Add a manually dispatched workflow for maintainers to sync a docker
release branch to a selected docker release tag.
The job checks out the requested release branch, merges the tag with
`git merge --no-ff`, checks the worktree content out from that tag,
stages the result, and pushes the updated branch.
The actual push is guarded by the `docker-releases` GitHub environment
which requires a manual approval.
Signed-off-by: Paweł Gronowski <pawel.gronowski@docker.com>
The DCO job runs inside an Alpine container and fetches the base
branch from VALIDATE_REPO unless VALIDATE_ORIGIN_BRANCH is set.
In forked runs that repository can point at a private upstream URL, so
the unauthenticated fetch fails with:
```
fatal: could not read Username for 'https://github.com': No such
device or address
```
Pass the pull request base SHA so the validator can resolve the
comparison point locally.
Signed-off-by: Paweł Gronowski <pawel.gronowski@docker.com>
This validation is already run elsewhere, but wasn't excluded in this workflow,
causing failures on non-default branches (because VALIDATE_BRANCH isn't set,
and won't be set when running from a "push" or "workflow_dispatch").
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
I noticed that this workflow was running both before, and after merging a
pull request. When running after it's merged, it gets confused and the check
will be failing (post merge);
Modified files: .github/workflows/.dco.yml, .github/workflows/.test-unit.yml, .github/workflows/.test.yml, .github/workflows/.vm.yml, .github/workflows/.windows.yml, .github/workflows/buildkit.yml, .github/workflows/ci.yml, .github/workflows/codeql.yml, .github/workflows/test.yml, .github/workflows/validate-pr.yml
Touches version: false
Base ref: master
Error: PR must have a milestone set (expected: 29.7.0)
Add an extra condition so that the check is only triggered while the PR
is open, not after it's closed or merged. Also add `reopened` as event,
to make sure it's run if someone would close/reopen the PR.
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
These were the only two jobs running directly via `runs-on:` that did
not have a `timeout-minutes` guardrail. Add 120 minutes as a starting
point to prevent runaway jobs, matching the existing convention used
elsewhere in the workflows. Tuning each job's timeout to its usual
runtime is left as a follow-up, as suggested in the issue.
Signed-off-by: Takumi Akasaka <takumiakasaka1231@gmail.com>
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
The concurrency groups currently cancel older runs for push, tag,
scheduled, and manually dispatched events.
On maintained refs this canhide a regression when a later run starts
before the earlier validation finishes.
Keep cancellation for stale pull request runs only, while allowing
non-PR validation to complete.
Signed-off-by: Paweł Gronowski <pawel.gronowski@docker.com>
This step would fail if the daemon was never started ("Starting test daemon"),
or failed to start;
Run Get-WinEvent -ea SilentlyContinue `
out-file: D:\a\_temp\2b911acb-4e0e-4684-bf63-606f0da5f7c6.ps1:2
Line |
2 | Get-WinEvent -ea SilentlyContinue `
| ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
| Could not find a part of the path 'D:\a\moby\moby\go\src\github.com\docker\docker\bundles\daemon.log'.
Error: Process completed with exit code 1.
- Update the step to skip if we never attempted to start the daemon
- Make sure the output directory is created: even if we failed to start
the daemon (and thus tests weren't run), the startup itself could
potentially contain information that helps debugging the reason for
the daemon starting.
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
If setup failed or was skipped, this produced an error;
Run (Stop-Service -DisplayName "OpenTelemetry Collector" -PassThru).WaitForStatus('Stopped', (New-TimeSpan -Seconds 30))
Stop-Service: D:\a\_temp\f0230cca-e5e4-4a0b-9fe2-0d0a6a5bc60e.ps1:2
Line |
2 | (Stop-Service -DisplayName "OpenTelemetry Collector" -PassThru).WaitF …
| ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
| Cannot find any service with display name 'OpenTelemetry Collector'.
Error: Process completed with exit code 1.
Skip this step if we skipped "Set up OpenTelemetry Collector", and ignore situations
where the service could not be found for other reasons.
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
GitHub issue and PR references in commit messages become part of
persistent history and can create unintended cross-references.
Check commit subjects and bodies for shorthand references such as
<hash>123, moby/moby<hash>123 and GitHub issue or pull-request URLs.
Signed-off-by: Paweł Gronowski <pawel.gronowski@docker.com>
The integration matrix now starts from the default runner row and lets
the caller provide extra modes.
This keeps native arm64 on the single default mode while amd64 retains
expanded coverage.
Signed-off-by: Paweł Gronowski <pawel.gronowski@docker.com>
Add a small compatibility job named `build (binary)` so existing branch
protection rules continue to work.
Signed-off-by: Paweł Gronowski <pawel.gronowski@docker.com>
Combining the arm64 builds into the existing build matrix changed the
GitHub check name from `build (binary)` to `build (<runner>,
<target>)`, so the previous required `build (binary)` status is no
longer produced.
Add a final CI job with a stable display name that depends on all
previous steps.
Signed-off-by: Paweł Gronowski <pawel.gronowski@docker.com>
Avoid running graphdriver coverage on native arm64.
Containerd snapshotter is the default now.
Signed-off-by: Paweł Gronowski <pawel.gronowski@docker.com>
Run native arm64 coverage through the same CI and test workflow matrices
as amd64 to avoid a separate workflow.
Signed-off-by: Paweł Gronowski <pawel.gronowski@docker.com>
This release include 3 security fixes following the security policy:
- mime: quadratic complexity in WordDecoder.DecodeHeader
Decoding a maliciously-crafted MIME header containing many invalid
encoded-words could consume excessive CPU.
The MIME decoder now better handles this case.
Thanks to p4p3r (https://hackerone.com/p4p3r_hak) for reporting this issue.
This is CVE-2026-42504 and Go issue https://go.dev/issue/79217.
- net/textproto: arbitrary input are included in errors without any escaping
When returning errors, functions in the net/textproto package would
include its input as part of the error, without any escaping. Note that
said input is often controlled by external parties when using this
package naturally. For example, a net/http client uses ReadMIMEHeader
when parsing the headers it receive from a server.
As a result, an attacker could inject arbitrary content into the error.
Practically, this can result in an attacker injecting misleading
content, terminal control bytes, etc. into a victim's output or logs.
This is CVE-2026-42507 and Go issue https://go.dev/issue/79346
- crypto/x509: split candidate hostname only once
(*x509.Certificate).VerifyHostname previously called matchHostnames in a loop
over all DNS Subject Alternative Name (SAN) entries. This caused
strings.Split(host, ".") to execute repeatedly on the same input hostname.
With a large DNS SAN list, verification costs scaled quadratically based on the
number of SAN entries multiplied by the hostname's label count. Because
x509.Verify validates hostnames before building the certificate chain, this
overhead occurred even for untrusted certificates.
Thanks to Jakub Ciolek (https://ciolek.dev) for reporting this issue.
This is CVE-2026-27145 and https://go.dev/issue/79694.
View the release notes for more information:
https://go.dev/doc/devel/release#go1.26.4
Signed-off-by: Paweł Gronowski <pawel.gronowski@docker.com>
Delay regular dependency updates until releases are at least 3 days old,
using strict internal checks so Renovate waits before creating branches
or PRs.
Signed-off-by: Paweł Gronowski <pawel.gronowski@docker.com>
