build-wasm.yml

on:
  push:
    tags:
      - '*'
  pull_request:
    paths:
      - ".github/workflows/build-wasm.yml"
name: Build&Publish WASM
concurrency:
  group: '${{ github.workflow }}-${{ github.event.pull_request.head.label || github.head_ref || github.ref }}'
  cancel-in-progress: true
permissions:
  id-token: write
  contents: read
jobs:
  build-runtime-wasms:
    environment: production # It needs the production GCP credentials to upload WASM
    # Benchmark (with cache hit)
    # ubuntu-latest 50 min
    # ubuntu-latest-4-cores 34 min
    runs-on: ubuntu-latest-4-cores
    strategy:
      matrix:
        chain: [ altair, centrifuge, development ]
    name: build-runtime-${{ matrix.chain }}
    steps:
      # PREP
      - name: Check out code
        uses: actions/checkout@0ad4b8fadaa221de15dcec353f45205ec38ea70b #4.1.4

      - name: Prep build on Ubuntu
        uses: ./.github/actions/prep-ubuntu

      # sccache does not work inside the srtool container
      - uses: Swatinem/rust-cache@23bce251a8cd2ffc3c1075eaa2367cf899916d84 # 2.7
        with:
          prefix-key: build
          shared-key: wasm
          workspaces: |
            .
            ./target/srtool
          cache-directories: ./runtime

      # Use this to debug what's going on inside the srtool container
      # - name: Run Docker SRTool
      #   uses: addnab/docker-run-action@4f65fabd2431ebc8d299f8e5a018d79a769ae185 #v3
      #   with:
      #     image: paritytech/srtool:${{ matrix.rust_version }}
      #     options: --user root -v /home/runner/.cargo:/cargo-home -v ${{ github.workspace }}:/build -e BUILD_OPTS=${{ env.BUILD_OPTS || ''}} -e PACKAGE=${{ matrix.chain }}-runtime
      #     run: |
      #       echo "---- Env VARS ----"
      #       echo "BUILD_OPT=${BUILD_OPT}"
      #       echo "PACKAGE=${PACKAGE}"
      #       echo "---- List Cache Folder ----"
      #       ls -la /cargo-home/
      #       du -sh /cargo-home/*
      #       echo "---- RUNNING BUILD ----"
      #       /srtool/build --app --json -cM   
      
      
      # Build and setup env vars:
      - name: Run srtool # https://docs.substrate.io/reference/command-line-tools/srtool/
        id: srtool_build
        shell: bash
        run: |
          ##"RUNNING SRTOOL"
          echo ::group::Docker run srtool build ${{ inputs.chain }}
          CMD="docker run --rm  --user root --platform=linux/amd64
          -e PROFILE=release -e PACKAGE=${{ matrix.chain }}-runtime -e BUILD_OPTS="--features=on-chain-release-build" 
          -v /home/runner/.cargo:/cargo-home -v ${{ github.workspace }}:/build 
          paritytech/srtool:1.77.0-0.15.0 /srtool/build --app --json -cM"
          echo ::debug::build::docker_run $CMD
          echo ::endgroup
          # here we keep streaming the progress and fetch the last line for the json result
          stdbuf -oL $CMD | {
            while IFS= read -r line
            do
              echo ║ $line
              JSON="$line"
            done
            echo "json=$JSON" >> $GITHUB_OUTPUT

            PROP=`echo $JSON | jq -r .runtimes.compact.prop`
            echo "proposal_hash=$PROP" >> $GITHUB_OUTPUT
  
            WASM=`echo $JSON | jq -r .runtimes.compact.wasm`
            echo "wasm=$WASM" >> $GITHUB_OUTPUT
  
            Z_WASM=`echo $JSON | jq -r .runtimes.compressed.wasm`
            echo "wasm_compressed=$Z_WASM" >> $GITHUB_OUTPUT
  
            IPFS=`echo $JSON | jq -r .runtimes.compact.ipfs`
            echo "ipfs=$IPFS" >> $GITHUB_OUTPUT
          }
             
      - name: Summary
        run: |
          ## Summary and JSON output
          echo "::group::Summary"
          echo "- version: ${{ steps.srtool_build.outputs.version }}"
          echo "- info: ${{ steps.srtool_build.outputs.info }}"
          echo "- prop: ${{ steps.srtool_build.outputs.proposal_hash }}"
          echo "- runtime location: ${{ steps.srtool_build.outputs.wasm }}"
          echo "::endgroup"

          echo "::group::JSON output"
          PRETTY_JSON=$(echo '${{ steps.srtool_build.outputs.json }}' | jq .)
          echo '${{ steps.srtool_build.outputs.json }}' | jq . > "${{ matrix.chain }}-srtool-digest.json"
          echo "JSON Output:"
          cat "${{ matrix.chain }}-srtool-digest.json"
          echo "::endgroup"

      - id: 'auth'
        if: github.event_name != 'pull_request'
        uses: 'google-github-actions/auth@5a50e581162a13f4baa8916d01180d2acbc04363' # v2.1.0
        with:
          workload_identity_provider: ${{ secrets.GWIP_ARTIFACTS }}
          service_account: ${{ secrets.GSA_ARTIFACTS }}

      - name: Setup - gcloud / gsutil
        if: ${{ steps.auth.outcome == 'success' }}
        uses: google-github-actions/setup-gcloud@98ddc00a17442e89a24bbf282954a3b65ce6d200 # v2.1.0

      - name: Publish artifacts to GCS
        if: ${{ steps.auth.outcome == 'success' }}
        shell: bash
        run: |
          ## Publish WASM and JSON summary
          echo '${{ steps.srtool_build.outputs.json }}' | jq . > "${{ matrix.chain }}-srtool-digest.json"
          gsutil cp \
            "${{ steps.srtool_build.outputs.wasm }}" \
            "gs://centrifuge-wasm-repo/${{ matrix.chain }}/${{ matrix.chain }}-$(git rev-parse --short HEAD).wasm"
          gsutil cp \
            "${{ matrix.chain }}-srtool-digest.json" \
            "gs://centrifuge-wasm-repo/${{ matrix.chain }}/${{ matrix.chain }}-$(git rev-parse --short HEAD)-srtool-digest.json"

      - name: Upload WASM to release tag ${{ github.ref_name }}
        uses: ncipollo/release-action@a2e71bdd4e7dab70ca26a852f29600c98b33153e # @v1
        if: github.event_name == 'release'
        # https://github.com/ncipollo/release-action
        with:
          tag: ${{ github.ref_name }}
          commit: ${{ github.sha }}
          artifacts: "${{ steps.srtool_build.outputs.wasm }}, ${{ matrix.chain }}-srtool-digest.json"
          replacesArtifacts: true
          allowUpdates: true
          artifactErrorsFailBuild: true
          omitBodyDuringUpdate: true
          omitDraftDuringUpdate: true
          omitNameDuringUpdate: true
          omitPrereleaseDuringUpdate: true
          # updateOnlyUnreleased: true # When allowUpdates is enabled, this will fail the action if the release it is updating is not a draft or a prerelease.