fix: ensure WASM sha in docs matches released binary (#432)

Upload the WASM as a versioned artifact in gen-release-pr.yml, then
download that same artifact in release.yml instead of fetching a
fresh build. This guarantees the SHA embedded in the docs during
the release-prep PR matches the SHA of the published WASM.

Author: doron050

.github/workflows/gen-release-pr.yml

@@ -172,6 +172,13 @@ jobs:
           echo "Re-generated documentation"
           git status
 
+      - name: Upload wasm as release candidate
+        if: steps.version-update.outputs.new-version != ''
+        uses: actions/upload-artifact@v4
+        with:
+          name: wasm-${{ steps.version-update.outputs.new-version }}
+          path: plugin.wasm
+
       - name: Generate PR body
         if: steps.version-update.outputs.new-version != ''
         env:

.github/workflows/release.yml

@@ -46,21 +46,21 @@ jobs:
           fetch-depth: 0
           ref: ${{ github.event.workflow_run.head_sha }}
 
-      - name: Download artifact
-        uses: dawidd6/action-download-artifact@v6
-        with:
-          github_token: ${{ secrets.GITHUB_TOKEN }}
-          workflow: build.yml
-          workflow_conclusion: success
-          name: wasm-file
-
       - name: Extract version from commit message
         id: extract-version
         run: |
           VERSION=$(git log -1 --pretty=%B | grep -oP 'Release Prep \Kv[0-9]+\.[0-9]+\.[0-9]+')
           echo "Extracted version: $VERSION"
           echo "version=$VERSION" >> $GITHUB_OUTPUT
 
+      - name: Download wasm
+        uses: dawidd6/action-download-artifact@v6
+        with:
+          github_token: ${{ secrets.GITHUB_TOKEN }}
+          workflow: gen-release-pr.yml
+          workflow_conclusion: success
+          name: wasm-${{ steps.extract-version.outputs.version }}
+
       - name: Calculate sha256
         run: |
           SHA256_HASH=$(sha256sum plugin.wasm | awk '{ print $1 }')