nandi.uk
Fork of daniellemaywood.uk/gleam — Wasm codegen work
7.4 kB
214 lines
1name: "Build Gleam"
2description: "Build Gleam Release"
3inputs:
4 version:
5 description: "Build Version"
6 required: true
7 toolchain:
8 description: "Cargo Toolchain"
9 required: true
10 target:
11 description: "Cargo Installation Target"
12 required: true
13 cargo-tool:
14 description: "Cargo Tool used for Build (for example, `cross`)"
15 required: true
16 expected-binary-architecture:
17 description: "Expected Binary Architecture"
18 required: false
19 default: ""
20
21outputs:
22 archive:
23 description: "Path to build asset"
24 value: "${{ steps.build.outputs.archive }}"
25 files:
26 description: "Path to all files"
27 value: |
28 ${{ steps.build.outputs.archive }}
29 ${{ steps.build.outputs.archive }}.sha256
30 ${{ steps.build.outputs.archive }}.sha512
31 ${{ steps.build.outputs.archive }}.sigstore
32 ${{ steps.build.outputs.archive }}.sbom.spdx.json
33 ${{ steps.build.outputs.archive }}.sbom.cyclonedx.json
34
35runs:
36 using: "composite"
37 steps:
38 - name: Install Rust toolchain
39 uses: actions-rust-lang/setup-rust-toolchain@v1
40 with:
41 toolchain: ${{ inputs.toolchain }}
42 target: ${{ inputs.target }}
43 cache-key: v1-${{ inputs.target }}
44
45 - name: Install Cargo SBoM
46 shell: bash
47 # The `cargo-sbom` version is specified in the next line. Change it to
48 # keep it up-to-date.
49 run: cargo install cargo-sbom@~0.9.1
50
51 - name: Build WASM release binary
52 if: ${{ inputs.target != 'wasm32-unknown-unknown' }}
53 uses: clechasseur/rs-cargo@v3
54 with:
55 command: build
56 args: --release --target ${{ inputs.target }}
57 tool: ${{ inputs.cargo-tool }}
58
59 - name: Install wasm-pack
60 if: ${{ inputs.target == 'wasm32-unknown-unknown' }}
61 shell: bash
62 run: curl -sSL https://rustwasm.github.io/wasm-pack/installer/init.sh | sh
63
64 - name: Build WASM release binary
65 if: ${{ inputs.target == 'wasm32-unknown-unknown' }}
66 shell: bash
67 run: wasm-pack build --release --target web compiler-wasm
68
69 - name: Verify binary architecture
70 if: ${{ inputs.expected-binary-architecture }}
71 shell: bash
72 run: |
73 BINARY_PATH="target/${{ inputs.target }}/release/gleam"
74 if [[ "${{ inputs.target }}" == *"windows"* ]]; then
75 BINARY_PATH="${BINARY_PATH}.exe"
76 fi
77
78 if ! file -b "$BINARY_PATH" | grep -q "${{ inputs.expected-binary-architecture }}"; then
79 echo "error: Architecture mismatch"
80 echo "Expected architecture: '${{ inputs.expected-binary-architecture }}'"
81 echo "Found binary type: '$(file -b "$BINARY_PATH")'"
82 exit 1
83 fi
84 echo "ok: Architecture match"
85
86 - name: Build archive
87 id: build
88 shell: bash
89 run: |
90 case "$TARGET" in
91 *windows*)
92 ARCHIVE="gleam-$VERSION-$TARGET.zip"
93 cp "target/$TARGET/release/gleam.exe" "gleam.exe"
94 7z a "$ARCHIVE" "gleam.exe"
95 rm gleam.exe
96 ;;
97 wasm*)
98 ARCHIVE="gleam-$VERSION-browser.tar.gz"
99 tar -C compiler-wasm/pkg/ -czvf $ARCHIVE .
100 rm -rf compiler-wasm/pkg/
101 ;;
102 *)
103 ARCHIVE="gleam-$VERSION-$TARGET.tar.gz"
104 cp "target/$TARGET/release/gleam" "gleam"
105 tar -czvf "$ARCHIVE" "gleam"
106 rm gleam
107 ;;
108 esac
109
110 echo "archive=$ARCHIVE" >> $GITHUB_OUTPUT
111 env:
112 TARGET: "${{ inputs.target }}"
113 VERSION: "${{ inputs.version }}"
114
115 - name: Ensure binary successfully boots
116 if: ${{ inputs.expected-binary-architecture }}
117 shell: bash
118 run: |
119 case "$TARGET" in
120 x86_64-pc-windows-msvc)
121 7z x "$ARCHIVE"
122 ./gleam.exe --version
123 ;;
124 aarch64*)
125 echo "We cannot test an ARM binary on a AMD64 runner"
126 ;;
127 *)
128 tar -xvzf "$ARCHIVE"
129 ./gleam --version
130 ;;
131 esac
132 env:
133 TARGET: "${{ inputs.target }}"
134 ARCHIVE: "${{ steps.build.outputs.archive }}"
135
136 # By using `cargo-sbom``, we create two formats of Build SBoMs
137 # (SPDX and CycloneDX) for the gleam build.
138 # We store those files alongside the build artifacts on the GitHub Release
139 # page and also use them to create Container SBoMs for Docker images.
140 #
141 # Why is this helpful?
142 # * It gives us and our users complete visibility into which dependencies
143 # and which versions are present in the build / container image.
144 # * The SBoM can be fed into vulnerability scanners so that anyone can check
145 # if any dependencies have known security issues.
146 - name: Generate Build SBoM
147 shell: bash
148 run: |
149 cargo-sbom \
150 --output-format spdx_json_2_3 \
151 > "$ARCHIVE.sbom.spdx.json"
152
153 cargo-sbom \
154 --output-format cyclone_dx_json_1_4 \
155 > "$ARCHIVE.sbom.cyclonedx.json"
156 env:
157 ARCHIVE: "${{ steps.build.outputs.archive }}"
158
159 - name: Hash Build Archive
160 shell: bash
161 run: |
162 openssl dgst -r -sha256 -out "$ARCHIVE".sha256 "$ARCHIVE"
163 openssl dgst -r -sha512 -out "$ARCHIVE".sha512 "$ARCHIVE"
164 env:
165 ARCHIVE: "${{ steps.build.outputs.archive }}"
166
167 # We provide SLSA Provenance for the distribution build. This attests to
168 # where, when, and how the asset or image was built.
169 #
170 # Why is this helpful?
171 # * It provides a record of the exact Git commit (git sha) and GitHub
172 # Actions workflow used to produce a release.
173 # * Users or automated systems can verify that the artifact you’re
174 # downloading was indeed built from the official Gleam repo, on a
175 # particular date, using the correct pipeline and not tampered with later.
176 # * The attestation is published to a transparency log for extra
177 # verification: https://github.com/gleam-lang/gleam/attestations/
178 #
179 # For more information, see:
180 # * https://github.com/actions/attest
181 # * https://github.com/actions/attest-sbom
182 - name: Attest Distribution Assets with SBoM
183 id: attest-sbom
184 uses: actions/attest-sbom@v2
185 with:
186 subject-path: |
187 ${{ steps.build.outputs.archive }}
188 ${{ steps.build.outputs.archive }}.sbom.spdx.json
189 ${{ steps.build.outputs.archive }}.sbom.cyclonedx.json
190 sbom-path: "${{ steps.build.outputs.archive }}.sbom.spdx.json"
191
192 # The provenanve information is stored alongside the built artifact with
193 # the `.sigstore` file extension.
194 - name: "Copy SBoM provenance"
195 id: sbom-provenance
196 shell: bash
197 run: |
198 cp "$ATTESTATION" "$ARCHIVE.sigstore"
199 env:
200 ARCHIVE: "${{ steps.build.outputs.archive }}"
201 ATTESTATION: "${{ steps.attest-sbom.outputs.bundle-path }}"
202
203 - name: Upload artifact
204 uses: actions/upload-artifact@v4
205 with:
206 name: release-${{ matrix.target }}
207 path: |
208 ${{ steps.build.outputs.archive }}
209 ${{ steps.build.outputs.archive }}.sha256
210 ${{ steps.build.outputs.archive }}.sha512
211 ${{ steps.build.outputs.archive }}.sigstore
212 ${{ steps.build.outputs.archive }}.sbom.spdx.json
213 ${{ steps.build.outputs.archive }}.sbom.cyclonedx.json
214 overwrite: true