feat(ci): setup ci oci releases

.github/workflows/main.yml

@@ -6,9 +6,21 @@ on:
     branches: [main]
 
 jobs:
+  validate:
+    name: Validate WIT
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+
+      - name: Install wasm-tools
+        uses: bytecodealliance/actions/wasm-tools/setup@v1
+
+      - name: Validate WIT
+        run: wasm-tools component wit wit/
+
   abi-up-to-date:
     name: Check ABI files are up-to-date
     runs-on: ubuntu-latest
     steps:
-    - uses: actions/checkout@v4
-    - uses: WebAssembly/wit-abi-up-to-date@v25
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+      - uses: WebAssembly/wit-abi-up-to-date@v25

.github/workflows/prepare-release.yml

@@ -0,0 +1,55 @@
+name: Prepare Release
+
+on:
+  workflow_dispatch:
+
+jobs:
+  prepare:
+    name: Create Release PR
+    runs-on: ubuntu-latest
+    permissions:
+      contents: write
+      pull-requests: write
+    steps:
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        with:
+          fetch-depth: 0
+
+      - name: Determine next RC version
+        id: version
+        run: |
+          # Find highest RC number from existing tags
+          HIGHEST_RC=0
+          for tag in $(git tag -l 'v0.2.0-rc.*'); do
+            if [[ "$tag" =~ ^v0\.2\.0-rc\.([0-9]+)$ ]]; then
+              RC_NUM="${BASH_REMATCH[1]}"
+              if [ "$RC_NUM" -gt "$HIGHEST_RC" ]; then
+                HIGHEST_RC="$RC_NUM"
+              fi
+            fi
+          done
+
+          NEXT_RC=$((HIGHEST_RC + 1))
+          VERSION="0.2.0-rc.${NEXT_RC}"
+          echo "version=$VERSION" >> "$GITHUB_OUTPUT"
+          echo "Preparing version: $VERSION"
+
+      - name: Bump package version
+        run: |
+          # Update package version (matches wasi:webgpu@ANY_VERSION)
+          find wit -type f -name "*.wit" -exec sed -i \
+            "s/\(wasi:webgpu@\)[^;]*/\1${{ steps.version.outputs.version }}/g" {} +
+
+      - name: Create Pull Request
+        uses: peter-evans/create-pull-request@c0f553fe549906ede9cf27b5156039d195d2ece0 # v8.1.0
+        with:
+          commit-message: "chore: bump version to ${{ steps.version.outputs.version }}"
+          branch: release/${{ steps.version.outputs.version }}
+          title: "Release ${{ steps.version.outputs.version }}"
+          body: |
+            Bumps package version to `${{ steps.version.outputs.version }}`.
+
+            Once merged, manually run the **Publish Release** workflow to:
+            - Create git tag `v${{ steps.version.outputs.version }}`
+            - Create GitHub release
+            - Publish to `ghcr.io/webassembly/wasi/webgpu:${{ steps.version.outputs.version }}`

.github/workflows/publish-release.yml

@@ -0,0 +1,95 @@
+name: Publish Release
+
+on:
+  workflow_dispatch:
+
+jobs:
+  publish:
+    name: Publish Release
+    runs-on: ubuntu-latest
+    permissions:
+      id-token: write
+      packages: write
+      contents: write
+      attestations: write
+    steps:
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        with:
+          fetch-depth: 0
+
+      - name: Extract version from package
+        id: version
+        run: |
+          # Extract version from wit/imports.wit
+          VERSION=$(grep -oP 'package wasi:webgpu@\K[^;]+' wit/imports.wit)
+          if [[ ! "$VERSION" =~ ^0\.2\.0-rc\.[0-9]+$ ]]; then
+            echo "Error: Version '$VERSION' is not a valid RC version"
+            exit 1
+          fi
+          TAG="v${VERSION}"
+          echo "version=$VERSION" >> "$GITHUB_OUTPUT"
+          echo "tag=$TAG" >> "$GITHUB_OUTPUT"
+          echo "Publishing version: $VERSION"
+
+      - name: Check tag doesn't exist
+        run: |
+          if git tag -l "${{ steps.version.outputs.tag }}" | grep -q .; then
+            echo "Error: Tag ${{ steps.version.outputs.tag }} already exists"
+            exit 1
+          fi
+
+      - name: Create git tag
+        run: |
+          git config user.name "github-actions[bot]"
+          git config user.email "github-actions[bot]@users.noreply.github.com"
+          git tag -a "${{ steps.version.outputs.tag }}" -m "Release ${{ steps.version.outputs.version }}"
+          git push origin "${{ steps.version.outputs.tag }}"
+
+      - name: Create GitHub release
+        env:
+          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+        run: |
+          gh release create "${{ steps.version.outputs.tag }}" \
+            --title "${{ steps.version.outputs.version }}" \
+            --prerelease \
+            --generate-notes
+
+      - name: Install cargo-binstall
+        uses: cargo-bins/cargo-binstall@80aaafe04903087c333980fa2686259ddd34b2d9 # v1.16.6
+
+      - name: Install wkg
+        run: cargo binstall -y "wkg@0.13.0"
+
+      - name: Login to GitHub Container Registry
+        uses: docker/login-action@5e57cd118135c172c3672efd75eb46360885c0ef # v3.6.0
+        with:
+          registry: ghcr.io
+          username: ${{ github.actor }}
+          password: ${{ secrets.GITHUB_TOKEN }}
+
+      - name: Build WIT package
+        run: wkg wit build -o wasi-webgpu.wasm
+
+      - name: Publish to GitHub Container Registry
+        id: publish
+        uses: bytecodealliance/wkg-github-action@10b3b04b9059ba46208cd7daf7d352af14bded0f # v5
+        with:
+          oci-reference-without-tag: ghcr.io/webassembly/wasi/webgpu
+          file: wasi-webgpu.wasm
+          description: 'WASI WebGPU API'
+          source: https://github.com/WebAssembly/wasi-webgpu
+          homepage: https://github.com/WebAssembly/wasi-webgpu
+          version: ${{ steps.version.outputs.version }}
+          licenses: Apache-2.0 WITH LLVM-exception
+
+      - name: Attest build provenance
+        uses: actions/attest-build-provenance@00014ed6ed5efc5b1ab7f7f34a39eb55d41aa4f8 # v3.1.0
+        with:
+          subject-name: ghcr.io/webassembly/wasi/webgpu
+          subject-digest: ${{ steps.publish.outputs.digest }}
+          push-to-registry: true
+
+      - name: Upload wasm to release
+        env:
+          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+        run: gh release upload "${{ steps.version.outputs.tag }}" wasi-webgpu.wasm

generate/src/main.rs

@@ -26,17 +26,7 @@ fn main() {
                 "OffscreenCanvas".into(),
             ],
             resource_inheritance: ResourceInheritance::DuplicateMethods,
-            package_name: webidl2wit::PackageName::new(
-                "wasi",
-                "webgpu",
-                Some(semver::Version {
-                    major: 0,
-                    minor: 0,
-                    patch: 1,
-                    pre: Default::default(),
-                    build: Default::default(),
-                }),
-            ),
+            package_name: webidl2wit::PackageName::new("wasi", "webgpu", Some(package_version())),
             interface_name: "webgpu".into(),
             ..Default::default()
         },
@@ -73,3 +63,15 @@ fn main() {
 
     fs::write("../wit/webgpu.wit", output).unwrap();
 }
+
+fn package_version() -> semver::Version {
+    let version = fs::read_to_string("../wit/imports.wit")
+        .ok()
+        .and_then(|wit| {
+            wit.lines()
+                .find_map(|line| line.trim().strip_prefix("package wasi:webgpu@"))
+                .map(|rest| rest.trim_end_matches(';').trim().to_string())
+        })
+        .unwrap();
+    semver::Version::parse(&version).unwrap()
+}