release.yaml

name: release


on:
  # push: 
  #   tags: 
  #     - 'v*'
  create: 
    tags: 
      - 'v*'

permissions:
  contents: write
  id-token: write # needed for signing the images with GitHub OIDC Token

jobs:
  releaser:
    runs-on: ubuntu-latest
    steps:

      

      -
        name: Checkout
        uses:  actions/checkout@v3
      
      - name: Install Rust
        uses: actions-rs/toolchain@v1     
        with:
          toolchain: stable      

      - name: Add WASM target
        run: rustup target add wasm32-wasi

      - name: Install Cosign
        uses: sigstore/cosign-installer@main
      
      - name: Build 
        run: cargo build --release 


      - name: Sign binary
        run: cosign sign-blob --oidc-issuer=https://token.actions.githubusercontent.com --output-certificate=cosign_cert.pem --output-signature=cosign.sig target/wasm32-wasi/release/ghost.wasm
        env:
          ## Cosign ENV Vars
          COSIGN_EXPERIMENTAL: 1
          COSIGN_YES: true
    
      - name: Release
        uses: softprops/action-gh-release@v1
        if: startsWith(github.ref, 'refs/tags/')
        with:
          files: |
            target/wasm32-wasi/release/ghost.wasm
            cosign.sig
            cosign_cert.pem