Merge branch 'main' into test-on-win

.github/workflows/build-and-release.yml

@@ -5,8 +5,30 @@ on:
     tags:
       - "*"
 
+permissions:
+  id-token: write
+  contents: write
+
 jobs:
+  set-version:
+    runs-on: ubuntu-latest
+    outputs:
+      version: ${{ steps.get_version.outputs.tag }}
+    steps:
+      - name: Set version number
+        id: get_version
+        run: |
+          version="${{ github.ref_name }}"
+          echo "tag=$version" >> $GITHUB_OUTPUT
+
+  create-binaries:
+    needs: set-version
+    uses: ./.github/workflows/create-artifact.yml
+    with:
+      version: ${{ needs.set-version.outputs.version }}
+
   build:
+    needs: [set-version, create-binaries]
     runs-on: ubuntu-latest
 
     steps:
@@ -26,14 +48,8 @@ jobs:
           npm i -g @aikidosec/safe-chain
           safe-chain setup-ci
 
-      - name: Set version number
-        id: get_version
-        run: |
-          version="${{ github.ref_name }}"
-          echo "tag=$version" >> $GITHUB_OUTPUT
-
       - name: Set the version in safe-chain package
-        run: npm --no-git-tag-version version ${{ steps.get_version.outputs.tag }} --workspace=packages/safe-chain
+        run: npm --no-git-tag-version version ${{ needs.set-version.outputs.version }} --workspace=packages/safe-chain
 
       - name: Install dependencies
         run: npm ci
@@ -49,7 +65,33 @@ jobs:
 
       - name: Publish to npm
         run: |
-          echo "Publishing version ${{ steps.get_version.outputs.tag }} to NPM"
-          npm publish --workspace=packages/safe-chain --access public
+          echo "Publishing version ${{ needs.set-version.outputs.version }} to NPM"
+          npm publish --workspace=packages/safe-chain --access public --provenance
+
+      - name: Download all binary artifacts
+        uses: actions/download-artifact@v4
+        with:
+          path: binaries/
+          pattern: safe-chain-*
+          merge-multiple: false
+
+      - name: Rename binaries to include platform and architecture
+        run: |
+          mv binaries/safe-chain-macos-x64/safe-chain binaries/safe-chain-macos-x64/safe-chain-macos-x64
+          mv binaries/safe-chain-macos-arm64/safe-chain binaries/safe-chain-macos-arm64/safe-chain-macos-arm64
+          mv binaries/safe-chain-linux-x64/safe-chain binaries/safe-chain-linux-x64/safe-chain-linux-x64
+          mv binaries/safe-chain-linux-arm64/safe-chain binaries/safe-chain-linux-arm64/safe-chain-linux-arm64
+          mv binaries/safe-chain-win-x64/safe-chain.exe binaries/safe-chain-win-x64/safe-chain-win-x64.exe
+          mv binaries/safe-chain-win-arm64/safe-chain.exe binaries/safe-chain-win-arm64/safe-chain-win-arm64.exe
+
+      - name: Upload binaries to existing GitHub Release
         env:
-          NPM_AUTH_TOKEN: ${{ secrets.NPM_PUBLISH_TOKEN }}
+          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+        run: |
+          gh release upload ${{ needs.set-version.outputs.version }} \
+            binaries/safe-chain-macos-x64/* \
+            binaries/safe-chain-macos-arm64/* \
+            binaries/safe-chain-linux-x64/* \
+            binaries/safe-chain-linux-arm64/* \
+            binaries/safe-chain-win-x64/* \
+            binaries/safe-chain-win-arm64/*

.github/workflows/create-artifact.yml

@@ -0,0 +1,82 @@
+name: Create binaries
+
+on:
+  pull_request:
+  workflow_call:
+    inputs:
+      version:
+        description: 'Version to set in package.json'
+        required: false
+        type: string
+
+jobs:
+  create-binaries:
+    name: Create binary for ${{ matrix.os }}-${{ matrix.arch }}
+
+    runs-on: ${{ matrix.runner }}
+
+    strategy:
+      fail-fast: false
+      matrix:
+        include:
+          - os: macos
+            arch: x64
+            runner: macos-15-intel
+            target: node20-macos-x64
+            extension: ""
+          - os: macos
+            arch: arm64
+            runner: macos-latest
+            target: node20-macos-arm64
+            extension: ""
+          - os: linux
+            arch: x64
+            runner: ubuntu-latest
+            target: node20-linux-x64
+            extension: ""
+          - os: linux
+            arch: arm64
+            runner: ubuntu-24.04-arm
+            target: node20-linux-arm64
+            extension: ""
+          - os: win
+            arch: x64
+            runner: windows-latest
+            target: node20-win-x64
+            extension: ".exe"
+          - os: win
+            arch: arm64
+            runner: windows-11-arm
+            target: node20-win-arm64
+            extension: ".exe"
+
+    steps:
+      - name: Checkout code
+        uses: actions/checkout@v3
+
+      - name: Set up Node.js
+        uses: actions/setup-node@v3
+        with:
+          node-version: "20.x"
+
+      - name: Setup safe-chain
+        run: |
+          npm i -g @aikidosec/safe-chain
+          safe-chain setup-ci
+
+      - name: Set the version in safe-chain package
+        if: inputs.version != ''
+        run: npm --no-git-tag-version version ${{ inputs.version }} --workspace=packages/safe-chain
+
+      - name: Install dependencies
+        run: npm ci --ignore-scripts
+
+      - name: Create binary
+        run: |
+          node build.js ${{ matrix.target }}
+
+      - name: Upload binary artifact
+        uses: actions/upload-artifact@v4
+        with:
+          name: safe-chain-${{ matrix.os }}-${{ matrix.arch }}
+          path: dist/*

.github/workflows/test-on-pr.yml

@@ -33,9 +33,12 @@ jobs:
       - name: Run unit tests
         run: npm test
 
-      - name: Run ESLint
+      - name: Run linting
         run: npm run lint
 
+      - name: Type check
+        run: npm run typecheck --workspace=packages/safe-chain
+
       - name: Create package tarball
         run: npm pack --workspace=packages/safe-chain