ci: distribute WASM binary to all language packages on release (#111)

## Summary
- Extends release workflow to copy WASM binary to all language package
directories (go, dotnet, js, python) instead of just go/
- Removes Rust toolchain from `build-java` job — uses the committed WASM
binary instead of building its own, eliminating divergence risk
- Extends WASM staleness check to verify language directory copies match
the root binary

Closes #83

## Test plan
- [ ] Verify release workflow YAML is valid and paths are correct
- [ ] Confirm `build-java` works with `-Dexec.skip=true` and pre-placed
WASM
- [ ] Check staleness workflow detects mismatched copies
- [ ] Local dev workflow unaffected (each language's Makefile still
works independently)

🤖 Generated with [Claude Code](https://claude.com/claude-code)

---------

Co-authored-by: Claude Opus 4.6 <noreply@anthropic.com>

Author: aepfli

.github/workflows/release.yml

@@ -78,21 +78,30 @@ jobs:
           echo "WASM file size: $SIZE bytes ($(echo "scale=2; $SIZE / 1024" | bc) KB)"
           sha256sum flagd_evaluator.wasm
 
-      - name: Copy WASM to go/ for release tag
+      - name: Copy WASM to language packages
         run: |
-          if [ -d go ]; then
-            cp flagd_evaluator.wasm go/flagd_evaluator.wasm
-            echo "Copied WASM to go/ for go:embed"
-          fi
+          for dest in \
+            go/flagd_evaluator.wasm \
+            dotnet/src/FlagdEvaluator/flagd_evaluator.wasm \
+            js/flagd_evaluator.wasm \
+            python/flagd_evaluator_wasm/flagd_evaluator.wasm; do
+            dir=$(dirname "$dest")
+            if [ -d "$dir" ]; then
+              cp flagd_evaluator.wasm "$dest"
+              echo "Copied to $dest"
+            fi
+          done
 
       - name: Commit WASM binary
         run: |
           git config user.name "github-actions[bot]"
           git config user.email "github-actions[bot]@users.noreply.github.com"
           git add flagd_evaluator.wasm
-          if [ -d go ]; then
-            git add -f go/flagd_evaluator.wasm
-          fi
+          git add -f \
+            go/flagd_evaluator.wasm \
+            dotnet/src/FlagdEvaluator/flagd_evaluator.wasm \
+            js/flagd_evaluator.wasm \
+            python/flagd_evaluator_wasm/flagd_evaluator.wasm 2>/dev/null || true
           if git diff --cached --quiet; then
             echo "WASM binary is already up to date"
           else
@@ -115,29 +124,16 @@ jobs:
           distribution: 'temurin'
           cache: 'maven'
 
-      - name: Install Rust
-        uses: dtolnay/rust-toolchain@stable
-        with:
-          targets: wasm32-unknown-unknown
-
-      - name: Cache cargo
-        uses: actions/cache@v4
-        with:
-          path: |
-            ~/.cargo/bin/
-            ~/.cargo/registry/index/
-            ~/.cargo/registry/cache/
-            ~/.cargo/git/db/
-            target/
-          key: ${{ runner.os }}-cargo-java-release-${{ hashFiles('**/Cargo.lock') }}
-          restore-keys: |
-            ${{ runner.os }}-cargo-java-release-
+      - name: Place WASM for Maven
+        run: |
+          mkdir -p target/wasm32-unknown-unknown/release
+          cp flagd_evaluator.wasm target/wasm32-unknown-unknown/release/
 
       - name: Make Maven wrapper executable
         run: chmod +x java/mvnw
 
-      - name: Build with Maven
-        run: cd java && ./mvnw clean package
+      - name: Build with Maven (skip WASM build)
+        run: cd java && ./mvnw clean package -Dexec.skip=true
 
       - name: Generate checksums
         run: |

.github/workflows/wasm-staleness.yml

@@ -61,3 +61,37 @@ jobs:
           else
             echo "WASM binary is up to date."
           fi
+
+      - name: Check language directory copies match root
+        run: |
+          if [ ! -f flagd_evaluator.wasm ]; then
+            echo "No root WASM binary to compare against, skipping."
+            exit 0
+          fi
+
+          ROOT_HASH=$(sha256sum flagd_evaluator.wasm | awk '{print $1}')
+          MISMATCH=0
+
+          for copy in \
+            go/flagd_evaluator.wasm \
+            dotnet/src/FlagdEvaluator/flagd_evaluator.wasm \
+            js/flagd_evaluator.wasm \
+            python/flagd_evaluator_wasm/flagd_evaluator.wasm; do
+            if [ -f "$copy" ]; then
+              COPY_HASH=$(sha256sum "$copy" | awk '{print $1}')
+              if [ "$ROOT_HASH" != "$COPY_HASH" ]; then
+                echo "::warning::$copy does not match root flagd_evaluator.wasm"
+                echo "  Root: $ROOT_HASH"
+                echo "  Copy: $COPY_HASH"
+                MISMATCH=1
+              else
+                echo "$copy matches root binary."
+              fi
+            fi
+          done
+
+          if [ "$MISMATCH" -eq 1 ]; then
+            echo ""
+            echo "::warning::Some language directory WASM copies are out of sync with the root binary."
+            echo "::warning::The release-please workflow will update all copies on the release PR."
+          fi