Merge main branch into dev/shared_heap

.dockerignore

@@ -1,16 +1,12 @@
 # for now, it is used to speed up wasi-nn tests only.
 # you shall adapt below rules to incoming requirements
 
-build
-*/build
-*/*/build
-*/*/*/build
-*/*/*/*/build
-*/*/*/*/*/build
-*/*/*/*/*/*/build
+**/build
+**/tmp.*
 .*
+**/*.gguf
 
-core/deps
-!core/deps/tensorflow-src
-samples
-tests
+/core/deps/
+!/core/deps/tensorflow-src
+/samples
+/tests

.github/actions/install-linux-sgx/action.yml

@@ -0,0 +1,47 @@
+# Copyright (C) 2019 Intel Corporation.  All rights reserved.
+# SPDX-License-Identifier: Apache-2.0 WITH LLVM-exception
+
+# Always follow https://download.01.org/intel-sgx/latest/linux-latest/docs/
+
+name: "Install Intel SGX SDK"
+description: "Installs the Intel SGX SDK and necessary libraries for Ubuntu."
+author: "Intel Corporation"
+inputs:
+  os:
+    description: "Operating system to install on (ubuntu-22.04)"
+    required: true
+
+runs:
+  using: "composite"
+  steps:
+    - name: Check Runner OS
+      if: ${{ inputs.os != 'ubuntu-22.04' }}
+      shell: bash
+      run: |
+        echo "::error title=⛔ error hint::Only support ubuntu-22.04 for now"
+        exit 1
+
+    - name: Create installation directory
+      shell: bash
+      run: sudo mkdir -p /opt/intel
+
+    - name: Download and install SGX SDK on ubuntu-22.04
+      if: ${{ inputs.os == 'ubuntu-22.04' }}
+      shell: bash
+      run: |
+        sudo wget -O sgx_linux_x64_sdk.bin https://download.01.org/intel-sgx/sgx-linux/2.25/distro/ubuntu22.04-server/sgx_linux_x64_sdk_2.25.100.3.bin
+        sudo chmod +x sgx_linux_x64_sdk.bin
+        echo 'yes' | sudo ./sgx_linux_x64_sdk.bin
+      working-directory: /opt/intel
+
+    - name: Add SGX repository and install libraries
+      shell: bash
+      run: |
+        echo "deb [arch=amd64] https://download.01.org/intel-sgx/sgx_repo/ubuntu $(lsb_release -cs) main" | sudo tee /etc/apt/sources.list.d/intel-sgx.list
+        wget -qO - https://download.01.org/intel-sgx/sgx_repo/ubuntu/intel-sgx-deb.key | sudo apt-key add -
+        sudo apt update
+        sudo apt install -y libsgx-launch libsgx-urts
+
+    - name: Source SGX SDK environment
+      shell: bash
+      run: source /opt/intel/sgxsdk/environment

.github/actions/install-wasi-sdk-wabt/action.yml

@@ -0,0 +1,80 @@
+# Copyright (C) 2019 Intel Corporation.  All rights reserved.
+# SPDX-License-Identifier: Apache-2.0 WITH LLVM-exception
+
+# Get URLs from:
+#   - https://github.com/WebAssembly/wasi-sdk/releases
+#   - https://github.com/WebAssembly/wabt/releases
+
+# Install WASI-SDK and WABT at /opt
+# /opt is the assumed location widely used in the project
+name: Install WASI-SDK and WABT
+
+description: A composite action to download and install wasi-sdk and wabt on Ubuntu, macOS.
+
+inputs:
+  os:
+    description: "Operating system to install on (ubuntu, macos)"
+    required: true
+
+runs:
+  using: "composite"
+  steps:
+    - name: Check Runner OS
+      if: ${{ !startsWith(inputs.os, 'ubuntu') && !startsWith(inputs.os, 'windows') && !startsWith(inputs.os, 'macos') }}
+      shell: bash
+      run: |
+        echo "::error title=⛔ error hint::Support Ubuntu, Windows, and macOS Only"
+        exit 1
+
+    - name: Set up wasi-sdk and wabt on Ubuntu
+      if: ${{ startsWith(inputs.os, 'ubuntu') }}
+      shell: bash
+      run: |
+        sudo wget -O wasi-sdk.tar.gz --progress=dot:giga https://github.com/WebAssembly/wasi-sdk/releases/download/wasi-sdk-25/wasi-sdk-25.0-x86_64-linux.tar.gz
+        sudo tar -xf wasi-sdk.tar.gz
+        sudo ln -sf  wasi-sdk-25.0-x86_64-linux/ wasi-sdk
+        sudo wget -O wabt.tar.gz     --progress=dot:giga https://github.com/WebAssembly/wabt/releases/download/1.0.37/wabt-1.0.37-ubuntu-20.04.tar.gz
+        sudo tar -xf wabt.tar.gz
+        sudo ln -sf  wabt-1.0.37 wabt
+        /opt/wasi-sdk/bin/clang --version
+        /opt/wabt/bin/wasm-interp --version
+        echo "::notice::wasi-sdk-25 and wabt-1.0.37 installed on ubuntu"
+      working-directory: /opt
+
+    - name: Set up wasi-sdk and wabt on macOS-13 (intel)
+      if: ${{ inputs.os == 'macos-13' }}
+      shell: bash
+      run: |
+        sudo wget -O wasi-sdk.tar.gz --progress=dot:giga https://github.com/WebAssembly/wasi-sdk/releases/download/wasi-sdk-25/wasi-sdk-25.0-x86_64-macos.tar.gz
+        sudo tar -xf wasi-sdk.tar.gz
+        sudo ln -sf  wasi-sdk-25.0-x86_64-macos wasi-sdk
+        sudo wget -O wabt.tar.gz     --progress=dot:giga https://github.com/WebAssembly/wabt/releases/download/1.0.36/wabt-1.0.36-macos-12.tar.gz
+        sudo tar -xf wabt.tar.gz
+        sudo ln -sf  wabt-1.0.36 wabt
+        /opt/wasi-sdk/bin/clang --version
+        /opt/wabt/bin/wasm-interp --version
+        echo "::notice::wasi-sdk-25 and wabt-1.0.36 installed on macos-13"
+      working-directory: /opt
+
+    - name: Set up wasi-sdk and wabt on macOS-14 (arm64)
+      if: ${{ inputs.os == 'macos-14' }}
+      shell: bash
+      run: |
+        sudo wget -O wasi-sdk.tar.gz --progress=dot:giga https://github.com/WebAssembly/wasi-sdk/releases/download/wasi-sdk-25/wasi-sdk-25.0-arm64-macos.tar.gz
+        sudo tar -xf wasi-sdk.tar.gz
+        sudo ln -sf  wasi-sdk-25.0-arm64-macos wasi-sdk
+        sudo wget -O wabt.tar.gz     --progress=dot:giga https://github.com/WebAssembly/wabt/releases/download/1.0.37/wabt-1.0.37-macos-14.tar.gz
+        sudo tar -xf wabt.tar.gz
+        sudo ln -sf  wabt-1.0.37 wabt
+        /opt/wasi-sdk/bin/clang --version
+        /opt/wabt/bin/wasm-interp --version
+        echo "::notice::wasi-sdk-25 and wabt-1.0.37 installed on macos-14"
+      working-directory: /opt
+
+    #TODO: Add support for Windows
+    - name: Set up wasi-sdk and wabt on Windows
+      if: ${{ startsWith(inputs.os, 'windows') }}
+      shell: powershell
+      run: |
+        echo "::notice::Support for Windows is not implemented yet"
+        exit 1

.github/workflows/build_iwasm_release.yml

@@ -137,7 +137,8 @@ jobs:
       - name: compress the binary on non-Windows
         if: inputs.runner != 'windows-latest'
         run: |
-          tar czf iwasm${{ matrix.suffix }}-${{ inputs.ver_num }}-${{ inputs.runner }}.tar.gz iwasm
+          # Follow the symlink to the actual binary file
+          tar --dereference -czf iwasm${{ matrix.suffix }}-${{ inputs.ver_num }}-${{ inputs.runner }}.tar.gz iwasm
           zip iwasm${{ matrix.suffix }}-${{ inputs.ver_num }}-${{ inputs.runner }}.zip iwasm
         working-directory: ${{ inputs.cwd }}/build
 

.github/workflows/build_llvm_libraries.yml

@@ -65,6 +65,7 @@ jobs:
         shell: bash
         run: |
           echo "last_commit=$(GH_TOKEN=${{ secrets.GITHUB_TOKEN }} /usr/bin/env python3 ./build_llvm.py ${{ inputs.extra_build_llvm_options }} --llvm-ver)" >> $GITHUB_OUTPUT
+        working-directory: build-scripts
 
       # Bump the prefix number to evict all previous caches and
       # enforce a clean build, in the unlikely case that some
@@ -88,14 +89,6 @@ jobs:
             ./core/deps/llvm/build/share
           key: ${{ steps.create_lib_cache_key.outputs.key}}
 
-      - uses: actions/cache@v4
-        with:
-          path: ~/.ccache
-          key: 0-ccache-${{ inputs.os }}-${{ steps.get_last_commit.outputs.last_commit }}
-          restore-keys: |
-            0-ccache-${{ inputs.os }}
-        if: steps.retrieve_llvm_libs.outputs.cache-hit != 'true' && inputs.os == 'ubuntu-20.04'
-
       - uses: actions/cache@v4
         with:
           path: ~/.cache/ccache

.github/workflows/build_wamr_lldb.yml

@@ -172,13 +172,20 @@ jobs:
           python3 ci/validate_lldb.py --port 1239 --lldb core/deps/wamr-lldb/bin/lldb --wamr wamr-debug/iwasm --verbose
         working-directory: .
 
+      # Define CMAKE_OSX_SYSROOT to avoid the error:
+      #   no such file or directory: 'llvm-project/build/tools/lldb/tools/debugserver/source/mach_excServer.c'
+      #   no such file or directory: 'llvm-project/build/tools/lldb/tools/debugserver/source/mach_excUser.c'
+      #
+      # This workaround should be removed when the issue is fixed in llvm-project:
+      #   - https://github.com/llvm/llvm-project/pull/138020/
       - name: build lldb macos
         if: steps.lldb_build_cache.outputs.cache-hit != 'true' && contains(inputs.runner, 'macos')
         run: |
           echo "start to build lldb..."
           mkdir -p wamr-lldb
           cmake -S ./llvm -B build \
             -G Ninja \
+            -DCMAKE_OSX_SYSROOT=$(xcrun --show-sdk-path) \
             -DCMAKE_INSTALL_PREFIX=../wamr-lldb \
             -DCMAKE_BUILD_TYPE:STRING="Release" \
             -DCMAKE_EXPORT_COMPILE_COMMANDS=ON \

.github/workflows/build_wamrc.yml

@@ -73,7 +73,8 @@ jobs:
       - name: compress the binary on non-Windows
         if: inputs.runner != 'windows-latest' && inputs.release
         run: |
-          tar czf wamrc-${{ inputs.ver_num }}-${{ inputs.runner }}.tar.gz wamrc
+          # Follow the symlink to the actual binary file
+          tar --dereference -czf wamrc-${{ inputs.ver_num }}-${{ inputs.runner }}.tar.gz wamrc
           zip wamrc-${{ inputs.ver_num }}-${{ inputs.runner }}.zip wamrc
         working-directory: wamr-compiler/build
 

.github/workflows/check_version_h.yml

@@ -0,0 +1,29 @@
+# Copyright (C) 2019 Intel Corporation.  All rights reserved.
+# SPDX-License-Identifier: Apache-2.0 WITH LLVM-exception
+name: confirm version.h stay in sync
+
+on:
+  workflow_call:
+
+permissions:
+  contents: read
+
+jobs:
+  confirm_version:
+    runs-on: ubuntu-latest
+
+    steps:
+      - name: checkout
+        uses: actions/checkout@v4
+
+      - name: cmake execute to generate version.h
+        run: cmake -B build_version -S .
+
+      - name: confirm version.h
+        run: |
+          if [ -z "$(git status --porcelain | grep version.h)" ]; then
+            echo "version.h is in sync"
+          else
+            echo "version.h is not in sync"
+            exit 1
+          fi

.github/workflows/codeql.yml

@@ -53,7 +53,7 @@
 
     # Initializes the CodeQL tools for scanning.
     - name: Initialize CodeQL
-      uses: github/codeql-action/init@v3.28.8
+      uses: github/codeql-action/init@v3.28.19
       with:
         languages: ${{ matrix.language }}
 
@@ -70,7 +70,7 @@
     - run: |
         ./.github/scripts/codeql_buildscript.sh
     - name: Perform CodeQL Analysis
-      uses: github/codeql-action/analyze@v3.28.8
+      uses: github/codeql-action/analyze@v3.28.19
       with:
         category: "/language:${{matrix.language}}"
         upload: false
@@ -99,14 +99,14 @@
         output: ${{ steps.step1.outputs.sarif-output }}/cpp.sarif
 
     - name: Upload CodeQL results to code scanning
-      uses: github/codeql-action/upload-sarif@v3.28.8
+      uses: github/codeql-action/upload-sarif@v3.28.19
       with:
         sarif_file: ${{ steps.step1.outputs.sarif-output }}
         category: "/language:${{matrix.language}}"
 
     - name: Upload CodeQL results as an artifact
       if: success() || failure()
-      uses: actions/upload-artifact@v4.6.0
+      uses: actions/upload-artifact@v4.6.2
       with:
         name: codeql-results
         path: ${{ steps.step1.outputs.sarif-output }}

.github/workflows/coding_guidelines.yml

@@ -19,7 +19,7 @@ permissions:
 
 jobs:
   compliance_job:
-    runs-on: ubuntu-20.04
+    runs-on: ubuntu-22.04
     steps:
       - name: checkout
         uses: actions/checkout@v4