Redirecting to WRT API Documentation...
+ + + EOF + fi + + # List what we're uploading + echo "๐ฆ Documentation artifact contents:" + ls -la ./docs_artifact_final/ + - name: Setup Pages uses: actions/configure-pages@v5 - name: Upload artifact uses: actions/upload-pages-artifact@v3 with: - path: './docs_artifact_final' # Path where Dagger pipeline (via xtask) exports the final result + path: './docs_artifact_final' # Path to the prepared documentation artifact # Deployment job deploy: diff --git a/.github/workflows/security-audit.yml b/.github/workflows/security-audit.yml new file mode 100644 index 00000000..e1d783ad --- /dev/null +++ b/.github/workflows/security-audit.yml @@ -0,0 +1,144 @@ +name: Security Audit and Analysis + +on: + push: + branches: [ main, develop ] + pull_request: + branches: [ main, develop ] + schedule: + # Run security audit every Tuesday at 3 AM UTC + - cron: '0 3 * * 2' + +env: + CARGO_TERM_COLOR: always + +jobs: + security-audit: + name: Security Audit + runs-on: ubuntu-latest + steps: + - uses: actions/checkout@v4 + + - name: Install Rust + uses: dtolnay/rust-toolchain@stable + + - name: Cache Cargo + uses: actions/cache@v4 + with: + path: | + ~/.cargo/bin/ + ~/.cargo/registry/index/ + ~/.cargo/registry/cache/ + ~/.cargo/git/db/ + target/ + key: ${{ runner.os }}-cargo-audit-${{ hashFiles('**/Cargo.lock') }} + + - name: Install cargo-audit + run: cargo install --locked cargo-audit --force + + - name: Run Security Audit + run: cargo audit --json > audit-report.json + continue-on-error: true + + - name: Process Audit Results + run: | + if [ -f audit-report.json ]; then + # Count vulnerabilities by severity + HIGH=$(jq '[.vulnerabilities.list[] | select(.advisory.severity == "high")] | length' audit-report.json) + MEDIUM=$(jq '[.vulnerabilities.list[] | select(.advisory.severity == "medium")] | length' audit-report.json) + LOW=$(jq '[.vulnerabilities.list[] | select(.advisory.severity == "low")] | length' audit-report.json) + + echo "## Security Audit Results" >> $GITHUB_STEP_SUMMARY + echo "- High severity: $HIGH" >> $GITHUB_STEP_SUMMARY + echo "- Medium severity: $MEDIUM" >> $GITHUB_STEP_SUMMARY + echo "- Low severity: $LOW" >> $GITHUB_STEP_SUMMARY + + if [ $HIGH -gt 0 ]; then + echo "::error::High severity vulnerabilities found" + exit 1 + fi + fi + + - name: Upload Audit Report + uses: actions/upload-artifact@v4 + if: always() + with: + name: security-audit-report + path: audit-report.json + + safety-analysis: + name: Safety Analysis with Clippy + runs-on: ubuntu-latest + steps: + - uses: actions/checkout@v4 + + - name: Install Rust + uses: dtolnay/rust-toolchain@stable + with: + components: clippy + + - name: Cache Cargo + uses: actions/cache@v4 + with: + path: | + ~/.cargo/bin/ + ~/.cargo/registry/index/ + ~/.cargo/registry/cache/ + ~/.cargo/git/db/ + target/ + key: ${{ runner.os }}-cargo-clippy-${{ hashFiles('**/Cargo.lock') }} + + - name: Run Safety-Critical Clippy + run: | + cargo clippy --workspace --all-targets --all-features -- \ + -D clippy::unwrap_used \ + -D clippy::expect_used \ + -D clippy::panic \ + -D clippy::unreachable \ + -D clippy::std_instead_of_core \ + -D clippy::std_instead_of_alloc \ + -W clippy::unnecessary_box_returns \ + -W clippy::vec_init_then_push \ + > clippy-safety-report.txt 2>&1 + continue-on-error: true + + - name: Process Safety Results + run: | + if [ -f clippy-safety-report.txt ]; then + DENIES=$(grep -c "denied" clippy-safety-report.txt || echo 0) + WARNS=$(grep -c "warning" clippy-safety-report.txt || echo 0) + + echo "## Safety Analysis Results" >> $GITHUB_STEP_SUMMARY + echo "- Safety violations (denied): $DENIES" >> $GITHUB_STEP_SUMMARY + echo "- Safety warnings: $WARNS" >> $GITHUB_STEP_SUMMARY + + if [ $DENIES -gt 0 ]; then + echo "::error::Safety-critical violations found" + cat clippy-safety-report.txt + exit 1 + fi + fi + + - name: Upload Safety Report + uses: actions/upload-artifact@v4 + if: always() + with: + name: safety-analysis-report + path: clippy-safety-report.txt + + dependency-review: + name: Dependency Review + runs-on: ubuntu-latest + if: github.event_name == 'pull_request' + steps: + - uses: actions/checkout@v4 + - uses: actions/dependency-review-action@v4 + with: + fail-on-severity: high + # Allow common open source licenses + allow-licenses: MIT, Apache-2.0, BSD-3-Clause, ISC, MPL-2.0, Unlicense + # Exclude packages with undetected licenses that we've manually verified + # Using PURL format: pkg:cargo/package@version + allow-dependencies-licenses: | + pkg:cargo/chrono@0.4.*, + pkg:cargo/dagger-sdk@0.11.10 \ No newline at end of file diff --git a/.github/workflows/test-examples.yml b/.github/workflows/test-examples.yml deleted file mode 100644 index 23b0080c..00000000 --- a/.github/workflows/test-examples.yml +++ /dev/null @@ -1,42 +0,0 @@ -name: Test Documentation Examples - -on: - push: - paths: - - 'docs/**/*.rst' - - 'docs/**/*.md' - - 'examples/**' - - '.github/workflows/test-examples.yml' - pull_request: - paths: - - 'docs/**/*.rst' - - 'docs/**/*.md' - - 'examples/**' - -jobs: - test-examples: - runs-on: ubuntu-latest - steps: - - uses: actions/checkout@v4 - - - name: Install Rust - uses: dtolnay/rust-toolchain@stable - - - name: Test documentation examples - run: | - cargo test --doc - cargo test --test doc_examples_test - - - name: Build example projects - run: | - for example in examples/*/; do - echo "Building $example" - (cd "$example" && cargo build) - done - - - name: Run example tests - run: | - for example in examples/*/; do - echo "Testing $example" - (cd "$example" && cargo test) - done \ No newline at end of file diff --git a/.gitignore b/.gitignore index 0107f532..71117fd6 100644 --- a/.gitignore +++ b/.gitignore @@ -1,8 +1,12 @@ target/ docs/_build/ +docs/build/ docs/source/wrt* docs/source/changelog.md +# Documentation virtual environment +.venv-docs/ + # Ignore all WASM files but keep WAT files which are the source format *.wasm diff --git a/CLAUDE.md b/CLAUDE.md index 2f9c5c77..af0ebb2f 100644 --- a/CLAUDE.md +++ b/CLAUDE.md @@ -4,6 +4,16 @@ This file provides guidance to Claude Code (claude.ai/code) when working with co # WRT (WebAssembly Runtime) Project Guidelines +## Quick Setup + +```bash +# Install the unified build tool +cargo install --path cargo-wrt + +# Verify installation +cargo-wrt --help +``` + ## Important Rules - NEVER create hardcoded examples in the runtime code. Real implementations should parse or process actual external files. - NEVER add dummy or simulated implementations except in dedicated test modules. @@ -11,36 +21,502 @@ This file provides guidance to Claude Code (claude.ai/code) when working with co - The runtime should be able to execute real WebAssembly modules without special-casing specific files. - Only use placeholders when absolutely necessary and clearly document them. -## Build Commands -- Build all: `just build` or `cargo build` -- Build specific crate: `cargo build -p wrt|wrtd|example` -- Clean: `just clean` or `cargo clean` -- Run tests: `just ci-test` or `cargo test` +## Memory System Architecture + +### Unified Capability-Based Memory System +The WRT project uses a **single, unified memory management system** based on capabilities: + +- **Primary API**: `safe_managed_alloc!(size, crate_id)` - ALL memory allocation goes through this macro +- **Factory System**: `CapabilityWrtFactory` - Capability-based factory for advanced use cases +- **Automatic Cleanup**: RAII-based automatic memory management +- **NO LEGACY PATTERNS**: All `NoStdProvider::