[0yi0]

Summary

As described in WasmEdge#4277, move WasmEdge image definitions and their build workflows into WasmEdge/devcontainer so they can be maintained independently. This is the destination-side migration; it does not remove files or change publishing in WasmEdge.

• Import all 25 files from utils/docker, the dependency-family scripts, .dockerignore, .devcontainer, and the image, Alpine/Debian static, and OpenWrt workflows from WasmEdge 0.18.1 at b2e483553ea7a1826be117180125c71e5d0b8958.
• Keep Dockerfile.*, docker-bake.*.hcl, SHA256SUM.*, and build-manylinux.sh at repository root, with Dockerfile-consumed dependency inputs under scripts/<family>/.
• Keep the import commits faithful to the identified snapshot: only paths required by relocation change. Required destination adaptations follow in separate commits, not under upstream authors' provenance.
• Retain the destination's existing separate Ubuntu and manylinux workflows. Workflow consolidation is not part of this migration.
• Configure .devcontainer for developing WasmEdge/devcontainer, using wasmedge/wasmedge:ci-image-base and the name WasmEdge devcontainer development. README ends after its Layout table; local migration notes, draft text, and one-off verification tooling are not PR deliverables.

Commit organization and required adaptations

1. feat(docker): import WasmEdge image definitions and dependencies — faithful definition, dependency, and configuration import. Only relocated Bake contexts, Dockerfile references, and dependency COPY paths change. Preserve source whitespace, executable modes, target groups, and image behavior.
2. ci(docker): import WasmEdge image and platform workflows — faithful workflow import with relocated build-input paths and globs. Preserve original triggers, job dependencies and containers, matrices, Docker Hub login/push conditions, and conditional release uploads. Leave existing destination workflows untouched.
3. ci(docker): provide release source for standalone platform builds — the image repository has no WasmEdge runtime source tree, so static and OpenWrt workflows download the agreed 0.18.1 archive rather than automatically checking out WasmEdge. Static Dockerfiles receive a named source context; Alpine reads an explicit version marker because the archive has no Git metadata. OpenWrt receives the runtime source and its package Makefile at adapted local paths. Remove its unavailable WasmEdge C++ reusable-linter dependency; this repository retains its existing PR super-linter. Keep the inline OpenWrt Dockerfile and original release-upload behavior.
4. ci(docker): align imported definitions with destination entry points — use the destination's main branch for pushes and restore the aarch64 Bake alias required by its existing Ubuntu workflow. Leave upstream default/latest groups, target names, runner organization, and publishing behavior otherwise unchanged.
5. chore(devcontainer): configure this repository development environment — customize the faithfully imported environment for developing this repository, separately from the import; omit unrelated editor settings and extensions.
6. docs: describe the root-level image repository layout — document the final layout and keep migration working notes ignored.

Import commit messages identify the exact source snapshot and retain source PR/direct-commit references and original author information. Those references describe imported content, not the later destination adaptations. All rewritten commits retain Signed-off-by: Yi Huang <yi@secondstate.io>.

Related discussion: devcontainer#1 records the original destination migration; WasmEdge#5362 records the resumed roadmap item.

Publishing and ownership boundary

The imported image workflow retains Docker Hub login and push: ${{ github.event_name != 'pull_request' }}. This PR does not introduce a hidden publishing-disabled policy. Withholding usable Docker Hub credentials is the intended human gate; maintainers must consider organization secrets and any pre-authenticated runners, not merely the absence of repository secrets. Non-PR runs still attempt login/publication and can fail without credentials.

The static reusable workflows retain their conditional gh release upload steps and write permission. The source archive remains fixed at 0.18.1; the existing version input names a release upload destination, not a source selector. Calls that request a release upload must account for that distinction. No new token or explicit cross-repository release target is introduced: the existing token/release context belongs to the calling repository. These workflows do not automatically publish WasmEdge release assets from the destination repository.

Current WasmEdge Docker Hub publishing remains unchanged. Future work will first publish newly versioned GHCR images from devcontainer without changing current Docker Hub behavior, then remove Dockerfiles from WasmEdge and transfer publishing responsibility. GHCR publication, credential provisioning, source-side removal, and ownership cutover are not implemented here.

Verification

• Byte-and-mode comparisons passed for all 41 files in the definition/configuration import and all 4 imported workflows against the exact source snapshot, allowing only the documented relocation paths. The comparisons inspect the intermediate import commits, not merely the final tree.
• Read-only Docker Buildx v0.38.2 Bake expansion passed for ten selections covering all six Bake files, upstream Ubuntu targets, the destination Ubuntu architecture alias, and both manylinux architectures. Referenced Dockerfiles, target contexts, and local COPY/ADD inputs were checked. Dockerfile.release still requires the caller-supplied release archive.
• actionlint v1.7.12 passed for all final workflow files with shellcheck and pyflakes disabled because those tools are unavailable. YAML lint v1.37.1, using the repository configuration, completed with inherited indentation and line-length warnings; source formatting changes were deliberately not bundled into the migration.
• bash -n passed for all 14 imported helper scripts; the scripts were not executed.
• Review found and corrected an archive-version newline regression within the source-adaptation commit. A targeted regression check ran both real workflow marker writes through the exact source CMake version reader and header template: both now produce exactly 0.18.1 without a newline, a single-line version macro, and a header accepted by clang -Werror -fsyntax-only. Both checks failed before the correction and pass afterward.
• Commitlint v20 completed with no errors for all six commits. The two import messages have warnings about provenance text being parsed as footer content and exceeding the configured footer line length; source references and author information remain intact.
• All four post-import commits pass git diff --check. The full range does not pass that check: faithful imports retain whitespace in Dockerfile.alpine-base and context lines in scripts/wasi-nn/libpiper.patch. Those bytes match upstream and were not silently cleaned or suppressed.
• Verified commit boundaries, provenance/sign-offs, retained destination workflows, development-container configuration, README ending, absence of migration-only test scaffolding, and ignored local notes/draft. The WasmEdge source checkout remains clean and unchanged.
• No images, runtime artifacts, OpenWrt builds, registry pushes, or release uploads were executed locally. Static validation does not prove runtime builds, runner-container compatibility, package installation, or publication succeeds. Existing upstream build limitations are not repaired by this faithful migration. Earlier CI results belong to the old remote head and do not validate these rewritten commits; fresh GitHub Actions results must be evaluated against the rewritten PR head.