Bump Buildah to v1.43.2 in prepration of the next Podman v5.8 release.
Also includes the changes from 47ab0f1e94
And adjustments to test/buildah-bud/buildah-tests.diff
Signed-off-by: Tom Sweeney <tsweeney@redhat.com>
When the validate-source job is re-run manually after adding a label,
it uses stale labels (from the "pull_request" event that originally
triggered it), and so the steps that check labels don't see new labels.
Fix by querying the labels live (similar to how it was done before
commits 6e597af6dc and 1da154117c).
Note the logic differs slightly between hack/ci/make-and-check-size.sh
and hack/ci/pr-should-include-tests. This is because
pr-should-include-tests is also executed locally as well as on non-PRs,
while make-and-check-size is run strictly in CI for PRs only.
Signed-off-by: Kir Kolyshkin <kolyshkin@gmail.com>
(cherry picked from commit d05c113acd)
Signed-off-by: Paul Holzinger <pholzing@redhat.com>
Template expansions are not aware of shell script syntax, and therefore
can potentially result in code injection vulnerabilities when used in
code contexts: https://docs.zizmor.sh/audits/#template-injection
To avoid this, instead use environment variables to safely store the
values of the template expansions.
Also (in the process of doing the above) added double-quotes around a
some instances of variable expansions in shell scripts, which is
necessary to avoid unintended shell splitting and globbing. (I didn't
see any instances where this was actually likely to result in erroneous
behavior, but it's good practice and makes shell scripts more robust.)
Signed-off-by: Daniel Hast <hast.daniel@protonmail.com>
(cherry picked from commit 67c050bb8e)
Signed-off-by: Paul Holzinger <pholzing@redhat.com>
sed scripts are capable of doing file I/O and executing arbitrary
commands. The `--sandbox` option prevents this by rejecting sed commands
with such capabilities; it's good practice to use this whenever the sed
script is dynamically generated (e.g. if it involves a variable
expansion).
Also fixed an error in one sed script where `.*` had been placed outside
of the quoted string (and would therefore be subject to shell globbing),
presumably due to single-quotes having been changed to double-quotes at
some point in the past.
Signed-off-by: Daniel Hast <hast.daniel@protonmail.com>
(cherry picked from commit 3f4af378f4)
Signed-off-by: Paul Holzinger <pholzing@redhat.com>
This is basically a partial backport of commit b14e833ef6
("machine: add test to check config mount").
It seems on the ubuntu github actions runners we have XDG_CONFIG_HOME
set so the tests do not actually use its own private dir but a shared
one for the configs which breaks the test assumptions.
Signed-off-by: Paul Holzinger <pholzing@redhat.com>
Podman v5.8 is not designed to run with it, we want to test with the
actual packaged one from the image.
Signed-off-by: Paul Holzinger <pholzing@redhat.com>
The new config parser is not in 5.8, so revert to the older config
format where all is in one file.
Signed-off-by: Paul Holzinger <pholzing@redhat.com>
Add some basic test checks for the new ci.yml to ensure all job
dependencies are set up right.
We can expand this with more checks later.
Signed-off-by: Paul Holzinger <pholzing@redhat.com>
(cherry picked from commit 66e7c06073)
Signed-off-by: Paul Holzinger <pholzing@redhat.com>
It is not strictly needed I think since other jobs depend on this
already but for consistency this is easier to check that success waits
for all jobs.
Signed-off-by: Paul Holzinger <pholzing@redhat.com>
(cherry picked from commit c4d895b07c)
Signed-off-by: Paul Holzinger <pholzing@redhat.com>
Makes for easier cleanup, and follows previous cirrus convention.
Signed-off-by: Ashley Cui <acui@redhat.com>
(cherry picked from commit 2984c2450b)
Signed-off-by: Paul Holzinger <pholzing@redhat.com>
We need to not hard depend on the pull_request var contexts so use the
right alternatives. The PR_ envs can be left empty, the tests using them
should skip the checks if they are unset/empty.
Fixes: #28825
Signed-off-by: Paul Holzinger <pholzing@redhat.com>
(cherry picked from commit 602a803f57)
Signed-off-by: Paul Holzinger <pholzing@redhat.com>
The checkout needs the PR context so this fails on push, as such skip it
there for now until we make this work to also work on normal pushes.
Signed-off-by: Paul Holzinger <pholzing@redhat.com>
(cherry picked from commit 3faf2deaf8)
Signed-off-by: Paul Holzinger <pholzing@redhat.com>
The test uses the token for API request so we do not get rate limit
failures without a token, see commit 7c7d56a0fb.
Signed-off-by: Paul Holzinger <pholzing@redhat.com>
(cherry picked from commit 0fce332955)
Signed-off-by: Paul Holzinger <pholzing@redhat.com>
It does not seem to work in the new CI system right now.
Signed-off-by: Paul Holzinger <pholzing@redhat.com>
(cherry picked from commit 30aaf14abb)
Signed-off-by: Paul Holzinger <pholzing@redhat.com>
Copied from Tim, but directly integrated into the main yml file to allow
for proper task dependencies.
Co-authored-by: Tim Zhou <tizhou@redhat.com>
Signed-off-by: Paul Holzinger <pholzing@redhat.com>
(cherry picked from commit a758d09b64)
Signed-off-by: Paul Holzinger <pholzing@redhat.com>
Copied from Tim, but directly integrated into the main ci.yml file to
allow for proper task dependencies.
I renamed same task and updated the task dependencies.
Co-authored-by: Tim Zhou <tizhou@redhat.com>
Signed-off-by: Paul Holzinger <pholzing@redhat.com>
(cherry picked from commit 2297695d0c)
[fixed merge conflicts]
Signed-off-by: Paul Holzinger <pholzing@redhat.com>
The main gh action is just there to install lima and then call the main
ci.sh script which uses lima to start the right VM and then run the
tests inside there mostly for linux tasks where possible.
Inside the VM we use the runner.sh script to setup the env and launch the
final test.
Signed-off-by: Paul Holzinger <pholzing@redhat.com>
(cherry picked from commit 399e822ca4)
[fixed merge conflict]
Signed-off-by: Paul Holzinger <pholzing@redhat.com>
Build pkg/api/swagger.yaml via the go-swagger tool as part of source
validation, confirming the API spec generates cleanly. This mirrors the
generation half of the Cirrus swagger_task; that task is kept for now as
it also publishes swagger.yaml to GCS for the docs site, which is not
migrated here.
Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>
Signed-off-by: Kir Kolyshkin <kolyshkin@gmail.com>
(cherry picked from commit 6071d780e9)
Signed-off-by: Paul Holzinger <pholzing@redhat.com>
Add a 'Build each commit' step to the validate-source job. It builds the
PR fork point to record baseline binary sizes, then rebuilds and size-checks
each commit via 'git rebase -x', confirming every commit compiles on its own
and that no binary grows beyond the enforced limit.
Move hack/make-and-check-size to hack/ci/make-and-check-size.sh and replace
its Cirrus-specific GitHub GraphQL label query with a BLOAT_APPROVED env var
that the workflow derives from the 'bloat_approved' PR label.
Drop the now-migrated 'Build Each Commit' matrix entry from .cirrus.yml and
the corresponding *Each* case from hack/ci/runner.sh.
NOTE due to chicken-and-egg problem with make-and-check-size we need to
make a copy of it before working with git.
Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>
Signed-off-by: Kir Kolyshkin <kolyshkin@gmail.com>
(cherry picked from commit 1da154117c)
Signed-off-by: Paul Holzinger <pholzing@redhat.com>
Move the Cirrus validate-source_task to a GitHub Actions workflow
(.github/workflows/ci.yml) running as a single job on the CNCF-hosted
runner. The job runs the same stages: make validate-source,
tests-included, and the conditional renovate config check.
golangci-lint for FreeBSD and macOS now runs cross-compiled (GOOS) on
the native Linux runner instead of on dedicated Cirrus VMs/workers, so
the lint steps are dropped from osx_alt_build and freebsd_alt_build.
The PR helper scripts are de-Cirrus'd: they read CI-neutral env vars
(PR_HEAD, PR_NUMBER, PR_BODY) and the "No New Tests" label override is
now handled natively in the workflow instead of via a GraphQL query.
The shared clone/setup/main YAML anchors are relocated into build_task,
and the dead _run_validate-source runner.sh function is removed.
The tests-of-tests (.t files) are fixed for new setup (mostly removing
test cases which are now obsoleted, like [CI:DOCS] and [NO NEW TESTS]
markers. NOTE we still don't run tests in CI (although we could), but
I ran them locally and fixed all the issues.
Finally, test-jira-links-included is removed as it is RHEL-branch
specific and have no place in the new repo.
Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>
Signed-off-by: Kir Kolyshkin <kolyshkin@gmail.com>
(cherry picked from commit 6e597af6dc)
[fixed merge commit]
Signed-off-by: Paul Holzinger <pholzing@redhat.com>
Since PR 28760 linting is done for all OSes on linux, so there's no need
to run golangci-lint on Mac and FreeBSD separately. This also fixes the
issue of mixing up golangci-lint caches between different Mac OS X runs.
Signed-off-by: Kir Kolyshkin <kolyshkin@gmail.com>
(cherry picked from commit c22f67e729)
Signed-off-by: Paul Holzinger <pholzing@redhat.com>
Amend golangci-lint target to also run linters on all supported OSes
in addition to a native run.
Use CGO_ENABLED=0 because Makefile sets CGO_ENABLED=1, and
cross-compilation tools are probably not available.
Use GOARCH=arm64 for darwin because since commit f87cefc Mac builds are
arm64-only.
Signed-off-by: Kir Kolyshkin <kolyshkin@gmail.com>
(cherry picked from commit e9ec0ecef5)
Signed-off-by: Paul Holzinger <pholzing@redhat.com>
The install script only reuses the binary from $PATH if the version
matches otherwise installs into ./bin, if the version of $PATH matches
then the binary from ./bin is removed there.
That means the actual run must prefer ./bin as this has a known good
version when it exists unlike $PATH which can be the wrong version.
This fixes the logic added in commit cf021c4ba9.
Signed-off-by: Paul Holzinger <pholzing@redhat.com>
(cherry picked from commit 2e7178f428)
Signed-off-by: Paul Holzinger <pholzing@redhat.com>
Commit cf021c4ba9 switched the logic to also allow golangci-lint in
$PATH but forgot to update the call here.
Signed-off-by: Paul Holzinger <pholzing@redhat.com>
(cherry picked from commit 13c6b5d786)
Signed-off-by: Paul Holzinger <pholzing@redhat.com>
When a specific version of golangci-lint is already available in $PATH,
use it instead of installing one locally.
Signed-off-by: Kir Kolyshkin <kolyshkin@gmail.com>
(cherry picked from commit cf021c4ba9)
Signed-off-by: Paul Holzinger <pholzing@redhat.com>
Since commit def70012b9 git-validation is only used to check if the
commit subject is less than 90 characters.
Drop the vendored git-validation Go tool and the .gitvalidation make
target in favor of hack/commit-subject-check.sh.
This removes a Go build dependency and a vendored tree from
test/tools/ while keeping the same CI and local behavior.
Note the now-removed GIT_CHECK_EXCLUDE was not used by gitvalidation
since commit def70012b9 because it was not checking any specific
files, just the commit subject lengths.
Signed-off-by: Kir Kolyshkin <kolyshkin@gmail.com>
(cherry picked from commit f45b4c506a)
[manually fixed merge conflicts]
Signed-off-by: Paul Holzinger <pholzing@redhat.com>
EditorConfig is a way to specify some basic code formatting rules
independently of an $EDITOR being used.
Add rules for bats/bash/sh files:
- use 4 spaces for indentation (which appears to be a de-facto standard
in this repository, see e.g. commit 86e55d0ec1);
- ignore everything in vendor directories.
Signed-off-by: Kir Kolyshkin <kolyshkin@gmail.com>
(cherry picked from commit 5c5389dddd)
Signed-off-by: Paul Holzinger <pholzing@redhat.com>
This functionality is superseded by golangci-lint.
Signed-off-by: Kir Kolyshkin <kolyshkin@gmail.com>
(cherry picked from commit b2b552749d)
Signed-off-by: Paul Holzinger <pholzing@redhat.com>
They were replaced by errors.Is by the previous commit, and shall not
crawl back in.
Signed-off-by: Kir Kolyshkin <kolyshkin@gmail.com>
(cherry picked from commit 730934bd86)
Signed-off-by: Paul Holzinger <pholzing@redhat.com>
The interfacer linter was removed a few years ago.
Remove the annotations as well.
Signed-off-by: Kir Kolyshkin <kolyshkin@gmail.com>
(cherry picked from commit a7886d1fe8)
Signed-off-by: Paul Holzinger <pholzing@redhat.com>
Using os.Is{Exist,NotExist,Permission} checks is not recommended in the
new code (see official documentation). While using it in the existing
code is OK, it may still result in a subtle errors later (for a specific
example of that, see [1]).
Replace those with errors.Is.
Generated by:
gofmt -r 'os.IsExist(a) -> errors.Is(a, os.ErrExist)' -w .
gofmt -r 'os.IsNotExist(a) -> errors.Is(a, os.ErrNotExist)' -w .
gofmt -r 'os.IsPermission(a) -> errors.Is(a, os.ErrPermission)' -w .
goimports -w .
git diff vendor test/tools/vendor | patch -p1 -R
[1]: https://github.com/opencontainers/runc/pull/5061
Signed-off-by: Kir Kolyshkin <kolyshkin@gmail.com>
(cherry picked from commit 7f7b35356f)
[Added extra replacements manually that were only in the 5.8 tree]
Signed-off-by: Paul Holzinger <pholzing@redhat.com>
Have the build conditions match the build conditions of the
referenced implementation.
Signed-off-by: Miloslav Trmač <mitr@redhat.com>
(cherry picked from commit cb9df63d63)
Signed-off-by: Paul Holzinger <pholzing@redhat.com>
The test flakes on the socat pid kill when the pid already exited.
Because the timeout is just 10s we can just bump it to something loinger
to ensure the process is still alive when we kill it. Also move it up a
bit so the kill happens earlier.
I observed multiple time failing with test times of 11s+. This should be
enough to make it work properly.
Signed-off-by: Paul Holzinger <pholzing@redhat.com>
(cherry picked from commit c1ffafe5b7)
Signed-off-by: Paul Holzinger <pholzing@redhat.com>
In the new CI with run with many parallel jobs (8) and that is messing
up timings a fair but, any command might take unexpected long to
scheduling delays and lock holding by other tests.
Any test doing a podman ps -a while need to take all container locks
for example and that then can delay the stop command an unknown amount
of time, bump the timeout to 8 and use a higher stop timeout so we are
still testing that we exit before the wait timeout is reached.
Signed-off-by: Paul Holzinger <pholzing@redhat.com>
(cherry picked from commit 48594b61c8)
Signed-off-by: Paul Holzinger <pholzing@redhat.com>
This started to fail on fedora rawhide with kernel 7.1. I have not
looked into why exactly why but the theory from commit 12d40777f0
is likely related. What I do not get is why this tests seem to pass
elsewhere, i.e. it passes in openQA and testing farm but not in our
custom lima based VMs.
Lets hope this works better.
Signed-off-by: Paul Holzinger <pholzing@redhat.com>
(cherry picked from commit f9db3cbd2b)
Signed-off-by: Paul Holzinger <pholzing@redhat.com>
It is possible that the background podman stop -t 1 completes before we
get to podman kill making the kill fail as the container is not running.
The result is this error in the test:
"Error: can only kill running containers. xxx is in state exited: container state improper"
We can just bump the stop timeout to have a larger time where we can
trigger kill on a stopping container.
Signed-off-by: Paul Holzinger <pholzing@redhat.com>
(cherry picked from commit c4c2778776)
Signed-off-by: Paul Holzinger <pholzing@redhat.com>
The problem is by default we create the systemd timers and run hc in the
background. This means any tests who depend on exact hc timing can get
broken by this so use the DISABLE_HC_SYSTEMD=true env which makes podman
skip creating the systemd timers but still allows you to manually run
the commands.
Signed-off-by: Paul Holzinger <pholzing@redhat.com>
(cherry picked from commit ea51ae7305)
Signed-off-by: Paul Holzinger <pholzing@redhat.com>
