[pull] main from bytecodealliance:main

.github/actions/android-ndk/action.yml

@@ -0,0 +1,32 @@
+# This is a small action which uses the pre-installed Android NDK on GitHub
+# Actions builders, configured with `$ANDROID_NDK`, to compile and link Android
+# code. For Rust we mostly need to configure the linker to Cargo and the C
+# compiler to the `cc` crate, so this sets various environment variables to the
+# appropriate tool within `$ANDROID_NDK`.
+
+name: 'Setup Rust to use the Android NDK'
+description: 'Setup Rust to use the android NDK'
+
+inputs:
+  target:
+    description: 'Rust target being used'
+    required: true
+  android-platform:
+    description: 'Platform version to use for the C compiler'
+    required: false
+    default: '26'
+
+runs:
+  using: composite
+  steps:
+    - run: |
+        target=${{ inputs.target }}
+        cc_target=$(echo ${{ inputs.target }} | tr - _)
+        upcase=$(echo $target | tr a-z- A-Z_)
+        ndk_bin=$ANDROID_NDK/toolchains/llvm/prebuilt/linux-x86_64/bin
+        linker=$ndk_bin/${target}${{ inputs.android-platform }}-clang
+        echo CARGO_TARGET_${upcase}_LINKER=$linker >> $GITHUB_ENV
+        echo CC_${cc_target}=$linker >> $GITHUB_ENV
+        echo RANLIB_${cc_target}=$ndk_bin/llvm-ranlib >> $GITHUB_ENV
+        echo AR_${cc_target}=$ndk_bin/llvm-ar >> $GITHUB_ENV
+      shell: bash

.github/actions/binary-compatible-builds/action.yml

@@ -2,7 +2,7 @@ name: 'Set up a CentOS 6 container to build releases in'
 description: 'Set up a CentOS 6 container to build releases in'
 
 runs:
-  using: node16
+  using: node20
   main: 'main.js'
 inputs:
   name:

.github/actions/binary-compatible-builds/main.js

@@ -21,20 +21,45 @@ if (process.platform == 'win32') {
   return;
 }
 
+// Android doesn't use a container as it's controlled by the installation of the
+// SDK/NDK.
+if (process.env.INPUT_NAME && process.env.INPUT_NAME.indexOf("android") >= 0) {
+  return;
+}
+
 // ... and on Linux we do fancy things with containers. We'll spawn an old
 // CentOS container in the background with a super old glibc, and then we'll run
 // commands in there with the `$CENTOS` env var.
 
 if (process.env.CENTOS !== undefined) {
-  const args = ['exec', '-w', process.cwd(), '-i', 'build-container'];
+  const args = ['exec', '--workdir', process.cwd(), '--interactive'];
+  // Forward any rust-looking env vars from the environment into the container
+  // itself.
+  for (let key in process.env) {
+    if (key.startsWith('CARGO') || key.startsWith('RUST')) {
+      args.push('--env');
+      args.push(key);
+    }
+  }
+  args.push('build-container')
+
+  // Start the container by appending to `$PATH` with the `/rust/bin` path that
+  // is mounted below.
+  args.push('bash');
+  args.push('-c');
+  args.push('export PATH=$PATH:/rust/bin; export RUSTFLAGS="$RUSTFLAGS $EXTRA_RUSTFLAGS"; exec "$@"');
+  args.push('bash');
+
+  // Add in whatever we're running which will get executed in the sub-shell with
+  // an augmented PATH.
   for (const arg of process.argv.slice(2)) {
     args.push(arg);
   }
   child_process.execFileSync('docker', args, stdio);
   return;
 }
 
-const name = process.env.INPUT_NAME;
+const name = process.env.INPUT_NAME.replace(/-min$/, '');
 
 child_process.execFileSync('docker', [
   'build',

.github/actions/build-adapter-provider/action.yml

@@ -0,0 +1,25 @@
+name: 'Build wasi component adapter provider'
+description: 'Build the wasi-preview1-component-adapter provider using the adapter artefacts'
+
+inputs:
+  run-id:
+    description: 'run id of the main.yml action that produced the adapter artefacts'
+    required: true
+
+runs:
+  using: composite
+  steps:
+    - uses: actions/download-artifact@v4
+      with:
+        name: bins-wasi-preview1-component-adapter
+        path: crates/wasi-preview1-component-adapter/provider/artefacts
+        github-token: ${{ github.token }}
+        run-id: ${{ inputs.run-id }}
+
+    - name: Install required Rust components
+      shell: bash
+      run: rustup component add rustfmt clippy
+
+    - name: Build and checl the adapter provider
+      shell: bash
+      run: ./ci/build-wasi-preview1-component-adapter-provider.sh

.github/actions/fetch-run-id/action.yml

@@ -0,0 +1,18 @@
+name: 'Fetch run id for commit'
+description: 'Fetch the main.yml run id for the current commit'
+
+runs:
+  using: composite
+  steps:
+    - name: Fetch run id
+      shell: bash
+      run: |
+        run_id=$(
+          gh api -H 'Accept: application/vnd.github+json' \
+              /repos/${{ github.repository }}/actions/workflows/main.yml/runs\?exclude_pull_requests=true \
+              | jq '.workflow_runs' \
+              | jq "map(select(.head_commit.id == \"${{ github.sha }}\"))[0].id" \
+        )
+        echo COMMIT_RUN_ID=${run_id} >> "$GITHUB_ENV"
+      env:
+        GH_TOKEN: ${{ github.token }}

.github/actions/github-release/action.yml

@@ -8,5 +8,5 @@ inputs:
     description: ''
     required: true
 runs:
-  using: 'node16'
+  using: 'node20'
   main: 'main.js'

.github/actions/github-release/main.js

@@ -91,13 +91,25 @@ async function runOnce() {
   } catch (e) {
     console.log("ERROR: ", JSON.stringify(e, null, 2));
     core.info(`creating a release`);
+
+    const releaseNotes = fs.readFileSync('RELEASES.md').toString();
+    let notes = null;
+    const opts = {
+      owner,
+      repo,
+      tag_name: name,
+      prerelease: name === 'dev',
+    };
+    if (name !== 'dev') {
+      for (let x of releaseNotes.split(/^---+$/m)) {
+        if (x.indexOf(name.substring(1)) == -1)
+          continue;
+        opts.body = x;
+        break;
+      }
+    }
     try {
-      release = await octokit.rest.repos.createRelease({
-        owner,
-        repo,
-        tag_name: name,
-        prerelease: name === 'dev',
-      });
+      release = await octokit.rest.repos.createRelease(opts);
     } catch(e) {
       console.log("ERROR: ", JSON.stringify(e, null, 2));
       core.info(`fetching one more time`);

.github/actions/install-cargo-vet/action.yml

@@ -5,16 +5,16 @@ inputs:
   version:
     description: 'Version to install'
     required: false
-    default: '0.8.0'
+    default: '0.9.0'
 
 runs:
   using: composite
   steps:
-    - uses: actions/cache@v3
+    - uses: actions/cache@v4
       with:
         path: ${{ runner.tool_cache }}/cargo-vet
         key: cargo-vet-bin-${{ inputs.version }}
     - run: echo "${{ runner.tool_cache }}/cargo-vet/bin" >> $GITHUB_PATH
       shell: bash
-    - run: cargo install --root ${{ runner.tool_cache }}/cargo-vet --version ${{ inputs.version }} cargo-vet
+    - run: cargo install --root ${{ runner.tool_cache }}/cargo-vet --version ${{ inputs.version }} cargo-vet --locked
       shell: bash

.github/actions/install-rust/action.yml

@@ -1,15 +1,15 @@
 name: 'Install Rust toolchain'
-description: 'Install a rust toolchain and cache the crates index'
+description: 'Install a rust toolchain'
 
 inputs:
   toolchain:
     description: 'Default toolchan to install'
     required: false
     default: 'default'
-  lockfiles:
-    description: 'Path glob for Cargo.lock files to use as cache keys'
+  msrv_range:
+    description: 'Versions later-than-latest-Rust the MSRV supports'
     required: false
-    default: '**/Cargo.lock'
+    default: '2'
 
 runs:
   using: composite
@@ -21,11 +21,14 @@ runs:
         # Determine MSRV as N in `1.N.0` by looking at the `rust-version`
         # located in the root `Cargo.toml`.
         msrv=$(grep 'rust-version.*1' Cargo.toml | sed 's/.*\.\([0-9]*\)\..*/\1/')
+        range=${{ inputs.msrv_range }}
 
         if [ "${{ inputs.toolchain }}" = "default" ]; then
-          echo "version=1.$((msrv+2)).0" >> "$GITHUB_OUTPUT"
+          echo "version=1.$((msrv+range)).0" >> "$GITHUB_OUTPUT"
         elif [ "${{ inputs.toolchain }}" = "msrv" ]; then
           echo "version=1.$msrv.0" >> "$GITHUB_OUTPUT"
+        elif [ "${{ inputs.toolchain }}" = "wasmtime-ci-pinned-nightly" ]; then
+          echo "version=nightly-2024-10-02" >> "$GITHUB_OUTPUT"
         else
           echo "version=${{ inputs.toolchain }}" >> "$GITHUB_OUTPUT"
         fi
@@ -55,53 +58,10 @@ runs:
         EOF
         fi
 
-        # Use a more efficient method for fetching the crates.io-index than
-        # the (currently) default git-based index.
-        cat >> "$GITHUB_ENV" <<EOF
-        CARGO_REGISTRIES_CRATES_IO_PROTOCOL=sparse
-        EOF
-
     - name: Require semicolons in WIT
       shell: bash
       run: echo WIT_REQUIRE_SEMICOLONS=1 >> "$GITHUB_ENV"
 
-    - name: Choose registry cache key
+    - name: Install the WASI target
       shell: bash
-      # Update the registry index cache at most once per day. actions/cache
-      # won't write changes back to the cache if the cache key already exists,
-      # so this means every job may have to re-download the index entries which
-      # are new since the last time the cache key changed. Changing the cache
-      # key relatively frequently keeps the amount of duplicated work down. But
-      # changing it too frequently means we might hit the 10GB quota too
-      # quickly, which would cause GitHub to evict other caches we still want.
-      run: echo CARGO_REGISTRY_CACHE_KEY=$(date +%Y%m%d) >> $GITHUB_ENV
-
-    - name: Cache Cargo registry index
-      uses: actions/cache@v3
-      with:
-        path: ~/.cargo/registry/index/
-        key: cargo-registry-${{ env.CARGO_REGISTRY_CACHE_KEY }}
-        # Any older registry-index cache is still valid. It's a git clone, so
-        # cargo only has to pull down the changes since the index was cached.
-        restore-keys: cargo-registry-
-
-    - name: Cache crate sources for dependencies
-      uses: actions/cache@v3
-      with:
-        path: |
-          ~/.cargo/registry/cache/
-          ~/.cargo/git/db/
-        key: cargo-crates-${{ inputs.lockfiles }}-${{ hashFiles(inputs.lockfiles) }}
-        # If Cargo.lock has changed, we probably will need to get the source
-        # code for some crates we don't already have. But any crates we have
-        # source cached for are still valid. The only problem is nothing
-        # removes old crate sources from the cache, so using `restore-keys`
-        # this way may use more of our GitHub cache quota than we'd like.
-        #
-        # Also, scope this cache by which Cargo.lock we're building from.
-        # Otherwise, whichever job writes the cache first will get its
-        # dependencies cached, and that cache will be used as the basis for the
-        # next job, even though odds are pretty good the cache is useless.
-        restore-keys: cargo-crates-${{ inputs.lockfiles }}-
-
-# TODO: on cache miss, after cargo has updated the registry index, run `git gc`
+      run: rustup target add wasm32-wasip1 wasm32-unknown-unknown

.github/labeler.yml

@@ -56,6 +56,9 @@
   - "cranelift/codegen/src/isa/*/lower/isle/**"
   - "cranelift/codegen/src/opts/*"
 
+"pulley":
+  - "pulley/**"
+
 "wasi":
   - "crates/wasi/**"
   - "crates/wasi-common/**"
@@ -76,8 +79,12 @@
   - "docs/**"
 
 "wasmtime:ref-types":
-  - "crates/wasmtime/src/ref.rs"
-  - "crates/runtime/src/externref.rs"
+  - "crates/cranelift/src/gc.rs"
+  - "crates/cranelift/src/gc/**"
+  - "crates/wasmtime/src/runtime/gc.rs"
+  - "crates/wasmtime/src/runtime/gc/**"
+  - "crates/wasmtime/src/runtime/vm/gc.rs"
+  - "crates/wasmtime/src/runtime/vm/gc/**"
 
 "winch":
   - "winch/**"

.github/subscribe-to-label.json

@@ -1,6 +1,5 @@
 {
   "cfallin": ["isle"],
-  "fitzgen": ["fuzzing", "isle", "wasmtime:ref-types"],
-  "peterhuene": ["wasmtime:api", "wasmtime:c-api"],
+  "fitzgen": ["fuzzing", "isle", "pulley", "wasmtime:ref-types"],
   "saulecabrera": ["winch"]
 }

.github/workflows/cargo-audit.yml

@@ -7,9 +7,12 @@ jobs:
     if: github.repository == 'bytecodealliance/wasmtime'
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v3
+      - uses: actions/checkout@v4
         with:
           submodules: true
-      - uses: actions-rs/audit-check@v1
+      - uses: rustsec/audit-check@v1.4.1
         with:
           token: ${{ secrets.GITHUB_TOKEN }}
+        # This seems to hit rate limits about 50% of the time, unclear why, but
+        # emailing us once every few days is not the most useful thing.
+        continue-on-error: true