Add check runtimes GH Workflow (#2252)

This PR introduces:
- a new script 
- a new GH Workflow 
- runtime reference spec files for `rococo` and `westend`

It brings a mechanism to check that part(s) of the runtimes' metadata
that should not change over time, actually did not change over time.

Ideally, the GHW should trigger when a release is edited but GH seem to
[have an issue](https://github.com/orgs/community/discussions/47794)
that prevents the trigger from working. This is why the check has been
implemented as `workflow_dispatch` for a start.

The `workflow_dispatch` requires a `release_id` that can be found using:
```
curl -s -H "Authorization: Bearer ${GITHUB_TOKEN}" \
   https://api.github.com/repos/paritytech/polkadot-sdk/releases | \
   jq '.[] | { name: .name, id: .id }'
```
as documented in the workflow.

A sample run can be seen
[here](https://github.com/chevdor/polkadot-sdk/actions/runs/6811176342).

.github/workflows/build-and-attach-release-runtimes.yml

@@ -31,7 +31,7 @@ jobs:
 
     steps:
     - name: Checkout code
-      uses: actions/checkout@v4
+      uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4.1.1
 
     - name: Build ${{ matrix.runtime.name }} ${{ matrix.build_config.type }}
       id: srtool_build

.github/workflows/check-publish.yml

@@ -12,7 +12,7 @@ jobs:
   check-publish:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@8ade135a41bc03ea155e62e844d188df1ea18608 # v4.1.0
+      - uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4.1.1
 
       - name: Rust Cache
         uses: Swatinem/rust-cache@3cf7f8cc28d1b4e7d01e3783be10a97d55d483c8 # v2.7.1

.github/workflows/check-runtimes.yml

@@ -0,0 +1,94 @@
+name: Check Runtimes Specs
+# This GH Workflow fetches the runtimes available in a release.
+# It then compares their metadata with reference specs located under
+#  .github/runtime_specs.
+
+on:
+  workflow_dispatch:
+    inputs:
+      release_id:
+        description: |
+          Release ID.
+          You can find it using the command:
+          curl -s \
+            -H "Authorization: Bearer ${GITHUB_TOKEN}" https://api.github.com/repos/paritytech/polkadot-sdk/releases | \
+            jq '.[] | { name: .name, id: .id }'
+        required: true
+        type: string
+
+  # This trigger unfortunately does not work as expected.
+  # https://github.com/orgs/community/discussions/47794
+  # release:
+  #   types: [edited]
+
+env:
+  RUNTIME_SPECS_DIR: .github/runtime_specs
+  DATA_DIR: runtimes
+  RELEASE_ID: ${{ inputs.release_id }}
+  REPO: ${{ github.repository }}
+
+jobs:
+  find-specs:
+    name: Fetch runtime specs
+    outputs:
+      specs: ${{ steps.get-list.outputs.specs }}
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout the repo
+        uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4.1.1
+
+      - name: Get list
+        id: get-list
+        run: |
+          lst=$(ls $RUNTIME_SPECS_DIR/*.json | xargs -I{} basename "{}" .json | jq -R .| jq -sc .)
+          echo "Found: $lst"
+          echo "specs=$lst" >> $GITHUB_OUTPUT
+
+  check-runtimes:
+    name: Check runtime specs
+    runs-on: ubuntu-latest
+    needs:
+      - find-specs
+
+    strategy:
+      matrix:
+        specs: ${{ fromJSON(needs.find-specs.outputs.specs) }}
+
+    steps:
+      - name: Checkout the repo
+        uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4.1.1
+
+      - name: Fetch release artifacts based on release id
+        env:
+          OUTPUT_DIR: ${{ env.DATA_DIR }}
+          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+        run: |
+          . ./.github/scripts/common/lib.sh
+          fetch_release_artifacts
+
+      - name: Install tooling
+        env:
+          SUBWASM_VERSION: v0.20.0
+          DL_BASE_URL: https://github.com/chevdor/subwasm/releases/download
+        run: |
+          wget $DL_BASE_URL/$SUBWASM_VERSION/subwasm_linux_amd64_$SUBWASM_VERSION.deb \
+            -O subwasm.deb
+          sudo dpkg -i subwasm.deb
+          subwasm --version
+
+      - name: Extract metadata JSON for ${{ matrix.specs }}
+        env:
+          RUNTIME: ${{ matrix.specs }}
+        run: |
+          WASM=$(ls ${DATA_DIR}/${RUNTIME}*.wasm)
+          echo "WASM=$WASM"
+          subwasm show --json "$WASM" > "${DATA_DIR}/${RUNTIME}.json"
+
+      - name: Check specs for ${{ matrix.specs }}
+        id: build
+        env:
+          RUNTIME: ${{ matrix.specs }}
+          LOGLEVEL: info
+        run: |
+          python --version
+          .github/scripts/check-runtime.py "${DATA_DIR}/${RUNTIME}.json" "${RUNTIME_SPECS_DIR}/${RUNTIME}.json"