From ea6fab161ea8faa7b36557892441f1d02ddbf74d Mon Sep 17 00:00:00 2001
From: Lann Martin <lmartin@akamai.com>
Date: Sun, 23 Aug 2026 20:50:00 -0400
Subject: [PATCH] jsr-publish: attach the component assets to the release it
 creates
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

A release created with the workflow's own github.token emits no
`release: published` event, so release-assets.yml never fires for the
releases jsr-publish creates — v0.5.0 and v0.5.1 both needed a manual
backfill dispatch. jsr-publish now uploads iroh_endpoint.wasm +
SHA256SUMS itself, from the same in-run build it embeds into the
published package, so the release asset and the JSR-embedded component
are byte-identical by construction. release-assets.yml stays for
backfill dispatch and human-published releases; both headers state the
split.
---
 .github/workflows/jsr-publish.yml    | 21 +++++++++++++++------
 .github/workflows/release-assets.yml | 15 +++++++++------
 2 files changed, 24 insertions(+), 12 deletions(-)

diff --git a/.github/workflows/jsr-publish.yml b/.github/workflows/jsr-publish.yml
index 142684e..3bb959e 100644
--- a/.github/workflows/jsr-publish.yml
+++ b/.github/workflows/jsr-publish.yml
@@ -7,11 +7,16 @@
 # the manifest version is not yet on JSR: the workflow publishes, then
 # creates the vX.Y.Z tag + release at this run's commit if one doesn't
 # already exist (a pre-created release is left alone; a bare tag without
-# a release fails loudly). JSR rejects duplicate versions, so a re-run
-# is a no-op-by-failure; if publish succeeded but release creation
-# failed, create the release manually at this run's commit before
-# re-dispatching. --allow-dirty is for the generated (gitignored) asset
-# module only.
+# a release fails loudly) and attaches iroh_endpoint.wasm + SHA256SUMS
+# from this run's build — the same bytes the published package embeds,
+# and necessarily so, because a release created with github.token emits
+# no `release: published` event, so release-assets.yml cannot fire for
+# it (that workflow covers backfill and human-published releases). JSR
+# rejects duplicate versions, so a re-run is a no-op-by-failure; if
+# publish succeeded but release creation failed, create the release
+# manually at this run's commit and dispatch release-assets for it
+# before re-dispatching. --allow-dirty is for the generated (gitignored)
+# asset module only.
 name: jsr-publish
 on:
   workflow_dispatch:
@@ -36,7 +41,7 @@ jobs:
           deno run --allow-read=target --allow-write=host-polyengine/src/endpoint_component.ts scripts/embed-endpoint-component.ts
       - run: deno publish --allow-dirty
         working-directory: host-polyengine
-      - name: Create the vX.Y.Z release
+      - name: Create the vX.Y.Z release with the component assets
         env:
           GH_TOKEN: ${{ github.token }}
         run: |
@@ -57,3 +62,7 @@ jobs:
             "Still 0.x/unstable, but caret-honest: releases within a minor line stay compatible; breaking changes bump the minor." \
             >"$notes"
           gh release create "$tag" -R "$GITHUB_REPOSITORY" --target "$GITHUB_SHA" --title "${GITHUB_REPOSITORY#*/} $tag" --notes-file "$notes"
+          cp target/wasm32-wasip2/release/iroh_endpoint.wasm .
+          sha256sum iroh_endpoint.wasm > SHA256SUMS
+          cat SHA256SUMS
+          gh release upload "$tag" -R "$GITHUB_REPOSITORY" iroh_endpoint.wasm SHA256SUMS --clobber
diff --git a/.github/workflows/release-assets.yml b/.github/workflows/release-assets.yml
index 8cde9b0..2ad1e12 100644
--- a/.github/workflows/release-assets.yml
+++ b/.github/workflows/release-assets.yml
@@ -4,12 +4,15 @@
 # repo and building from source — the same consumer story polyengine's
 # releases give its translator shim.
 #
-# Runs automatically when a release is published; `workflow_dispatch`
-# with a tag backfills an existing release (e.g. one cut before this
-# workflow existed). The build is the exact recipe jsr-publish.yml embeds
-# into @polymorph/iroh, at the release's own tag, on the toolchain
-# rust-toolchain.toml pins there. `--clobber` makes re-runs converge on
-# the latest build instead of failing on the existing asset.
+# jsr-publish.yml attaches these assets itself to the releases it
+# creates (github.token-created releases emit no `release: published`
+# event, so this workflow cannot fire for them). This workflow covers
+# the rest: it runs automatically when a release is published by hand,
+# and `workflow_dispatch` with a tag backfills an existing release. The
+# build is the exact recipe jsr-publish.yml embeds into @polymorph/iroh,
+# at the release's own tag, on the toolchain rust-toolchain.toml pins
+# there. `--clobber` makes re-runs converge on the latest build instead
+# of failing on the existing asset.
 name: release-assets
 on:
   release: