༼ つ ◕_◕ ༽つ release elide alpha8

Prepares the `alpha8` release of Elide.

- feat: extended language tooling
- feat(dev): add support for rust
- feat(dev): add new `graalvm-ts` module for typescript
- feat(model): model for dependencies in project config
- feat(model): model for tooling configurations and support
- feat(node): node native std module structures
- feat(node): implement `path` module
- feat(node): implement `process` module
- fix: build deprecations, ability to override kotlin + jvm targets
- fix: detect `Throwable` instances as provided to logging calls
- fix: generate stacktrace and include in place of exception
- fix: ci audit for build, unused imports/fmt
- fix: version alignment for netty and kotlin
- fix(cli): duplicate print with commands via repl
- fix(cli): language selector logic
- fix(cli): missing libffi dependency
- fix(cli): static native library registration
- fix(cli): jline output style
- fix(cli): support for `elide srcfile.<js|py|rb>`
- fix(cli): language/action selection from root entrypoint
- fix(cli): ability to detect language by file extension
- fix(cli): command prefix should override language selection
- fix(dev): detekt version and conventions
- fix(js): cis and esm imports
- fix(js): js bindings in newer testing framework
- fix(js): latest language declaration for `ES2023`
- fix(vfs): short-read bug in vfs layer
- fix(vfs): vfs access during testing
- chore: release bump → `1.0.0-alpha8`
- chore: issue new packaging and install script versions
- chore: doc for issue with gvm/ruby
- chore: readme updates; language compat, new versions
- chore: use short test names in console reporting
- chore: rebuild docs
- chore: fix slsa provenance
- chore: strict ci hardening
- chore: update pgo profiles
- chore: remove superfluous deps from native image
- chore: enable embedded sbom
- chore: enable pgo
- chore: enable context pre-init (non-experimental)
- chore(model): language support updates to embedded vm info
- chore(tooling): add `pkl` module
- chore(tooling): add `esbuild` module
- chore(tooling): add `ruff` module
- chore(tooling): add `uv` module
- chore(tooling): add third_party root
- chore(cli): re-enable native lib features
- chore(cli): add `umbrella` native lib for tooling bridge
- chore(cli): add new `cli-bridge` module for JNI access to umbrella lib
- chore(js): recompile polyfills and runtime facade
- chore(js): cleanup old experimental esbuild entry point

Fixes and closes #789
Fixes and closes #210

Relates-To: oracle/graal#8795
Signed-off-by: Sam Gammon <sam@elide.ventures>

.devcontainer/Dockerfile

@@ -5,7 +5,7 @@ FROM mcr.microsoft.com/devcontainers/base:ubuntu-22.04
 LABEL org.opencontainers.image.vendor=Elide
 LABEL org.opencontainers.image.title="Elide Codespace"
 LABEL org.opencontainers.image.description="Elide runtime within a GitHub Codespace"
-LABEL org.opencontainers.image.version=1.0.0-alpha7
+LABEL org.opencontainers.image.version=1.0.0-alpha8
 LABEL org.opencontainers.image.url=https://github.com/elide-dev/elide
 LABEL org.opencontainers.image.base.name=mcr.microsoft.com/devcontainers/base
 LABEL org.opencontainers.image.source=https://github.com/elide-dev/elide/blob/main/.devcontainer/Elide.devcontainer

.gitattributes

@@ -5,14 +5,18 @@
 *.owl linguist-language=Web-Ontology-Language
 *.BUILD -linguist-detectable
 *.bzl linguist-language=Starlark linguist-detectable
+*.lockfile linguist-generated
+pnpm-lock.yaml linguist-generated
+gradle/verification* linguist-generated
 **/package-info.java -linguist-detectable linguist-generated
 samples/** -linguist-detectable
+tools/tsc/src/main/resources/META-INF/elide/embedded/tools/tsc/entry.mjs linguist-generated
 packages/graalvm/src/test/resources/embedded/** -linguist-detectable linguist-generated
 packages/graalvm/src/test/resources/embedded/*.js -linguist-detectable linguist-generated
 packages/graalvm-react/src/main/node/** -linguist-detectable linguist-generated
 packages/graalvm-react/src/main/node/*.js -linguist-detectable linguist-generated
-docs linguist-documentation
-docs/* linguist-documentation
+docs linguist-documentation -linguist-detectable linguist-generated
+docs/* linguist-documentation -linguist-detectable linguist-generated
 tools/plugin/gradle-plugin/plugin-build/plugin/src/model/java -linguist-detectable linguist-generated
 tools/plugin/gradle-plugin/plugin-build/plugin/src/model/kotlin -linguist-detectable linguist-generated
 tools/plugin/gradle-plugin/plugin-build/plugin/src/main/proto -linguist-detectable linguist-generated

.github/CONTRIBUTING.md

@@ -32,13 +32,17 @@ image-native-alpine            Build native Alpine base image.
 image-native                   Build native Ubuntu base image.
 image-runtime-jvm17            Build runtime GVM17 builder image.
 images                         Build all Docker images.
+model-update                   Update the proto model and re-build it.
+model                          Build proto model targets.
 publish                        Publish a new version of all Elide packages.
+release                        Perform a full release, including publishing to Maven Central and the Elide repository.
 relock-deps                    Update dependency locks and hashes across Yarn and Gradle.
 reports                        Generate reports for tests, coverage, etc.
 serve-docs                     Serve documentation locally.
 serve-site                     Serve Elide site locally.
 site                           Generate the static Elide website.
 test                           Run the library testsuite, and code-sample tests if SAMPLES=yes.
+third-party                    Build all third-party embedded projects.
 update-deps                    Perform interactive dependency upgrades across Yarn and Gradle.
 update-jdeps                   Interactively update Gradle dependencies.
 update-jsdeps                  Interactively update Yarn dependencies.
@@ -137,13 +141,13 @@ Check the `gradle.properties` file at the project root to see all available opti
 If you are building a JVM application that runs guest code in one of the languages supported by Elide, you can use the Runtime DSL to configure your own embedded polyglot engine:
 
 ```kotlin
-implementation("dev.elide:elide-graalvm:1.0.0-alpha7")
+implementation("dev.elide:elide-graalvm:1.0.0-alpha8")
 ```
 
 or for Groovy scripts:
 
 ```groovy
-implementation 'dev.elide:elide-graalvm:1.0.0-alpha7'
+implementation 'dev.elide:elide-graalvm:1.0.0-alpha8'
 ```
 
 The DSL is used internally by the Elide binaries and by the SSR packages and provides a simplified API to harness the power of the underlying [GraalVM](https://graalvm.org) engine:

.github/workflows/checks.apicheck.yml

@@ -63,7 +63,22 @@ jobs:
       - name: "Setup: Harden Runner"
         uses: step-security/harden-runner@63c24ba6bd7ba022e95695ff85de572c04a18142 # v2.7.0
         with:
-          egress-policy: audit
+          disable-sudo: true
+          egress-policy: block
+          allowed-endpoints: >
+            api.github.com:443
+            d3ob9fqp587by1.cloudfront.net:443
+            download.oracle.com:443
+            elide-snapshots.storage-download.googleapis.com:443
+            github.com:443
+            gradle.less.build:443
+            gradle.pkg.st:443
+            jpms.pkg.st:443
+            maven.pkg.jetbrains.space:443
+            maven.pkg.st:443
+            nodejs.org:443
+            registry.npmjs.org:443
+            repo.maven.apache.org:443
       - name: "Setup: Checkout"
         uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4.1.1
         with:

.github/workflows/checks.codeql.yml

@@ -59,7 +59,21 @@ jobs:
       - name: "Setup: Harden Runner"
         uses: step-security/harden-runner@63c24ba6bd7ba022e95695ff85de572c04a18142 # v2.7.0
         with:
-          egress-policy: audit
+          disable-sudo: true
+          egress-policy: block
+          allowed-endpoints: >
+            androidx.dev:443
+            api.github.com:443
+            d3ob9fqp587by1.cloudfront.net:443
+            download.oracle.com:443
+            elide-snapshots.storage-download.googleapis.com:443
+            github.com:443
+            gradle.less.build:443
+            gradle.pkg.st:443
+            jpms.pkg.st:443
+            maven.pkg.jetbrains.space:443
+            maven.pkg.st:443
+            objects.githubusercontent.com:443
       - name: "Setup: Checkout"
         uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4.1.1
         with:

.github/workflows/checks.dependency-review.yml

@@ -28,7 +28,13 @@ jobs:
       - name: "Setup: Harden Runner"
         uses: step-security/harden-runner@63c24ba6bd7ba022e95695ff85de572c04a18142 # v2.7.0
         with:
-          egress-policy: audit
+          disable-sudo: true
+          egress-policy: block
+          allowed-endpoints: >
+            api.deps.dev:443
+            api.github.com:443
+            api.securityscorecards.dev:443
+            github.com:443
       - name: "Setup: Checkout"
         uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4.1.1
         with:

.github/workflows/checks.detekt.yml

@@ -51,7 +51,17 @@ jobs:
       - name: "Setup: Harden Runner"
         uses: step-security/harden-runner@63c24ba6bd7ba022e95695ff85de572c04a18142 # v2.7.0
         with:
-          egress-policy: audit
+          disable-sudo: true
+          egress-policy: block
+          allowed-endpoints: >
+            api.github.com:443
+            download.oracle.com:443
+            elide-snapshots.storage-download.googleapis.com:443
+            github.com:443
+            gradle.less.build:443
+            gradle.pkg.st:443
+            jpms.pkg.st:443
+            maven.pkg.st:443
       - name: "Setup: Checkout"
         uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4.1.1
         with:

.github/workflows/checks.formatting.yml

@@ -63,7 +63,21 @@ jobs:
       - name: "Setup: Harden Runner"
         uses: step-security/harden-runner@63c24ba6bd7ba022e95695ff85de572c04a18142 # v2.7.0
         with:
-          egress-policy: audit
+          disable-sudo: true
+          egress-policy: block
+          allowed-endpoints: >
+            api.github.com:443
+            download.oracle.com:443
+            elide-snapshots.storage-download.googleapis.com:443
+            github.com:443
+            gradle.less.build:443
+            gradle.pkg.st:443
+            keyserver.ubuntu.com:443
+            maven.pkg.jetbrains.space:443
+            maven.pkg.st:443
+            nodejs.org:443
+            registry.npmjs.org:443
+            repo.maven.apache.org:443
       - name: "Setup: Checkout"
         uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4.1.1
         with:

.github/workflows/checks.gradle-wrapper.yml

@@ -28,7 +28,12 @@ jobs:
       - name: "Setup: Harden Runner"
         uses: step-security/harden-runner@63c24ba6bd7ba022e95695ff85de572c04a18142 # v2.7.0
         with:
-          egress-policy: audit
+          disable-sudo: true
+          egress-policy: block
+          allowed-endpoints: >
+            downloads.gradle.org:443
+            github.com:443
+            services.gradle.org:443
       - name: "Setup: Checkout"
         uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4.1.1
         with:

.github/workflows/checks.model.yml

@@ -84,7 +84,13 @@ jobs:
       - name: "Setup: Harden Runner"
         uses: step-security/harden-runner@63c24ba6bd7ba022e95695ff85de572c04a18142 # v2.7.0
         with:
-          egress-policy: audit
+          disable-sudo: true
+          egress-policy: block
+          allowed-endpoints: >
+            api.github.com:443
+            buf.build:443
+            github.com:443
+            objects.githubusercontent.com:443
       - name: "Setup: Checkout"
         uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4.1.1
         with:
@@ -116,7 +122,13 @@ jobs:
       - name: "Setup: Harden Runner"
         uses: step-security/harden-runner@63c24ba6bd7ba022e95695ff85de572c04a18142 # v2.7.0
         with:
-          egress-policy: audit
+          disable-sudo: true
+          egress-policy: block
+          allowed-endpoints: >
+            api.github.com:443
+            buf.build:443
+            github.com:443
+            objects.githubusercontent.com:443
       - name: "Setup: Checkout"
         uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4.1.1
         with:

.github/workflows/job.build.yml

@@ -190,7 +190,40 @@ jobs:
       - name: "Setup: Harden Runner"
         uses: step-security/harden-runner@63c24ba6bd7ba022e95695ff85de572c04a18142 # v2.7.0
         with:
+          disable-sudo: true
           egress-policy: audit
+          allowed-endpoints: >
+            agent.less.build:443
+            androidx.dev:443
+            api.github.com:443
+            cli.less.build:443
+            d3ob9fqp587by1.cloudfront.net:443
+            dl.google.com:443
+            dl.less.build:443
+            download-cdn.jetbrains.com:443
+            download.jetbrains.com:443
+            download.oracle.com:443
+            edge.pkg.st:443
+            elide-snapshots.storage-download.googleapis.com:443
+            github.com:443
+            global.less.build:443
+            gradle.pkg.st:443
+            jpms.pkg.st:443
+            keys.openpgp.org:443
+            keyserver.ubuntu.com:443
+            local.less.build:443
+            maven.pkg.jetbrains.space:443
+            maven.pkg.st:443
+            nodejs.org:443
+            npm.pkg.st:443
+            objects.githubusercontent.com:443
+            pgp.mit.edu:443
+            plugins-artifacts.gradle.org:443
+            plugins.gradle.org:443
+            registry.npmjs.org:443
+            repo.maven.apache.org:443
+            scans-in.gradle.com:443
+            services.gradle.org:443
       - name: "Setup: Checkout"
         uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4.1.1
         with:
@@ -370,7 +403,7 @@ jobs:
   ## Report: Provenance
   provenance:
     name: Provenance
-    uses: slsa-framework/slsa-github-generator/.github/workflows/generator_generic_slsa3.yml@v1.9.0
+    uses: slsa-framework/slsa-github-generator/.github/workflows/generator_generic_slsa3.yml@v1.10.0
     if: inputs.provenance
     needs: [gradle]
     permissions:

.github/workflows/job.test.yml

@@ -156,7 +156,48 @@ jobs:
       - name: "Setup: Harden Runner"
         uses: step-security/harden-runner@63c24ba6bd7ba022e95695ff85de572c04a18142 # v2.7.0
         with:
-          egress-policy: audit
+          disable-sudo: true
+          egress-policy: block
+          allowed-endpoints: >
+            agent.less.build:443
+            androidx.dev:443
+            api.codecov.io:443
+            api.foojay.io:443
+            api.github.com:443
+            cli.codecov.io:443
+            cli.less.build:443
+            d3ob9fqp587by1.cloudfront.net:443
+            dc.services.visualstudio.com:443
+            dl.google.com:443
+            dl.less.build:443
+            download-cdn.jetbrains.com:443
+            download.jetbrains.com:443
+            download.oracle.com:443
+            ea6ne4j2sb.execute-api.eu-central-1.amazonaws.com:443
+            edge.pkg.st:443
+            elide-snapshots.storage-download.googleapis.com:443
+            github.com:22
+            github.com:443
+            global.less.build:443
+            gradle.pkg.st:443
+            jpms.pkg.st:443
+            keys.openpgp.org:443
+            keyserver.ubuntu.com:443
+            local.less.build:443
+            maven.pkg.jetbrains.space:443
+            maven.pkg.st:443
+            nodejs.org:443
+            npm.pkg.st:443
+            objects.githubusercontent.com:443
+            pgp.mit.edu:443
+            registry.npmjs.org:443
+            repo.maven.apache.org:443
+            sc-cleancode-sensorcache-eu-central-1-prod.s3.amazonaws.com:443
+            scanner.sonarcloud.io:443
+            scans-in.gradle.com:443
+            services.gradle.org:443
+            sonarcloud.io:443
+            storage.googleapis.com:443
       - name: "Setup: Checkout"
         uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4.1.1
         with:

.github/workflows/on.pr.yml

@@ -125,7 +125,29 @@ jobs:
       - name: "Setup: Harden Runner"
         uses: step-security/harden-runner@63c24ba6bd7ba022e95695ff85de572c04a18142 # v2.7.0
         with:
-          egress-policy: audit
+          disable-sudo: true
+          egress-policy: block
+          allowed-endpoints: >
+            agent.less.build:443
+            api.github.com:443
+            cli.less.build:443
+            d3ob9fqp587by1.cloudfront.net:443
+            dl.less.build:443
+            download.oracle.com:443
+            edge.pkg.st:443
+            elide-snapshots.storage-download.googleapis.com:443
+            github.com:443
+            global.less.build:443
+            gradle.pkg.st:443
+            jpms.pkg.st:443
+            keys.openpgp.org:443
+            keyserver.ubuntu.com:443
+            local.less.build:443
+            maven.pkg.jetbrains.space:443
+            maven.pkg.st:443
+            objects.githubusercontent.com:443
+            pgp.mit.edu:443
+            services.gradle.org:443
       - name: "Setup: Checkout"
         uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4.1.1
         with:

.gitignore

@@ -34,3 +34,4 @@ packages/graalvm/test.mjs
 *.pyo
 .codebase/
 docs/reports/
+target

.gitmodules

@@ -5,3 +5,19 @@
 [submodule "elide-uuid"]
 	path = packages/uuid
 	url = git@github.com:elide-dev/uuid.git
+[submodule "ruff"]
+	path = third_party/astral/ruff
+	url = git@github.com:astral-sh/ruff.git
+[submodule "uv"]
+	path = third_party/astral/uv
+	url = git@github.com:astral-sh/uv.git
+[submodule "esbuild"]
+	path = third_party/evanw/esbuild
+	url = git@github.com:evanw/esbuild.git
+[submodule "pkl"]
+	path = third_party/apple/pkl
+	url = git@github.com:elide-dev/pkl.git
+	branch = edge
+[submodule "oxc"]
+	path = third_party/oxc-project/oxc
+	url = git@github.com:oxc-project/oxc.git

.prettierignore

@@ -5,6 +5,7 @@ docs
 kotlin-js-store
 .idea
 .gradle
+.github/workflows
 proto
 proto/buf.pb.json
 buildSrc

.release

@@ -1 +1 @@
-1.0.0-alpha7
+1.0.0-alpha8