Add support for targeting custom WIT worlds

.cargo/config.toml

@@ -2,11 +2,9 @@
 runner = 'wasmtime run --dir=.::/cwd --dir=. --dir=/tmp -Sinherit-env=y,inherit-network=y,http=y,tcp=y,udp=y -C native-unwind-info=n'
 
 [target.wasm32-wasip2]
-# Keep in sync with the RUSTFLAGS overrides in scripts/build-runtime.sh and scripts/build-dylib.sh.
 rustflags = ["-C", "target-feature=+simd128"]
 runner = 'wasmtime run --dir=.::/cwd --dir=. --dir=/tmp -Sinherit-env=y,inherit-network=y,http=y,tcp=y,udp=y -C native-unwind-info=n'
 
 [target.wasm32-wasip3]
-# Keep in sync with the RUSTFLAGS overrides in scripts/build-runtime.sh and scripts/build-dylib.sh.
 rustflags = ["-C", "target-feature=+simd128"]
 runner = 'wasmtime run --dir=.::/cwd --dir=. --dir=/tmp -Sinherit-env=y,inherit-network=y,http=y,tcp=y,udp=y -C native-unwind-info=n'

.github/actions/setup/action.yml

@@ -1,6 +1,6 @@
 # SPDX-License-Identifier: Apache-2.0-WITH-LLVM-exception
 name: Setup build environment
-description: Install system deps, Rust toolchain, WASI SDK, wasmtime, and configure sccache.
+description: Install system deps, Rust toolchain, WASI SDK, wasmtime, wasm-tools, and configure sccache.
 
 inputs:
   target:
@@ -10,19 +10,20 @@ inputs:
 runs:
   using: composite
   steps:
+    - name: Add the tool versions to the environment
+      shell: bash
+      run: grep -v '^#' "${{ github.action_path }}/../../tool-versions.env" >>"$GITHUB_ENV"
+
     - name: Install system dependencies
       shell: bash
       run: |
         sudo apt-get update
         sudo apt-get install -y build-essential python3 m4 libclang-dev llvm
 
+    # `install-tool.sh` checks each download's SHA-256 digest.
     - name: Install just
       shell: bash
-      run: |
-        mkdir -p "$HOME/.just/bin"
-        curl --proto '=https' --tlsv1.2 -sSf https://just.systems/install.sh \
-          | bash -s -- --to "$HOME/.just/bin"
-        echo "$HOME/.just/bin" >> "$GITHUB_PATH"
+      run: ${{ github.action_path }}/install-tool.sh just
 
     - name: Install Rust toolchain
       shell: bash
@@ -34,30 +35,30 @@ runs:
       run: rustup target add wasm32-wasip2
 
     # The pinned toolchain ships no wasm32-wasip3 std, so the justfile builds that target with the
-    # nightly toolchain `STARLING_NIGHTLY` names. The pinned toolchain is still needed for the
+    # beta toolchain `STARLING_BETA` names. The pinned toolchain is still needed for the
     # host-side test harnesses.
-    - name: Install nightly Rust toolchain with the wasm32-wasip3 target
+    - name: Install beta Rust toolchain with the wasm32-wasip3 target
       if: inputs.target == 'wasm32-wasip3'
       shell: bash
       run: |
-        rustup toolchain install "$STARLING_NIGHTLY" --profile minimal --target wasm32-wasip3
-        rustc "+$STARLING_NIGHTLY" --version
+        rustup toolchain install "$STARLING_BETA" --profile minimal --component clippy \
+          --target wasm32-wasip3
+        rustc "+$STARLING_BETA" --version
 
     - name: Install WASI SDK
       if: inputs.target != 'native'
       shell: bash
-      run: |
-        sudo mkdir -p /opt/wasi-sdk
-        curl -sSfL "https://github.com/WebAssembly/wasi-sdk/releases/download/wasi-sdk-${WASI_SDK_VERSION}/wasi-sdk-${WASI_SDK_VERSION}.0-x86_64-linux.tar.gz" \
-          | sudo tar xz --strip-components=1 -C /opt/wasi-sdk
-        echo "WASI_SDK_PATH=/opt/wasi-sdk" >> "$GITHUB_ENV"
+      run: ${{ github.action_path }}/install-tool.sh wasi-sdk
 
     - name: Install wasmtime
       if: inputs.target != 'native'
       shell: bash
-      run: |
-        curl -sSf https://wasmtime.dev/install.sh | bash -s -- --version "v$WASMTIME_VERSION"
-        echo "$HOME/.wasmtime/bin" >> "$GITHUB_PATH"
+      run: ${{ github.action_path }}/install-tool.sh wasmtime
+
+    - name: Install wasm-tools
+      if: inputs.target != 'native'
+      shell: bash
+      run: ${{ github.action_path }}/install-tool.sh wasm-tools
 
     - name: Run sccache-cache
-      uses: mozilla-actions/sccache-action@v0.0.9
+      uses: mozilla-actions/sccache-action@fc920bf0ec8de6ee65d409111f7ec508035751ba # v0.0.11

.github/actions/setup/install-tool.sh

@@ -0,0 +1,84 @@
+#!/usr/bin/env bash
+# SPDX-License-Identifier: Apache-2.0-WITH-LLVM-exception
+#
+# Download the x86_64 Linux release of a tool at the version `.github/tool-versions.env` names,
+# check its SHA-256 digest against the digest listed below for that version, install it, and add
+# it to `GITHUB_PATH`. The WASI SDK goes to /opt/wasi-sdk, which `WASI_SDK_PATH` is set to in
+# `GITHUB_ENV`, and the other tools go to `~/.<tool>/bin`. A version without a listed digest
+# fails.
+#
+# Usage:
+#   install-tool.sh <just|wasi-sdk|wasmtime|wasm-tools>
+
+set -euo pipefail
+
+TOOL="$1"
+# shellcheck source=../../tool-versions.env
+. "$(dirname "$0")/../../tool-versions.env"
+case "$TOOL" in
+    just) VERSION="$JUST_VERSION" ;;
+    wasi-sdk) VERSION="$WASI_SDK_VERSION" ;;
+    wasmtime) VERSION="$WASMTIME_VERSION" ;;
+    wasm-tools) VERSION="$WASM_TOOLS_VERSION" ;;
+    *) echo "unknown tool $TOOL" >&2; exit 1 ;;
+esac
+GH=https://github.com
+
+case "$TOOL-$VERSION" in
+    just-1.58.0)
+        URL="$GH/casey/just/releases/download/$VERSION/just-$VERSION-x86_64-unknown-linux-musl.tar.gz"
+        SHA256=4a5cc2f53e6f0f8c59092a6cc38291eb729d46a7dd95d3ae582008881b84931d
+        ;;
+    wasi-sdk-34)
+        URL="$GH/WebAssembly/wasi-sdk/releases/download/wasi-sdk-$VERSION/wasi-sdk-$VERSION.0-x86_64-linux.tar.gz"
+        SHA256=b761e3a0721dbae9c09a0059e5fdb2bf917d1b4a8a7b430fb3b5aafb0984b2c4
+        ;;
+    wasmtime-50.0.0)
+        URL="$GH/bytecodealliance/wasmtime/releases/download/v$VERSION/wasmtime-v$VERSION-x86_64-linux.tar.xz"
+        SHA256=77c19ee0437991f9ac7837b9c269d9c7076744f85dad263fea5214cc2723c7ff
+        ;;
+    wasm-tools-1.262.0)
+        URL="$GH/bytecodealliance/wasm-tools/releases/download/v$VERSION/wasm-tools-$VERSION-x86_64-linux.tar.gz"
+        SHA256=655b8df67d54c3ef9b52fc237c4e94bbfbb5f5f43825245cb0940a7002a9ed65
+        ;;
+    *)
+        echo "No SHA-256 digest for $TOOL $VERSION. Add it to $0." >&2
+        exit 1
+        ;;
+esac
+
+TMP="$(mktemp -d)"
+trap 'rm -rf "$TMP"' EXIT
+ARCHIVE="$TMP/$(basename "$URL")"
+curl --fail --silent --show-error --location -o "$ARCHIVE" "$URL"
+ACTUAL="$(sha256sum "$ARCHIVE" | cut -d' ' -f1)"
+if [[ "$ACTUAL" != "$SHA256" ]]; then
+    echo "SHA-256 mismatch for $URL:" >&2
+    echo "  expected $SHA256" >&2
+    echo "  got      $ACTUAL" >&2
+    exit 1
+fi
+
+case "$TOOL" in
+    just)
+        mkdir -p "$HOME/.just/bin"
+        tar -xzf "$ARCHIVE" -C "$HOME/.just/bin" just
+        echo "$HOME/.just/bin" >>"$GITHUB_PATH"
+        ;;
+    wasi-sdk)
+        sudo rm -rf /opt/wasi-sdk
+        sudo mkdir /opt/wasi-sdk
+        sudo tar -xzf "$ARCHIVE" --no-same-owner --strip-components=1 -C /opt/wasi-sdk
+        echo "WASI_SDK_PATH=/opt/wasi-sdk" >>"$GITHUB_ENV"
+        ;;
+    wasmtime)
+        mkdir -p "$HOME/.wasmtime/bin"
+        tar -xJf "$ARCHIVE" --strip-components=1 -C "$HOME/.wasmtime/bin" "wasmtime-v$VERSION-x86_64-linux/wasmtime"
+        echo "$HOME/.wasmtime/bin" >>"$GITHUB_PATH"
+        ;;
+    wasm-tools)
+        mkdir -p "$HOME/.wasm-tools/bin"
+        tar -xzf "$ARCHIVE" --strip-components=1 -C "$HOME/.wasm-tools/bin" "wasm-tools-$VERSION-x86_64-linux/wasm-tools"
+        echo "$HOME/.wasm-tools/bin" >>"$GITHUB_PATH"
+        ;;
+esac

.github/tool-versions.env

@@ -0,0 +1,12 @@
+# The tool versions CI and releases install. The setup action adds them to the job's environment,
+# and `actions/setup/install-tool.sh` installs the version given here, checking the digest it
+# lists for it. A new release changes nothing until these are bumped.
+JUST_VERSION=1.58.0
+WASI_SDK_VERSION=34
+# The wasmtime CLI the wasm tests run under, and the wasm-tools CLI `scripts/build-runtime.sh`
+# wraps the runtime with, each at the version of the crates `componentize/Cargo.lock` holds.
+WASMTIME_VERSION=50.0.0
+WASM_TOOLS_VERSION=1.262.0
+# The beta toolchain wasm32-wasip3 builds use.
+STARLING_BETA=beta-2026-10-18
+NODE_VERSION=24.21.0

.github/workflows/ci.yml

@@ -16,14 +16,13 @@ concurrency:
   group: ${{ github.workflow }}-${{ github.ref }}
   cancel-in-progress: true
 
+permissions:
+  contents: read
+
 env:
   CARGO_TERM_COLOR: always
   CARGO_INCREMENTAL: 0
-  WASI_SDK_VERSION: "34"
-  # The wasmtime CLI the wasm tests run under, and the nightly toolchain wasm32-wasip3 builds use.
-  # Both are pinned, so a new release changes nothing until these are bumped.
-  WASMTIME_VERSION: "49.0.0"
-  STARLING_NIGHTLY: nightly-2026-09-24
+  # The setup action adds the tool versions of `.github/tool-versions.env`.
   RUSTC_WRAPPER: sccache
   CCACHE: sccache
   # Bump to purge the sccache GHA cache.
@@ -37,7 +36,7 @@ jobs:
     name: Lint
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 
       - uses: ./.github/actions/setup
         with:
@@ -49,9 +48,33 @@ jobs:
       - name: Run clippy
         run: just clippy --all
 
+      - name: Run the componentizer's unit tests
+        run: just test-componentize-unit
+
+  # ---------------------------------------------------------------------------
+  # The `init` interface between the runtime and the componentizer
+  # (`starling/wit/init.wit`) changes only with a version not compatible with the latest
+  # release's, since the componentizer accepts runtimes with a compatible version.
+  # ---------------------------------------------------------------------------
+  init-wit:
+    name: init.wit versioning
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          # The release tags the check compares with.
+          fetch-depth: 0
+
+      - name: Install wasm-tools
+        run: ./.github/actions/setup/install-tool.sh wasm-tools
+
+      - name: Check init.wit's version
+        run: ./scripts/check-init-wit.sh
+
   # ---------------------------------------------------------------------------
   # Cargo tests: {native, wasm32-wasip2, wasm32-wasip3} × {debug+debugmozjs, release}
-  # The wasm recipes also run the serve end-to-end suite (`just test-serve-wasm`).
+  # The wasm recipes also run the serve end-to-end suite (`just test-serve-wasm`). The debug wasm
+  # jobs first lint the code each wasm target compiles (`just clippy-wasm`).
   # ---------------------------------------------------------------------------
   test:
     name: Test (${{ matrix.target }}, ${{ matrix.profile }})
@@ -74,19 +97,60 @@ jobs:
       WASMTIME_BACKTRACE_DETAILS: '1'
       RUST_BACKTRACE: 'full'
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 
       - uses: ./.github/actions/setup
         with:
           target: ${{ matrix.target }}
 
+      - name: Run clippy for the wasm target
+        if: matrix.target != 'native' && matrix.profile == 'debug'
+        run: just clippy-wasm
+
       - name: Run tests
         run: just ${{ matrix.recipe }}
 
       - name: Run example tests
         if: matrix.target != 'native'
         run: just ${{ matrix.recipe }} --examples
 
+  # ---------------------------------------------------------------------------
+  # Componentization suites against the debug runtime (`just test-componentize`).
+  # That recipe builds the runtime for wasm32-wasip3, the target the componentizer
+  # links against, so this job installs beta and a wasi-sdk with a sysroot for it.
+  # ---------------------------------------------------------------------------
+  componentize:
+    name: Componentize
+    runs-on: ubuntu-latest
+    env:
+      WASMTIME_BACKTRACE_DETAILS: '1'
+      RUST_BACKTRACE: 'full'
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+
+      - uses: ./.github/actions/setup
+        with:
+          target: wasm32-wasip3
+
+      - uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v7.1.0
+        with:
+          node-version: ${{ env.NODE_VERSION }}
+
+      # `--tests` includes the `wit_to_ts` suite, which type-checks its output.
+      - name: Install the TypeScript compiler
+        run: npm ci
+
+      - name: Build the debug runtime and run the componentization suites
+        run: just test-componentize
+
+      # Runs scripts and a late-rejecting top level with the debug runtime component itself.
+      - name: Run scripts with the runtime component
+        run: just test-runtime
+
+      # Snapshots with `wizer-initialize`, including CLI tools whose `run` export a snapshot calls.
+      - name: Test Wizer snapshots
+        run: WASM_TARGET=p3 just test-wizer
+
   # ---------------------------------------------------------------------------
   # WPT suite: {native, wasm32-wasip2, wasm32-wasip3}
   # ---------------------------------------------------------------------------
@@ -102,15 +166,15 @@ jobs:
       WASMTIME_BACKTRACE_DETAILS: '1'
       RUST_BACKTRACE: 'full'
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 
       - uses: ./.github/actions/setup
         with:
           target: ${{ matrix.target }}
 
-      - uses: actions/setup-node@v4
+      - uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v7.1.0
         with:
-          node-version: "lts/*"
+          node-version: ${{ env.NODE_VERSION }}
 
       - name: Clone WPT suite
         run: ./scripts/clone-wpt.sh
@@ -135,25 +199,44 @@ jobs:
 
   gc_rooting:
     name: GC Rooting Checks
-    strategy:
-      fail-fast: false
     runs-on: ubuntu-latest
     env:
       RUST_BACKTRACE: full
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 
+      # `just check-gc` also checks the wasm32-wasip2 build, which needs the target's std and the
+      # WASI SDK, and runs crown's own tests.
       - uses: ./.github/actions/setup
         with:
-          target: native
+          target: wasm32-wasip2
 
-      - uses: actions/setup-node@v4
+      - uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v7.1.0
         with:
-          node-version: "lts/*"
+          node-version: ${{ env.NODE_VERSION }}
 
       - name: Crown static analysis
-        run: |
-          ./scripts/check-crown.sh --workspace --examples
+        run: just check-gc
+
+  # ---------------------------------------------------------------------------
+  # GC zeal tests of the default `scripts/test-gc-zeal.sh` packages, each shard
+  # running every third mode of the full set.
+  # ---------------------------------------------------------------------------
+  gc_zeal:
+    name: GC Zeal (${{ matrix.shard }}/3)
+    strategy:
+      fail-fast: false
+      matrix:
+        shard: [1, 2, 3]
+    runs-on: ubuntu-latest
+    env:
+      RUST_BACKTRACE: full
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+
+      - uses: ./.github/actions/setup
+        with:
+          target: native
 
       - name: GC Zeal tests
-        run: just gc-zeal --zeal full --examples --workspace
+        run: just gc-zeal --zeal full --shard ${{ matrix.shard }}/3