fast-interp: relaxed-SIMD opcode lowering

.github/scripts/codeql_buildscript.sh

@@ -19,9 +19,20 @@ sudo wget --progress=dot:giga -O clang+llvm-x86_64-linux-gnu.tar.xz https://gith
 popd
 
 # libtinfo.so.5 for /opt/llvm-18.1.8/lib/libomptarget.rtl.amdgpu.so.18.1
+# Install the libtinfo5 compat package at the same ncurses version as the
+# runner's already-installed libtinfo6; fall back to the newest one in the
+# pool. A hard-coded URL 404s once the ncurses point release is bumped, which
+# then breaks the wamrc link against libomptarget (NCURSES_TINFO_5 symbols).
 sudo apt -qq update
-wget http://security.ubuntu.com/ubuntu/pool/universe/n/ncurses/libtinfo5_6.3-2ubuntu0.1_amd64.deb
-sudo apt install -y -qq ./libtinfo5_6.3-2ubuntu0.1_amd64.deb
+nc_pool="http://security.ubuntu.com/ubuntu/pool/universe/n/ncurses"
+nc_ver="$(dpkg-query -W -f='${Version}' libtinfo6)"
+libtinfo5_deb="libtinfo5_${nc_ver}_amd64.deb"
+if ! wget -q "${nc_pool}/${libtinfo5_deb}"; then
+  libtinfo5_deb="$(wget -qO- "${nc_pool}/" \
+    | grep -oE 'libtinfo5_[0-9][^"]*_amd64\.deb' | sort -Vu | tail -1)"
+  wget -q "${nc_pool}/${libtinfo5_deb}"
+fi
+sudo apt install -y -qq "./${libtinfo5_deb}"
 
 # Start the build process
 WAMR_DIR=${PWD}

.github/scripts/codeql_fail_on_error.py

@@ -61,9 +61,15 @@ def codeql_sarif_contain_error(filename, dismissed_alerts):
         s = json.load(f)
 
     for run in s.get("runs", []):
-        rules_metadata = run["tool"]["driver"]["rules"]
+        # Rule metadata isn't always in one place: CodeQL keeps it on the tool
+        # driver, but rules contributed by a query-pack extension live on that
+        # extension instead, and the driver's list is empty when nothing fired.
+        # So read the driver rules, then fall back to gathering them from the
+        # extensions rather than assuming a fixed location.
+        rules_metadata = run["tool"]["driver"].get("rules") or []
         if not rules_metadata:
-            rules_metadata = run["tool"]["extensions"][0]["rules"]
+            for ext in run["tool"].get("extensions", []):
+                rules_metadata += ext.get("rules", [])
 
         for res in run.get("results", []):
             if "ruleIndex" in res:

.github/workflows/build_docker_images.yml

@@ -26,7 +26,7 @@ jobs:
 
     steps:
       - name: Checkout repository
-        uses: actions/checkout@v6.0.2
+        uses: actions/checkout@v7.0.0
 
       - name: Build and save Docker image(wasm-debug-server:${{ inputs.ver_num }}) to tar file
         run: |

.github/workflows/build_iwasm_release.yml

@@ -104,11 +104,11 @@ jobs:
       contents: write # for uploading release artifacts
 
     steps:
-      - uses: actions/checkout@v6.0.2
+      - uses: actions/checkout@v7.0.0
 
       - name: get cached LLVM libraries
         id: retrieve_llvm_libs
-        uses: actions/cache@v5
+        uses: actions/cache@v6
         with:
           path: |
             ./core/deps/llvm/build/bin

.github/workflows/build_llvm_libraries.yml

@@ -45,7 +45,7 @@ jobs:
 
     steps:
       - name: checkout
-        uses: actions/checkout@v6.0.2
+        uses: actions/checkout@v7.0.0
 
       - name: install dependencies for non macos
         if: ${{ !startsWith(inputs.os, 'macos') }}
@@ -79,7 +79,7 @@ jobs:
 
       - name: Cache LLVM libraries
         id: retrieve_llvm_libs
-        uses: actions/cache@v5
+        uses: actions/cache@v6
         with:
           path: |
             ./core/deps/llvm/build/bin

.github/workflows/build_wamr_lldb.yml

@@ -55,7 +55,7 @@ jobs:
       contents: write # for uploading release artifacts
 
     steps:
-      - uses: actions/checkout@v6.0.2
+      - uses: actions/checkout@v7.0.0
 
       - name: download and install wasi-sdk
         run: |
@@ -68,7 +68,7 @@ jobs:
 
       - name: Cache build
         id: lldb_build_cache
-        uses: actions/cache@v5
+        uses: actions/cache@v6
         with:
           path: |
             ./core/deps/llvm-project/build/bin

.github/workflows/build_wamr_sdk.yml

@@ -45,7 +45,7 @@ jobs:
       contents: write # for uploading release artifacts
 
     steps:
-      - uses: actions/checkout@v6.0.2
+      - uses: actions/checkout@v7.0.0
 
       - name: download wamr-app-framework
         run: |

.github/workflows/build_wamr_vscode_ext.yml

@@ -24,7 +24,7 @@ jobs:
       contents: write # for uploading release artifacts
 
     steps:
-      - uses: actions/checkout@v6.0.2
+      - uses: actions/checkout@v7.0.0
 
       - name: Use Node.js 18.x
         uses: actions/setup-node@v6

.github/workflows/build_wamr_wasi_extensions.yml

@@ -28,7 +28,7 @@ jobs:
         os: [ubuntu-22.04]
     steps:
       - name: checkout
-        uses: actions/checkout@v6.0.2
+        uses: actions/checkout@v7.0.0
 
       - name: install-wasi-sdk-wabt
         uses: ./.github/actions/install-wasi-sdk-wabt

.github/workflows/build_wamrc.yml

@@ -41,11 +41,11 @@ jobs:
       contents: write # for uploading release artifacts
 
     steps:
-      - uses: actions/checkout@v6.0.2
+      - uses: actions/checkout@v7.0.0
 
       - name: get cached LLVM libraries
         id: retrieve_llvm_libs
-        uses: actions/cache@v5
+        uses: actions/cache@v6
         with:
           path: |
             ./core/deps/llvm/build/bin

.github/workflows/check_version_h.yml

@@ -14,7 +14,7 @@ jobs:
 
     steps:
       - name: checkout
-        uses: actions/checkout@v6.0.2
+        uses: actions/checkout@v7.0.0
 
       - name: cmake execute to generate version.h
         run: cmake -B build_version -S .

.github/workflows/codeql.yml

@@ -9,17 +9,35 @@ on:
   push:
     branches:
       - dev/**
+  # scan pull requests so findings surface on the PR instead of only post-merge
+  pull_request:
   # midnight UTC on the latest commit on the main branch
   schedule:
     - cron: "0 0 * * *"
   # allow to be triggered manually
   workflow_dispatch:
 
+# Serialize CodeQL runs per PR / branch. Only a pull_request cancels its own
+# superseded run - once a PR head is replaced the old analysis is throwaway.
+# Pushes to dev/** and the nightly cron are left to finish, so branch and
+# scheduled scans are never dropped.
+concurrency:
+  group: ${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: ${{ github.event_name == 'pull_request' }}
+
 jobs:
   analyze:
-    # only run this job if the repository is not a fork
-    # if want to run this job on a fork, please remove the if condition
-    if: github.repository == 'bytecodealliance/wasm-micro-runtime'
+    # Pull requests: only scan when the head branch lives in this same
+    # repository. A pull request from a fork runs with a read-only GITHUB_TOKEN
+    # (no `security-events: write`), so uploading results and reading
+    # code-scanning alerts is not permitted and the job would fail; skip it
+    # cleanly instead. Other events (push to dev/**, the nightly cron, manual
+    # runs) keep the original behavior of running only on the upstream repo.
+    if: >-
+      (github.event_name == 'pull_request' &&
+       github.event.pull_request.head.repo.full_name == github.repository)
+      || (github.event_name != 'pull_request' &&
+          github.repository == 'bytecodealliance/wasm-micro-runtime')
     name: Analyze
     # Runner size impacts CodeQL analysis time. To learn more, please see:
     #   - https://gh.io/recommended-hardware-resources-for-running-codeql
@@ -43,13 +61,13 @@ jobs:
 
     steps:
       - name: Checkout repository
-        uses: actions/checkout@v6.0.2
+        uses: actions/checkout@v7.0.0
         with:
           submodules: recursive
 
       # Initializes the CodeQL tools for scanning.
       - name: Initialize CodeQL
-        uses: github/codeql-action/init@v4.36.0
+        uses: github/codeql-action/init@v4.36.3
         with:
           languages: ${{ matrix.language }}
           # For more details on CodeQL's query packs, refer to: https://docs.github.com/en/code-security/code-scanning/automatically-scanning-your-code-for-vulnerabilities-and-errors/configuring-code-scanning#using-queries-in-ql-packs
@@ -61,7 +79,7 @@ jobs:
           ./.github/scripts/codeql_buildscript.sh || exit 1
 
       - name: Perform CodeQL Analysis
-        uses: github/codeql-action/analyze@v4.36.0
+        uses: github/codeql-action/analyze@v4.36.3
         with:
           category: "/language:${{matrix.language}}"
           upload: false
@@ -114,7 +132,7 @@ jobs:
           output: ${{ steps.step1.outputs.sarif-output }}/cpp.sarif
 
       - name: Upload CodeQL results to code scanning
-        uses: github/codeql-action/upload-sarif@v4.36.0
+        uses: github/codeql-action/upload-sarif@v4.36.3
         with:
           sarif_file: ${{ steps.step1.outputs.sarif-output }}
           category: "/language:${{matrix.language}}"

.github/workflows/coding_guidelines.yml

@@ -22,7 +22,7 @@ jobs:
     runs-on: ubuntu-22.04
     steps:
       - name: checkout
-        uses: actions/checkout@v6.0.2
+        uses: actions/checkout@v7.0.0
         with:
           fetch-depth: 0
 

.github/workflows/compilation_on_android_ubuntu.yml

@@ -100,13 +100,13 @@ jobs:
             llvm_cache_key: ${{ needs.build_llvm_libraries_on_ubuntu_2204.outputs.cache_key }}
     steps:
       - name: checkout
-        uses: actions/checkout@v6.0.2
+        uses: actions/checkout@v7.0.0
 
       # since jobs.id can't contain the dot character
       # it is hard to use `format` to assemble the cache key
       - name: Get LLVM libraries
         id: retrieve_llvm_libs
-        uses: actions/cache@v5
+        uses: actions/cache@v6
         with:
           path: |
             ./core/deps/llvm/build/bin
@@ -271,13 +271,13 @@ jobs:
             extra_options: "-DWAMR_BUILD_SIMD=0"
     steps:
       - name: checkout
-        uses: actions/checkout@v6.0.2
+        uses: actions/checkout@v7.0.0
 
       # only download llvm cache when needed
       - name: Get LLVM libraries
         id: retrieve_llvm_libs
         if: endsWith(matrix.make_options_run_mode, '_JIT_BUILD_OPTIONS')
-        uses: actions/cache@v5
+        uses: actions/cache@v6
         with:
           path: |
             ./core/deps/llvm/build/bin
@@ -322,13 +322,13 @@ jobs:
 
     steps:
       - name: checkout
-        uses: actions/checkout@v6.0.2
+        uses: actions/checkout@v7.0.0
         with:
           submodules: recursive
 
       - name: Get LLVM libraries
         id: retrieve_llvm_libs
-        uses: actions/cache@v5
+        uses: actions/cache@v6
         with:
           path: |
             ./core/deps/llvm/build/bin
@@ -381,11 +381,11 @@ jobs:
 
     steps:
       - name: checkout
-        uses: actions/checkout@v6.0.2
+        uses: actions/checkout@v7.0.0
 
       - name: Get LLVM libraries
         id: retrieve_llvm_libs
-        uses: actions/cache@v5
+        uses: actions/cache@v6
         with:
           path: |
             ./core/deps/llvm/build/bin
@@ -446,12 +446,12 @@ jobs:
 
     steps:
       - name: checkout
-        uses: actions/checkout@v6.0.2
+        uses: actions/checkout@v7.0.0
 
       - name: Get LLVM libraries
         id: retrieve_llvm_libs
         if: (!endsWith(matrix.make_options, '_INTERP_BUILD_OPTIONS'))
-        uses: actions/cache@v5
+        uses: actions/cache@v6
         with:
           path: |
             ./core/deps/llvm/build/bin
@@ -503,11 +503,11 @@ jobs:
 
     steps:
       - name: checkout
-        uses: actions/checkout@v6.0.2
+        uses: actions/checkout@v7.0.0
 
       - name: Get LLVM libraries
         id: retrieve_llvm_libs
-        uses: actions/cache@v5
+        uses: actions/cache@v6
         with:
           path: |
             ./core/deps/llvm/build/bin
@@ -677,7 +677,7 @@ jobs:
 
     steps:
       - name: checkout
-        uses: actions/checkout@v6.0.2
+        uses: actions/checkout@v7.0.0
 
       - name: Set-up OCaml
         uses: ocaml/setup-ocaml@v3
@@ -707,11 +707,21 @@ jobs:
            && matrix.running_mode != 'fast-jit' && matrix.running_mode != 'jit' && matrix.running_mode != 'multi-tier-jit')
         run: echo "TEST_ON_X86_32=true" >> $GITHUB_ENV
 
+      - name: Free up disk space
+        if: env.USE_LLVM == 'true'
+        run: |
+          # Restoring the prebuilt LLVM libraries cache overflows the runner's
+          # small default free space and fails with "no space left on device".
+          # Drop preinstalled toolchains this job never uses (~20 GB freed).
+          sudo rm -rf /usr/share/dotnet /usr/local/lib/android /opt/ghc \
+            /opt/hostedtoolcache/CodeQL /usr/local/share/boost
+          df -h /
+
       #only download llvm libraries in jit and aot mode
       - name: Get LLVM libraries
         if: env.USE_LLVM == 'true'
         id: retrieve_llvm_libs
-        uses: actions/cache@v5
+        uses: actions/cache@v6
         with:
           path: |
             ./core/deps/llvm/build/bin