From 44862fdcfd89a1cff854ea8d3a5cef2249df9ed0 Mon Sep 17 00:00:00 2001
From: Satoshi Qazi Muhammed <info@pezkuwichain.io>
Date: Fri, 24 Jul 2026 11:52:31 -0700
Subject: [PATCH] ci(gitlab): add deployable runtime-WASM release job to match
 github pipeline
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

The GitLab pipeline already mirrors github's checks/security/test/docs gates
(more thoroughly, in places), but its release stage built only the node binary
(pezkuwi + workers). github's release.yml additionally builds the deployable
runtime WASM (pezkuwichain / asset-hub-pezkuwichain / people-pezkuwichain) and
publishes the blake2-256 authorize_upgrade hash — the fund-critical artifact that
governance authorizes on-chain and anyone can reproduce.

Add an equivalent build-runtime-wasm job (matrix over the 3 deployable runtimes,
blake2-256 + sha256 digest, artifacts) on v*/runtime-* tags, pinned to a single
runner for hash reproducibility, so gitlab.com produces the same verifiable
release artifact as github.com. Also trigger pipelines on runtime-* tags.
---
 .gitlab-ci.yml | 63 ++++++++++++++++++++++++++++++++++++++++++++++++++
 1 file changed, 63 insertions(+)

diff --git a/.gitlab-ci.yml b/.gitlab-ci.yml
index 18503c03..1b9f5031 100644
--- a/.gitlab-ci.yml
+++ b/.gitlab-ci.yml
@@ -36,6 +36,7 @@ workflow:
     - if: $CI_COMMIT_BRANCH == $CI_DEFAULT_BRANCH
     - if: $CI_MERGE_REQUEST_IID
     - if: $CI_COMMIT_TAG =~ /^v\d+\.\d+\.\d+$/
+    - if: $CI_COMMIT_TAG =~ /^runtime-/
     - if: $CI_PIPELINE_SOURCE == "schedule"
     - if: $CI_PIPELINE_SOURCE == "web"
 
@@ -821,6 +822,68 @@ build-release:
     - if: $CI_COMMIT_BRANCH == $CI_DEFAULT_BRANCH
     - if: $CI_COMMIT_TAG =~ /^v\d+\.\d+\.\d+$/
 
+# ╔══════════════════════════════════════════════════════════════════════════════
+# RUNTIME WASM RELEASE — deployable runtime blobs + verifiable blake2-256
+# authorize_upgrade hashes (mirrors github .github/workflows/release.yml
+# build-runtime). This is the fund-critical release artifact: governance
+# authorizes the blake2-256 hash on-chain, and anyone can rebuild this tag with the
+# pinned toolchain (rust-toolchain.toml) + committed Cargo.lock and compare.
+# ╚══════════════════════════════════════════════════════════════════════════════
+
+build-runtime-wasm:
+  stage: build
+  # Pin to ONE runner for a reproducible install path/hash (until a hermetic srtool
+  # build lands). Register a dedicated GitLab runner tagged `dks-runner-1` to match
+  # the github pinned box; without it, tag the reproducible-release runner here.
+  tags: [dks-runner-1]
+  needs: []
+  variables:
+    RUSTFLAGS: "-D warnings"
+  timeout: 4h
+  parallel:
+    matrix:
+      - RUNTIME:
+          - pezkuwichain-runtime
+          - asset-hub-pezkuwichain-runtime
+          - people-pezkuwichain-runtime
+  script:
+    - git config --global --add safe.directory '*'
+    - rustup show
+    - rustup component add rust-src
+    - rustup target add wasm32v1-none wasm32-unknown-unknown
+    - cargo build --release --locked -p "$RUNTIME"
+    - |
+      set -euo pipefail
+      wbuild_dir="target/release/wbuild/${RUNTIME}"
+      mapfile -t candidates < <(find "$wbuild_dir" -maxdepth 1 \
+             -name '*.compact.compressed.wasm' ! -name 'fast_runtime_binary*')
+      [ "${#candidates[@]}" -eq 1 ] || { echo "ambiguous/missing WASM for ${RUNTIME}: ${candidates[*]:-none}"; exit 1; }
+      wasm="${candidates[0]}"; mkdir -p artifacts
+      cp "$wasm" "artifacts/${RUNTIME}.compact.compressed.wasm"
+      b2=$(b2sum -l 256 "$wasm" | cut -d' ' -f1)
+      sha=$(sha256sum "$wasm" | cut -d' ' -f1)
+      size=$(stat -c%s "$wasm")
+      {
+        echo "### ${RUNTIME}"; echo ""
+        echo "| field | value |"; echo "|---|---|"
+        echo "| commit | \`${CI_COMMIT_SHA}\` |"
+        echo "| toolchain | \`$(rustc --version)\` |"
+        echo "| size (bytes) | ${size} |"
+        echo "| blake2-256 (authorize_upgrade) | \`0x${b2}\` |"
+        echo "| sha256 | \`${sha}\` |"; echo ""
+      } | tee "artifacts/${RUNTIME}.digest.md"
+      echo "0x${b2}  ${RUNTIME}"
+  artifacts:
+    name: "$RUNTIME"
+    paths:
+      - artifacts/*
+    expire_in: never
+  rules:
+    - if: $CI_COMMIT_TAG =~ /^v\d+\.\d+\.\d+$/
+    - if: $CI_COMMIT_TAG =~ /^runtime-/
+    - if: $CI_PIPELINE_SOURCE == "web"
+      when: manual
+
 # ╔══════════════════════════════════════════════════════════════════════════════
 # RELEASE — GitLab Release with assets (tags only)
 # ╚══════════════════════════════════════════════════════════════════════════════