Skip to content

feat: Migrate from Spin registry to wkg publishing for standardized WebAssembly distribution #4

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
DevOpsDali merged 6 commits into from
Jul 20, 2025
Merged

feat: Migrate from Spin registry to wkg publishing for standardized WebAssembly distribution #4

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
6 commits
Select commit Hold shift + click to select a range
86252c8
feat: Add wkg publishing test workflow based on WASI-HTTP pattern
Jul 20, 2025
89918be
feat: Integrate wkg publishing test into release workflow
Jul 20, 2025
3d76cc7
fix: Handle branch push trigger in release workflow version detection
Jul 20, 2025
30e9657
fix: Correct Spin registry source format for wkg-published components
Jul 20, 2025
f8bf10c
feat: Complete migration from Spin to wkg publishing for all 84 tools
Jul 20, 2025
3b51041
feat: Finalize release workflow for production wkg deployment
Jul 20, 2025
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
123 changes: 78 additions & 45 deletions .github/workflows/release.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,8 +1,6 @@
name: Release
# New workflow for manual/tagged releases
# Incorporates versioning from publish-tools.yml with manual dispatch

# TESTING: Temporarily disable automatic triggers for validation
# Production release workflow with wkg publishing
# Publishes all 84+ tools as individual WebAssembly components to GHCR
on:
workflow_dispatch:
inputs:
Expand Down Expand Up @@ -189,6 +187,7 @@ jobs:
path: target/wasm32-wasip1/release/*.wasm
retention-days: 30


# ===== TEST RELEASE =====
# TEMPORARILY DISABLED: Smoke test failing, needs investigation
# test-release:
Expand Down Expand Up @@ -356,22 +355,22 @@ jobs:
core-tools-${{ needs.prepare.outputs.version }}.zip
core-tools-${{ needs.prepare.outputs.version }}.zip.sha256

# ===== PUBLISH ALL INDIVIDUAL TOOLS =====
# Publishes ALL tools individually with version and latest tags
# ===== PUBLISH ALL INDIVIDUAL TOOLS VIA WKG =====
# Publishes ALL tools individually with version and latest tags using wkg
publish-all-tools:
name: Publish All Tools
name: Publish All Tools via WKG
needs: [prepare, build-release] # test-release temporarily disabled
runs-on: ubuntu-latest
permissions:
contents: read
packages: write
id-token: write # For cosign signing
steps:
- uses: actions/checkout@v4

- name: Install Spin
uses: fermyon/actions/spin/setup@v1
with:
version: ${{ env.SPIN_VERSION }}
- name: Install wkg
run: |
cargo install wkg --version 0.11.0

- name: Download artifacts
uses: actions/download-artifact@v4
Expand All @@ -380,12 +379,19 @@ jobs:
merge-multiple: true
path: target/wasm32-wasip1/release/

- name: Log in to GHCR
- name: Log in to GitHub Container Registry
if: github.event.inputs.dry_run != 'true'
run: |
echo "${{ secrets.GITHUB_TOKEN }}" | spin registry login ghcr.io -u ${{ github.actor }} --password-stdin
uses: docker/login-action@v3
with:
registry: ghcr.io
username: ${{ github.actor }}
password: ${{ secrets.GITHUB_TOKEN }}

- name: Publish all tools individually
- name: Install cosign
if: github.event.inputs.dry_run != 'true'
uses: sigstore/cosign-installer@v3

- name: Publish all tools individually via wkg
run: |
VERSION="${{ needs.prepare.outputs.version }}"
DRY_RUN="${{ github.event.inputs.dry_run }}"
Expand All @@ -396,48 +402,72 @@ jobs:
TOOL_NAME=$(basename $tool_dir)
PACKAGE_NAME=$(grep '^name = ' "$cargo_file" | cut -d'"' -f2)

# Clean name for container registry and component names
# Clean name for container registry (consistent with existing naming)
TOOL_NAME_CLEAN=$(echo "$TOOL_NAME" | tr '_' '-')

# Create minimal spin.toml for this tool
cat > tool-spin.toml << EOF
spin_manifest_version = 2

[application]
name = "$TOOL_NAME_CLEAN"
version = "${VERSION#v}"

[[trigger.http]]
route = "/$TOOL_NAME_CLEAN"
component = "$TOOL_NAME_CLEAN"

[component.$TOOL_NAME_CLEAN]
source = "target/wasm32-wasip1/release/${PACKAGE_NAME//-/_}.wasm"
allowed_outbound_hosts = []
EOF
# Expected WASM file name (from cargo component build)
WASM_FILE="target/wasm32-wasip1/release/${PACKAGE_NAME//-/_}.wasm"

# Registry image name
IMAGE_NAME="${{ env.REGISTRY }}/${{ github.repository_owner }}/ftl-tool-${TOOL_NAME_CLEAN}"

# Check if WASM file exists
if [ ! -f "$WASM_FILE" ]; then
echo "⚠️ WASM file not found for ${TOOL_NAME}: $WASM_FILE"
continue
fi

if [[ "$DRY_RUN" == "true" ]]; then
echo "🔍 DRY RUN: Would publish ${IMAGE_NAME}:${VERSION}"
echo "🔍 DRY RUN: Would publish ${IMAGE_NAME}:latest"
echo "🧪 Testing build process for ${TOOL_NAME}..."
spin build -f tool-spin.toml
echo "✅ Build successful for ${TOOL_NAME}"
echo "📁 WASM file: $WASM_FILE ($(ls -lh "$WASM_FILE" | awk '{print $5}'))"
else
# Actual publishing
echo "📦 Publishing ${TOOL_NAME} as ${IMAGE_NAME}..."
spin registry push --build -f tool-spin.toml "${IMAGE_NAME}:${VERSION}"
spin registry push --build -f tool-spin.toml "${IMAGE_NAME}:latest"
echo "✅ Published ${IMAGE_NAME}:${VERSION} and :latest"
# Actual publishing with wkg
echo "📦 Publishing ${TOOL_NAME} via wkg..."
echo " 🎯 Target: ${IMAGE_NAME}:${VERSION}"
echo " 📁 Source: $WASM_FILE"

# Publish with version tag
wkg oci push "${IMAGE_NAME}:${VERSION}" "$WASM_FILE"

# Publish with latest tag
wkg oci push "${IMAGE_NAME}:latest" "$WASM_FILE"

# Sign both tags with cosign
cosign sign --yes "${IMAGE_NAME}:${VERSION}"
cosign sign --yes "${IMAGE_NAME}:latest"

echo "✅ Published and signed ${IMAGE_NAME}:${VERSION} and :latest"
fi
done

- name: Summary
run: |
VERSION="${{ needs.prepare.outputs.version }}"
DRY_RUN="${{ github.event.inputs.dry_run }}"

echo "## WKG Publishing Summary" >> $GITHUB_STEP_SUMMARY
echo "" >> $GITHUB_STEP_SUMMARY

if [[ "$DRY_RUN" == "true" ]]; then
echo "🔍 **Mode**: Dry Run" >> $GITHUB_STEP_SUMMARY
echo "📊 **Tools**: All 84+ tools validated for publishing" >> $GITHUB_STEP_SUMMARY
else
echo "🚀 **Mode**: Live Publishing" >> $GITHUB_STEP_SUMMARY
echo "📊 **Tools**: All tools published to GHCR via wkg" >> $GITHUB_STEP_SUMMARY
echo "🔐 **Security**: All components signed with cosign" >> $GITHUB_STEP_SUMMARY
echo "🏷️ **Tags**: Both :${VERSION} and :latest published" >> $GITHUB_STEP_SUMMARY
fi

echo "" >> $GITHUB_STEP_SUMMARY
echo "### Registry Format" >> $GITHUB_STEP_SUMMARY
echo "\`ghcr.io/${{ github.repository_owner }}/ftl-tool-[name]:[tag]\`" >> $GITHUB_STEP_SUMMARY

# ===== RELEASE SUMMARY =====
release-summary:
name: Release Summary
if: always()
needs: [prepare, lint, build-release, publish-release, publish-all-tools] # test-release temporarily disabled
needs: [prepare, lint, build-release, publish-release, publish-all-tools]
runs-on: ubuntu-latest
steps:
- name: Create summary
Expand Down Expand Up @@ -478,12 +508,15 @@ jobs:
fi

if [[ "${{ needs.publish-all-tools.result }}" == "success" ]]; then
echo "✅ **All Tools**: Published with version and latest tags" >> $GITHUB_STEP_SUMMARY
echo "✅ **All Tools**: Published via wkg with version and latest tags" >> $GITHUB_STEP_SUMMARY
echo "🔐 **Security**: All components signed with cosign" >> $GITHUB_STEP_SUMMARY
else
echo "❌ **All Tools**: Publishing failed" >> $GITHUB_STEP_SUMMARY
echo "❌ **All Tools**: WKG publishing failed" >> $GITHUB_STEP_SUMMARY
fi

echo "" >> $GITHUB_STEP_SUMMARY
echo "### Release Artifacts" >> $GITHUB_STEP_SUMMARY
echo "- GitHub Release: https://github.com/${{ github.repository }}/releases/tag/${VERSION}" >> $GITHUB_STEP_SUMMARY
echo "- Individual Tools: \`ghcr.io/${{ github.repository_owner }}/ftl-tool-[name]:${VERSION}\`" >> $GITHUB_STEP_SUMMARY
echo "- **GitHub Release**: https://github.com/${{ github.repository }}/releases/tag/${VERSION}" >> $GITHUB_STEP_SUMMARY
echo "- **WebAssembly Components**: \`ghcr.io/${{ github.repository_owner }}/ftl-tool-[name]:${VERSION}\`" >> $GITHUB_STEP_SUMMARY
echo "- **Registry Format**: \`{ registry = \"ghcr.io\", package = \"${{ github.repository_owner }}:ftl-tool-[name]\", version = \"${VERSION}\" }\`" >> $GITHUB_STEP_SUMMARY
echo "- **Publishing Method**: wkg (WebAssembly Package Tools)" >> $GITHUB_STEP_SUMMARY
5 changes: 5 additions & 0 deletions README.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -22,6 +22,11 @@ This project provides production-ready APIs across multiple computational domain
- **Single Responsibility**: Extracted bundled tools into atomic components (vector_angle, line_segment_intersection, cartesian_to_cylindrical, spherical_to_cartesian)
- **Composition Patterns**: Demonstrated HTTP-based composition with `vector_analysis` composite tool
- **Quality Assurance**: Achieved 100% FTL-SDK pattern compliance across entire codebase
- **Code Quality Initiative**: Systematic audit and cleanup of anti-patterns across all tools (July 2025)
- Comprehensive audit of 84 tools identifying 15 violations
- Fixed 5 critical anti-patterns: eliminated HTTP composition, unused functions, WASM dependencies
- Improved architectural consistency with proper logic.rs usage patterns
- Created ANTI_PATTERNS_AUDIT.md for future maintenance guidelines

## 🏗️ Architecture

Expand Down