Boomatang/main

.github/actions/install-yq/action.yaml

@@ -0,0 +1,18 @@
+name: Install yq
+description: Install mikefarah/yq at a pinned version
+
+inputs:
+  version:
+    description: "yq version to install"
+    required: false
+    default: "4.53.3"
+
+runs:
+  using: composite
+  steps:
+    - name: Install yq v${{ inputs.version }}
+      shell: bash
+      run: |
+        sudo wget -qO /usr/local/bin/yq \
+          "https://github.com/mikefarah/yq/releases/download/v${{ inputs.version }}/yq_linux_amd64"
+        sudo chmod +x /usr/local/bin/yq

.github/actions/prepare-release/action.yaml

@@ -68,3 +68,11 @@ runs:
     - name: Update Cargo.lock
       shell: bash
       run: cargo check --target wasm32-wasip1
+
+    - uses: ./.github/actions/install-yq
+
+    - name: Sync release.yaml from Cargo.toml
+      shell: bash
+      run: |
+        chmod +x .github/scripts/sync-release-yaml.sh
+        .github/scripts/sync-release-yaml.sh

.github/scripts/README.md

@@ -0,0 +1,57 @@
+# Release Scripts
+
+Helper scripts for the two-phase release process. All scripts use `release.yaml` as the default path but accept an override as the first positional argument.
+
+## Source of Truth
+
+**`Cargo.toml` is the authoritative source for the wasm-shim version.** `release.yaml` is a derived mirror maintained by `sync-release-yaml.sh` for cross-repo tooling compatibility.
+
+## Scripts
+
+### `sync-release-yaml.sh`
+
+Reads the wasm-shim version from `cargo metadata` and writes it to `release.yaml`. If the Cargo.toml version contains `-dev`, the sentinel value `0.0.0` is written instead.
+
+```bash
+.github/scripts/sync-release-yaml.sh [release.yaml]
+```
+
+**Requires:** `cargo`, `jq`, `yq`
+
+### `check-versions.sh`
+
+Validates that `release.yaml` and `Cargo.toml` are consistent:
+
+- If `release.yaml` has `0.0.0` (sentinel), `Cargo.toml` must end in `-dev`
+- Otherwise, both must match exactly
+
+```bash
+.github/scripts/check-versions.sh [release.yaml]
+```
+
+**Requires:** `cargo`, `jq`, `yq`
+
+### `parse-version.sh`
+
+Reads the version from `release.yaml`, validates it as semver, and outputs decomposed components to `$GITHUB_OUTPUT` (or stdout when run locally).
+
+```bash
+.github/scripts/parse-version.sh [release.yaml]
+```
+
+**Outputs:** `version`, `major`, `minor`, `patch`, `release-branch`
+
+**Requires:** `yq`
+
+### `validate-release-yaml.sh`
+
+Validates `release.yaml` for release readiness:
+
+- On `release-*` branches: rejects `0.0.0` sentinel and `-dev` versions
+- Checks that declared dependency versions have corresponding GitHub Releases
+
+```bash
+.github/scripts/validate-release-yaml.sh <branch-name> [org] [release.yaml]
+```
+
+**Requires:** `yq`, `gh` (GitHub CLI)

.github/scripts/check-versions.sh

@@ -0,0 +1,35 @@
+#!/usr/bin/env bash
+set -euo pipefail
+
+RELEASE_YAML="${1:-release.yaml}"
+
+if [[ ! -f "$RELEASE_YAML" ]]; then
+  echo "::error::File not found: $RELEASE_YAML"
+  exit 1
+fi
+
+YAML_VERSION=$(yq '.wasm-shim.version' "$RELEASE_YAML")
+CARGO_VERSION=$(cargo metadata --no-deps --format-version 1 \
+  | jq -r '.packages[] | select(.name=="wasm-shim") | .version')
+
+ERRORS=0
+
+if [[ "$YAML_VERSION" == "0.0.0" ]]; then
+  if [[ "$CARGO_VERSION" != *-dev* ]]; then
+    echo "::error::release.yaml version is 0.0.0 but Cargo.toml version '${CARGO_VERSION}' does not end in -dev"
+    ERRORS=$((ERRORS + 1))
+  fi
+else
+  if [[ "$YAML_VERSION" != "$CARGO_VERSION" ]]; then
+    echo "::error::Version mismatch: release.yaml has '${YAML_VERSION}' but Cargo.toml has '${CARGO_VERSION}'"
+    ERRORS=$((ERRORS + 1))
+  fi
+fi
+
+if [[ "$ERRORS" -gt 0 ]]; then
+  echo "::error::Version consistency check failed with ${ERRORS} error(s)"
+  exit 1
+fi
+
+echo "Version consistency check passed: release.yaml and Cargo.toml agree"
+echo "  release.yaml=${YAML_VERSION} Cargo.toml=${CARGO_VERSION}"

.github/scripts/parse-version.sh

@@ -0,0 +1,31 @@
+#!/usr/bin/env bash
+set -euo pipefail
+
+RELEASE_YAML="${1:-release.yaml}"
+
+if [[ ! -f "$RELEASE_YAML" ]]; then
+  echo "::error::File not found: $RELEASE_YAML"
+  exit 1
+fi
+
+VERSION=$(yq '.wasm-shim.version' "$RELEASE_YAML")
+if [[ -z "$VERSION" || "$VERSION" == "null" ]]; then
+  echo "::error::No version found in $RELEASE_YAML under wasm-shim.version"
+  exit 1
+fi
+
+if ! [[ "$VERSION" =~ ^[0-9]+\.[0-9]+\.[0-9]+(-[a-zA-Z0-9.]+)?$ ]]; then
+  echo "::error::Invalid semver for version: $VERSION"
+  exit 1
+fi
+
+MAJOR=$(echo "$VERSION" | cut --delimiter=. --fields=1)
+MINOR=$(echo "$VERSION" | cut --delimiter=. --fields=2)
+PATCH=$(echo "$VERSION" | cut --delimiter=. --fields=3 | cut --delimiter=- --fields=1)
+RELEASE_BRANCH="release-${MAJOR}.${MINOR}"
+
+echo "version=$VERSION" >> "${GITHUB_OUTPUT:-/dev/stdout}"
+echo "major=$MAJOR" >> "${GITHUB_OUTPUT:-/dev/stdout}"
+echo "minor=$MINOR" >> "${GITHUB_OUTPUT:-/dev/stdout}"
+echo "patch=$PATCH" >> "${GITHUB_OUTPUT:-/dev/stdout}"
+echo "release-branch=$RELEASE_BRANCH" >> "${GITHUB_OUTPUT:-/dev/stdout}"

.github/scripts/sync-release-yaml.sh

@@ -0,0 +1,20 @@
+#!/usr/bin/env bash
+set -euo pipefail
+
+RELEASE_YAML="${1:-release.yaml}"
+
+VERSION=$(cargo metadata --no-deps --format-version 1 \
+  | jq -r '.packages[] | select(.name=="wasm-shim") | .version')
+
+if [[ -z "$VERSION" || "$VERSION" == "null" ]]; then
+  echo "::error::Could not read wasm-shim version from cargo metadata"
+  exit 1
+fi
+
+if [[ "$VERSION" == *-dev* ]]; then
+  VERSION="0.0.0"
+fi
+
+yq --inplace ".\"wasm-shim\".version = \"${VERSION}\"" "$RELEASE_YAML"
+
+echo "release.yaml synced: version=${VERSION}"

.github/scripts/validate-release-yaml.sh

@@ -0,0 +1,38 @@
+#!/usr/bin/env bash
+set -euo pipefail
+
+BRANCH="${1:?Branch name required}"
+ORG="${2:-Kuadrant}"
+RELEASE_YAML="${3:-release.yaml}"
+
+if [[ ! -f "$RELEASE_YAML" ]]; then
+  echo "::error::File not found: $RELEASE_YAML"
+  exit 1
+fi
+
+VERSION=$(yq '.wasm-shim.version' "$RELEASE_YAML")
+
+if [[ "$BRANCH" =~ ^release- ]]; then
+  if [[ "$VERSION" == "0.0.0" ]]; then
+    echo "::error::release.yaml version is 0.0.0 on branch '$BRANCH' -- must specify a release version on release branches"
+    exit 1
+  fi
+
+  if [[ "$VERSION" == *-dev* ]]; then
+    echo "::error::release.yaml version '${VERSION}' is a dev version on branch '$BRANCH' -- release versions must not contain '-dev'"
+    exit 1
+  fi
+fi
+
+DEPS=$(yq '.dependencies | keys | .[]' "$RELEASE_YAML" 2>/dev/null || true)
+for dep in $DEPS; do
+  dep_version=$(yq ".dependencies.${dep}" "$RELEASE_YAML")
+  if [[ "$dep_version" != "0.0.0" && "$dep_version" != "null" && -n "$dep_version" ]]; then
+    if ! gh release view "v${dep_version}" --repo "${ORG}/${dep}" &>/dev/null; then
+      echo "::error::Dependency '${dep}' targets version '${dep_version}', but release v${dep_version} does not exist in ${ORG}/${dep}"
+      exit 1
+    fi
+  fi
+done
+
+echo "release.yaml validation passed"

.github/workflows/build-image.yaml

@@ -4,13 +4,28 @@ name: Build WASM Image
 on:
   push:
     branches: ['*']
-    tags: ['*']
+    tags-ignore:
+      - 'v*'
   workflow_dispatch: {}
+  workflow_call:
+    inputs:
+      image-tags:
+        description: Space-separated list of image tags
+        required: true
+        type: string
+      ref:
+        description: Git ref to checkout (tag, branch, or SHA)
+        required: true
+        type: string
+    secrets:
+      IMG_REGISTRY_USERNAME:
+        required: true
+      IMG_REGISTRY_TOKEN:
+        required: true
 
 env:
-  IMG_TAGS: ${{ github.ref_name }}
   IMG_REGISTRY_HOST: quay.io
-  IMG_REGISTRY_ORG: kuadrant
+  IMG_REGISTRY_ORG: ${{ vars.IMG_REGISTRY_ORG || 'kuadrant' }}
   MAIN_BRANCH_NAME: main
 
 jobs:
@@ -20,26 +35,42 @@ jobs:
     steps:
       - name: Check out code
         uses: actions/checkout@v6
+        with:
+          ref: ${{ inputs.ref || github.ref }}
+
+      - name: Determine image tags
+        run: |
+          if [ -n "${{ inputs.image-tags }}" ]; then
+            echo "IMG_TAGS=${{ inputs.image-tags }}" >> $GITHUB_ENV
+          else
+            echo "IMG_TAGS=${{ github.ref_name }}" >> $GITHUB_ENV
+          fi
+
       - name: Add latest tag for the main branch
-        if: ${{ github.ref_name == env.MAIN_BRANCH_NAME }}
-        id: add-latest-tag
+        if: ${{ !inputs.image-tags && github.ref_name == env.MAIN_BRANCH_NAME }}
         run: |
           echo "IMG_TAGS=latest ${{ env.IMG_TAGS }}" >> $GITHUB_ENV
+
       - name: Add git sha tag for the main branch
-        if: ${{ github.ref_name == env.MAIN_BRANCH_NAME }}
-        id: add-git-sha-tag
+        if: ${{ !inputs.image-tags && github.ref_name == env.MAIN_BRANCH_NAME }}
         run: |
           echo "IMG_TAGS=${{ github.sha }} ${{ env.IMG_TAGS }}" >> $GITHUB_ENV
+
+      - name: Resolve git SHA from checkout
+        run: |
+          echo "GIT_SHA=$(git rev-parse HEAD)" >> $GITHUB_ENV
+
       - name: Build Image
         id: build-image
         uses: redhat-actions/buildah-build@v2
         with:
           image: wasm-shim
           tags: ${{ env.IMG_TAGS }}
           build-args: |
-            GITHUB_SHA=${{ github.sha }}
+            GITHUB_SHA=${{ env.GIT_SHA }}
           dockerfiles: |
             ./Dockerfile
+
       - name: Push Image
         if: ${{ !env.ACT }}
         id: push-to-quay
@@ -50,5 +81,6 @@ jobs:
           registry: ${{ env.IMG_REGISTRY_HOST }}/${{ env.IMG_REGISTRY_ORG }}
           username: ${{ secrets.IMG_REGISTRY_USERNAME }}
           password: ${{ secrets.IMG_REGISTRY_TOKEN }}
+
       - name: Print Image URL
         run: echo "Image pushed to ${{ steps.push-to-quay.outputs.registry-paths }}"