tools: automate uvwasi dependency update

Refs: https://github.com/nodejs/security-wg/issues/828
PR-URL: https://github.com/nodejs/node/pull/47509
Reviewed-By: Marco Ippolito <marcoippolito54@gmail.com>
Reviewed-By: Michael Dawson <midawson@redhat.com>
Reviewed-By: Rafael Gonzaga <rafael.nunu@hotmail.com>

.github/workflows/tools.yml

@@ -190,6 +190,14 @@ jobs:
               cat temp-output
               tail -n1 temp-output | grep "NEW_VERSION=" >> "$GITHUB_ENV" || true
               rm temp-output
+          - id: uvwasi
+            subsystem: deps
+            label: dependencies
+            run: |
+              ./tools/dep_updaters/update-uvwasi.sh > temp-output
+              cat temp-output
+              tail -n1 temp-output | grep "NEW_VERSION=" >> "$GITHUB_ENV" || true
+              rm temp-output
     steps:
       - uses: actions/checkout@ac593985615ec2ede58e132d2e21d2b1cbd6127c  # v3.3.0
         with:

doc/contributing/maintaining-web-assembly.md

@@ -78,13 +78,6 @@ Node.js GitHub organization. As needed, an updated copy
 is vendored into the Node.js deps in
 [deps/uvwasi](https://github.com/nodejs/node/tree/main/deps/uvwasi).
 
-To update the copy of uvwasi in the Node.js deps:
-
-* Copy over the contents of `include` and `src` to the corresponding
-  directories.
-* Check if any additional files have been added and need to be added
-  to the `sources` list in `deps/uvwasi/uvwasi.gyp`.
-
 In addition to the code from uvwasi, Node.js includes bindings and
 APIs that allow WebAssembly to be run with WASI support from Node.js.
 The documentation for this API is in
@@ -95,3 +88,12 @@ The implementation of the bindings and the public API is in:
 * [src/node\_wasi.h](https://github.com/nodejs/node/blob/main/src/node_wasi.h)
 * [src/node\_wasi.cc](https://github.com/nodejs/node/blob/main/src/node_wasi.cc)
 * [lib/wasi.js](https://github.com/nodejs/node/blob/main/lib/wasi.js)
+
+### Running the update script
+
+The `tools/dep_updaters/update-uvwasi.sh` script automates the update of
+the uvwasi source files.
+
+```bash
+./tools/dep_updaters/update-uvwasi.sh
+```

tools/dep_updaters/update-uvwasi.sh

@@ -0,0 +1,78 @@
+#!/bin/sh
+set -e
+# Shell script to update uvwasi in the source tree to a specific version
+
+BASE_DIR=$(cd "$(dirname "$0")/../.." && pwd)
+DEPS_DIR="$BASE_DIR/deps"
+
+[ -z "$NODE" ] && NODE="$BASE_DIR/out/Release/node"
+[ -x "$NODE" ] || NODE=$(command -v node)
+
+NEW_VERSION="$("$NODE" --input-type=module <<'EOF'
+const res = await fetch('https://api.github.com/repos/nodejs/uvwasi/releases/latest');
+if (!res.ok) throw new Error(`FetchError: ${res.status} ${res.statusText}`, { cause: res });
+const { tag_name } = await res.json();
+console.log(tag_name.replace('v', ''));
+EOF
+)"
+
+CURRENT_MAJOR_VERSION=$(grep "#define UVWASI_VERSION_MAJOR" "$DEPS_DIR/uvwasi/include/uvwasi.h" | sed -n "s/^.*MAJOR \(.*\)/\1/p")
+CURRENT_MINOR_VERSION=$(grep "#define UVWASI_VERSION_MINOR" "$DEPS_DIR/uvwasi/include/uvwasi.h" | sed -n "s/^.*MINOR \(.*\)/\1/p")
+CURRENT_PATCH_VERSION=$(grep "#define UVWASI_VERSION_PATCH" "$DEPS_DIR/uvwasi/include/uvwasi.h" | sed -n "s/^.*PATCH \(.*\)/\1/p")
+CURRENT_VERSION="$CURRENT_MAJOR_VERSION.$CURRENT_MINOR_VERSION.$CURRENT_PATCH_VERSION"
+
+echo "Comparing $NEW_VERSION with $CURRENT_VERSION"
+
+if [ "$NEW_VERSION" = "$CURRENT_VERSION" ]; then
+  echo "Skipped because uvwasi is on the latest version."
+  exit 0
+fi
+
+echo "Making temporary workspace"
+
+WORKSPACE=$(mktemp -d 2> /dev/null || mktemp -d -t 'tmp')
+echo "$WORKSPACE"
+cleanup () {
+  EXIT_CODE=$?
+  [ -d "$WORKSPACE" ] && rm -rf "$WORKSPACE"
+  exit $EXIT_CODE
+}
+
+trap cleanup INT TERM EXIT
+
+UVWASI_ZIP="uvwasi-$NEW_VERSION"
+cd "$WORKSPACE"
+
+echo "Fetching UVWASI source archive..."
+curl -sL -o "$UVWASI_ZIP.zip" "https://github.com/nodejs/uvwasi/archive/refs/tags/v$NEW_VERSION.zip"
+
+echo "Moving existing GYP build file"
+mv "$DEPS_DIR/uvwasi/"*.gyp "$WORKSPACE/"
+rm -rf "$DEPS_DIR/uvwasi/"
+
+echo "Unzipping..."
+unzip "$UVWASI_ZIP.zip" -d "$DEPS_DIR/uvwasi/"
+rm "$UVWASI_ZIP.zip"
+
+mv "$WORKSPACE/"*.gyp "$DEPS_DIR/uvwasi/"
+cd "$DEPS_DIR/uvwasi/"
+
+echo "Copying new files to deps folder"
+cp -r "$UVWASI_ZIP/include" "$DEPS_DIR/uvwasi/"
+cp -r "$UVWASI_ZIP/src" "$DEPS_DIR/uvwasi/"
+cp "$UVWASI_ZIP/LICENSE" "$DEPS_DIR/uvwasi/"
+rm -rf "$UVWASI_ZIP"
+
+echo "All done!"
+echo ""
+echo "Please git add uvwasi, commit the new version:"
+echo ""
+echo "$ git add -A deps/uvwasi"
+echo "$ git commit -m \"deps: update uvwasi to $NEW_VERSION\""
+echo ""
+echo "Make sure to update the deps/uvwasi/uvwasi.gyp if any significant changes have occurred upstream"
+echo ""
+
+# The last line of the script should always print the new version,
+# as we need to add it to $GITHUB_ENV variable.
+echo "NEW_VERSION=$NEW_VERSION"