From 9deb831a2887d7bb0c004b022defdcca382ad37e Mon Sep 17 00:00:00 2001
From: Doron Eli Rachman <doron050@gmail.com>
Date: Sat, 25 Jul 2026 15:34:20 +0300
Subject: [PATCH] fix: ensure WASM sha in docs matches released binary

Upload the WASM as a versioned artifact in gen-release-pr.yml, then
download that same artifact in release.yml instead of fetching a
fresh build. This guarantees the SHA embedded in the docs during
the release-prep PR matches the SHA of the published WASM.
---
 .github/workflows/gen-release-pr.yml |  7 +++++++
 .github/workflows/release.yml        | 16 ++++++++--------
 2 files changed, 15 insertions(+), 8 deletions(-)

diff --git a/.github/workflows/gen-release-pr.yml b/.github/workflows/gen-release-pr.yml
index 63d68721..56ff62c8 100644
--- a/.github/workflows/gen-release-pr.yml
+++ b/.github/workflows/gen-release-pr.yml
@@ -172,6 +172,13 @@ jobs:
           echo "Re-generated documentation"
           git status
 
+      - name: Upload wasm as release candidate
+        if: steps.version-update.outputs.new-version != ''
+        uses: actions/upload-artifact@v4
+        with:
+          name: wasm-${{ steps.version-update.outputs.new-version }}
+          path: plugin.wasm
+
       - name: Generate PR body
         if: steps.version-update.outputs.new-version != ''
         env:
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index 8aad5cdc..3e69a264 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -46,14 +46,6 @@ jobs:
           fetch-depth: 0
           ref: ${{ github.event.workflow_run.head_sha }}
 
-      - name: Download artifact
-        uses: dawidd6/action-download-artifact@v6
-        with:
-          github_token: ${{ secrets.GITHUB_TOKEN }}
-          workflow: build.yml
-          workflow_conclusion: success
-          name: wasm-file
-
       - name: Extract version from commit message
         id: extract-version
         run: |
@@ -61,6 +53,14 @@ jobs:
           echo "Extracted version: $VERSION"
           echo "version=$VERSION" >> $GITHUB_OUTPUT
 
+      - name: Download wasm
+        uses: dawidd6/action-download-artifact@v6
+        with:
+          github_token: ${{ secrets.GITHUB_TOKEN }}
+          workflow: gen-release-pr.yml
+          workflow_conclusion: success
+          name: wasm-${{ steps.extract-version.outputs.version }}
+
       - name: Calculate sha256
         run: |
           SHA256_HASH=$(sha256sum plugin.wasm | awk '{ print $1 }')