wasmtime/.github/workflows/main.yml

name: CI
on:
  push:
    branches: [master]
    tags-ignore: [dev]
  pull_request:
    branches: [master]

jobs:
  # Check Code style quickly by running `rustfmt` over all code
  rustfmt:
    name: Rustfmt
    runs-on: ubuntu-latest
    steps:
    - uses: actions/checkout@v1
      with:
        submodules: true
    - uses: ./.github/actions/install-rust
    - run: rustup component add rustfmt
    - run: cargo fmt --all -- --check

  # Build `mdBook` documentation for `wasmtime`, and upload it as a temporary
  # build artifact
  doc_book:
    name: Doc - build the book
    runs-on: ubuntu-latest
    steps:
    - uses: actions/checkout@v1
      with:
        submodules: true
    - run: |
        set -e
        curl -L https://github.com/rust-lang-nursery/mdBook/releases/download/v0.3.1/mdbook-v0.3.1-x86_64-unknown-linux-gnu.tar.gz | tar xzf -
        echo ::add-path::`pwd`
    - run: (cd docs && mdbook build)
    - run: cargo build -p wasmtime
    - run: (cd docs && mdbook test -L ../target/debug/deps)
    - uses: actions/upload-artifact@v1
      with:
        name: doc-book
        path: docs/book

  # Build rustdoc API documentation for `wasmtime*` crates. Note that we don't
  # want to document all our transitive dependencies, hence `--no-deps`. This is
  # a temporary build artifact we upload to consume later.
  doc_api:
    name: Doc - build the API documentation
    runs-on: ubuntu-latest
    steps:
    - uses: actions/checkout@v1
      with:
        submodules: true
    - uses: ./.github/actions/install-rust
      with:
        toolchain: nightly
    - run: cargo doc --no-deps --all --exclude wasmtime-cli --exclude test-programs --exclude cranelift-codegen-meta
    - run: cargo doc --package cranelift-codegen-meta --document-private-items
    - uses: actions/upload-artifact@v1
      with:
        name: doc-api
        path: target/doc

  # Quick checks of various feature combinations and whether things
  # compile. The goal here isn't to run tests, mostly just serve as a
  # double-check that Rust code compiles and is likely to work everywhere else.
  checks:
    name: Check
    runs-on: ubuntu-latest
    steps:
    - uses: actions/checkout@v1
      with:
        submodules: true
    - uses: ./.github/actions/install-rust
      with:
        toolchain: nightly

    # Check some feature combinations of the `wasmtime` crate
    - run: cargo check --manifest-path crates/api/Cargo.toml --no-default-features
    - run: cargo check --manifest-path crates/api/Cargo.toml --features wat
    - run: cargo check --manifest-path crates/api/Cargo.toml --features lightbeam
    - run: cargo check --manifest-path crates/api/Cargo.toml --features jitdump

    # Check some feature combinations of the `wasmtime-c-api` crate
    - run: cargo check --manifest-path crates/c-api/Cargo.toml --no-default-features
    - run: cargo check --manifest-path crates/c-api/Cargo.toml --features wat
    - run: cargo check --manifest-path crates/c-api/Cargo.toml --features wasi

    # Check a few builds of the cranelift backend
    # - only x86 backend support,
    # - only arm64 backend support,
    # - no debug_assertions.
    - run: cargo check --manifest-path=./cranelift/Cargo.toml --bin clif-util --no-default-features --features=cranelift-codegen/arm64
    - run: cargo check --manifest-path=./cranelift/Cargo.toml --bin clif-util --no-default-features --features=cranelift-codegen/x86
    - run: cargo check --manifest-path=./cranelift/Cargo.toml --bin clif-util
      env:
        CARGO_PROFILE_DEV_DEBUG_ASSERTIONS: false

    # Check whether `crates/wasi-common` cross-compiles to the following targets:
    # * wasm32-unknown-emscripten
    # * armv7-unknown-linux-gnueabihf
    - run: |
        rustup target add wasm32-unknown-emscripten
        rustup target add armv7-unknown-linux-gnueabihf
    - run: cargo check --target wasm32-unknown-emscripten -p wasi-common
    - run: cargo check --target armv7-unknown-linux-gnueabihf -p wasi-common


  # Download our libFuzzer corpus and make sure that we can still handle all the
  # inputs.
  fuzz_corpora:
    name: Fuzz Corpora
    runs-on: ubuntu-latest
    steps:
    - uses: actions/checkout@v1
      with:
        submodules: true
    - uses: actions/checkout@v1
      with:
        repository: bytecodealliance/wasmtime-libfuzzer-corpus
        path: ./wasmtime/fuzz/corpus
        ref: refs/heads/master
    - uses: ./.github/actions/install-rust
      with:
        toolchain: nightly
    - run: cargo install cargo-fuzz --vers "^0.7"
    - run: cargo fetch
      working-directory: ./fuzz
    - run: cargo fuzz build --release --debug-assertions --features binaryen
    # Our corpora are too large to run in full on every pull request, they just
    # take too long. Instead, we sample some of them and make sure that running
    # our fuzzers over the sampled inputs still works OK.
    - run: |
        find fuzz/corpus/compile -type f \
            | shuf \
            | head -n 3000 \
            | xargs cargo fuzz run compile --release --debug-assertions --features binaryen
      env:
        RUST_BACKTRACE: 1
    - run: |
        find fuzz/corpus/instantiate -type f \
            | shuf \
            | head -n 2000 \
            | xargs cargo fuzz run instantiate --release --debug-assertions --features binaryen
      env:
        RUST_BACKTRACE: 1
    - run: |
        find fuzz/corpus/instantiate_translated -type f \
            | shuf \
            | head -n 1000 \
            | xargs cargo fuzz run instantiate_translated --release --debug-assertions --features binaryen
      env:
        RUST_BACKTRACE: 1
    - run: |
        find fuzz/corpus/api_calls -type f \
            | shuf \
            | head -n 100 \
            | xargs cargo fuzz run api_calls --release --debug-assertions --features binaryen
      env:
        RUST_BACKTRACE: 1
    - run: |
        find fuzz/corpus/differential -type f \
            | shuf \
            | head -n 100 \
            | xargs cargo fuzz run differential --release --debug-assertions --features binaryen
      env:
        RUST_BACKTRACE: 1

  # Perform all tests (debug mode) for `wasmtime`. This runs stable/beta/nightly
  # channels of Rust as well as macOS/Linux/Windows.
  test:
    name: Test
    runs-on: ${{ matrix.os }}
    strategy:
      matrix:
        build: [stable, beta, nightly, windows, macos]
        include:
          - build: stable
            os: ubuntu-latest
            rust: stable
          - build: beta
            os: ubuntu-latest
            rust: beta
          - build: nightly
            os: ubuntu-latest
            rust: nightly
          - build: macos
            os: macos-latest
            rust: stable
          - build: windows
            os: windows-latest
            rust: stable
    steps:
    - uses: actions/checkout@v1
      with:
        submodules: true
    - uses: ./.github/actions/install-rust
      with:
        toolchain: ${{ matrix.rust }}
    - uses: ./.github/actions/define-llvm-env

    - name: Install libclang
      # Note: libclang is pre-installed on the macOS and linux images.
      if: matrix.os == 'windows-latest'
      run: |
        Invoke-WebRequest https://releases.llvm.org/9.0.0/LLVM-9.0.0-win64.exe -OutFile llvm-installer.exe
        7z x llvm-installer.exe -oC:\llvm-binary
        Write-Host ::set-env name=LIBCLANG_PATH::C:\llvm-binary\bin\libclang.dll
        Write-Host ::add-path::C:\llvm-binary\bin

    - name: Query Clang Version
      if: matrix.os == 'windows-latest'
      run: |
        Get-Command clang.exe
        clang.exe --version

    # Install wasm32 targets in order to build various tests throughout the
    # repo
    - run: rustup target add wasm32-wasi
    - run: rustup target add wasm32-unknown-unknown

    - run: cargo fetch --locked
    - run: cargo fetch --locked --manifest-path crates/test-programs/wasi-tests/Cargo.toml

    # Ensure all our examples build and execute
    - run: cargo run -p run-examples

    # Build and test all features except for lightbeam
    - run: cargo test --features test-programs/test_programs --all --exclude lightbeam -- --nocapture
      env:
        RUST_BACKTRACE: 1

    # Test debug (DWARF) related functionality.
    - run: cargo test test_debug_dwarf_ -- --ignored --nocapture --test-threads 1
      if: matrix.os == 'ubuntu-latest'
      env:
        RUST_BACKTRACE: 1

    # Build and test lightbeam if we're using the nightly toolchain. Note that
    # Lightbeam tests fail right now, but we don't want to block on that.
    - run: cargo build --package lightbeam
      if: matrix.rust == 'nightly'
    - run: cargo test --package lightbeam -- --nocapture
      if: matrix.rust == 'nightly'
      continue-on-error: true
      env:
        RUST_BACKTRACE: 1

  # Verify that cranelift's code generation is deterministic
  meta_determinist_check:
    name: Meta deterministic check
    runs-on: ubuntu-latest
    steps:
    - uses: actions/checkout@v1
      with:
        submodules: true
    - name: Install Rust
      run: rustup update stable && rustup default stable
    - run: cd cranelift/codegen && cargo build --features all-arch
    - run: ci/ensure_deterministic_build.sh

  # Perform release builds of `wasmtime` and `libwasmtime.so`. Builds on
  # Windows/Mac/Linux, and artifacts are uploaded after the build is finished.
  # Note that we also run tests here to test exactly what we're deploying.
  build:
    name: Build wasmtime
    runs-on: ${{ matrix.os }}
    strategy:
      matrix:
        os: [ubuntu-latest, macos-latest, windows-latest]
    steps:
    - uses: actions/checkout@v1
      with:
        submodules: true
    - uses: ./.github/actions/install-rust
    - uses: ./.github/actions/binary-compatible-builds

    # Install wasm32-wasi target in order to build wasi-common's integration
    # tests
    - run: rustup target add wasm32-wasi

    # Build `wasmtime` and executables
    - run: $CENTOS cargo build --release --bin wasmtime
      shell: bash
    # Build `libwasmtime.so`
    - run: $CENTOS cargo build --release --manifest-path crates/c-api/Cargo.toml
      shell: bash
    # Test what we just built
    - run: $CENTOS cargo test --features test-programs/test_programs --release --all --exclude lightbeam --exclude wasmtime --exclude wasmtime-c-api --exclude wasmtime-fuzzing
      shell: bash
      env:
        RUST_BACKTRACE: 1

    # Postprocess the macOS dylib a bit to have a more reasonable `LC_ID_DYLIB`
    # directive than the default one that comes out of the linker when typically
    # doing `cargo build`. For more info see #984
    - run: install_name_tool -id "@rpath/libwasmtime.dylib" target/release/libwasmtime.dylib
      if: matrix.os == 'macos-latest'

    # ... and now perform some goop to move all the relevant artifacts into
    # something that we'll upload from this action.

    - run: mkdir dist
      shell: bash

    # Move binaries to dist folder
    - run: cp target/release/wasmtime dist
      if: matrix.os != 'windows-latest'
    - run: cp target/release/wasmtime.exe dist
      shell: bash
      if: matrix.os == 'windows-latest'

    # Move libwasmtime dylib to dist folder
    - run: cp target/release/libwasmtime.{so,a} dist
      if: matrix.os == 'ubuntu-latest'
    - run: cp target/release/libwasmtime.{dylib,a} dist
      if: matrix.os == 'macos-latest'
    - run: cp target/release/wasmtime.{dll,lib,dll.lib} dist
      shell: bash
      if: matrix.os == 'windows-latest'

    # Make a Windows MSI installer if we're on Windows
    - run: |
        export WT_VERSION=`cat Cargo.toml | sed -n 's/^version = "\([^"]*\)".*/\1/p'`
        "$WIX/bin/candle" -arch x64 -out target/wasmtime.wixobj ci/wasmtime.wxs
        "$WIX/bin/light" -out dist/installer.msi target/wasmtime.wixobj -ext WixUtilExtension
        rm dist/installer.wixpdb
      shell: bash
      if: matrix.os == 'windows-latest'

    - uses: actions/upload-artifact@v1
      with:
        name: bins-${{ matrix.os }}
        path: dist

  # Consumes all published artifacts from all the previous build steps, creates
  # a bunch of tarballs for all of them, and then publishes the tarballs
  # themselves as an artifact (for inspection) and then optionally creates
  # github releases and/or tags for pushes.
  publish:
    name: Publish
    needs: [doc_book, doc_api, build]
    runs-on: ubuntu-latest
    steps:
    - uses: actions/checkout@v1
      with:
        submodules: true
    - run: rustup update stable && rustup default stable

    # Download all the artifacts that we'll be publishing. Should keep an eye on
    # the `download-artifact` repository to see if we can ever get something
    # like "download all artifacts" or "download this list of artifacts"
    - name: Download book
      uses: actions/download-artifact@v1
      with:
        name: doc-book
    - name: Download API docs
      uses: actions/download-artifact@v1
      with:
        name: doc-api
    - name: Download macOS binaries
      uses: actions/download-artifact@v1
      with:
        name: bins-macos-latest
    - name: Download Linux binaries
      uses: actions/download-artifact@v1
      with:
        name: bins-ubuntu-latest
    - name: Download Windows binaries
      uses: actions/download-artifact@v1
      with:
        name: bins-windows-latest

    - name: Assemble gh-pages
      run: |
        mv doc-book gh-pages
        mv doc-api gh-pages/api

    # If this is a push to the master branch push to the `gh-pages` using a
    # deploy key. Note that a deploy key is necessary for now because otherwise
    # using the default token for github actions doesn't actually trigger a page
    # rebuild.
    - name: Push to gh-pages
      run: curl -LsSf https://git.io/fhJ8n | rustc - && (cd gh-pages && ../rust_out)
      env:
        GITHUB_DEPLOY_KEY: ${{ secrets.DEPLOY_KEY }}
        BUILD_REPOSITORY_ID: ${{ github.repository }}
        BUILD_SOURCEVERSION: ${{ github.sha }}
      if: github.event_name == 'push' && github.ref == 'refs/heads/master'

    - name: Calculate tag name
      run: |
        name=dev
        if [[ $GITHUB_REF == refs/tags/v* ]]; then
          name=${GITHUB_REF:10}
        fi
        echo ::set-output name=val::$name
        echo ::set-env name=TAG::$name
      id: tagname

    # Assemble all the build artifacts into tarballs and zip archives.
    - name: Assemble tarballs
      run: |
        ./ci/build-tarballs.sh x86_64-linux ubuntu-latest
        ./ci/build-tarballs.sh x86_64-windows windows-latest .exe
        ./ci/build-tarballs.sh x86_64-macos macos-latest

    # Upload all assembled tarballs as an artifact of the github action run, so
    # that way even PRs can inspect the output.
    - uses: actions/upload-artifact@v1
      with:
        name: tarballs
        path: dist

    # The action 'pypa/gh-action-pypi-publish' will try to upload all files in the
    # dist/ folder. This folder also contains non-package files, and therefore the
    # action fails.
    #
    # To prevent the action from failing all .whl files are copied into a new
    # directory.
    - run: |
        mkdir -p tmp/whl
        find dist/ -name '*.whl' -type f -exec cp '{}' tmp/whl -v \;

    # ... and if this was an actual push (tag or `master`) then we publish a
    # new release. This'll automatically publish a tag release or update `dev`
    # with this `sha`
    - name: Publish Release
      uses: ./.github/actions/github-release
      if: github.event_name == 'push' && (github.ref == 'refs/heads/master' || startsWith(github.ref, 'refs/tags/v'))
      with:
        files: "dist/*"
        name: ${{ steps.tagname.outputs.val }}
        token: ${{ secrets.GITHUB_TOKEN }}

  cargo-audit:
    env:
      CARGO_AUDIT_VERSION: 0.11.2
    runs-on: ubuntu-latest
    steps:
    - uses: actions/checkout@v1
    - uses: actions/cache@v1
      with:
        path: ${{ runner.tool_cache }}/cargo-audit
        key: cargo-audit-bin-${{ env.CARGO_AUDIT_VERSION }}
    - run: echo "::add-path::${{ runner.tool_cache }}/cargo-audit/bin"
    - run: |
        cargo install --root ${{ runner.tool_cache }}/cargo-audit --version ${{ env.CARGO_AUDIT_VERSION }} cargo-audit
        cargo audit