chore(deps): bump actions/dependency-review-action from 4.7.3 to 4.8.1

.clippy.toml

@@ -0,0 +1,11 @@
+disallowed-methods = [
+    { path = "std::slice::from_raw_parts", reason = "see null_safe_slice" }
+]
+disallowed-macros = [
+    { path = "std::dbg" }
+]
+allow-mixed-uninlined-format-args = false
+allow-unwrap-in-tests = true
+allow-dbg-in-tests = true
+avoid-breaking-exported-api = false # We have one consumer and can afford to break the API.
+pass-by-value-size-limit = 32

.github/CODEOWNERS

@@ -0,0 +1 @@
+*    @KershawChang @martinthomson @larseggert @mxinden

.github/actionlint-matcher.json

@@ -0,0 +1,17 @@
+{
+  "problemMatcher": [
+    {
+      "owner": "actionlint",
+      "pattern": [
+        {
+          "regexp": "^(?:\\x1b\\[\\d+m)?(.+?)(?:\\x1b\\[\\d+m)*:(?:\\x1b\\[\\d+m)*(\\d+)(?:\\x1b\\[\\d+m)*:(?:\\x1b\\[\\d+m)*(\\d+)(?:\\x1b\\[\\d+m)*: (?:\\x1b\\[\\d+m)*(.+?)(?:\\x1b\\[\\d+m)* \\[(.+?)\\]$",
+          "file": 1,
+          "line": 2,
+          "column": 3,
+          "message": 4,
+          "code": 5
+        }
+      ]
+    }
+  ]
+}

.github/actionlint.yml

@@ -0,0 +1,6 @@
+# Configuration related to self-hosted runner.
+self-hosted-runner:
+  # Labels of self-hosted runner in array of strings.
+  labels:
+    - moonshot
+    - moonshot-exp

.github/actions/check-android/action.yml

@@ -0,0 +1,112 @@
+name: 'CI VM'
+description: 'Run main CI steps in VMs for VM-only platforms.'
+
+inputs:
+  target:
+    description: 'Rust target to build for.'
+    required: true
+  working-directory:
+    description: 'Working directory.'
+    default: '.'
+  ndk-version:
+    description: 'NDK version to install.'
+    # https://searchfox.org/mozilla-central/search?q=NDK_VERSION =&path=python/mozboot/mozboot/android.py
+    default: '27.2.12479018'
+  api-level:
+    description: 'Android API level to use.'
+    # https://searchfox.org/mozilla-central/search?q=\bapi_level=&path=taskcluster/scripts/misc/build-llvm-common.sh&regexp=true
+    # However, NSS requires an API >= 23 for a few symbols.
+    default: '23'
+  minimum-nss-version:
+    description: 'If NSS is required, the minimum version required.'
+    default: ''
+  codecov-token:
+    description: 'Codecov token, if Codecov upload is desired.'
+    default: ''
+  github-token:
+    description: 'A Github PAT'
+    required: true
+
+runs:
+  using: composite
+  steps:
+    - uses: actions/setup-java@dded0888837ed1f317902acf8a20df0ad188d165 # v5.0.0
+      with:
+        distribution: zulu
+        java-version: 23
+
+    - uses: android-actions/setup-android@9fc6c4e9069bf8d3d10b2204b1fb8f6ef7065407 # v3.2.2
+      with:
+        accept-android-sdk-licenses: true
+        log-accepted-android-sdk-licenses: false
+
+    - shell: bash
+      env:
+        NDK_VERSION: ${{ inputs.ndk-version }}
+        WD: ${{ inputs.working-directory }}
+      run: cd "$WD" && sdkmanager --install "ndk;$NDK_VERSION"
+
+    - uses: ./.github/actions/rust
+      with:
+        version: stable
+        targets: ${{ inputs.target }}
+        tools: cargo-ndk@^4
+        token: ${{ inputs.github-token }}
+
+    - uses: ./.github/actions/nss
+      if: ${{ inputs.minimum-nss-version != '' }}
+      with:
+        minimum-version: ${{ inputs.minimum-nss-version }}
+        target: ${{ inputs.target }}
+
+    - shell: bash
+      env:
+        TARGET: ${{ startsWith(inputs.target, 'arm') && 'arm64-v8a' || inputs.target }}
+        API_LEVEL: ${{ inputs.api-level }}
+        WD: ${{ inputs.working-directory }}
+      run: cd "$WD" && cargo ndk --platform "$API_LEVEL" --target "$TARGET" test --no-run
+
+    - shell: bash
+      env:
+        TARGET: ${{ inputs.target }}
+        API_LEVEL: ${{ inputs.api-level }}
+      run: |
+        echo 'KERNEL=="kvm", GROUP="kvm", MODE="0666", OPTIONS+="static_node=kvm"' | sudo tee /etc/udev/rules.d/99-kvm4all.rules
+        sudo udevadm control --reload-rules
+        sudo udevadm trigger --name-match=kvm
+        cat <<'EOF' > /tmp/rust-android-run-tests-on-emulator.sh
+        #!/bin/bash
+        set -ex
+        adb wait-for-device
+        while [ -z "$(adb shell getprop sys.boot_completed | tr -d '\r')" ]; do sleep 1; done
+        any_failures=0
+        TMP=/data/local/tmp
+        [ -e "$WD/test-fixture/db" ] && adb push "test-fixture/db" "$TMP/"
+        [ "$LD_LIBRARY_PATH" ] && adb push "$LD_LIBRARY_PATH" "$TMP/"
+        for test in $(find $WD/target/$TARGET/debug/deps/ -type f -executable ! -name "*.so" -name "*-*"); do
+          adb push "$test" "$TMP/"
+          adb shell chmod +x "$TMP/$(basename "$test")"
+          # See https://unix.stackexchange.com/a/451140/409256
+          adb shell "CARGO_TERM_COLOR=always RUST_BACKTRACE=1 LD_LIBRARY_PATH=$TMP/lib NSS_DB_PATH=$TMP/db API_LEVEL=$API_LEVEL $TMP/$(basename "$test") || echo _FAIL_" 2>&1 | tee output
+          grep _FAIL_ output > /dev/null && any_failures=1
+        done
+        exit $any_failures
+        EOF
+        chmod a+x /tmp/rust-android-run-tests-on-emulator.sh
+
+    - uses: reactivecircus/android-emulator-runner@1dcd0090116d15e7c562f8db72807de5e036a4ed # v2.34.0
+      with:
+        api-level: ${{ inputs.api-level }}
+        arch: ${{ startsWith(inputs.target, 'x86_64') && 'x86_64' || (startsWith(inputs.target, 'i686') && 'x86' || (startsWith(inputs.target, 'aarch64') && 'arm64-v8a')) }}
+        ndk: ${{ inputs.ndk-version }}
+        emulator-boot-timeout: 120
+        disk-size: 2G
+        script: /tmp/rust-android-run-tests-on-emulator.sh
+
+    - if: ${{ inputs.codecov-token != '' }}
+      uses: codecov/codecov-action@fdcc8476540edceab3de004e990f80d881c6cc00 # v5.5.0
+      with:
+        files: lcov.info
+        fail_ci_if_error: false
+        token: ${{ inputs.codecov-token }}
+        verbose: true

.github/actions/check-vm/action.yml

@@ -0,0 +1,146 @@
+name: 'CI VM'
+description: 'Run main CI steps in VMs for VM-only platforms.'
+
+inputs:
+  working-directory:
+    description: 'Working directory.'
+    default: '.'
+  platform:
+    description: 'Platform to run the checks on.'
+    default: ''
+  codecov-token:
+    description: 'Codecov token, if Codecov upload is desired.'
+    default: ''
+
+runs:
+  using: composite
+  steps:
+    - shell: bash
+      id: prep
+      env:
+        WD: ${{ inputs.working-directory }}
+        PLATFORM: ${{ inputs.platform }}
+        WORKSPACE: ${{ inputs.working-directory == '.' && '--workspace' || '' }}
+      run: |
+        cat <<EOF > prepare.sh
+          # This executes as root
+          set -ex
+          pwd
+          case "$PLATFORM" in
+            freebsd)    pkg install -y curl llvm nss pkgconf
+                        ;;
+            openbsd)    # TODO: Is there a way to not pin the version of llvm? -z to pkg_add does not work.
+                        pkg_add rust rust-clippy rust-rustfmt llvm-19.1.7p3 nss pkgconf # rustup does not support OpenBSD at all
+                        ;;
+            netbsd)     /usr/sbin/pkg_add pkgin && pkgin -y install curl clang nss pkgconf
+                        ;;
+            solaris)    pkg install clang-libs nss pkg-config
+                        ;;
+            *)          echo "Unsupported OS: $PLATFORM"
+                        exit 1
+                        ;;
+          esac
+        EOF
+        {
+          echo 'prepare<<EOF'
+          cat prepare.sh
+          echo EOF
+        } >> "$GITHUB_OUTPUT"
+
+        cat <<EOF > run.sh
+          # This executes as user
+          set -ex
+          cd "$WD"
+          pwd
+          case "$PLATFORM" in
+            freebsd)    sh rustup.sh --default-toolchain stable --profile minimal --component clippy,llvm-tools,rustfmt -y
+                        . "\$HOME/.cargo/env"
+                        ;;
+            openbsd)    export LIBCLANG_PATH=/usr/local/llvm19/lib
+                        export LLVM_COV=/usr/local/llvm19/bin/llvm-cov
+                        export LLVM_PROFDATA=/usr/local/llvm19/bin/llvm-profdata
+                        [ "$WORKSPACE" ] && EXCLUDE="--exclude fuzz" # Fuzzing not supported on OpenBSD
+                        ;;
+            netbsd)     sh rustup.sh --default-toolchain stable --profile minimal --component clippy,llvm-tools,rustfmt -y
+                        . "\$HOME/.cargo/env"
+                        # FIXME: Why do we need to set this on NetBSD?
+                        export LD_LIBRARY_PATH=/usr/pkg/lib/nss:/usr/pkg/lib/nspr
+                        [ "$WORKSPACE" ] && EXCLUDE="--exclude fuzz" # Fuzzing not supported on NetBSD
+                        ;;
+            solaris)    curl --output rust.sh -s https://raw.githubusercontent.com/psumbera/solaris-rust/refs/heads/main/sh.rust-web-install
+                        chmod a+x rust.sh
+                        ls -lt
+                        source ./rust.sh || true # This does not exit with zero on success
+                        export LIBCLANG_PATH="/usr/lib/amd64"
+                        [ "$WORKSPACE" ] && EXCLUDE="--exclude fuzz" # Fuzzing not supported on Solaris
+                        ;;
+          esac
+          cargo version
+          cargo check --locked --all-targets $WORKSPACE \$EXCLUDE
+          case "$PLATFORM" in
+            openbsd)    # clippy fails on OpenBSD, because libfuzzer-sys is not supported.
+                        ;;
+            *)          cargo clippy -- -D warnings
+                        ;;
+          esac
+          cargo fmt --all -- --check
+          case "$PLATFORM" in
+            freebsd)    cargo install cargo-llvm-cov --locked
+                        cargo llvm-cov test --locked --no-fail-fast --lcov --output-path lcov.info
+                        ;;
+            *)          # FIXME: No profiler support on other platforms, error is: cannot find crate for profiler_builtins
+                        cargo test --locked --no-fail-fast # We do this instead for now
+                        ;;
+          esac
+          cargo test --locked --no-fail-fast --release
+          rm -rf target # Do not sync this back to host
+        EOF
+        {
+          echo 'run<<EOF'
+          cat run.sh
+          echo EOF
+        } >> "$GITHUB_OUTPUT"
+
+        curl -o "$WD/rustup.sh" --proto '=https' --tlsv1.2 -sSf https://sh.rustup.rs
+        echo "envs=CARGO_TERM_COLOR RUST_BACKTRACE RUST_LOG GITHUB_ACTIONS RUST_TEST_TIME_UNIT RUST_TEST_TIME_INTEGRATION RUST_TEST_TIME_DOCTEST WD" >> "$GITHUB_OUTPUT"
+
+    - if: ${{ inputs.platform == 'freebsd' }}
+      uses: vmactions/freebsd-vm@966989c456d41351f095a421f60e71342d3bce41 # v1.2.1
+      with:
+        usesh: true
+        envs: ${{ steps.prep.outputs.envs }}
+        prepare: ${{ steps.prep.outputs.prepare }}
+        run: ${{ steps.prep.outputs.run }}
+
+    - if: ${{ inputs.platform == 'openbsd' }}
+      uses: vmactions/openbsd-vm@0d65352eee1508bab7cb12d130536d3a556be487 # v1.1.8
+      with:
+        usesh: true
+        envs: ${{ steps.prep.outputs.envs }}
+        prepare: ${{ steps.prep.outputs.prepare }}
+        run: ${{ steps.prep.outputs.run }}
+
+    - if: ${{ inputs.platform == 'netbsd' }}
+      uses: vmactions/netbsd-vm@d0228be27fbaba19418cc1b332609a895cf16561 # v1.1.9
+      with:
+        usesh: true
+        envs: ${{ steps.prep.outputs.envs }}
+        prepare: ${{ steps.prep.outputs.prepare }}
+        run: ${{ steps.prep.outputs.run }}
+
+    - if: ${{ inputs.platform == 'solaris' }}
+      uses: vmactions/solaris-vm@58cbd70c6e051860f9b8f65908cc582938fbbdba # v1.1.5
+      with:
+        release: "11.4-gcc"
+        usesh: true
+        envs: ${{ steps.prep.outputs.envs }}
+        prepare: ${{ steps.prep.outputs.prepare }}
+        run: ${{ steps.prep.outputs.run }}
+
+    - if: ${{ inputs.codecov-token != '' }}
+      uses: codecov/codecov-action@fdcc8476540edceab3de004e990f80d881c6cc00 # v5.5.0
+      with:
+        files: lcov.info
+        fail_ci_if_error: false
+        token: ${{ inputs.codecov-token }}
+        verbose: true