist "$name.zip") -Force
|
|
$h = (Get-FileHash (Join-Path $dist "$name.zip") -Algorithm SHA256).Hash.ToLower()
|
|
Set-Content -NoNewline -Path (Join-Path $dist "$name.zip.sha256") -Value "$h $name.zip`n"
|
|
# clean-machine.ps1 has run under PowerShell 7 on a macOS archive, without its contents step
|
|
# and its check of WAI Studio. No Windows archive has been through it.
|
|
- name: The quickstart from the archive, as a new user runs it
|
|
shell: pwsh
|
|
run: |
|
|
$ErrorActionPreference = 'Stop'
|
|
Remove-Item Env:CI -ErrorAction SilentlyContinue
|
|
$name = "wai-${{ needs.version.outputs.version }}-x86_64-pc-windows-msvc"
|
|
pwsh -NoProfile -File wai\quickstart\test\clean-machine.ps1 (Join-Path $env:RUNNER_TEMP "dist\$name.zip")
|
|
if ($LASTEXITCODE -ne 0) { throw "the quickstart failed from $name.zip" }
|
|
- name: Attach to the release
|
|
shell: pwsh
|
|
env:
|
|
FORGE_TOKEN: ${{ github.token }}
|
|
run: |
|
|
$ErrorActionPreference = 'Stop'
|
|
$H = @{ Authorization = "token $env:FORGE_TOKEN" }
|
|
$base = "$env:FORGE_API/repos/$env:FORGE_REPO/releases"
|
|
$rel = Invoke-RestMethod -Headers $H -Uri "$base/tags/$env:GITHUB_REF_NAME"
|
|
foreach ($f in Get-ChildItem (Join-Path $env:RUNNER_TEMP 'dist')) {
|
|
foreach ($a in (Invoke-RestMethod -Headers $H -Uri "$base/$($rel.id)/assets" | Where-Object { $_.name -eq $f.Name })) {
|
|
Invoke-RestMethod -Headers $H -Method Delete -Uri "$base/$($rel.id)/assets/$($a.id)" | Out-Null
|
|
}
|
|
curl.exe -fsS -H "Authorization: token $env:FORGE_TOKEN" -X POST "$base/$($rel.id)/assets?name=$($f.Name)" -F "attachment=@$($f.FullName);type=application/octet-stream" -o NUL -w "uploaded $($f.Name): http %{http_code}`n"
|
|
if ($LASTEXITCODE -ne 0) { throw "the upload of $($f.Name) failed" }
|
|
}
|
|
|
|
formulae:
|
|
name: Homebrew formula and Scoop manifest
|
|
needs: [version, macos, linux, windows]
|
|
if: always() && needs.version.result == 'success'
|
|
runs-on: linux
|
|
steps:
|
|
- uses: actions/checkout@v5
|
|
- name: Write and attach them
|
|
shell: bash
|
|
env:
|
|
FORGE_TOKEN: ${{ github.token }}
|
|
run: |
|
|
set -euo pipefail
|
|
v="${{ needs.version.outputs.version }}"
|
|
out="$RUNNER_TEMP/formulae"; mkdir -p "$out"
|
|
python3 wai/quickstart/formulae.py "$v" "$GITHUB_REF_NAME" "$FORGE_API" "$FORGE_REPO" "$PUBLIC" "$out"
|
|
bash wai/quickstart/publish.sh "$GITHUB_REF_NAME" "wai $v" "$out"/*
|