Group actions published by the docker organization so Renovate opens
one update pull request instead of a separate pull request for each
action.
Signed-off-by: Paweł Gronowski <pawel.gronowski@docker.com>
User namespace remapping currently has no full integration-suite CI
coverage. Add a graphdriver mode that starts dockerd with
DOCKER_REMAP_ROOT=default.
Skip tests that require privileged or host namespaces, and avoid the
host network optimization in TestUpdatePidsLimit, because dockerd
rejects those combinations when remapping is enabled.
Signed-off-by: Paweł Gronowski <pawel.gronowski@docker.com>
Without -r, xargs invokes sync-branch with no arguments when the tags
file is empty (all tags already merged), causing sync-branch to exit
with a usage error.
Signed-off-by: Paweł Gronowski <pawel.gronowski@docker.com>
sync-branch calls git merge --continue, which creates a commit and
therefore requires a git author identity even in dry-run mode.
Skipping the "Configure git author" step on dry runs caused those runs
to fail with a git identity error before any merges were attempted.
Signed-off-by: Paweł Gronowski <pawel.gronowski@docker.com>
The guard compared the lowercase shell variable $branch (undefined,
expands to empty string) against "master " with a trailing space, so
the branch protection never fired.
Signed-off-by: Paweł Gronowski <pawel.gronowski@docker.com>
go1.26.5 (released 2026-07-07) includes security fixes to the crypto/tls
and os packages, as well as bug fixes to the compiler, the runtime, the
go command, and the net, os, and syscall packages. See the Go 1.26.5
milestone on our issue tracker for details;
- https://github.com/golang/go/issues?q=milestone%3AGo1.26.5+label%3ACherryPickApproved
- full diff: https://github.com/golang/go/compare/go1.26.4...go1.26.5
From the security announcement:
We have just released Go versions 1.26.5 and 1.25.12, minor point releases.
These releases include 2 security fixes following the security policy:
- os: Root escape via symlink plus trailing slash
On Unix systems, opening a file in an os.Root improperly
followed symlinks to locations outside of the Root when
the final path component of the a path is a symbolic link
and the path ends in /.
For example, root.Open("symlink/") would open "symlink"
even when "symlink" is a symbolic link pointing outside of the root.
On Unix, openat(fd, path, O_NOFOLLOW) will follow symlinks
in path when path ends in a /. Root failed to account for
this behavior, permitting paths with a trailing / to escape.
It now properly sanitizes the path parameter provided to openat.
hanks to Mundur for reporting this issue.
This is CVE-2026-39822 and Go issue https://go.dev/issue/79005.
- crypto/tls: Encrypted Client Hello privacy leak
he Encrypted Client Hello implementation would leak the pre-shared key
dentities during the handshake, allowing a passive network observer who can
ollect handshakes to de-anonymize the hostname of the server, even when ECH was
eing used.
Thanks to Coia Prant (github.com/rbqvq) for reporting this issue.
This is CVE-2026-42505 and Go issue https://go.dev/issue/79282.
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
Allows PR authors to stress-test specific integration tests for
flakiness even when the diff doesn't touch them.
Add a /flaky-check directive on its own line in the PR body:
/flaky-check=TestFoo,TestBar
The GHA integration-flaky job parses the directive from the PR body and
exports the names as FLAKY_EXTRA_TESTS, which the script appends to the
diff-detected set before running the stress loop.
Signed-off-by: Paweł Gronowski <pawel.gronowski@docker.com>
In Docker org, QEMU exits before SSH is available on GitHub-hosted
runners because the VM job asks KVM for 12 GiB of guest memory:
```
qemu-system-x86_64: cannot set up guest memory 'pc.ram': Cannot
allocate memory
```
Set the Lima guest size to the runner's detected memory minus 2 GiB.
This keeps headroom for the host while avoiding fixed assumptions about
which organization or runner size is executing the workflow.
Signed-off-by: Paweł Gronowski <pawel.gronowski@docker.com>
Sometimes we get rate limited for cache access.
Drop fail-on-cache-miss and fall back to building the dev image from the
GHA buildkit cache (scope=dev-amd64) when the restore doesn't hit, the
same way the test and test-unit jobs already build it.
The happy path (cache hit + docker load) is unchanged.
Signed-off-by: Paweł Gronowski <pawel.gronowski@docker.com>
Add a manually dispatched workflow for maintainers to sync a docker
release branch to a selected docker release tag.
The job checks out the requested release branch, merges the tag with
`git merge --no-ff`, checks the worktree content out from that tag,
stages the result, and pushes the updated branch.
The actual push is guarded by the `docker-releases` GitHub environment
which requires a manual approval.
Signed-off-by: Paweł Gronowski <pawel.gronowski@docker.com>
The DCO job runs inside an Alpine container and fetches the base
branch from VALIDATE_REPO unless VALIDATE_ORIGIN_BRANCH is set.
In forked runs that repository can point at a private upstream URL, so
the unauthenticated fetch fails with:
```
fatal: could not read Username for 'https://github.com': No such
device or address
```
Pass the pull request base SHA so the validator can resolve the
comparison point locally.
Signed-off-by: Paweł Gronowski <pawel.gronowski@docker.com>
This validation is already run elsewhere, but wasn't excluded in this workflow,
causing failures on non-default branches (because VALIDATE_BRANCH isn't set,
and won't be set when running from a "push" or "workflow_dispatch").
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
I noticed that this workflow was running both before, and after merging a
pull request. When running after it's merged, it gets confused and the check
will be failing (post merge);
Modified files: .github/workflows/.dco.yml, .github/workflows/.test-unit.yml, .github/workflows/.test.yml, .github/workflows/.vm.yml, .github/workflows/.windows.yml, .github/workflows/buildkit.yml, .github/workflows/ci.yml, .github/workflows/codeql.yml, .github/workflows/test.yml, .github/workflows/validate-pr.yml
Touches version: false
Base ref: master
Error: PR must have a milestone set (expected: 29.7.0)
Add an extra condition so that the check is only triggered while the PR
is open, not after it's closed or merged. Also add `reopened` as event,
to make sure it's run if someone would close/reopen the PR.
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
These were the only two jobs running directly via `runs-on:` that did
not have a `timeout-minutes` guardrail. Add 120 minutes as a starting
point to prevent runaway jobs, matching the existing convention used
elsewhere in the workflows. Tuning each job's timeout to its usual
runtime is left as a follow-up, as suggested in the issue.
Signed-off-by: Takumi Akasaka <takumiakasaka1231@gmail.com>
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
The concurrency groups currently cancel older runs for push, tag,
scheduled, and manually dispatched events.
On maintained refs this canhide a regression when a later run starts
before the earlier validation finishes.
Keep cancellation for stale pull request runs only, while allowing
non-PR validation to complete.
Signed-off-by: Paweł Gronowski <pawel.gronowski@docker.com>
