new release process

.github/workflows/main.yml

@@ -1,9 +1,7 @@
 name: CI
 on:
-  push:
-    branches: [main]
   pull_request:
-    branches: [main]
+  merge_group:
 
 # Cancel any in-flight jobs for the same PR/branch so there's only one active
 # at a time
@@ -12,6 +10,48 @@ concurrency:
   cancel-in-progress: true
 
 jobs:
+  build:
+    name: Build wasm-tools
+    runs-on: ${{ matrix.os }}
+    strategy:
+      matrix:
+        include:
+        - build: x86_64-linux
+          os: ubuntu-latest
+        - build: x86_64-macos
+          os: macos-latest
+        - build: aarch64-macos
+          os: macos-latest
+          target: aarch64-apple-darwin
+        - build: x86_64-windows
+          os: windows-latest
+        - build: aarch64-linux
+          os: ubuntu-latest
+          target: aarch64-unknown-linux-gnu
+    steps:
+    - uses: actions/checkout@v4
+      with:
+        submodules: true
+    - run: rustup update stable --no-self-update && rustup default stable
+    - uses: bytecodealliance/wasmtime/.github/actions/[email protected]
+      with:
+        name: ${{ matrix.build }}
+    - run: |
+        echo CARGO_BUILD_TARGET=${{ matrix.target }} >> $GITHUB_ENV
+        rustup target add ${{ matrix.target }}
+      if: matrix.target != ''
+    - run: $CENTOS cargo build --release
+    - run: ./ci/build-tarballs.sh "${{ matrix.build }}" "${{ matrix.target }}"
+    - uses: actions/upload-artifact@v3
+      with:
+        name: bins-${{ matrix.build }}
+        path: dist
+
+    # - uses: softprops/action-gh-release@v1
+    #   if: startsWith(github.ref, 'refs/tags/') && github.repository == 'bytecodealliance/wasm-tools'
+    #   with:
+    #     files: "dist/*"
+
   test:
     name: Test
     runs-on: ${{ matrix.os }}
@@ -35,7 +75,7 @@ jobs:
             os: windows-latest
             rust: stable
     steps:
-    - uses: actions/checkout@v3
+    - uses: actions/checkout@v4
       with:
         submodules: true
     - name: Install Rust (rustup)
@@ -54,7 +94,7 @@ jobs:
     name: Test on WebAssembly
     runs-on: ubuntu-latest
     steps:
-    - uses: actions/checkout@v3
+    - uses: actions/checkout@v4
       with:
         submodules: true
     - name: Install Rust
@@ -77,7 +117,7 @@ jobs:
     name: Rustfmt
     runs-on: ubuntu-latest
     steps:
-    - uses: actions/checkout@v3
+    - uses: actions/checkout@v4
     - name: Install Rust
       run: rustup update stable && rustup default stable && rustup component add rustfmt
     # Note that this doesn't use `cargo fmt` because that doesn't format
@@ -89,7 +129,7 @@ jobs:
     name: Fuzz
     runs-on: ubuntu-latest
     steps:
-    - uses: actions/checkout@v3
+    - uses: actions/checkout@v4
       with:
         submodules: true
     - name: Install Rust
@@ -101,7 +141,7 @@ jobs:
   check:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v3
+      - uses: actions/checkout@v4
       - run: cargo check --benches -p wasm-smith
       - run: cargo check --no-default-features
       - run: cargo check --no-default-features --features print
@@ -133,5 +173,73 @@ jobs:
   doc:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v3
+      - uses: actions/checkout@v4
       - run: cargo doc --all
+
+  # "Join node" which the merge queue waits on.
+  ci-status:
+    name: Record the result of testing and building steps
+    runs-on: ubuntu-latest
+    needs:
+      - test
+      - wasm
+      - rustfmt
+      - fuzz
+      - check
+      - doc
+      - build
+    if: always()
+
+    steps:
+    - name: Successful test and build
+      if: ${{ !(contains(needs.*.result, 'failure')) }}
+      run: exit 0
+    - name: Failing test and build
+      if: ${{ contains(needs.*.result, 'failure') }}
+      run: exit 1
+    - name: Report failure on cancellation
+      if: ${{ contains(needs.*.result, 'cancelled') || cancelled() }}
+      run: exit 1
+
+  # Look for the term "automatically-tag-and-release-this-commit" within merged
+  # PRs/commits.
+  push-tag:
+    runs-on: ubuntu-latest
+    needs: ci-status
+    if: |
+      always()
+      && needs.ci-status.result == 'success'
+      && github.event_name == 'push'
+      && github.ref == 'refs/heads/main'
+      && github.repository_owner == 'bytecodealliance'
+    steps:
+    - uses: actions/checkout@v4
+      with:
+        submodules: true
+    - name: Test if tag is needed
+      run: |
+        git log ${{ github.event.before }}...${{ github.event.after }} | tee main.log
+        version=$(./ci/print-current-version.sh)
+        echo "version: $version"
+        echo "version=$version" >> $GITHUB_OUTPUT
+        echo "sha=$(git rev-parse HEAD)" >> $GITHUB_OUTPUT
+        if grep -q "automatically-tag-and-release-this-commit" main.log; then
+          echo push-tag
+          echo "push_tag=yes" >> $GITHUB_OUTPUT
+        else
+          echo no-push-tag
+          echo "push_tag=no" >> $GITHUB_OUTPUT
+        fi
+      id: tag
+    - name: Push the tag
+      run: |
+        git_refs_url=$(jq .repository.git_refs_url $GITHUB_EVENT_PATH | tr -d '"' | sed 's/{\/sha}//g')
+        curl -iX POST $git_refs_url \
+          -H "Authorization: token ${{ secrets.GITHUB_TOKEN }}" \
+          -d @- << EOF
+        {
+          "ref": "refs/tags/v${{ steps.tag.outputs.version }}",
+          "sha": "${{ steps.tag.outputs.sha }}"
+        }
+        EOF
+      if: steps.tag.outputs.push_tag == 'yes'

.github/workflows/publish-to-cratesio.yml

@@ -0,0 +1,25 @@
+# The purpose of this workflow is to publish the workspace of crates whenever a
+# tag is created. This baiscally boils down to running `ci/publish.rs` at the
+# right time.
+
+name: "Publish to crates.io"
+
+on:
+  push:
+    tags:
+    - 'v*'
+
+jobs:
+  publish:
+    if: github.repository_owner == 'bytecodealliance'
+    runs-on: ubuntu-latest
+    steps:
+    - uses: actions/checkout@v4
+      with:
+        submodules: true
+    - run: rustup update stable && rustup default stable
+    - run: |
+        rustc ci/publish.rs
+        ./publish publish
+      env:
+        CARGO_REGISTRY_TOKEN: ${{ secrets.CARGO_REGISTRY_TOKEN }}

.github/workflows/release-process.yml

@@ -0,0 +1,106 @@
+# The purpose of this workflow is to orchestrate Wasmtime's release process as
+# much as possible. This specific workflow is responsible for a few timed parts
+# of the process:
+#
+# * On the 5th of every month a new release branch is automatically created and
+#   the version number of the `main` branch is increased
+# * On the 20th of every month the previous release branch is published.
+#
+# This automation is all done through PRs except for the creation of the release
+# branch itself which is an write-action performed by this script. Otherwise
+# humans are ideally reviewing and rubber-stamping the output of the script all
+# other steps of the way.
+#
+# Note that this script also helps manage patch releases by sending a PR to the
+# release branch with a bumped version number for all crates with a patch-bump.
+
+name: "Automated Release Process"
+on:
+  # Allow manually triggering this request via the button on the action
+  # workflow page.
+  workflow_dispatch:
+    inputs:
+      action:
+        description: 'Publish script argument: "release-major", or "release-patch"'
+        required: false
+        default: 'release-major'
+
+jobs:
+  release_process:
+    name: Run the release process
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+        with:
+          submodules: true
+      - name: Setup
+        run: |
+          rustc ci/publish.rs
+          git config user.name 'Auto Release Process'
+          git config user.email '[email protected]'
+          git remote set-url origin https://git:${{ secrets.GITHUB_TOKEN }}@github.com/${{ github.repository }}
+
+      - run: rustup update stable && rustup default stable
+
+      - run: rustc ci/publish.rs
+
+      - name: Bump major version number
+        run: ./publish bump
+        if: github.event.inputs.action == 'release-major'
+
+      - name: Bump minor version number
+        run: ./publish bump-patch
+        if: github.event.inputs.action == 'release-minor'
+
+      - name: Prep PR metadata
+        run: |
+          set -ex
+          git fetch origin
+
+          cur=$(./ci/print-current-version.sh)
+
+          git commit --allow-empty -a -F-<<EOF
+          Release ${{ github.event.repository.name }} $cur
+
+          [automatically-tag-and-release-this-commit]
+          EOF
+
+          # Push the result to a branch and setup metadata for the step below
+          # that creates a PR
+          git push origin HEAD:ci/release-$cur
+          echo "PR_HEAD=ci/release-$cur" >> $GITHUB_ENV
+          echo "PR_TITLE=Release ${{ github.event.repository.name }} $cur" >> $GITHUB_ENV
+          echo "PR_BASE=release-$cur" >> $GITHUB_ENV
+          cat > pr-body <<-EOF
+          This is an automated pull request from CI to release
+          ${{ github.event.repository.name }} $cur when merged. The commit
+          message for this PR has a marker that is detected by CI to create
+          tags and publish crate artifacts.
+
+          [RELEASES.md]: https://github.com/${{ github.repository }}/blob/main/RELEASES.md
+          [process]: https://docs.wasmtime.dev/contributing-release-process.html
+          [branch]: https://github.com/${{ github.repository }}/tree/release-$cur
+          EOF
+
+      - name: Make a PR
+        # Note that the syntax here is kinda funky, and the general gist is that
+        # I couldn't figure out a good way to have a multiline string-literal
+        # become a json-encoded string literal to send to GitHub. This
+        # represents my best attempt.
+        run: |
+          set -ex
+          body=$(jq -sR < ./pr-body)
+
+          curl --include --request POST \
+            https://api.github.com/repos/${{ github.repository }}/pulls \
+            --header "Authorization: token ${{ secrets.GITHUB_TOKEN }}" \
+            --data @- << EOF
+          {
+            "head": "$PR_HEAD",
+            "base": "$PR_BASE",
+            "title": "$PR_TITLE",
+            "body": $body,
+            "maintainer_can_modify": true
+
+          }
+          EOF