ci: add prebuild workflow

For #186.

Author: crepererum

.github/workflows/prebuild.yml

@@ -0,0 +1,86 @@
+---
+name: Prebuild
+description: Pre-Build WASM Binaries
+
+# yamllint disable-line rule:truthy
+on:
+  workflow_dispatch:
+
+permissions:
+  attestations: write
+  contents: write
+  id-token: write
+
+env:
+  # Disable incremental compilation to avoid overhead.
+  CARGO_INCREMENTAL: "0"
+
+jobs:
+  release:
+    runs-on: ubuntu-latest
+    steps:
+      # do NOT load any caches here, we want a clean, freestanding build w/o stateful dependencies!
+
+      - name: Set Timestamp
+        id: timestamp
+        run: echo "::set-output name=timestamp::$(date +%s)"
+
+      - name: Checkout
+        uses: actions/checkout@1af3b93b6815bc44a9784bd300feb67ff0d1eeb3  # v6.0.0
+        with:
+          fetch-depth: 1
+
+      - name: Free disk space
+        uses: ./.github/actions/free-disk-space
+
+      - name: Fetch main branch
+        run: git fetch --depth=1 origin main
+
+      - name: Install `just`
+        uses: taiki-e/install-action@763e3324d4fd026c9bd284c504378585777a87d5  # v2
+        with:
+          tool: just
+
+      - name: Install stable toolchain
+        uses: dtolnay/rust-toolchain@e97e2d8cc328f1b50210efc529dca0028893a2d9  # master
+        with:
+          components: clippy, rustfmt
+          toolchain: stable
+          targets: wasm32-wasip2
+
+      - name: build "add one" example (debug)
+        run: just guests::rust::build-add-one-debug
+
+      - name: build "add one" example (release)
+        run: just guests::rust::build-add-one-release
+
+      - name: build python guest (debug)
+        run: just guests::python::build-debug
+
+      - name: build python guest (release)
+        run: just guests::python::build-release
+
+      - name: attestation
+        uses: actions/attest-build-provenance@977bb373ede98d70efdf65b84cb5f73e068dcc2a  #v3
+        with:
+          subject-path: |
+            target/wasm32-wasip2/debug/examples/add_one.wasm
+            target/wasm32-wasip2/release/examples/add_one.wasm
+            target/wasm32-wasip2/debug/datafusion_udf_wasm_python.wasm
+            target/wasm32-wasip2/release/datafusion_udf_wasm_python.wasm
+
+      - name: publish release
+        uses: softprops/action-gh-release@5be0e66d93ac7ed76da52eca8bb058f665c3a5fe  # v2
+        with:
+          body: |
+            WASM binaries for [`${{ github.sha }}`](${{ github.server_url }}/${{ github.repository }}/tree/${{ github.sha }}).
+          preserve_order: true
+          files: |
+            target/wasm32-wasip2/debug/examples/add_one.wasm
+            target/wasm32-wasip2/release/examples/add_one.wasm
+            target/wasm32-wasip2/debug/datafusion_udf_wasm_python.wasm
+            target/wasm32-wasip2/release/datafusion_udf_wasm_python.wasm
+          name: "WASM Binaries `${{ steps.date.outputs.date }}` @ `${{ github.sha }}`"
+          tag_name: "wasm-binaries/${{ steps.date.outputs.date }}/${{ github.sha }}"
+          fail_on_unmatched_files: true
+          target_commitish: "${{ github.sha }}"