Add source tarballs to our releases (#4294)

* Add source tarballs to our releases

This commit adds a small script to create a source tarball as part of
the release process. This goes further than requested by #3808 by
vendoring all Rust dependencies as well to be more in line with
"download the source once then build somewhere without a network".
Vendoring the Rust dependencies makes the tarball pretty beefy (67M
compressed, 500M uncompressed). Unfortunately most of this size comes
from vendored crates such as v8, pqcrypto-kyber, winapi, capstone-sys,
plotters, and web-sys. Only `winapi` in this list is actually needed for
`wasmtime`-the-binary and only on Windows as well but for now this is
the state of things related to `cargo vendor`. If this becomes an issue
we could specifically remove the bulky contents of crates in the
`vendor` directory such as `v8` since it's only used for fuzzing.

Closes #3808

* Review feedback

* Review comments

.github/workflows/main.yml

@@ -407,6 +407,10 @@ jobs:
     - uses: actions/checkout@v2
       with:
         submodules: true
+    # On one builder produce the source tarball since there's no need to produce
+    # it everywhere
+    - run: ./ci/build-src-tarball.sh
+      if: matrix.build == 'x86_64-linux'
     - uses: ./.github/actions/install-rust
     - uses: ./.github/actions/binary-compatible-builds
       with:

ci/build-src-tarball.sh

@@ -0,0 +1,20 @@
+#!/bin/bash
+
+set -ex
+
+# Determine the name of the tarball
+tag=dev
+if [[ $GITHUB_REF == refs/tags/v* ]]; then
+  tag=${GITHUB_REF#refs/tags/}
+fi
+pkgname=wasmtime-$tag-src
+
+# Vendor all crates.io dependencies since this is supposed to be an
+# offline-only-compatible tarball
+mkdir .cargo
+cargo vendor > .cargo/config.toml
+
+# Create the tarball from the destination
+tar -czf /tmp/$pkgname.tar.gz --transform "s/^\./$pkgname/S" --exclude=.git .
+mkdir -p dist
+mv /tmp/$pkgname.tar.gz dist/