feat(examples): add hello-odin, an Odin ABI v2 guest

.github/renovate.json5

@@ -110,7 +110,7 @@
       // The wasmtime-wasi-http release every vendored WASI WIT file under a
       // wit/deps/ was copied from: its src/p3/wit/deps for the rust scaffold
       // and cloudflare-origin, its wit/deps for the python, c, zig and go
-      // scaffolds, team-tags, hello-c, hello-zig, pdb-addon and
+      // scaffolds, team-tags, hello-c, hello-zig, hello-odin, pdb-addon and
       // dashboard-bundle (templates and goldens included: the
       // files are plain .wit in all of them). Same tripwire as the proto: a
       // bump PR moves the version in every header at once; it does NOT
@@ -208,7 +208,8 @@
     },
     // The WASI WIT headers, for the same reason: one dep across the rust,
     // python, c, zig and go templates, their goldens, cloudflare-origin,
-    // team-tags, hello-c, hello-zig, pdb-addon and dashboard-bundle.
+    // team-tags, hello-c, hello-zig, hello-odin, pdb-addon and
+    // dashboard-bundle.
     // Their group is the wasmtime one above.
     {
       matchManagers: ['custom.regex'],
@@ -281,9 +282,10 @@
     // time (the cut-release skill), never in this batch - pip_requirements
     // is not an enabled manager.
     //
-    // hello-zig and hello-c name their dependencies in build.zig.zon by URL
-    // and content hash, which no Renovate manager reads: they move by hand,
-    // with the zig and c templates, at release time.
+    // hello-zig, hello-c and hello-odin name their dependencies in
+    // build.zig.zon by URL and content hash, which no Renovate manager
+    // reads: they move by hand, with the zig and c templates, at release
+    // time (hello-odin's nanopb pin is hello-c's).
     //
     // One batch, early on the 1st of the month. Renovate does not group lock
     // file maintenance with other updates - a grouped one gets its own

.github/workflows/e2e.yml

@@ -539,6 +539,133 @@ jobs:
       - name: Render the C Guest
         run: make -C examples/hello-c render-check
 
+  # The same guest in Odin, an ABI v2 component on the c flavour's plumbing
+  # (its C bindings, nanopb codec, WIT and proto byte for byte): odin
+  # compiles the guest to a freestanding wasm32 object, zig cc compiles the
+  # C half and links the core module behind its build.zig, and guestfn
+  # wraps it like the c guest (no wasm-tools, no adapter download). Odin is
+  # its GitHub release for linux amd64, pinned by checksum like wit-bindgen
+  # (the binary is statically linked, its base and core collections sit
+  # beside it); the codec and bindings drift checks are the c job's, over
+  # this example's copies.
+  render-odin:
+    name: render (odin)
+    runs-on: ubuntu-26.04
+    needs:
+      - start
+      - build-tools
+    env:
+      XP_CHANNEL: stable
+      XP_VERSION: 'v2.5.0'
+      # The wit-bindgen that wrote the checked-in bindings (their header
+      # names it), as a release binary pinned by checksum like xprin.
+      WIT_BINDGEN_VERSION: 0.62.0
+      WIT_BINDGEN_SHA256: 3e81cc6523729f7532b4aa7968648a04abf0c711b7d1677150e9121f4e6458fe
+      # The Odin release the example builds with (its README names it).
+      ODIN_VERSION: dev-2026-10
+      ODIN_SHA256: c3c8b095621fd0c75f7f73e3a0829f1b4d45324225f20ba11ed8dc4da310a8ab
+    steps:
+      - name: Checkout
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          ref: refs/pull/${{ github.event.issue.number }}/merge
+          persist-credentials: false
+
+      # The runtime, guestfn and xprin come from build-tools; render.sh and
+      # the Makefiles take them from FUNCTION_BIN, GUESTFN and XPRIN instead
+      # of building or installing them.
+      - name: Download the Runtime, guestfn and xprin
+        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
+        with:
+          name: e2e-tools
+          path: ${{ runner.temp }}/e2e-tools
+
+      - name: Use the Prebuilt Runtime, guestfn and xprin
+        run: |
+          chmod +x "${RUNNER_TEMP}/e2e-tools/function" "${RUNNER_TEMP}/e2e-tools/guestfn" \
+            "${RUNNER_TEMP}/e2e-tools/xprin"
+          {
+            echo "FUNCTION_BIN=${RUNNER_TEMP}/e2e-tools/function"
+            echo "GUESTFN=${RUNNER_TEMP}/e2e-tools/guestfn"
+            echo "XPRIN=${RUNNER_TEMP}/e2e-tools/xprin"
+          } >> "$GITHUB_ENV"
+
+      - name: Setup Zig
+        uses: mlugg/setup-zig@d1434d08867e3ee9daa34448df10607b98908d29 # v2.2.1
+        with:
+          use-cache: false
+          version: 0.16.0
+
+      - name: Setup protoc
+        uses: arduino/setup-protoc@c65c819552d16ad3c9b72d9dfd5ba5237b9c906b # v3.0.0
+        with:
+          repo-token: ${{ secrets.GITHUB_TOKEN }}
+
+      # The nanopb version must match the one the checked-in codec was
+      # generated with (its header names it) and the one build.zig fetches.
+      - name: Setup Python
+        uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0
+        with:
+          python-version: '3.14'
+
+      - name: Setup nanopb_generator
+        run: pip install nanopb==0.4.9.1
+
+      - name: Check Generated Codec
+        working-directory: examples/hello-odin
+        run: |
+          zig build gen-proto
+          if [ -n "$(git status --porcelain)" ]; then
+            echo "examples/hello-odin/src/fnv1 is not up to date with its proto; commit the result of zig build gen-proto:"
+            git status --porcelain
+            git diff
+            exit 1
+          fi
+
+      - name: Setup wit-bindgen
+        run: |
+          curl -fsSL -o "${RUNNER_TEMP}/wit-bindgen.tar.gz" \
+            "https://github.com/bytecodealliance/wit-bindgen/releases/download/v${WIT_BINDGEN_VERSION}/wit-bindgen-${WIT_BINDGEN_VERSION}-x86_64-linux.tar.gz"
+          echo "${WIT_BINDGEN_SHA256}  ${RUNNER_TEMP}/wit-bindgen.tar.gz" | sha256sum -c -
+          tar -xzf "${RUNNER_TEMP}/wit-bindgen.tar.gz" -C "${RUNNER_TEMP}"
+          echo "${RUNNER_TEMP}/wit-bindgen-${WIT_BINDGEN_VERSION}-x86_64-linux" >> "$GITHUB_PATH"
+
+      - name: Check Generated Bindings
+        working-directory: examples/hello-odin
+        run: |
+          zig build gen-bindings
+          if [ -n "$(git status --porcelain)" ]; then
+            echo "examples/hello-odin/src/gen is not up to date with its wit; commit the result of zig build gen-bindings:"
+            git status --porcelain
+            git diff
+            exit 1
+          fi
+
+      - name: Setup Odin
+        run: |
+          curl -fsSL -o "${RUNNER_TEMP}/odin.tar.gz" \
+            "https://github.com/odin-lang/Odin/releases/download/${ODIN_VERSION}/odin-linux-amd64-${ODIN_VERSION}.tar.gz"
+          echo "${ODIN_SHA256}  ${RUNNER_TEMP}/odin.tar.gz" | sha256sum -c -
+          mkdir -p "${RUNNER_TEMP}/odin"
+          tar -xzf "${RUNNER_TEMP}/odin.tar.gz" -C "${RUNNER_TEMP}/odin" --strip-components=1
+          echo "${RUNNER_TEMP}/odin" >> "$GITHUB_PATH"
+          "${RUNNER_TEMP}/odin/odin" version
+
+      - name: Lint and Test the Odin Guest
+        working-directory: examples/hello-odin
+        run: |
+          zig fmt --check build.zig
+          zig build lint
+          zig build test
+
+      - name: Setup the Crossplane CLI
+        run: |
+          curl -sL https://raw.githubusercontent.com/crossplane/crossplane/master/install.sh | sh
+          sudo mv crossplane /usr/local/bin/crossplane
+
+      - name: Render the Odin Guest
+        run: make -C examples/hello-odin render-check
+
   # The TypeScript guest, an ABI v2 component (jco): the policy-gate use
   # case, the last step after function-go-templating (which render runs in
   # Docker). It asks for its environment's EnvironmentConfig through
@@ -767,7 +894,7 @@ jobs:
 
   report:
     runs-on: ubuntu-26.04
-    needs: [start, guest-suite, render-go, render-rust, render-zig, render-c, render-ts, render-python, render-dotnet, e2e-oci]
+    needs: [start, guest-suite, render-go, render-rust, render-zig, render-c, render-odin, render-ts, render-python, render-dotnet, e2e-oci]
     if: always() && needs.start.result == 'success'
     permissions:
       statuses: write
@@ -781,7 +908,7 @@ jobs:
           for result in "${{ needs.guest-suite.result }}" "${{ needs.render-go.result }}" \
             "${{ needs.render-rust.result }}" \
             "${{ needs.render-zig.result }}" "${{ needs.render-c.result }}" \
-            "${{ needs.render-ts.result }}" \
+            "${{ needs.render-odin.result }}" "${{ needs.render-ts.result }}" \
             "${{ needs.render-python.result }}" "${{ needs.render-dotnet.result }}" \
             "${{ needs.e2e-oci.result }}"; do
             if [ "$result" != "success" ]; then