Update GitHub release action

This update introduces this new behaviour for the release action:

  * Execute it on push requests against `main` branch and whenever
    there's a tag that starts with `v<something>`
  * Publish the WASM module to the GitHub Container registry as an OCI
    artifact
  * The action pushes a `pod-runtime:latest` OCI artifact to ghcr
    for regular pushes against the `main` branch
  * The action pushes a `pod-runtime:v<something>` OCI artifact to ghcr
    for tag pushes
  * Tag pushes trigger also the creation of a release

.github/workflows/release.yml

@@ -1,31 +1,69 @@
 on:
   push:
+    branches:
+    - main
     tags:
     - 'v*'
 
-name: release
+name: publish WASM module
 
 jobs:
   build:
     name: Create new release with the WASM artifact
     runs-on: ubuntu-20.04
     steps:
-      - name: Checkout code
+      -
+        name: Checkout code
         uses: actions/checkout@v2
-      - name: Build release
+      -
+        name: Download wasm-to-oci
+        uses: i3h/download-release-asset@v1
+        with:
+          owner: engineerd
+          repo: wasm-to-oci
+          tag: v0.1.1
+          file: linux-amd64-wasm-to-oci
+      -
+        name: fix wasm-to-oci permissions
+        run: |
+          chmod 755 linux-amd64-wasm-to-oci
+      -
+        name: Build release
         uses: swiftwasm/swiftwasm-action@v5.3
         with:
           shell-action: swift build -c release --triple wasm32-unknown-wasi --build-path build
-      - name: WASM strip
+      -
+        name: WASM strip
         uses: swiftwasm/swiftwasm-action@v5.3
         with:
           shell-action: wasm-strip build/wasm32-unknown-wasi/release/policy.wasm
-      - name: WASM optimize
+      -
+        name: WASM optimize
         uses: swiftwasm/swiftwasm-action@v5.3
         with:
           shell-action: wasm-opt -Os build/wasm32-unknown-wasi/release/policy.wasm -o policy.wasm
-      - name: Create Release
+      -
+        name: Login to GitHub Container Registry
+        uses: docker/login-action@v1
+        with:
+          registry: ghcr.io
+          username: ${{ github.repository_owner }}
+          password: ${{ secrets.CR_PAT }}
+      -
+        name: Publish WASM policy artifact to OCI registry with the 'latest' tag
+        if: ${{ startsWith(github.ref, 'refs/heads/') }}
+        run: |
+          ./linux-amd64-wasm-to-oci push policy.wasm ghcr.io/chimera-kube/policies/pod-runtime:latest
+      -
+        name: Publish WASM policy artifact to OCI registry with the version tag
+        if: ${{ startsWith(github.ref, 'refs/tags/') }}
+        run: |
+          export OCI_TAG=$(echo $GITHUB_REF | sed -e "s|refs/tags/||")
+          ./linux-amd64-wasm-to-oci push policy.wasm ghcr.io/chimera-kube/policies/pod-runtime:${OCI_TAG}
+      -
+        name: Create Release
         id: create_release
+        if: ${{ startsWith(github.ref, 'refs/tags/v') }}
         uses: actions/create-release@v1
         env:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
@@ -34,8 +72,10 @@ jobs:
           release_name: Release ${{ github.ref }}
           draft: false
           prerelease: false
-      - name: Upload Release Asset
+      -
+        name: Upload Release Asset
         id: upload-release-asset
+        if: ${{ startsWith(github.ref, 'refs/tags/v') }}
         uses: actions/upload-release-asset@v1
         env:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}