diff --git a/.github/workflows/airgapped.yaml b/.github/workflows/airgapped.yaml index fb3fd4ee..ada93900 100644 --- a/.github/workflows/airgapped.yaml +++ b/.github/workflows/airgapped.yaml @@ -26,6 +26,8 @@ on: - "component/**" - "examples/components/**" - "templates/**" + # check-versions.sh reads its go-pkg pin. + - "plugin/go.mod" # Runs on every pull request so the required `airgapped-gate` check always # reports; the `changes` job skips the build when none of the paths changed. pull_request: @@ -61,6 +63,7 @@ jobs: - "component/**" - "examples/components/**" - "templates/**" + - "plugin/go.mod" # Cheap and fast: catches BUILDING.md drifting from reality without building # anything. Runs first so a stale doc fails in seconds, not minutes. diff --git a/BUILDING.md b/BUILDING.md index 38e886f7..44511d52 100644 --- a/BUILDING.md +++ b/BUILDING.md @@ -15,7 +15,7 @@ every value from its real upstream source and fails if the two disagree. |---|---| | Go | 1.27.3 (`go.bytecodealliance.org/pkg` and `/wasi` declare `go 1.27.1`, the minimum) | | `go.wasmcloud.dev/component` | v0.1.6 | -| `go.bytecodealliance.org/pkg` | v0.4.0 | +| `go.bytecodealliance.org/pkg` | v0.4.1 | | `go.bytecodealliance.org/wasi` | v0.1.1 | | componentize-go | v0.4.3 (module and toolchain) | | wit-bindgen-go | 0.61.1 (rev `4f9a02d7`) | @@ -72,13 +72,29 @@ the pinned module and fails if it does not match the module's own version. ## go-pkg and go-wasi -`go.bytecodealliance.org/pkg` v0.4.0 is only the WIT runtime the generated -bindings link against (`wit/types`, `wit/runtime`, `wit/async`). The +Since v0.4.0, `go.bytecodealliance.org/pkg` is only the WIT runtime the +generated bindings link against (`wit/types`, `wit/runtime`, `wit/async`). The vendor-neutral packages that used to live beside it — `wasihttp`, `wasilog`, `wasiconfig` and the `wasi:*` bindings — moved to [`go.bytecodealliance.org/wasi`](https://github.com/bytecodealliance/go-wasi) (go-wasi). Apps import those from go-wasi; this SDK does not wrap them. +**v0.4.1 is the floor.** Before it, the Go garbage collector could start a +cycle inside `cabi_realloc`, the allocator the host calls to copy a value into +the component's memory. A GC cycle calls imports (clocks, I/O polling), and the +component model forbids imports during `cabi_realloc`, so the component traps. +It only shows up once a single value is large enough to trigger GC: a +`list` of ~40k records, or one multi-megabyte NATS KV value, with +`gcStart` and `cabi_realloc` in the backtrace. +[go-pkg#13](https://github.com/bytecodealliance/go-pkg/pull/13) defers GC work +until the allocation returns. Every module here requires v0.4.1, so Go's +minimum version selection picks it even under an SDK release that still names +v0.4.0. If you copied an example before this, run +`go get go.bytecodealliance.org/pkg@v0.4.1` in your module. That updates go.mod +and go.sum together. Editing go.mod by hand does not, and the next build fails +with `missing go.sum entry` (or, if you added a second `require` line, +`go: updates to go.mod needed`). + go-wasi carries its own `componentize-go.toml` and WIT, as this SDK does, and componentize-go loads both. The `wasi:*` packages under `component/wit/deps` are kept byte-identical to go-wasi's, so the two resolve to one package each. diff --git a/airgap/Dockerfile b/airgap/Dockerfile index f40e45c5..1590695a 100644 --- a/airgap/Dockerfile +++ b/airgap/Dockerfile @@ -53,8 +53,12 @@ COPY . . # Fill GOMODCACHE for every module in the repo. Done before any build so a # failure here is unambiguously a module-resolution problem. +# +# component/ is seeded too: an in-repo SDK build replaces the released SDK +# with it, so its own requirements must be here even when no example happens +# to name the same versions. RUN set -eux; \ - for mod in $(find examples/components templates -name go.mod); do \ + for mod in $(find component examples/components templates -name go.mod); do \ dir=$(dirname "$mod"); \ echo "==> downloading deps for ${dir}"; \ (cd "$dir" && go mod download all); \ diff --git a/airgap/check-versions.sh b/airgap/check-versions.sh index beda6ec5..d2391977 100755 --- a/airgap/check-versions.sh +++ b/airgap/check-versions.sh @@ -32,6 +32,28 @@ check() { note() { printf ' -- %-28s %s\n' "$1" "$2"; } +# check_module_pins