name: WASI Preview 3 — wasmtime parity

# Issue #583 C1 — runs the same `wasm32-wasip3` fixtures through both
# `wamr` and upstream `wasmtime`, then diffs the JSON reports so a
# wamr regression that wasmtime *also* exhibits surfaces as a fixture
# bug rather than a wamr bug. PR #518 only landed the wamr-side gate;
# this workflow closes the loop proposed in #489.
#
# Trigger policy:
#   * push to `main` / `zig` — keeps the gate close to PRs without
#     blocking individual PRs while the parity infra beds in. Per #583
#     C1's "start with on-push to main and adjust" guidance.
#   * nightly cron — catches drift between wamr and wasmtime even if
#     no push lands in a 24h window.
#   * `workflow_dispatch` — manual triage from the Actions UI.
#
# Wasmtime is pinned to v44.0.1 (the same pin used by the existing
# `component-examples-wasmtime` job in `.github/workflows/ci.yml`).
# v44.0.1 is the first stable release with `-Sp3` / wasm32-wasip3
# support; older versions cannot run the corpus at all. The pin lives
# in two places (`component-examples-wasmtime` and here); bump them
# together.

on:
  push:
    branches: [main, zig]
  schedule:
    - cron: "27 4 * * *" # 04:27 UTC nightly — outside CI peak.
  workflow_dispatch:

# Cancel superseded runs on the same branch so a sequence of pushes
# only consumes one runner-slot worth of wall time.
concurrency:
  group: ${{ github.workflow }}-${{ github.ref }}
  cancel-in-progress: true

permissions:
  contents: read

jobs:
  wasi-p3-parity:
    name: Wasmtime parity (wasm32-wasip3)
    runs-on: ubuntu-22.04
    # Required: a green run means either every fixture matches between
    # wamr and wasmtime, or every wamr-pass / wasmtime-fail delta is
    # documented under `tests/wasi-p3-parity-skip.json` with an
    # upstream tracking issue (the gate flips red on any *new* such
    # delta, and on any wamr regression that wasmtime still passes).
    # Used to run with `continue-on-error: true` while the wasmtime
    # baseline was being characterised (PR #592); flipped to required
    # in PR #583 C1 follow-up once the 4 v44.0.1 deltas were filed
    # upstream and skip-listed.
    steps:
      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
        with:
          submodules: true

      - name: Install Zig
        uses: mlugg/setup-zig@d1434d08867e3ee9daa34448df10607b98908d29 # v2
        with:
          version: 0.16.0
          use-cache: false

      - name: Configure Zig caches
        uses: ./.github/actions/zig-cache

      - name: Set up Python
        uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065 # v5.6.0
        with:
          python-version: "3.12"

      - name: Install wasi-testsuite runner deps
        run: |
          pip install --user -r tests/wasi-testsuite/test-runner/requirements.txt

      # Wasmtime 44.0.1 is the first stable release that supports
      # `wasm32-wasip3` via `-Sp3`. Matches the pin used by the
      # `component-examples-wasmtime` job in `ci.yml`; bump them
      # together. The official installer drops the binary into
      # `~/.wasmtime/bin/`; appending it to `$GITHUB_PATH` lets the
      # `WASMTIME` env var fall back to the unqualified `wasmtime`
      # name resolved through `PATH`.
      - name: Install wasmtime v44.0.1
        run: |
          curl https://wasmtime.dev/install.sh -sSf | bash -s -- --version v44.0.1
          echo "$HOME/.wasmtime/bin" >> "$GITHUB_PATH"

      - name: Build wamr (ReleaseSafe)
        # ReleaseSafe instead of Debug for the same reason as the
        # `wasi-p3-testsuite` job: the `http-fields` fixture sweeps
        # ≥1024 codepoints through the host adapter on every run,
        # which the Debug interpreter cannot complete inside the
        # 5-second per-`wait` timeout. Safety checks still fire so a
        # real regression still trips the gate.
        run: zig build -Doptimize=ReleaseSafe

      - name: Run Wasmtime parity gate
        run: zig build wasi-p3-parity -Doptimize=ReleaseSafe

      - name: Upload parity JSON reports
        if: always()
        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
        with:
          name: wasi-p3-parity-reports
          path: |
            zig-out/test-reports/wamr-p3.json
            zig-out/test-reports/wasmtime-p3.json
            zig-out/test-reports/wasi-p3-parity.json
          if-no-files-found: warn
          retention-days: 30