chore: ༼ つ ◕_◕ ༽つ release elide alpha8

- chore: release bump → `1.0.0-alpha8`
- chore: issue new packaging and install script versions
- chore: doc for issue with gvm/ruby
- chore: readme updates; language compat, new versions
- chore: use short test names in console reporting
- chore: rebuild docs
- chore: fix slsa provenance
- chore: strict ci hardening

Fixes and closes #789

Relates-To: oracle/graal#8795
Signed-off-by: Sam Gammon <sam@elide.ventures>

.devcontainer/Dockerfile

@@ -5,7 +5,7 @@ FROM mcr.microsoft.com/devcontainers/base:ubuntu-22.04
 LABEL org.opencontainers.image.vendor=Elide
 LABEL org.opencontainers.image.title="Elide Codespace"
 LABEL org.opencontainers.image.description="Elide runtime within a GitHub Codespace"
-LABEL org.opencontainers.image.version=1.0.0-alpha7
+LABEL org.opencontainers.image.version=1.0.0-alpha8
 LABEL org.opencontainers.image.url=https://github.com/elide-dev/elide
 LABEL org.opencontainers.image.base.name=mcr.microsoft.com/devcontainers/base
 LABEL org.opencontainers.image.source=https://github.com/elide-dev/elide/blob/main/.devcontainer/Elide.devcontainer

.github/CONTRIBUTING.md

@@ -137,13 +137,13 @@ Check the `gradle.properties` file at the project root to see all available opti
 If you are building a JVM application that runs guest code in one of the languages supported by Elide, you can use the Runtime DSL to configure your own embedded polyglot engine:
 
 ```kotlin
-implementation("dev.elide:elide-graalvm:1.0.0-alpha7")
+implementation("dev.elide:elide-graalvm:1.0.0-alpha8")
 ```
 
 or for Groovy scripts:
 
 ```groovy
-implementation 'dev.elide:elide-graalvm:1.0.0-alpha7'
+implementation 'dev.elide:elide-graalvm:1.0.0-alpha8'
 ```
 
 The DSL is used internally by the Elide binaries and by the SSR packages and provides a simplified API to harness the power of the underlying [GraalVM](https://graalvm.org) engine:

.github/workflows/checks.apicheck.yml

@@ -63,7 +63,22 @@ jobs:
       - name: "Setup: Harden Runner"
         uses: step-security/harden-runner@63c24ba6bd7ba022e95695ff85de572c04a18142 # v2.7.0
         with:
-          egress-policy: audit
+          disable-sudo: true
+          egress-policy: block
+          allowed-endpoints: >
+            api.github.com:443
+            d3ob9fqp587by1.cloudfront.net:443
+            download.oracle.com:443
+            elide-snapshots.storage-download.googleapis.com:443
+            github.com:443
+            gradle.less.build:443
+            gradle.pkg.st:443
+            jpms.pkg.st:443
+            maven.pkg.jetbrains.space:443
+            maven.pkg.st:443
+            nodejs.org:443
+            registry.npmjs.org:443
+            repo.maven.apache.org:443
       - name: "Setup: Checkout"
         uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4.1.1
         with:

.github/workflows/checks.codeql.yml

@@ -59,7 +59,21 @@ jobs:
       - name: "Setup: Harden Runner"
         uses: step-security/harden-runner@63c24ba6bd7ba022e95695ff85de572c04a18142 # v2.7.0
         with:
-          egress-policy: audit
+          disable-sudo: true
+          egress-policy: block
+          allowed-endpoints: >
+            androidx.dev:443
+            api.github.com:443
+            d3ob9fqp587by1.cloudfront.net:443
+            download.oracle.com:443
+            elide-snapshots.storage-download.googleapis.com:443
+            github.com:443
+            gradle.less.build:443
+            gradle.pkg.st:443
+            jpms.pkg.st:443
+            maven.pkg.jetbrains.space:443
+            maven.pkg.st:443
+            objects.githubusercontent.com:443
       - name: "Setup: Checkout"
         uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4.1.1
         with:

.github/workflows/checks.dependency-review.yml

@@ -28,7 +28,13 @@ jobs:
       - name: "Setup: Harden Runner"
         uses: step-security/harden-runner@63c24ba6bd7ba022e95695ff85de572c04a18142 # v2.7.0
         with:
-          egress-policy: audit
+          disable-sudo: true
+          egress-policy: block
+          allowed-endpoints: >
+            api.deps.dev:443
+            api.github.com:443
+            api.securityscorecards.dev:443
+            github.com:443
       - name: "Setup: Checkout"
         uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4.1.1
         with:

.github/workflows/checks.detekt.yml

@@ -51,7 +51,17 @@ jobs:
       - name: "Setup: Harden Runner"
         uses: step-security/harden-runner@63c24ba6bd7ba022e95695ff85de572c04a18142 # v2.7.0
         with:
-          egress-policy: audit
+          disable-sudo: true
+          egress-policy: block
+          allowed-endpoints: >
+            api.github.com:443
+            download.oracle.com:443
+            elide-snapshots.storage-download.googleapis.com:443
+            github.com:443
+            gradle.less.build:443
+            gradle.pkg.st:443
+            jpms.pkg.st:443
+            maven.pkg.st:443
       - name: "Setup: Checkout"
         uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4.1.1
         with:

.github/workflows/checks.formatting.yml

@@ -63,7 +63,21 @@ jobs:
       - name: "Setup: Harden Runner"
         uses: step-security/harden-runner@63c24ba6bd7ba022e95695ff85de572c04a18142 # v2.7.0
         with:
-          egress-policy: audit
+          disable-sudo: true
+          egress-policy: block
+          allowed-endpoints: >
+            api.github.com:443
+            download.oracle.com:443
+            elide-snapshots.storage-download.googleapis.com:443
+            github.com:443
+            gradle.less.build:443
+            gradle.pkg.st:443
+            keyserver.ubuntu.com:443
+            maven.pkg.jetbrains.space:443
+            maven.pkg.st:443
+            nodejs.org:443
+            registry.npmjs.org:443
+            repo.maven.apache.org:443
       - name: "Setup: Checkout"
         uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4.1.1
         with:

.github/workflows/checks.gradle-wrapper.yml

@@ -28,7 +28,12 @@ jobs:
       - name: "Setup: Harden Runner"
         uses: step-security/harden-runner@63c24ba6bd7ba022e95695ff85de572c04a18142 # v2.7.0
         with:
-          egress-policy: audit
+          disable-sudo: true
+          egress-policy: block
+          allowed-endpoints: >
+            downloads.gradle.org:443
+            github.com:443
+            services.gradle.org:443
       - name: "Setup: Checkout"
         uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4.1.1
         with:

.github/workflows/checks.model.yml

@@ -84,7 +84,13 @@ jobs:
       - name: "Setup: Harden Runner"
         uses: step-security/harden-runner@63c24ba6bd7ba022e95695ff85de572c04a18142 # v2.7.0
         with:
-          egress-policy: audit
+          disable-sudo: true
+          egress-policy: block
+          allowed-endpoints: >
+            api.github.com:443
+            buf.build:443
+            github.com:443
+            objects.githubusercontent.com:443
       - name: "Setup: Checkout"
         uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4.1.1
         with:
@@ -116,7 +122,13 @@ jobs:
       - name: "Setup: Harden Runner"
         uses: step-security/harden-runner@63c24ba6bd7ba022e95695ff85de572c04a18142 # v2.7.0
         with:
-          egress-policy: audit
+          disable-sudo: true
+          egress-policy: block
+          allowed-endpoints: >
+            api.github.com:443
+            buf.build:443
+            github.com:443
+            objects.githubusercontent.com:443
       - name: "Setup: Checkout"
         uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4.1.1
         with:

.github/workflows/job.build.yml

@@ -190,7 +190,40 @@ jobs:
       - name: "Setup: Harden Runner"
         uses: step-security/harden-runner@63c24ba6bd7ba022e95695ff85de572c04a18142 # v2.7.0
         with:
-          egress-policy: audit
+          disable-sudo: true
+          egress-policy: block
+          allowed-endpoints: >
+            agent.less.build:443
+            androidx.dev:443
+            api.github.com:443
+            cli.less.build:443
+            d3ob9fqp587by1.cloudfront.net:443
+            dl.google.com:443
+            dl.less.build:443
+            download-cdn.jetbrains.com:443
+            download.jetbrains.com:443
+            download.oracle.com:443
+            edge.pkg.st:443
+            elide-snapshots.storage-download.googleapis.com:443
+            github.com:443
+            global.less.build:443
+            gradle.pkg.st:443
+            jpms.pkg.st:443
+            keys.openpgp.org:443
+            keyserver.ubuntu.com:443
+            local.less.build:443
+            maven.pkg.jetbrains.space:443
+            maven.pkg.st:443
+            nodejs.org:443
+            npm.pkg.st:443
+            objects.githubusercontent.com:443
+            pgp.mit.edu:443
+            plugins-artifacts.gradle.org:443
+            plugins.gradle.org:443
+            registry.npmjs.org:443
+            repo.maven.apache.org:443
+            scans-in.gradle.com:443
+            services.gradle.org:443
       - name: "Setup: Checkout"
         uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4.1.1
         with:
@@ -370,7 +403,7 @@ jobs:
   ## Report: Provenance
   provenance:
     name: Provenance
-    uses: slsa-framework/slsa-github-generator/.github/workflows/generator_generic_slsa3.yml@v1.9.0
+    uses: slsa-framework/slsa-github-generator/.github/workflows/generator_generic_slsa3.yml@v1.10.0
     if: inputs.provenance
     needs: [gradle]
     permissions:

.github/workflows/job.test.yml

@@ -156,7 +156,48 @@ jobs:
       - name: "Setup: Harden Runner"
         uses: step-security/harden-runner@63c24ba6bd7ba022e95695ff85de572c04a18142 # v2.7.0
         with:
-          egress-policy: audit
+          disable-sudo: true
+          egress-policy: block
+          allowed-endpoints: >
+            agent.less.build:443
+            androidx.dev:443
+            api.codecov.io:443
+            api.foojay.io:443
+            api.github.com:443
+            cli.codecov.io:443
+            cli.less.build:443
+            d3ob9fqp587by1.cloudfront.net:443
+            dc.services.visualstudio.com:443
+            dl.google.com:443
+            dl.less.build:443
+            download-cdn.jetbrains.com:443
+            download.jetbrains.com:443
+            download.oracle.com:443
+            ea6ne4j2sb.execute-api.eu-central-1.amazonaws.com:443
+            edge.pkg.st:443
+            elide-snapshots.storage-download.googleapis.com:443
+            github.com:22
+            github.com:443
+            global.less.build:443
+            gradle.pkg.st:443
+            jpms.pkg.st:443
+            keys.openpgp.org:443
+            keyserver.ubuntu.com:443
+            local.less.build:443
+            maven.pkg.jetbrains.space:443
+            maven.pkg.st:443
+            nodejs.org:443
+            npm.pkg.st:443
+            objects.githubusercontent.com:443
+            pgp.mit.edu:443
+            registry.npmjs.org:443
+            repo.maven.apache.org:443
+            sc-cleancode-sensorcache-eu-central-1-prod.s3.amazonaws.com:443
+            scanner.sonarcloud.io:443
+            scans-in.gradle.com:443
+            services.gradle.org:443
+            sonarcloud.io:443
+            storage.googleapis.com:443
       - name: "Setup: Checkout"
         uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4.1.1
         with:

.github/workflows/on.pr.yml

@@ -125,7 +125,29 @@ jobs:
       - name: "Setup: Harden Runner"
         uses: step-security/harden-runner@63c24ba6bd7ba022e95695ff85de572c04a18142 # v2.7.0
         with:
-          egress-policy: audit
+          disable-sudo: true
+          egress-policy: block
+          allowed-endpoints: >
+            agent.less.build:443
+            api.github.com:443
+            cli.less.build:443
+            d3ob9fqp587by1.cloudfront.net:443
+            dl.less.build:443
+            download.oracle.com:443
+            edge.pkg.st:443
+            elide-snapshots.storage-download.googleapis.com:443
+            github.com:443
+            global.less.build:443
+            gradle.pkg.st:443
+            jpms.pkg.st:443
+            keys.openpgp.org:443
+            keyserver.ubuntu.com:443
+            local.less.build:443
+            maven.pkg.jetbrains.space:443
+            maven.pkg.st:443
+            objects.githubusercontent.com:443
+            pgp.mit.edu:443
+            services.gradle.org:443
       - name: "Setup: Checkout"
         uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4.1.1
         with:

.prettierignore

@@ -5,6 +5,7 @@ docs
 kotlin-js-store
 .idea
 .gradle
+.github/workflows
 proto
 proto/buf.pb.json
 buildSrc

.release

@@ -1 +1 @@
-1.0.0-alpha7
+1.0.0-alpha8

README.md

@@ -17,13 +17,13 @@
   <a href="https://bestpractices.coreinfrastructure.org/projects/7690"><img src="https://bestpractices.coreinfrastructure.org/projects/7690/badge" /></a>
   <br />
   <a href="https://www.graalvm.org/"><img src="https://img.shields.io/badge/GraalVM-23.x.x-blue.svg?logo=oracle" /></a>
-  <a href="https://openjdk.org/projects/jdk/21/"><img src="https://img.shields.io/badge/Java-21-blue.svg?logo=oracle" /></a>
+  <a href="https://openjdk.org/projects/jdk/22/"><img src="https://img.shields.io/badge/Java-22-blue.svg?logo=oracle" /></a>
   <a href="http://kotlinlang.org"><img src="https://img.shields.io/badge/Kotlin-2.0.0-blue.svg?logo=kotlin" /></a>
-  <a href="https://262.ecma-international.org/13.0/"><img src="https://img.shields.io/badge/ECMA-2022-blue.svg?logo=javascript" /></a>
+  <a href="https://262.ecma-international.org/13.0/"><img src="https://img.shields.io/badge/ECMA-2023-blue.svg?logo=javascript" /></a>
 </p>
 
 <p align="center">
-Latest version: <code>1.0.0-alpha7</code>
+Latest version: <code>1.0.0-alpha8</code>
 </p>
 
 <hr />
@@ -151,7 +151,7 @@ Elide integrates with [Micronaut]() to provide Server-Side and Hybrid rendering
 
 ```properties
 // gradle.properties
-elideVersion = 1.0.0-alpha7
+elideVersion = 1.0.0-alpha8
 ```
 
 ```kotlin
@@ -261,15 +261,48 @@ Following this guide is recommended but optional. Depending on the style of deve
 not need some of these components:
 
 | Status                                                          | **Java**    | **Kotlin**    | **GraalVM** | **Micronaut** | **React** | **Protobuf/gRPC**  |
-| --------------------------------------------------------------- | ----------- | ------------- | ----------- | ------------- | --------- | ------------------ |
-| ![Status](https://img.shields.io/badge/-experimental-important) | `Java 21`   | `2.0.0-Beta4` | `23.1.x`    | `4.3.x`       | `18.x`    | `3.25.1`/`1.61.0`  |
+|-----------------------------------------------------------------|-------------|---------------|-------------|---------------|-----------|--------------------|
+| ![Status](https://img.shields.io/badge/-experimental-important) | `Java 22`   | `2.0.0-RC1`   | `24.x.x`    | `4.3.x`       | `18.x`    | `3.25.1`/`1.61.0`  |
+| ![Status](https://img.shields.io/badge/-tested-success)         | `Java 21`   | `2.0.0-Beta4` | `23.1.x`    | `4.3.x`       | `18.x`    | `3.25.1`/`1.61.0`  |
 | ![Status](https://img.shields.io/badge/-tested-success)         | `Java 20`   | `1.9.20`      | `23.0.x`    | `4.0.x`       | `18.x`    | `3.21.11`/`1.56.1` |
 | ![Status](https://img.shields.io/badge/-tested-success)         | `Java 20`   | `1.9.10`      | `23.0.x`    | `3.10.x`      | `18.x`    | `3.21.11`/`1.56.1` |
 | ![Status](https://img.shields.io/badge/-tested-success)         | `Java 17`   | `1.8.20`      | `22.3.x`    | `3.9.x`       | `18.x`    | `3.21.11`/`1.42.0` |
 | ![Status](https://img.shields.io/badge/-tested-success)         | `Java 11`   | `1.7.22`      | `22.3.x`    | `3.5.x`       | `18.x`    | `3.20.1`/`1.46.0`  |
 | ![Status](https://img.shields.io/badge/-no%20support-yellow)    | `Java 8-10` | --            | --          | --            | --        | --                 |
 
-If you aren't using certain components on this list, for example, gRPC/Protobuf, you can ignore that column entirely.
+## Language support
+
+The following version matrix describes language support for Elide, including **JavaScript**, **Python**, **Ruby**,
+**WASM**, and experimental languages (LLVM, JVM) and future languages which _could_ be supported based on the architecture:
+
+| **Language**    | **Status**                                                      | **Version** | **Elide release** | **Sandboxing**      | **Server**    | **Coverage**  | **VFS**      | **Debugger** |
+|-----------------|-----------------------------------------------------------------|-------------|-------------------|---------------------|---------------|---------------|--------------|--------------|
+| **JavaScript**  | ![Status](https://img.shields.io/badge/-tested-success)         | `ECMA 2023` | `alpha4+`         | ✅ Full support      | ✅             | ✅             | ✅            | ✅            |
+| **WebAssembly** | ![Status](https://img.shields.io/badge/-tested-success)         | `WASI P2`   | `alpha4+`         | ✅ (With JS)         | ✅ (With JS)   | ✅             | ✅            | ✅            |
+| **Python**      | ![Status](https://img.shields.io/badge/-tested-success)         | `3.10.x`    | `alpha7+`         | Not supported       | Not supported | ✅             | ⚠️           | ✅            |
+| **Ruby**        | ![Status](https://img.shields.io/badge/-tested-success)         | `3.2`       | `alpha8+`         | Not supported       | Not supported | ✅             | ⚠️           | ✅            |
+| **Java**        | ![Status](https://img.shields.io/badge/-experimental-important) | `Java 22`   | `edge`            | ✅ Partial support   | Not supported | Experimental  | Experimental | ✅            |
+| **Kotlin**      | ![Status](https://img.shields.io/badge/-experimental-important) | `Java 22`   | `edge`            | ✅ Partial support   | Not supported | Experimental  | Experimental | ✅            |
+| **LLVM**        | ![Status](https://img.shields.io/badge/-experimental-important) | `12.0.1`    | `edge`            | ⚠️ Requires license | Not supported | Not supported | N/A          | ✅            |
+| **TypeScript**  | ![Status](https://img.shields.io/badge/-future-purple)          | `5.x.x`     | Future release    | N/A                 | N/A           | N/A           | N/A          | N/A          |
+| **CUDA**        | ![Status](https://img.shields.io/badge/-future-purple)          | N/A         | Future release    | N/A                 | N/A           | N/A           | N/A          | N/A          |
+| **PHP**         | ![Status](https://img.shields.io/badge/-future-purple)          | `7.x`       | Future release    | N/A                 | N/A           | N/A           | N/A          | N/A          |
+| **.NET**        | ![Status](https://img.shields.io/badge/-future-purple)          | `ECMA 335`  | Future release    | N/A                 | N/A           | N/A           | N/A          | N/A          |
+| **Groovy**      | ![Status](https://img.shields.io/badge/-future-purple)          | `4.0.x`     | Future release    | N/A                 | N/A           | N/A           | N/A          | N/A          |
+| **Scala**       | ![Status](https://img.shields.io/badge/-future-purple)          | `3.4.x`     | Future release    | N/A                 | N/A           | N/A           | N/A          | N/A          |
+
+## Performance
+
+For officialy supported languages, rough benchmarks are shown below, for **server performance**, **language performance**, and **startup time**:
+
+| **Language**   | **Server**                        | **Language**          | **Startup** |
+|----------------|-----------------------------------|-----------------------|-------------|
+| **JavaScript** | `~660K RPS` (**75x** vs. Node 20) | (Unavailable)         | `~0.5s`     |
+| **Python**     | (Unavailable)                     | Up to `~3.0x CPython` | `~0.5s`     |
+| **Ruby**       | (Unavailable)                     | Up to `~22.4x CRuby`  | `~1.5s`     |
+
+> [!NOTE]
+> Newer languages don't have clear benchmarks yet; more are coming soon.
 
 ## Reports