Add GitHub release promotion and asset-consumption workflow

Author: turadg

.github/workflows/publish-github-release.yml

@@ -0,0 +1,85 @@
+name: publish-github-release
+
+on:
+  workflow_dispatch:
+    inputs:
+      version:
+        description: Version to release (example 0.15.0)
+        required: true
+      build_real_run_id:
+        description: Successful build-real workflow run ID
+        required: true
+      prerelease:
+        description: Mark release as pre-release
+        required: true
+        default: "false"
+      dry_run:
+        description: Validate only, do not create GitHub release
+        required: true
+        default: "true"
+
+permissions:
+  contents: write
+  actions: read
+
+jobs:
+  publish-release:
+    runs-on: ubuntu-latest
+    env:
+      VERSION: ${{ inputs.version }}
+      TAG: v${{ inputs.version }}
+      BUNDLE_DIR: bundle
+    steps:
+      - uses: actions/checkout@v4
+
+      - name: Download release bundle artifact from build-real
+        uses: actions/download-artifact@v4
+        with:
+          run-id: ${{ inputs.build_real_run_id }}
+          github-token: ${{ github.token }}
+          name: release-bundle-${{ inputs.version }}
+          path: ${{ env.BUNDLE_DIR }}
+
+      - name: Validate bundle contents
+        run: |
+          test -f "${BUNDLE_DIR}/xsnap-worker-binaries-${VERSION}.tar.gz"
+          test -f "${BUNDLE_DIR}/manifests/${VERSION}.json"
+
+      - name: Check release tag does not already exist
+        run: |
+          if gh release view "${TAG}" >/dev/null 2>&1; then
+            echo "Release ${TAG} already exists" >&2
+            exit 1
+          fi
+
+      - name: Dry run summary
+        if: ${{ inputs.dry_run == 'true' }}
+        run: |
+          echo "Dry run only. Would create release ${TAG} with assets:"
+          echo "- ${BUNDLE_DIR}/xsnap-worker-binaries-${VERSION}.tar.gz"
+          echo "- ${BUNDLE_DIR}/manifests/${VERSION}.json (renamed to xsnap-worker-manifest-${VERSION}.json)"
+
+      - name: Create GitHub release
+        if: ${{ inputs.dry_run != 'true' }}
+        run: |
+          cp "${BUNDLE_DIR}/manifests/${VERSION}.json" "${BUNDLE_DIR}/xsnap-worker-manifest-${VERSION}.json"
+
+          prerelease_flag=""
+          if [[ "${{ inputs.prerelease }}" == "true" ]]; then
+            prerelease_flag="--prerelease"
+          fi
+
+          cat > release-notes.txt <<NOTES
+          Prebuilt xsnap-worker binaries for ${VERSION}.
+
+          Assets:
+          - xsnap-worker-binaries-${VERSION}.tar.gz
+          - xsnap-worker-manifest-${VERSION}.json
+          NOTES
+
+          gh release create "${TAG}" \
+            "${BUNDLE_DIR}/xsnap-worker-binaries-${VERSION}.tar.gz" \
+            "${BUNDLE_DIR}/xsnap-worker-manifest-${VERSION}.json" \
+            --title "xsnap-worker-binaries ${TAG}" \
+            --notes-file release-notes.txt \
+            ${prerelease_flag}

README.md

@@ -56,3 +56,30 @@ The `build-real` workflow builds each supported target in a matrix, then assembl
   - `packages/<package>/` with staged `bin/` content
   - merged manifest `manifests/<version>.json`
   - `xsnap-worker-binaries-<version>.tar.gz`
+
+## GitHub Release Promotion
+You can promote a successful `build-real` run to a GitHub Release without touching npm:
+
+```bash
+gh workflow run publish-github-release \
+  -f version=X.Y.Z \
+  -f build_real_run_id=<build-real-run-id> \
+  -f prerelease=true \
+  -f dry_run=true
+```
+
+Set `dry_run=false` to actually create tag `vX.Y.Z` and upload:
+- `xsnap-worker-binaries-X.Y.Z.tar.gz`
+- `xsnap-worker-manifest-X.Y.Z.json`
+
+## agoric-sdk Pre-NPM Consumption
+`agoric-sdk` CI can consume these release assets directly:
+
+```bash
+./scripts/download-release-assets.sh X.Y.Z /tmp/xsnap-assets
+tar -xzf /tmp/xsnap-assets/xsnap-worker-binaries-X.Y.Z.tar.gz -C /tmp/xsnap-assets
+target=\"$(./scripts/host-target.sh)\"
+export XSNAP_WORKER=\"/tmp/xsnap-assets/dist/${target}/release/xsnap-worker\"
+```
+
+Then run agoric-sdk tests with `XSNAP_WORKER` override enabled.

RELEASE.md

@@ -6,6 +6,17 @@
 - `NPM_TOKEN` is configured in GitHub Actions secrets.
 - Live publish is disabled unless `ALLOW_NPM_PUBLISH=true`.
 
+## GitHub Release (No NPM)
+Promote build artifacts to a GitHub release first:
+```bash
+gh workflow run publish-github-release \
+  -f version=X.Y.Z \
+  -f build_real_run_id=<build-real-run-id> \
+  -f prerelease=true \
+  -f dry_run=true
+```
+Set `dry_run=false` when ready to create the release.
+
 ## Bundle Validation (No Publish)
 ```bash
 gh workflow run release \

package.json

@@ -14,6 +14,7 @@
     "ci:check-npm": "./scripts/check-npm-availability.sh",
     "ci:check-version-sync": "./scripts/validate-version-sync.sh",
     "release:bundle:dry-run": "./scripts/publish-from-bundle.sh release/$VERSION --dry-run",
-    "release:dry-run": "./scripts/publish-all.sh --dry-run"
+    "release:dry-run": "./scripts/publish-all.sh --dry-run",
+    "release:download-assets": "./scripts/download-release-assets.sh $VERSION ./release-assets"
   }
 }

scripts/download-release-assets.sh

@@ -0,0 +1,28 @@
+#!/usr/bin/env bash
+set -euo pipefail
+
+version="${1:-}"
+out_dir="${2:-}"
+repo="${3:-Agoric/xsnap-worker-binaries}"
+
+if [[ -z "$version" || -z "$out_dir" ]]; then
+  echo "Usage: $0 <version> <output-dir> [repo]" >&2
+  echo "Example: $0 0.15.0 /tmp/xsnap-assets" >&2
+  exit 1
+fi
+
+mkdir -p "$out_dir"
+tag="v$version"
+
+tarball="xsnap-worker-binaries-$version.tar.gz"
+manifest="xsnap-worker-manifest-$version.json"
+
+gh release download "$tag" \
+  --repo "$repo" \
+  --pattern "$tarball" \
+  --pattern "$manifest" \
+  --dir "$out_dir"
+
+echo "Downloaded release assets to $out_dir"
+echo "- $out_dir/$tarball"
+echo "- $out_dir/$manifest"

scripts/host-target.sh

@@ -0,0 +1,8 @@
+#!/usr/bin/env bash
+set -euo pipefail
+
+SCRIPT_DIR="$(cd "$(dirname "$0")" && pwd)"
+# shellcheck source=./common.sh
+source "$SCRIPT_DIR/common.sh"
+
+host_target