Merge branch 'release' into deploy-web

Author: infomiho

.github/actions/compute-artifact-names/action.yaml

@@ -0,0 +1,66 @@
+name: Compute artifact names
+description: Central place for computing the artifact names in the CI builds.
+
+inputs:
+  build-name:
+    description: >
+      The build name (e.g., linux-x86_64, macos-aarch64, etc.). The special
+      value "all" can be used to receive a glob that matches all of the build
+      names.
+    required: true
+
+runs:
+  using: composite
+
+  steps:
+    - name: Check valid build name
+      if: >
+        ! contains(
+          fromJson('[
+            "all",
+            "linux-x86_64",
+            "linux-x86_64-static",
+            "macos-x86_64",
+            "macos-aarch64",
+            "macos-universal"
+          ]'),
+          inputs.build-name
+        )
+      shell: sh
+      run: |
+        echo '::error::Invalid build name provided: ${{ inputs.build-name }}.'
+        exit 1
+
+    - name: Set artifact names
+      id: set-artifact-names
+      shell: sh
+      env:
+        BUILD_NAME: ${{ inputs.build-name == 'all' && '*' || inputs.build-name }}
+      run: |
+        echo "artifact-name=wasp-cli-${BUILD_NAME}" >> $GITHUB_OUTPUT
+        echo "tarball-name=wasp-${BUILD_NAME}.tar.gz" >> $GITHUB_OUTPUT
+
+    - name: Set npm target
+      id: set-npm-target
+      if: inputs.build-name != 'all' && inputs.build-name != 'macos-universal'
+      shell: sh
+      run: |
+        case '${{ inputs.build-name }}' in
+            linux-x86_64) npm_target='{"os":"linux","cpu":"x64","libc":"glibc"}' ;;
+            linux-x86_64-static) npm_target='{"os":"linux","cpu":"x64","libc":"musl"}' ;;
+            macos-x86_64) npm_target='{"os":"darwin","cpu":"x64"}' ;;
+            macos-aarch64) npm_target='{"os":"darwin","cpu":"arm64"}' ;;
+        esac
+
+        echo "npm-target=$npm_target" >>"$GITHUB_OUTPUT"
+
+outputs:
+  artifact-name:
+    value: ${{ steps.set-artifact-names.outputs.artifact-name }}
+    description: "The name of the artifact attached to the CI build."
+  tarball-name:
+    value: ${{ steps.set-artifact-names.outputs.tarball-name }}
+    description: "The name of the tarball inside the artifact."
+  npm-target:
+    value: ${{ steps.set-npm-target.outputs.npm-target }}
+    description: "A JSON-encoded object of {os, cpu, libc?} for this build."

.github/actions/fetch-nightly-cli/README.md

@@ -15,7 +15,7 @@ inputs:
     description: |
       The version of Cabal to install.
     required: false
-    default: "3.10.2.0"
+    default: "3.12.1.0"
 
   cabal-project-dir:
     description: |

.github/actions/fetch-nightly-cli/action.yaml

@@ -22,7 +22,7 @@ jobs:
     runs-on: ubuntu-latest
 
     steps:
-      - uses: actions/checkout@v5
+      - uses: actions/checkout@v6
 
       - name: Evict caches
         shell: bash

.github/actions/setup-haskell/action.yaml

@@ -0,0 +1,39 @@
+name: "Automation - Label external PRs"
+
+############################################################
+# CAUTION: This workflow should not check out the PR code! #
+############################################################
+# The `pull_request_target` event is only intended for simple automations on the
+# PRs themselves (e.g., labeling, commenting). If we checked out the PR code here,
+# we would be running untrusted code and giving it access to our repository
+# secrets, which is a major security risk.
+#
+# More info at:
+# https://securitylab.github.com/resources/github-actions-preventing-pwn-requests/
+
+on:
+  pull_request_target:
+    types:
+      - opened
+      - reopened
+      - ready_for_review
+
+jobs:
+  label-external-prs:
+    name: Label external PRs
+    runs-on: ubuntu-latest
+
+    permissions:
+      pull-requests: write
+
+    # We check if the PR comes from a different repo than ours:
+    if: github.event.pull_request.head.repo.full_name != github.repository
+
+    steps:
+      - name: Label external PR
+        run: gh pr edit "$PR_NUMBER" --add-label "$LABEL_NAME"
+        env:
+          LABEL_NAME: "external"
+          PR_NUMBER: ${{ github.event.pull_request.number }}
+          GH_TOKEN: ${{ github.token }}
+          GH_REPO: ${{ github.repository }}

.github/workflows/automation-cache-evict.yaml

@@ -26,11 +26,11 @@ jobs:
       name: fly-deploy-test
 
     steps:
-      - uses: actions/checkout@v5
+      - uses: actions/checkout@v6
 
       - uses: ./.github/actions/setup-haskell
 
-      - uses: actions/setup-node@v5
+      - uses: actions/setup-node@v6
         with:
           cache: "npm"
           node-version: "22"

.github/workflows/automation-pr-label-external.yaml

@@ -23,13 +23,13 @@ jobs:
           - kitchen-sink
 
     steps:
-      - uses: "actions/checkout@v5"
+      - uses: "actions/checkout@v6"
 
       - uses: ./.github/actions/setup-haskell
         with:
           cabal-project-dir: waspc
 
-      - uses: actions/setup-node@v5
+      - uses: actions/setup-node@v6
         with:
           node-version: lts/*
 

.github/workflows/ci-deploy-test.yaml

@@ -13,9 +13,9 @@ jobs:
   prettier:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v5
+      - uses: actions/checkout@v6
 
-      - uses: actions/setup-node@v5
+      - uses: actions/setup-node@v6
         with:
           cache: "npm"
           node-version: "22"
@@ -33,7 +33,7 @@ jobs:
           git config --global core.autocrlf input
           git config --global core.eol lf
 
-      - uses: actions/checkout@v5
+      - uses: actions/checkout@v6
 
       - name: Parse oromolu version
         working-directory: waspc

.github/workflows/ci-examples-test.yaml

@@ -0,0 +1,20 @@
+name: "Test - Publish nightly Wasp npm packages to pkg.pr.new"
+
+on:
+  workflow_call:
+
+jobs:
+  publish:
+    name: Publish packages
+    runs-on: ubuntu-latest
+
+    steps:
+      - uses: actions/setup-node@v6
+
+      - uses: actions/download-artifact@v6
+        with:
+          name: wasp-npm-packages
+          path: packages/
+
+      - name: Publish Wasp npm packages
+        run: npx pkg-pr-new publish --bin ./packages/*