[integration] static fast-interpreter/P2 component profile + multi-module hardening

.github/scripts/codeql_buildscript.sh

@@ -19,9 +19,20 @@ sudo wget --progress=dot:giga -O clang+llvm-x86_64-linux-gnu.tar.xz https://gith
 popd
 
 # libtinfo.so.5 for /opt/llvm-18.1.8/lib/libomptarget.rtl.amdgpu.so.18.1
+# Install the libtinfo5 compat package at the same ncurses version as the
+# runner's already-installed libtinfo6; fall back to the newest one in the
+# pool. A hard-coded URL 404s once the ncurses point release is bumped, which
+# then breaks the wamrc link against libomptarget (NCURSES_TINFO_5 symbols).
 sudo apt -qq update
-wget http://security.ubuntu.com/ubuntu/pool/universe/n/ncurses/libtinfo5_6.3-2ubuntu0.1_amd64.deb
-sudo apt install -y -qq ./libtinfo5_6.3-2ubuntu0.1_amd64.deb
+nc_pool="http://security.ubuntu.com/ubuntu/pool/universe/n/ncurses"
+nc_ver="$(dpkg-query -W -f='${Version}' libtinfo6)"
+libtinfo5_deb="libtinfo5_${nc_ver}_amd64.deb"
+if ! wget -q "${nc_pool}/${libtinfo5_deb}"; then
+  libtinfo5_deb="$(wget -qO- "${nc_pool}/" \
+    | grep -oE 'libtinfo5_[0-9][^"]*_amd64\.deb' | sort -Vu | tail -1)"
+  wget -q "${nc_pool}/${libtinfo5_deb}"
+fi
+sudo apt install -y -qq "./${libtinfo5_deb}"
 
 # Start the build process
 WAMR_DIR=${PWD}
@@ -58,6 +69,7 @@ build_iwasm() {
         -G Ninja \
         -DCMAKE_BUILD_TYPE=Debug \
         -DLLVM_DIR=${LLVM_DIR} \
+        -DWAMR_BUILD_COMPONENT_MODEL=0 \
         $options
     cmake --build build --target iwasm --parallel
     if [[ $? != 0 ]]; then
@@ -75,15 +87,20 @@ wamrc_options_list=(
 
 # List of compilation options for iwasm
 iwasm_options_list=(
-    #default
-    ""
+    # Default plus Preview 2. The remaining entries deliberately start from
+    # the core runtime so each feature permutation is independent; several
+    # legacy-libc, 32-bit, GC and thread combinations are not component-model
+    # configurations.
+    "-DWAMR_BUILD_COMPONENT_MODEL=1"
     # +classic interp
     "-DWAMR_BUILD_FAST_INTERP=0 -DWAMR_BUILD_SIMD=0"
     # fast jit
     "-DWAMR_BUILD_FAST_JIT=1 -DWAMR_BUILD_FAST_JIT_DUMP=1 -DWAMR_BUILD_SIMD=0"
     # +llvm jit
     "-DWAMR_BUILD_JIT=1"
     #
+    # The Preview 2 native-call bridge is 64-bit-only; this still covers the
+    # core X86_32 runtime.
     "-DWAMR_BUILD_TARGET=X86_32"
     #
     # libraries

.github/scripts/codeql_fail_on_error.py

@@ -61,9 +61,15 @@ def codeql_sarif_contain_error(filename, dismissed_alerts):
         s = json.load(f)
 
     for run in s.get("runs", []):
-        rules_metadata = run["tool"]["driver"]["rules"]
+        # Rule metadata isn't always in one place: CodeQL keeps it on the tool
+        # driver, but rules contributed by a query-pack extension live on that
+        # extension instead, and the driver's list is empty when nothing fired.
+        # So read the driver rules, then fall back to gathering them from the
+        # extensions rather than assuming a fixed location.
+        rules_metadata = run["tool"]["driver"].get("rules") or []
         if not rules_metadata:
-            rules_metadata = run["tool"]["extensions"][0]["rules"]
+            for ext in run["tool"].get("extensions", []):
+                rules_metadata += ext.get("rules", [])
 
         for res in run.get("results", []):
             if "ruleIndex" in res:

.github/workflows/apple_app_store_interpreter.yml

@@ -0,0 +1,198 @@
+# Copyright (C) 2026 Matt Hargett. All rights reserved.
+# SPDX-License-Identifier: Apache-2.0 WITH LLVM-exception
+
+name: Apple App Store interpreter
+
+on:
+  pull_request:
+    types:
+      - opened
+      - synchronize
+    paths:
+      - ".github/workflows/apple_app_store_interpreter.yml"
+      - "build-scripts/**"
+      - "core/**"
+      - "!core/deps/**"
+      - "product-mini/platforms/darwin/**"
+      - "tests/apple-app-store-interpreter/**"
+      - "tests/unit/component-execution/wasm-apps/add.wasm"
+  push:
+    branches:
+      - main
+      - "dev/**"
+    paths:
+      - ".github/workflows/apple_app_store_interpreter.yml"
+      - "build-scripts/**"
+      - "core/**"
+      - "!core/deps/**"
+      - "product-mini/platforms/darwin/**"
+      - "tests/apple-app-store-interpreter/**"
+      - "tests/unit/component-execution/wasm-apps/add.wasm"
+  workflow_dispatch:
+
+concurrency:
+  group: ${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: true
+
+permissions:
+  contents: read
+
+jobs:
+  build_static_interpreter:
+    name: ${{ matrix.platform }} static wasm32-wasip2 fast interpreter
+    runs-on: macos-15
+    strategy:
+      fail-fast: false
+      matrix:
+        include:
+          - platform: macOS
+            system_name: Darwin
+            sdk: macosx
+            architecture: arm64
+          - platform: iOS
+            system_name: iOS
+            sdk: iphoneos
+            architecture: arm64
+          - platform: tvOS
+            system_name: tvOS
+            sdk: appletvos
+            architecture: arm64
+          - platform: watchOS
+            system_name: watchOS
+            sdk: watchos
+            architecture: arm64_32
+          - platform: visionOS
+            system_name: visionOS
+            sdk: xros
+            architecture: arm64
+
+    steps:
+      - name: checkout
+        uses: actions/checkout@v7.0.0
+
+      - name: Install component parser build dependency
+        env:
+          HOMEBREW_NO_AUTO_UPDATE: "1"
+        run: brew list bison >/dev/null 2>&1 || brew install bison
+
+      - name: Build static interpreter archive
+        run: |
+          cmake \
+            -C tests/apple-app-store-interpreter/apple_wasip2_fast_interp.cmake \
+            -S product-mini/platforms/darwin \
+            -B "build/apple-${{ matrix.sdk }}" \
+            -DCMAKE_BUILD_TYPE=Release \
+            -DBISON_EXECUTABLE="$(brew --prefix bison)/bin/bison" \
+            -DCMAKE_SYSTEM_NAME="${{ matrix.system_name }}" \
+            -DCMAKE_OSX_SYSROOT="${{ matrix.sdk }}" \
+            -DCMAKE_OSX_ARCHITECTURES="${{ matrix.architecture }}" \
+            -DCMAKE_TRY_COMPILE_TARGET_TYPE=STATIC_LIBRARY \
+            -DWAMR_BUILD_TARGET=AARCH64
+          cmake --build "build/apple-${{ matrix.sdk }}" \
+            --target vmlib --config Release --parallel 4
+
+      - name: Verify archive shape
+        run: |
+          library="build/apple-${{ matrix.sdk }}/libiwasm.a"
+          tests/apple-app-store-interpreter/verify_archive.sh \
+            "build/apple-${{ matrix.sdk }}" \
+            "$library" \
+            "${{ matrix.architecture }}"
+
+      - name: Run hardened-runtime embedding smoke
+        if: matrix.platform == 'macOS'
+        run: |
+          common_flags=(
+            -std=c11 -O3 -DNDEBUG -Wall -Wextra -Werror
+            -flto=full -arch "${{ matrix.architecture }}"
+            -I core/iwasm/include
+          )
+          link_flags=(
+            "build/apple-${{ matrix.sdk }}/libiwasm.a"
+            -flto=full "-Wl,-dead_strip" -lpthread -lm
+          )
+          xcrun --sdk macosx clang "${common_flags[@]}" \
+            -I core/iwasm/include \
+            tests/apple-app-store-interpreter/smoke.c \
+            "${link_flags[@]}" \
+            -o "build/apple-${{ matrix.sdk }}/embed-smoke"
+          xcrun --sdk macosx clang "${common_flags[@]}" \
+            -DWASM_ENABLE_COMPONENT_MODEL=1 \
+            -DWASM_ENABLE_INTERP=1 \
+            -DWASM_ENABLE_FAST_INTERP=1 \
+            -DWASM_ENABLE_THREAD_MGR=1 \
+            -I core/iwasm/common \
+            -I core/iwasm/common/component-model \
+            -I core/iwasm/interpreter \
+            -I core/shared/mem-alloc \
+            -I core/shared/utils \
+            -I core/shared/platform/include \
+            -I core/shared/platform/darwin \
+            tests/apple-app-store-interpreter/component_smoke.c \
+            "${link_flags[@]}" \
+            -o "build/apple-${{ matrix.sdk }}/component-smoke"
+          xcrun --sdk macosx clang "${common_flags[@]}" \
+            -DWASM_ENABLE_COMPONENT_MODEL=1 \
+            -DWASM_ENABLE_INTERP=1 \
+            -DWASM_ENABLE_FAST_INTERP=1 \
+            -DWASM_ENABLE_THREAD_MGR=1 \
+            -I core/iwasm/common \
+            -I core/iwasm/common/component-model \
+            -I core/iwasm/interpreter \
+            -I core/shared/mem-alloc \
+            -I core/shared/utils \
+            -I core/shared/platform/include \
+            -I core/shared/platform/darwin \
+            tests/apple-app-store-interpreter/component_termination_smoke.c \
+            "${link_flags[@]}" \
+            -o "build/apple-${{ matrix.sdk }}/component-termination-smoke"
+          xcrun --sdk macosx clang "${common_flags[@]}" \
+            -DWASM_ENABLE_COMPONENT_MODEL=1 \
+            -DWASM_ENABLE_INTERP=1 \
+            -DWASM_ENABLE_FAST_INTERP=1 \
+            -DWASM_ENABLE_THREAD_MGR=1 \
+            -I core/iwasm/common \
+            -I core/iwasm/common/component-model \
+            -I core/iwasm/interpreter \
+            -I core/shared/mem-alloc \
+            -I core/shared/utils \
+            -I core/shared/platform/include \
+            -I core/shared/platform/darwin \
+            tests/apple-app-store-interpreter/component_host_import_smoke.c \
+            "${link_flags[@]}" \
+            -o "build/apple-${{ matrix.sdk }}/component-host-import-smoke"
+          xcrun --sdk macosx clang "${common_flags[@]}" \
+            -DWASM_ENABLE_COMPONENT_MODEL=1 \
+            -DWASM_ENABLE_INTERP=1 \
+            -DWASM_ENABLE_FAST_INTERP=1 \
+            -DWASM_ENABLE_THREAD_MGR=1 \
+            -I core/iwasm/common \
+            -I core/iwasm/common/component-model \
+            -I core/iwasm/interpreter \
+            -I core/shared/mem-alloc \
+            -I core/shared/utils \
+            -I core/shared/platform/include \
+            -I core/shared/platform/darwin \
+            tests/apple-app-store-interpreter/component_wasip2_command_smoke.c \
+            "${link_flags[@]}" \
+            -o "build/apple-${{ matrix.sdk }}/component-wasip2-command-smoke"
+          tests/apple-app-store-interpreter/verify_link.sh \
+            "build/apple-${{ matrix.sdk }}/component-smoke"
+          codesign --force --sign - --options runtime \
+            "build/apple-${{ matrix.sdk }}/embed-smoke"
+          codesign --force --sign - --options runtime \
+            "build/apple-${{ matrix.sdk }}/component-smoke"
+          codesign --force --sign - --options runtime \
+            "build/apple-${{ matrix.sdk }}/component-termination-smoke"
+          codesign --force --sign - --options runtime \
+            "build/apple-${{ matrix.sdk }}/component-host-import-smoke"
+          codesign --force --sign - --options runtime \
+            "build/apple-${{ matrix.sdk }}/component-wasip2-command-smoke"
+          "build/apple-${{ matrix.sdk }}/embed-smoke"
+          "build/apple-${{ matrix.sdk }}/component-smoke" \
+            tests/unit/component-execution/wasm-apps/add.wasm
+          "build/apple-${{ matrix.sdk }}/component-termination-smoke"
+          "build/apple-${{ matrix.sdk }}/component-host-import-smoke" \
+            tests/apple-app-store-interpreter/static_host_component.wasm
+          "build/apple-${{ matrix.sdk }}/component-wasip2-command-smoke" \
+            tests/apple-app-store-interpreter/wasip2_command.wasm

.github/workflows/build_docker_images.yml

@@ -26,7 +26,7 @@ jobs:
 
     steps:
       - name: Checkout repository
-        uses: actions/checkout@v6.0.2
+        uses: actions/checkout@v7.0.0
 
       - name: Build and save Docker image(wasm-debug-server:${{ inputs.ver_num }}) to tar file
         run: |

.github/workflows/build_iwasm_release.yml

@@ -104,11 +104,11 @@ jobs:
       contents: write # for uploading release artifacts
 
     steps:
-      - uses: actions/checkout@v6.0.2
+      - uses: actions/checkout@v7.0.0
 
       - name: get cached LLVM libraries
         id: retrieve_llvm_libs
-        uses: actions/cache@v5
+        uses: actions/cache@v6
         with:
           path: |
             ./core/deps/llvm/build/bin

.github/workflows/build_llvm_libraries.yml

@@ -45,7 +45,7 @@ jobs:
 
     steps:
       - name: checkout
-        uses: actions/checkout@v6.0.2
+        uses: actions/checkout@v7.0.0
 
       - name: install dependencies for non macos
         if: ${{ !startsWith(inputs.os, 'macos') }}
@@ -79,7 +79,7 @@ jobs:
 
       - name: Cache LLVM libraries
         id: retrieve_llvm_libs
-        uses: actions/cache@v5
+        uses: actions/cache@v6
         with:
           path: |
             ./core/deps/llvm/build/bin

.github/workflows/build_wamr_lldb.yml

@@ -55,7 +55,7 @@ jobs:
       contents: write # for uploading release artifacts
 
     steps:
-      - uses: actions/checkout@v6.0.2
+      - uses: actions/checkout@v7.0.0
 
       - name: download and install wasi-sdk
         run: |
@@ -68,7 +68,7 @@ jobs:
 
       - name: Cache build
         id: lldb_build_cache
-        uses: actions/cache@v5
+        uses: actions/cache@v6
         with:
           path: |
             ./core/deps/llvm-project/build/bin

.github/workflows/build_wamr_sdk.yml

@@ -45,7 +45,7 @@ jobs:
       contents: write # for uploading release artifacts
 
     steps:
-      - uses: actions/checkout@v6.0.2
+      - uses: actions/checkout@v7.0.0
 
       - name: download wamr-app-framework
         run: |

.github/workflows/build_wamr_vscode_ext.yml

@@ -24,7 +24,7 @@ jobs:
       contents: write # for uploading release artifacts
 
     steps:
-      - uses: actions/checkout@v6.0.2
+      - uses: actions/checkout@v7.0.0
 
       - name: Use Node.js 18.x
         uses: actions/setup-node@v6

.github/workflows/build_wamr_wasi_extensions.yml

@@ -28,7 +28,7 @@ jobs:
         os: [ubuntu-22.04]
     steps:
       - name: checkout
-        uses: actions/checkout@v6.0.2
+        uses: actions/checkout@v7.0.0
 
       - name: install-wasi-sdk-wabt
         uses: ./.github/actions/install-wasi-sdk-wabt

.github/workflows/build_wamrc.yml

@@ -41,11 +41,11 @@ jobs:
       contents: write # for uploading release artifacts
 
     steps:
-      - uses: actions/checkout@v6.0.2
+      - uses: actions/checkout@v7.0.0
 
       - name: get cached LLVM libraries
         id: retrieve_llvm_libs
-        uses: actions/cache@v5
+        uses: actions/cache@v6
         with:
           path: |
             ./core/deps/llvm/build/bin

.github/workflows/check_version_h.yml

@@ -14,7 +14,7 @@ jobs:
 
     steps:
       - name: checkout
-        uses: actions/checkout@v6.0.2
+        uses: actions/checkout@v7.0.0
 
       - name: cmake execute to generate version.h
         run: cmake -B build_version -S .