Prepare a Wasmtime 1.0.2 release (#5246)

* Merge pull request from GHSA-wh6w-3828-g9qf

This is a minimal fix for the release branch to fix the issue of having
a memory slot get reused between a module with an image and one without.

* Merge pull request from GHSA-44mr-8vmm-wjhg

This ensures that memories, even with zero contents, still have the
necessary virtual mappings as required by the code generator to report
out-of-bounds reads/writes.

* Merge pull request from GHSA-h84q-m8rr-3v9q

The Rust definition was previously performing a 4-byte write when the C
API was declared as taking an 1-byte buffer.

* CI fixes from CVE patches

* Bump to 1.0.2

* Cherry-pick github actions fixes for 1.0.2 release

Culmination of patches already landed in `main` and `release-2.0.0`

* Release Wasmtime 1.0.2

[automatically-tag-and-release-this-commit]

* Fix inst size test for Rust 1.65.0

* Use an alternate doxygen download link (#5150)

* Use an alternate doxygen download link

Looks like doxygen.nl is down otherwise.

* Update link

Author: alexcrichton

.github/actions/binary-compatible-builds/action.yml

@@ -2,7 +2,7 @@ name: 'Set up a CentOS 6 container to build releases in'
 description: 'Set up a CentOS 6 container to build releases in'
 
 runs:
-  using: node12
+  using: node16
   main: 'main.js'
 inputs:
   name:

.github/actions/github-release/action.yml

@@ -8,5 +8,5 @@ inputs:
     description: ''
     required: true
 runs:
-  using: 'node12'
+  using: 'node16'
   main: 'main.js'

.github/actions/github-release/main.js

@@ -25,7 +25,7 @@ async function runOnce() {
   core.info(`name: ${name}`);
   core.info(`token: ${token}`);
 
-  const octokit = new github.GitHub(token);
+  const octokit = github.getOctokit(token);
 
   // For the `dev` release we may need to update the tag to point to the new
   // commit on this branch. All other names should already have tags associated
@@ -43,20 +43,10 @@ async function runOnce() {
 
     if (tag === null || tag.data.object.sha !== sha) {
       core.info(`updating existing tag or creating new one`);
-      // Delete the previous release for this tag, if any
-      try {
-        core.info(`fetching release for ${name}`);
-        const release = await octokit.repos.getReleaseByTag({ owner, repo, tag: name });
-        core.info(`deleting release ${release.data.id}`);
-        await octokit.repos.deleteRelease({ owner, repo, release_id: release.data.id });
-      } catch (e) {
-        // ignore, there may not have been a release
-        console.log("ERROR: ", JSON.stringify(e, null, 2));
-      }
 
       try {
         core.info(`updating dev tag`);
-        await octokit.git.updateRef({
+        await octokit.rest.git.updateRef({
             owner,
             repo,
             ref: 'tags/dev',
@@ -80,6 +70,13 @@ async function runOnce() {
           // tag by this point.
         }
       }
+
+      console.log("double-checking tag is correct");
+      tag = await octokit.request("GET /repos/:owner/:repo/git/refs/tags/:name", { owner, repo, name });
+      if (tag.data.object.sha !== sha) {
+        console.log("tag: ", JSON.stringify(tag.data, null, 2));
+        throw new Error("tag didn't work");
+      }
     } else {
       core.info(`existing tag works`);
     }
@@ -91,12 +88,12 @@ async function runOnce() {
   let release = null;
   try {
     core.info(`fetching release`);
-    release = await octokit.repos.getReleaseByTag({ owner, repo, tag: name });
+    release = await octokit.rest.repos.getReleaseByTag({ owner, repo, tag: name });
   } catch (e) {
     console.log("ERROR: ", JSON.stringify(e, null, 2));
     core.info(`creating a release`);
     try {
-      release = await octokit.repos.createRelease({
+      release = await octokit.rest.repos.createRelease({
         owner,
         repo,
         tag_name: name,
@@ -105,19 +102,30 @@ async function runOnce() {
     } catch(e) {
       console.log("ERROR: ", JSON.stringify(e, null, 2));
       core.info(`fetching one more time`);
-      release = await octokit.repos.getReleaseByTag({ owner, repo, tag: name });
+      release = await octokit.rest.repos.getReleaseByTag({ owner, repo, tag: name });
     }
   }
   console.log("found release: ", JSON.stringify(release.data, null, 2));
 
   // Upload all the relevant assets for this release as just general blobs.
   for (const file of glob.sync(files)) {
     const size = fs.statSync(file).size;
+    const name = path.basename(file);
+    for (const asset of release.data.assets) {
+      if (asset.name !== name)
+        continue;
+      console.log(`deleting prior asset ${asset.id}`);
+      await octokit.rest.repos.deleteReleaseAsset({
+        owner,
+        repo,
+        asset_id: asset.id,
+      });
+    }
     core.info(`upload ${file}`);
-    await octokit.repos.uploadReleaseAsset({
+    await octokit.rest.repos.uploadReleaseAsset({
       data: fs.createReadStream(file),
       headers: { 'content-length': size, 'content-type': 'application/octet-stream' },
-      name: path.basename(file),
+      name,
       url: release.data.upload_url,
     });
   }