ci: monitor Wasmtime maintenance

[MuncleUscles]

Stack

• depends on fix: harden Wasmtime integration #14
• review only the final commit (ci: monitor Wasmtime maintenance) for this PR
• after fix: harden Wasmtime integration #14 lands, retarget this PR to v0.3-dev

Summary

• add daily OSV monitoring by both Wasmtime crate version and exact upstream commit
• inspect the real vX-dev and vX.x refs instead of assuming the scheduled default-branch checkout represents every line
• treat v0.2 as security-only and v0.3 as monthly maintenance plus security monitoring
• continuously reconcile one grouped advisory issue per executor line
• create one assigned monthly rebase-review issue for routine-maintenance lines
• audit Wasmtime pin changes on PRs without allowing the bot to write branches or protected refs

Branch strategy

The workflow runs from the default release branch because GitHub schedules are default-branch-only, then reads each configured development and release ref through the GitHub API. Remediation remains human-owned and follows the existing manager-linked mirror flow:

manager feature → pr/<executor-line>/<manager-feature> → <executor-line>-dev → standing release gate → <executor-line>.x

The automation never creates branches, pushes commits, or merges changes.

Ownership requiring GenVM review

A GenVM owner should review and confirm:

• the line policy (v0.2 security-only, v0.3 monthly)
• which findings are truly reachable under GenVM's feature configuration and patches
• the repository Actions variable WASMTIME_REBASE_OWNER, which supplies the accountable GitHub assignee
• the cadence and promotion checklist

Monitoring remains active if the variable is absent, but issues are deliberately left unassigned and the workflow emits a warning.

Validation

• 6 Python unit tests pass
• Python bytecode compilation passes
• workflow YAML parses successfully
• local audit of PR fix: harden Wasmtime integration #14's Wasmtime 43.0.2 version and exact commit reports no published advisories
• read-only full dry run against v0.2-dev, v0.2.x, v0.3-dev, and v0.3.x succeeds
• the dry run reconciles three review surfaces: grouped v0.2 advisories, grouped v0.3 advisories, and the monthly v0.3 review

[coderabbitai]

Important

Review skipped

Draft detected.

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Pro Plus

Run ID: 73f5e672-450b-40b1-85ae-df846a3b2f84

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}