chore: harden release ci

.github/workflows/release.yml

@@ -9,34 +9,34 @@ on:
       - "v*"
 
 env:
-  WASI_SDK_VERSION: 25
-  RUST_TOOLCHAIN: "1.86.0"
+  WASI_SDK_VERSION: 33
+  RUST_TOOLCHAIN: "1.96.0"
 
 jobs:
-  release:
+  build:
     runs-on: ubuntu-latest
-    permissions:
-      contents: write
     steps:
       - name: Checkout code
-        uses: actions/checkout@v4
+        uses: actions/checkout@9c091bb # @v7
 
       - name: Install WASI SDK
-        uses: konsumer/install-wasi-sdk@v1
+        uses: konsumer/install-wasi-sdk@d728b7a # @v1
         with:
           version: "${{ env.WASI_SDK_VERSION }}"
 
-      - uses: extractions/setup-just@v3
+      - uses: extractions/setup-just@53165ef # @v3
+        name: Install Just
 
-      - uses: actions-rust-lang/setup-rust-toolchain@v1
+      - name: Install Rust 
+        uses: actions-rust-lang/setup-rust-toolchain@46268bd # @v1.16.1
         with:
           toolchain: "${{ env.RUST_TOOLCHAIN }}"
 
       - name: Build WebAssembly module
         run: just
 
       - name: Build docs
-        uses: mattnotmitt/doxygen-action@v1.9.5
+        uses: mattnotmitt/doxygen-action@411df0c # @v1.9.5
 
       - name: Set env
         run: echo "ARCHIVE_FILENAME_PREFIX=fastly-cpp-${GITHUB_REF#refs/*/}" >> $GITHUB_ENV
@@ -69,6 +69,7 @@ jobs:
           wget https://github.com/WebAssembly/wasi-sdk/releases/download/wasi-sdk-${{ env.WASI_SDK_VERSION}}/wasi-sdk-${{ env.WASI_SDK_VERSION }}.0-arm64-linux.tar.gz https://github.com/WebAssembly/wasi-sdk/releases/download/wasi-sdk-${{ env.WASI_SDK_VERSION}}/wasi-sdk-${{ env.WASI_SDK_VERSION }}.0-arm64-macos.tar.gz https://github.com/WebAssembly/wasi-sdk/releases/download/wasi-sdk-${{ env.WASI_SDK_VERSION}}/wasi-sdk-${{ env.WASI_SDK_VERSION }}.0-x86_64-linux.tar.gz https://github.com/WebAssembly/wasi-sdk/releases/download/wasi-sdk-${{ env.WASI_SDK_VERSION}}/wasi-sdk-${{ env.WASI_SDK_VERSION }}.0-x86_64-macos.tar.gz https://github.com/WebAssembly/wasi-sdk/releases/download/wasi-sdk-${{ env.WASI_SDK_VERSION}}/wasi-sdk-${{ env.WASI_SDK_VERSION }}.0-x86_64-windows.tar.gz
 
       - name: Verify checksums
+        # NB(@zkat): these need to be manually updated every time we upgrade WASI_SDK_VERSION
         run: |
           sha256 -c 4f98ee738c7abb45c81a94d1461fc53cc569d1cd01498951c8184d841a027844 wasi-sdk-${{ env.WASI_SDK_VERSION }}.0-arm64-linux.tar.gz
           sha256 -c 85c997a2665ead91673b5bb88b7d0df3fc8900df3bfa244f720d478187bbdc78 wasi-sdk-${{ env.WASI_SDK_VERSION }}.0-arm64-macos.tar.gz
@@ -95,7 +96,27 @@ jobs:
       - name: Gzip tarballs
         run: gzip ${{ env.ARCHIVE_FILENAME_PREFIX }}.tar ${{ env.ARCHIVE_FILENAME_PREFIX }}-arm64-linux-wasi-sdk-${{ env.WASI_SDK_VERSION }}.0-quickstart.tar ${{ env.ARCHIVE_FILENAME_PREFIX }}-arm64-macos-wasi-sdk-${{ env.WASI_SDK_VERSION }}.0-quickstart.tar ${{ env.ARCHIVE_FILENAME_PREFIX }}-x86_64-linux-wasi-sdk-${{ env.WASI_SDK_VERSION }}.0-quickstart.tar ${{ env.ARCHIVE_FILENAME_PREFIX }}-x86_64-macos-wasi-sdk-${{ env.WASI_SDK_VERSION }}.0-quickstart.tar ${{ env.ARCHIVE_FILENAME_PREFIX }}-x86_64-windows-wasi-sdk-${{ env.WASI_SDK_VERSION }}.0-quickstart.tar
 
-      - uses: ncipollo/release-action@v1
+      - name: Upload tarballs for release job
+        uses: actions/upload-artifact@043fb46 # @v7
+        with:
+          name: env-cache-${{ github.run_id }}
+          retention-days: 7
+          path: "${{ env.ARCHIVE_FILENAME_PREFIX }}*.tar.gz"
+          compression: 0
+
+  release:
+    runs-on: ubuntu-latest
+    needs: build
+    permissions:
+      contents: write
+    steps:
+      - name: Download tarballs to release job
+        uses: actions/download-artifact@3e5f45b # @v8
+        with:
+          name: env-cache-${{ github.run_id }}
+
+      - name: Release action
+        uses: ncipollo/release-action@339a818 # @v1.21.0
         with:
           artifacts: "${{ env.ARCHIVE_FILENAME_PREFIX }}*.tar.gz"
           artifactErrorsFailBuild: true

CONTRIBUTING.md

@@ -17,7 +17,11 @@ right place.
 
 The build script assumes you're installing `wasi-sdk` to `/opt/wasi-sdk`. You
 can specify a custom path using `--set wasi-sdk /path/to/wasi-sdk-dist` in
-`just`, or by supplying the relevant `wasi-sdk-p1.cmake` file with `-DCMAKE_TOOLCHAIN_FILE` if using CMake directly.
+`just`, or by supplying the relevant `wasi-sdk-p1.cmake` file with
+`-DCMAKE_TOOLCHAIN_FILE` if using CMake directly.
+
+Additionally: any time the `wasi-sdk` version is upgraded,
+`./github/workflows/release.yml` needs to be updated with the new shasums.
 
 ### Example(s)