chore: add tools directory and include modsurfer

[nilslice]

In reference to #1120, this PR includes a tools directory along with the contents of the modsurfer directory within it. I am happy to update this PR according to any other location in the repo at your suggestion!

I've tested that the remote reference to a Spin checkfile works as documented in the README here, and will update the Modsurfer workflows to use these same remotes as soon as the PR is merged.

Closes #1120

[itowlson]

Thanks for this @nilslice! It all looks good but one question I have is how to maintain and version it. For example, at some future date, Spin HEAD will presumably go to WASI Preview 2. How will we ensure these files are updated in sync? And, even more importantly, how will users who are on older (released) builds ensure they are validating against their runtime instead of HEAD? We don't need to thrash out a process in detail but I'd like to have some sense of what day two operations looks like...

[nilslice]

Great question! The url key is set to track main, but it could certainly be pinned to a specific commit, or better yet, a tagged release of the Spin repo at the particular version a module was built from. Similar to how I can permalink to this version of a spin.toml from v0.9.0, https://github.com/fermyon/spin/blob/v0.9.0/templates/http-grain/content/spin.toml, a Spin user may want to pin their mod.yaml to the file in the Spin repo at a particular version.

One of the benefits of end-users tracking main/HEAD though, is that eventually as needed, Fermyon can update these checkfiles to include critical changes that you may need to make to SDKs and runtime ABIs & users will be notified upon their next build. To use the wasi_snapshot_preview2 example, you may actually want to phase out support for preview1... If so, you can update the mod.yaml files here to use:

validate:
  imports:
    namespace:
      include:
      - wasi_snapshot_preview2
      exclude: 
      - wasi_snapshot_preview1 # <--- this will break builds if users are not up to date

It also occurred to me that these files could go into the templates themselves... it may be something to consider in the future, and I'd be happy to collaborate on that.

Note that these files were generated by using the Modsurfer CLI:

modsurfer generate -p target/wasm32-wasi/release/http.wasm -o mod.yaml

So if you ever need to update them, and want to give it a shot yourself, you can use a built Spin wasm module as a starting point and have the checkfile created for you.

[nilslice]

@itowlson Hello, sir! Following up on this, as I just saw the Fermyon Cloud deployer GitHub Action news today... what better to complement that than with a pre-deploy validation check? 😄

[itowlson]

Ah! I was thinking just last night that I needed to get back to this, then morning came and I completely forgot. Thank you for the prompt!

[itowlson]

Oh, but you need to GPG sign the commit, sorry

[nilslice]

Force-pushed to override with the signed commit. Thanks!