feat(wasix): build wasm_tests Rust fixtures with cargo-wasix

.gitattributes

@@ -2,3 +2,4 @@ CHANGELOG.md merge=union
 *.wast linguist-vendored
 *.wat linguist-vendored
 scene*.txt -text
+*.stdin -text

.github/ci-constants.env

@@ -1,3 +1,5 @@
 # Shared CI constants. Loaded into GITHUB_ENV by workflows that need them.
 # Pinned wasix-libc sysroot (wasix-org/wasix-libc release tag).
 WASIX_LIBC_SYSROOT_TAG=v2026-07-30.1
+# Pinned WASIX rust toolchain (wasix-org/rust release tag).
+WASIX_RUST_TOOLCHAIN_TAG=v2026-08-06.1+rust-1.97

.github/workflows/copilot-setup-steps.yml

@@ -81,6 +81,10 @@ jobs:
         env:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
         run: WASIXCC_SYSROOT_PREFIX=~/.wasixcc/sysroot-v2026-05-12.1 wasixccenv download-sysroot v2026-05-12.1
+      - name: Install cargo-wasix
+        uses: wasix-org/cargo-wasix@main
+        with:
+          toolchain-version: ${{ env.WASIX_RUST_TOOLCHAIN_TAG }}
       - name: Install wasm-tools
         run: |
           cargo install --locked wasm-tools
@@ -95,6 +99,8 @@ jobs:
           wasm-tools --version
           # Check wasixcc is installed
           wasixcc --version
+          # Check cargo-wasix is installed
+          cargo wasix --version
           # Check wasm-opt is available
           wasm-opt --version
           # Check that the repo exists

.github/workflows/test.yaml

@@ -113,6 +113,18 @@ jobs:
             echo "Pinned sysroot ($WASIX_LIBC_SYSROOT_TAG) is older than latest release ($latest)"
             exit 1
           fi
+      - name: Verify pinned wasix rust toolchain is up to date
+        shell: bash
+        env:
+          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+        run: |
+          source .github/ci-constants.env
+          latest=$(gh release list --exclude-pre-releases --order desc -R wasix-org/rust --json tagName -q '.[0].tagName')
+          newest=$(printf '%s\n' "$latest" "$WASIX_RUST_TOOLCHAIN_TAG" | sort -V | tail -1)
+          if [ "$WASIX_RUST_TOOLCHAIN_TAG" != "$newest" ]; then
+            echo "Pinned rust toolchain ($WASIX_RUST_TOOLCHAIN_TAG) is older than latest release ($latest)"
+            exit 1
+          fi
   cargo_deny:
     name: cargo-deny
     runs-on: ubuntu-22.04
@@ -596,20 +608,26 @@ jobs:
           - description: "CLI integ. tests"
             make: test-integration-cli-ci
         metadata:
+          # `wasix_rust_toolchain` marks the hosts wasix-org/rust publishes a
+          # toolchain for, i.e. the ones that collect the Rust wasm_tests
+          # fixtures (see lib/wasix/tests/wasm_tests/README.md).
           - build: linux-x64
             os: ubuntu-22.04
             target: x86_64-unknown-linux-gnu
             exe: ""
+            wasix_rust_toolchain: true
             llvm_url: "https://github.com/wasmerio/llvm-custom-builds/releases/download/22.x/llvm-linux-amd64.tar.xz"
           - build: linux-arm64
             os: ubuntu-22.04-arm
             target: aarch64-unknown-linux-gnu
             exe: ""
+            wasix_rust_toolchain: true
             llvm_url: "https://github.com/wasmerio/llvm-custom-builds/releases/download/22.x/llvm-linux-aarch64.tar.xz"
           - build: macos-arm
             os: depot-macos-14
             target: aarch64-apple-darwin
             exe: ""
+            wasix_rust_toolchain: true
             llvm_url: "https://github.com/wasmerio/llvm-custom-builds/releases/download/22.x/llvm-darwin-aarch64.tar.xz"
           - build: windows-x64
             os: windows-2022
@@ -696,6 +714,8 @@ jobs:
         with:
           toolchain: ${{ steps.load_toolchain.outputs.rust_toolchain }}
           target: ${{ matrix.metadata.target }}
+      # For the wasip1-toolchain variants of the Rust wasm_tests fixtures, which
+      # build on every platform we support.
       - name: Install Rust WASI targets
         if: matrix.stage.make == 'test-all'
         shell: bash
@@ -716,6 +736,12 @@ jobs:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
         run: WASIXCC_SYSROOT_PREFIX=~/.wasixcc/sysroot-v2026-05-12.1 wasixccenv download-sysroot v2026-05-12.1
         if: matrix.metadata.build != 'windows-x64'
+      # For the wasix-toolchain variants of the Rust wasm_tests fixtures.
+      - name: Install cargo-wasix
+        if: matrix.stage.make == 'test-all' && matrix.metadata.wasix_rust_toolchain
+        uses: wasix-org/cargo-wasix@main
+        with:
+          toolchain-version: ${{ env.WASIX_RUST_TOOLCHAIN_TAG }}
       - name: Install LLVM
         shell: bash
         if: matrix.metadata.llvm_url

Makefile

@@ -950,6 +950,9 @@ lint-package-crate:
 lint-formatting:
 	cargo fmt --all -- --check
 	cargo fmt --manifest-path fuzz/Cargo.toml -- --check
+	# The wasm_tests Rust fixtures are not part of any crate, so `cargo fmt`
+	# does not cover them.
+	cd lib/wasix/tests/wasm_tests && find . -path ./build -prune -o -type f -name '*.rs' -exec rustfmt --edition 2024 --check {} +
 
 lint: lint-yamlfmt lint-clang-format lint-formatting lint-packages lint-taplo
 

lib/wasix/tests/wasm_tests/README.md

@@ -10,9 +10,18 @@ The `wasix-wasm` integration test target discovers tests automatically from this
 directory. Any subdirectory that contains one of these primary files is treated
 as a test fixture:
 
+- `build.sh` or other `*.sh` primary sources
+- `Cargo.toml`
 - `main.c`
 - `main.cpp`
-- `$name.sh`
+- `*.rs`
+
+Discovery precedence within a fixture directory is:
+
+1. `*.sh` shell primary sources
+2. `Cargo.toml` (full Cargo project)
+3. `main.c` / `main.cpp`
+4. `*.rs` (each Rust source is an independent test)
 
 The harness builds each discovered fixture, runs the resulting `main` module through the WASIX runner,
 and registers one test per configuration each of the enabled engines.
@@ -24,6 +33,9 @@ The supported directives are documented in [`../wasm_tests.rs`](../wasm_tests.rs
 If a fixture has more than one `.sh` file, each shell file is treated as a
 primary source, where `build.sh` is the default shell source name.
 
+Fixtures with an explicit `Cargo.toml` are built as full Cargo projects. Directives
+can be placed in `##Directive: Args` comments in the manifest.
+
 The former `tests/wasi-fyi` shell suite now lives in [`wasi_fyi/`](./wasi_fyi/)
 as Rust primary sources with inline directives.
 
@@ -34,7 +46,10 @@ The harness then builds them as follows:
 
 - `main.c` is compiled with `CC`, or `wasixcc` if `CC` is unset.
 - `main.cpp` is compiled with `CXX`, or `wasix++` if `CXX` is unset.
-- `*.rs` is compiled with `rustc --target=wasm32-wasip1`.
+- `*.rs` is built with `cargo wasix build` using an ephemeral `Cargo.toml` generated
+  in the build directory.
+- `Cargo.toml` fixtures are built with `cargo wasix build` and the single binary
+  artifact is copied to `main`.
 - `build.sh` and other shell primary sources are executed with `bash`; the
   harness sets `CC=wasixcc`, `CXX=wasix++`, and
   `WASIXCC_DISCARD_UNSUPPORTED_FLAGS=yes`.
@@ -50,7 +65,22 @@ the primary source, for example `//#BuildEnv: WASIXCC_PIC=1` in C/C++ sources or
 These tests run through the normal `wasix` integration test target, so standard
 Cargo and nextest filtering both work. Before running the suite, make sure
 `wasixcc` is installed and available in your shell environment.
-Rust `.rs` tests also require `rustc` with the `wasm32-wasip1` target installed.
+Rust fixtures also require `cargo-wasix` on `PATH` (`cargo install cargo-wasix`).
+
+Single-file Rust fixtures build with two Rust toolchains by default (see the
+`Toolchains` directive): `wasix` (cargo-wasix), which runs on every engine
+except Singlepass — the WASIX toolchain emits exception-handling opcodes
+Singlepass does not support — and `wasip1` (`rustc --target wasm32-wasip1`,
+nightly when the source uses `#![feature(...)]`), which runs on every engine.
+The wasip1 variants need `rustup target add wasm32-wasip1` (plus the same
+target on nightly).
+
+We do not publish the WASIX Rust toolchain for every platform yet, so the
+`wasix` variants are only collected on hosts that have one: gnu Linux on x86_64
+and aarch64, and macOS on aarch64. They are skipped on musl, which has no
+toolchain, and on Windows, which `wasixcc` does not cover either. The `wasip1`
+variants build everywhere, so single-file Rust fixtures keep running on those
+hosts.
 
 On macOS, this suite collects and runs the LLVM variants only because Cranelift
 exception-handling support is still incomplete there: