Update GitHub release action

This update introduces this new behaviour for the release action:

  * Execute it on push requests against `main` branch and whenever
    there's a tag that starts with `v<something>`
  * Publish the WASM module to the GitHub Container registry as an OCI
    artifact
  * The action pushes a `pod-toleration:latest` OCI artifact to ghcr
    for regular pushes against the `main` branch
  * The action pushes a `pod-toleration:v<something>` OCI artifact to
    ghcr for tag pushes
  * Tag pushes trigger also the creation of a release

.github/workflows/release.yml

@@ -1,29 +1,66 @@
 on:
   push:
+    branches:
+    - main
     tags:
     - 'v*'
 
-name: release
+name: publish WASM module
 
 jobs:
   build:
     name: Create new release with WASM artifact
     runs-on: ubuntu-latest
     steps:
-      - name: Checkout code
+      -
+        name: Checkout code
         uses: actions/checkout@v2
-      - name: Prepare Rust environment
+      -
+        name: Prepare Rust environment
         uses: actions-rs/toolchain@v1
         with:
           profile: minimal
           toolchain: stable
           target: wasm32-wasi
-      - name: Build WASM module
+      -
+        name: Download wasm-to-oci
+        uses: i3h/download-release-asset@v1
+        with:
+          owner: engineerd
+          repo: wasm-to-oci
+          tag: v0.1.1
+          file: linux-amd64-wasm-to-oci
+      -
+        name: fix wasm-to-oci permissions
+        run: |
+          chmod 755 linux-amd64-wasm-to-oci
+      -
+        name: Build WASM module
         uses: actions-rs/cargo@v1
         with:
           command: build
           args: --target=wasm32-wasi --release
-      - name: Create Release
+      -
+        name: Login to GitHub Container Registry
+        uses: docker/login-action@v1
+        with:
+          registry: ghcr.io
+          username: ${{ github.repository_owner }}
+          password: ${{ secrets.CR_PAT }}
+      -
+        name: Publish WASM policy artifact to OCI registry with the 'latest' tag
+        if: ${{ startsWith(github.ref, 'refs/heads/') }}
+        run: |
+          ./linux-amd64-wasm-to-oci push target/wasm32-wasi/release/pod-toleration-policy.wasm ghcr.io/chimera-kube/policies/pod-toleration:latest
+      -
+        name: Publish WASM policy artifact to OCI registry with the version tag and 'latest'
+        if: ${{ startsWith(github.ref, 'refs/tags/') }}
+        run: |
+          export OCI_TAG=$(echo $GITHUB_REF | sed -e "s|refs/tags/||")
+          ./linux-amd64-wasm-to-oci push target/wasm32-wasi/release/pod-toleration-policy.wasm ghcr.io/chimera-kube/policies/pod-toleration:${OCI_TAG}
+      -
+        name: Create Release
+        if: ${{ startsWith(github.ref, 'refs/tags/') }}
         id: create_release
         uses: actions/create-release@v1
         env:
@@ -33,7 +70,9 @@ jobs:
           release_name: Release ${{ github.ref }}
           draft: false
           prerelease: false
-      - name: Upload Release Asset
+      -
+        name: Upload Release Asset
+        if: ${{ startsWith(github.ref, 'refs/tags/') }}
         id: upload-release-asset
         uses: actions/upload-release-asset@v1
         env: