nasa · Kronos3 · Sep 3, 2026 · Aug 31, 2026 · Aug 31, 2026 · Sep 3, 2026
diff --git a/.github/actions/install-wabt/action.yml b/.github/actions/install-wabt/action.yml
@@ -0,0 +1,49 @@
+name: Install WABT
+description: >
+  Download and install the WebAssembly Binary Toolkit (WABT)
+
+runs:
+  using: composite
+  steps:
+    - name: Install WABT (WebAssembly Binary Toolkit)
+      shell: bash
+      run: |
+        set -euo pipefail
+        # WABT release to install. The SHA-256 pins below are specific to this
+        # version -- bump both together (checksums come from the upstream
+        # release page) or verification will (correctly) fail.
+        WABT_VERSION=1.0.41
+        # Select the upstream release asset for this runner. macOS x64 is handled
+        # defensively but intentionally has no pinned checksum: no Intel-mac
+        # runner is in the matrix, so add its checksum before scheduling one.
+        if [ "$RUNNER_OS" == "macOS" ]; then
+          if [ "$RUNNER_ARCH" == "ARM64" ]; then
+            WABT_PLATFORM="macos-arm64"
+          else
+            WABT_PLATFORM="macos-x64"
+          fi
+        else
+          # Linux
+          if [ "$RUNNER_ARCH" == "ARM64" ]; then
+            WABT_PLATFORM="linux-arm64"
+          else
+            WABT_PLATFORM="linux-x64"
+          fi
+        fi
+        case "$WABT_PLATFORM" in
+          linux-x64)   WABT_SHA256=83f8122e924745fcd70636e3594bc01c4c47f2d4c8f3c63b5d70d3f83a482677 ;;
+          linux-arm64) WABT_SHA256=5e35416ee8725dc7cc0572e4392a8117cbf008b0e34c0db65c75506b0299cdbf ;;
+          macos-arm64) WABT_SHA256=e5269d6bbe05dfeb179e4f21111b3a641d6ccaa38b0b21d472ae5c65f8c4ff5d ;;
+          *) echo "::error::No pinned WABT checksum for platform $WABT_PLATFORM"; exit 1 ;;
+        esac
+        tarball="wabt-${WABT_VERSION}-${WABT_PLATFORM}.tar.gz"
+        wget -q "https://github.com/WebAssembly/wabt/releases/download/${WABT_VERSION}/${tarball}"
+        # macOS runners ship `shasum` (Perl) rather than GNU coreutils'
+        # `sha256sum`; both accept the same "<hash>  <file>" verify format.
+        if command -v sha256sum >/dev/null 2>&1; then
+          echo "${WABT_SHA256}  ${tarball}" | sha256sum -c -
+        else
+          echo "${WABT_SHA256}  ${tarball}" | shasum -a 256 -c -
+        fi
+        tar -xzf "${tarball}"
+        sudo cp "wabt-${WABT_VERSION}/bin/"* /usr/local/bin/
diff --git a/.github/scripts/run-tests-with-miri.sh b/.github/scripts/run-tests-with-miri.sh
@@ -26,18 +26,29 @@ target_flag() {
 export -f target_flag
 
 # shellcheck disable=SC2206
-targets=(${MIRI_TEST_TARGETS:-lib core_integration regression_integration custom_page_sizes_integration statistics_integration})
+targets=(${MIRI_TEST_TARGETS:-lib core_integration regression_integration custom_page_sizes_integration})
 
 pairs_file="$(mktemp)"
 results_file="$(mktemp)"
 trap 'rm -f "$pairs_file" "$results_file"' EXIT
 
 for label in "${targets[@]}"; do
   target="$(target_flag "$label")"
-  RUSTFLAGS="--cfg miri" cargo test --quiet $target -- --list 2>/dev/null |
-    grep ': test$' | sed 's/: test$//' |
-    sed "s/^/${label}\t/" \
-      >>"$pairs_file"
+
+  if ! listing="$(RUSTFLAGS="--cfg miri" cargo test --quiet $target -- --list 2>&1)"; then
+    echo "!!! could not enumerate tests for target '${label}'" >&2
+    echo "$listing" >&2
+    exit 1
+  fi
+
+  names="$(printf '%s\n' "$listing" | grep ': test$' | sed 's/: test$//' || true)"
+  if [ -z "$names" ]; then
+    echo "!!! target '${label}' enumerated zero tests" >&2
+    echo "    (stale MIRI_TEST_TARGETS entry, or every test is #[ignore]d?)" >&2
+    exit 1
+  fi
+
+  printf '%s\n' "$names" | sed "s/^/${label}\t/" >>"$pairs_file"
 done
 
 total=$(wc -l <"$pairs_file")

diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
@@ -47,49 +47,15 @@ jobs:
 
     steps:
       - name: Checkout code
-        uses: actions/checkout@v4
+        uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4
 
       - name: Install Rust toolchain
         uses: dtolnay/rust-toolchain@4360b52568e2003a75bf9bc1d59f33a8e3fc893c
         with:
           components: rustfmt, clippy
 
       - name: Install WABT (WebAssembly Binary Toolkit)
-        run: |
-          set -euo pipefail
-          WABT_VERSION=1.0.41
-          if [ "$RUNNER_OS" == "macOS" ]; then
-            if [ "$RUNNER_ARCH" == "ARM64" ]; then
-              WABT_PLATFORM="macos-arm64"
-            else
-              WABT_PLATFORM="macos-x64"
-            fi
-          else
-            # Linux
-            if [ "$RUNNER_ARCH" == "ARM64" ]; then
-              WABT_PLATFORM="linux-arm64"
-            else
-              WABT_PLATFORM="linux-x64"
-            fi
-          fi
-          case "$WABT_PLATFORM" in
-            linux-x64)   WABT_SHA256=83f8122e924745fcd70636e3594bc01c4c47f2d4c8f3c63b5d70d3f83a482677 ;;
-            linux-arm64) WABT_SHA256=5e35416ee8725dc7cc0572e4392a8117cbf008b0e34c0db65c75506b0299cdbf ;;
-            macos-arm64) WABT_SHA256=e5269d6bbe05dfeb179e4f21111b3a641d6ccaa38b0b21d472ae5c65f8c4ff5d ;;
-            *) echo "::error::No pinned WABT checksum for platform $WABT_PLATFORM"; exit 1 ;;
-          esac
-          tarball="wabt-${WABT_VERSION}-${WABT_PLATFORM}.tar.gz"
-          wget -q "https://github.com/WebAssembly/wabt/releases/download/${WABT_VERSION}/${tarball}"
-          # macOS runners ship `shasum` (Perl) rather than GNU coreutils'
-          # `sha256sum`; both accept the same "<hash>  <file>" verify format.
-          if command -v sha256sum >/dev/null 2>&1; then
-            echo "${WABT_SHA256}  ${tarball}" | sha256sum -c -
-          else
-            echo "${WABT_SHA256}  ${tarball}" | shasum -a 256 -c -
-          fi
-          tar -xzf "${tarball}"
-          sudo cp wabt-${WABT_VERSION}/bin/* /usr/local/bin/
-        shell: bash
+        uses: ./.github/actions/install-wabt
 
       - name: Cache Rust dependencies
         # Pinned commit resolved from the annotated Swatinem/rust-cache@v2 tag.
@@ -127,7 +93,7 @@ jobs:
 
     steps:
       - name: Checkout code
-        uses: actions/checkout@v4
+        uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4
 
       - name: Install 32-bit system libraries
         run: |
@@ -140,16 +106,7 @@ jobs:
           targets: i686-unknown-linux-gnu
 
       - name: Install WABT (WebAssembly Binary Toolkit)
-        run: |
-          set -euo pipefail
-          WABT_VERSION=1.0.41
-          WABT_SHA256=83f8122e924745fcd70636e3594bc01c4c47f2d4c8f3c63b5d70d3f83a482677
-          tarball="wabt-${WABT_VERSION}-linux-x64.tar.gz"
-          wget -q "https://github.com/WebAssembly/wabt/releases/download/${WABT_VERSION}/${tarball}"
-          echo "${WABT_SHA256}  ${tarball}" | sha256sum -c -
-          tar -xzf "${tarball}"
-          sudo cp wabt-${WABT_VERSION}/bin/* /usr/local/bin/
-        shell: bash
+        uses: ./.github/actions/install-wabt
 
       # Only the interpreter library is deployed to the 32-bit target, so the
       # host-only workspace tooling is not built here. Running the suite on a
@@ -168,7 +125,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Checkout code
-        uses: actions/checkout@v4
+        uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4
 
       - name: Install Rust toolchain
         # Pinned to the commit the `stable` branch resolved to (its action.yml
@@ -210,7 +167,7 @@ jobs:
 
     steps:
       - name: Checkout code
-        uses: actions/checkout@v4
+        uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4
 
       - name: Install Rust toolchain
         uses: dtolnay/rust-toolchain@4360b52568e2003a75bf9bc1d59f33a8e3fc893c
@@ -228,24 +185,15 @@ jobs:
       contents: read
     steps:
       - name: Checkout code
-        uses: actions/checkout@v4
+        uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4
         with:
           fetch-depth: 0
 
       - name: Install Rust toolchain
         uses: dtolnay/rust-toolchain@4360b52568e2003a75bf9bc1d59f33a8e3fc893c
 
       - name: Install WABT (WebAssembly Binary Toolkit)
-        run: |
-          set -euo pipefail
-          WABT_VERSION=1.0.41
-          WABT_PLATFORM="linux-x64"
-          WABT_SHA256=83f8122e924745fcd70636e3594bc01c4c47f2d4c8f3c63b5d70d3f83a482677
-          tarball="wabt-${WABT_VERSION}-${WABT_PLATFORM}.tar.gz"
-          wget -q "https://github.com/WebAssembly/wabt/releases/download/${WABT_VERSION}/${tarball}"
-          echo "${WABT_SHA256}  ${tarball}" | sha256sum -c -
-          tar -xzf "${tarball}"
-          sudo cp wabt-${WABT_VERSION}/bin/* /usr/local/bin/
+        uses: ./.github/actions/install-wabt
 
       - name: Cache Rust dependencies
         # Pinned commit resolved from the annotated Swatinem/rust-cache@v2 tag.
@@ -262,7 +210,7 @@ jobs:
           echo "$output"
 
           # Extract the CoreMark score from the output
-          score=$(echo "$output" | grep "CoreMark Score:" | awk '{print $3}')
+          score=$(echo "$output" | grep -m1 "CoreMark Score:" | awk '{print $3}')
           if [ -z "$score" ]; then
             echo "Failed to extract CoreMark score"
             exit 1
@@ -280,7 +228,7 @@ jobs:
             git fetch origin main:main
             git checkout main
             baseline_output=$(cargo bench -p spacewasm_std --bench coremark --no-fail-fast 2>&1) || true
-            baseline_score=$(echo "$baseline_output" | grep "CoreMark Score:" | awk '{print $3}')
+            baseline_score=$(echo "$baseline_output" | grep -m1 "CoreMark Score:" | awk '{print $3}')
             git checkout -
 
             if [ -n "$baseline_score" ]; then
@@ -306,7 +254,7 @@ jobs:
 
       - name: Upload benchmark results
         if: github.event_name == 'pull_request'
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4
         with:
           name: benchmark-results
           path: benchmark-results.json
@@ -318,12 +266,12 @@ jobs:
       fail-fast: false
     steps:
       - name: Checkout code
-        uses: actions/checkout@v4
+        uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4
         with:
           fetch-depth: 0
 
       - name: Run Kani on repo
-        uses: model-checking/kani-github-action@v1.1
+        uses: model-checking/kani-github-action@f838096619a707b0f6b2118cf435eaccfa33e51f # v1.1
         with:
           args: "-j --output-format=terse"
 
@@ -332,16 +280,14 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Checkout code
-        uses: actions/checkout@v4
+        uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4
         with:
           fetch-depth: 0
 
       - name: Install Rust toolchain
-        uses: actions-rs/toolchain@v1
+        uses: dtolnay/rust-toolchain@4360b52568e2003a75bf9bc1d59f33a8e3fc893c
         with:
-          profile: minimal
-          toolchain: nightly
-          override: true
+          toolchain: nightly-2026-08-30
           components: miri
 
       - name: Run Miri
@@ -356,7 +302,7 @@ jobs:
       contents: read
     steps:
       - name: Checkout code
-        uses: actions/checkout@v4
+        uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4
         with:
           fetch-depth: 0
 
@@ -366,19 +312,12 @@ jobs:
           components: llvm-tools-preview
 
       - name: Install WABT (WebAssembly Binary Toolkit)
-        run: |
-          set -euo pipefail
-          WABT_VERSION=1.0.41
-          WABT_PLATFORM="linux-x64"
-          WABT_SHA256=83f8122e924745fcd70636e3594bc01c4c47f2d4c8f3c63b5d70d3f83a482677
-          tarball="wabt-${WABT_VERSION}-${WABT_PLATFORM}.tar.gz"
-          wget -q "https://github.com/WebAssembly/wabt/releases/download/${WABT_VERSION}/${tarball}"
-          echo "${WABT_SHA256}  ${tarball}" | sha256sum -c -
-          tar -xzf "${tarball}"
-          sudo cp wabt-${WABT_VERSION}/bin/* /usr/local/bin/
+        uses: ./.github/actions/install-wabt
 
       - name: Install cargo-llvm-cov
-        uses: taiki-e/install-action@cargo-llvm-cov
+        uses: taiki-e/install-action@37f7c5781271959fb65b6b35224e28652ff2b63d # v2.87.0
+        with:
+          tool: cargo-llvm-cov
 
       - name: Cache Rust dependencies
         uses: Swatinem/rust-cache@e18b497796c12c097a38f9edb9d0641fb99eee32
@@ -446,14 +385,14 @@ jobs:
 
       - name: Upload coverage results
         if: github.event_name == 'pull_request'
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4
         with:
           name: coverage-results
           path: coverage-results.json
 
       - name: Upload coverage to Codecov
         if: github.event_name == 'push' && github.ref == 'refs/heads/main'
-        uses: codecov/codecov-action@v7
+        uses: codecov/codecov-action@fb8b3582c8e4def4969c97caa2f19720cb33a72f # v7
         with:
           files: lcov.info
           token: ${{ secrets.CODECOV_TOKEN }}

diff --git a/.github/workflows/comment.yml b/.github/workflows/comment.yml
@@ -17,7 +17,7 @@ jobs:
     if: github.event.workflow_run.event == 'pull_request'
     steps:
       - name: Download CI artifacts
-        uses: actions/download-artifact@v4
+        uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # v4
         with:
           run-id: ${{ github.event.workflow_run.id }}
           github-token: ${{ secrets.GITHUB_TOKEN }}
@@ -27,7 +27,7 @@ jobs:
         continue-on-error: true
 
       - name: Post benchmark and coverage comments
-        uses: actions/github-script@v7
+        uses: actions/github-script@f28e40c7f34bde8b3046d885e986cb6290c5673b # v7
         env:
           TRUSTED_PR_NUMBER: ${{ github.event.workflow_run.pull_requests[0].number }}
         with:
@@ -99,7 +99,7 @@ jobs:
                 let comment = '## CoreMark Benchmark Results\n\n';
                 comment += `**Current Score:** ${currentScore.toFixed(3)}\n`;
 
-                if (baselineScore) {
+                if (baselineScore !== null) {
                   const diff = currentScore - baselineScore;
                   const percentChange = ((diff / baselineScore) * 100).toFixed(2);
 
@@ -128,7 +128,7 @@ jobs:
                 let comment = '## Code Coverage Report\n\n';
                 comment += `**Current Coverage:** ${currentCoverage.toFixed(2)}%\n`;
 
-                if (baselineCoverage) {
+                if (baselineCoverage !== null) {
                   const diff = currentCoverage - baselineCoverage;
 
                   comment += `**Baseline Coverage (main):** ${baselineCoverage.toFixed(2)}%\n`;

diff --git a/.github/workflows/daily.yml b/.github/workflows/daily.yml
@@ -18,26 +18,18 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Checkout code
-        uses: actions/checkout@v4
+        uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4
         with:
           fetch-depth: 0
 
       - name: Install Rust toolchain
-        uses: actions-rs/toolchain@v1
+        uses: dtolnay/rust-toolchain@4360b52568e2003a75bf9bc1d59f33a8e3fc893c
         with:
-          profile: minimal
-          toolchain: nightly
-          override: true
+          toolchain: nightly-2026-08-30
           components: miri
 
       - name: Install WABT (WebAssembly Binary Toolkit)
-        run: |
-          WABT_VERSION=1.0.41
-          WABT_PLATFORM="linux-x64"
-          wget https://github.com/WebAssembly/wabt/releases/download/${WABT_VERSION}/wabt-${WABT_VERSION}-${WABT_PLATFORM}.tar.gz
-          tar -xzf wabt-${WABT_VERSION}-${WABT_PLATFORM}.tar.gz
-          sudo cp wabt-${WABT_VERSION}/bin/* /usr/local/bin/
-        shell: bash
+        uses: ./.github/actions/install-wabt
 
       - name: Convert wast files for Miri
         run: cargo test --test miri_wast_convert -- --ignored
@@ -47,5 +39,5 @@ jobs:
           MIRIFLAGS: -Zmiri-disable-isolation
           MIRI_TEST_TIMEOUT_SECS: 1500
           MIRI_TEST_JOBS: 4
-          MIRI_TEST_TARGETS: core_integration regression_integration custom_page_sizes_integration statistics_integration
+          MIRI_TEST_TARGETS: core_integration regression_integration custom_page_sizes_integration
         run: ./.github/scripts/run-tests-with-miri.sh