The main Windows workflow already starts the service in this case, and
that recovery appears to have resolved the same flake there.
Use its shared readiness action for the BuildKit Windows build as well.
Signed-off-by: Paweł Gronowski <pawel.gronowski@docker.com>
The Windows build and unit-test jobs used identical PowerShell blocks
to wait for the runner's Docker daemon and recover when its service
was stopped.
Move that unchanged logic into a local composite action to allow reusing
it.
Signed-off-by: Paweł Gronowski <pawel.gronowski@docker.com>
Add an "embedded" mode to the Linux and Windows integration test
matrices that runs the daemon with the embedded-containerd feature.
Signed-off-by: Paweł Gronowski <pawel.gronowski@docker.com>
Group actions published by the docker organization so Renovate opens
one update pull request instead of a separate pull request for each
action.
Signed-off-by: Paweł Gronowski <pawel.gronowski@docker.com>
User namespace remapping currently has no full integration-suite CI
coverage. Add a graphdriver mode that starts dockerd with
DOCKER_REMAP_ROOT=default.
Skip tests that require privileged or host namespaces, and avoid the
host network optimization in TestUpdatePidsLimit, because dockerd
rejects those combinations when remapping is enabled.
Signed-off-by: Paweł Gronowski <pawel.gronowski@docker.com>
Without -r, xargs invokes sync-branch with no arguments when the tags
file is empty (all tags already merged), causing sync-branch to exit
with a usage error.
Signed-off-by: Paweł Gronowski <pawel.gronowski@docker.com>
sync-branch calls git merge --continue, which creates a commit and
therefore requires a git author identity even in dry-run mode.
Skipping the "Configure git author" step on dry runs caused those runs
to fail with a git identity error before any merges were attempted.
Signed-off-by: Paweł Gronowski <pawel.gronowski@docker.com>
The guard compared the lowercase shell variable $branch (undefined,
expands to empty string) against "master " with a trailing space, so
the branch protection never fired.
Signed-off-by: Paweł Gronowski <pawel.gronowski@docker.com>
go1.26.5 (released 2026-07-07) includes security fixes to the crypto/tls
and os packages, as well as bug fixes to the compiler, the runtime, the
go command, and the net, os, and syscall packages. See the Go 1.26.5
milestone on our issue tracker for details;
- https://github.com/golang/go/issues?q=milestone%3AGo1.26.5+label%3ACherryPickApproved
- full diff: https://github.com/golang/go/compare/go1.26.4...go1.26.5
From the security announcement:
We have just released Go versions 1.26.5 and 1.25.12, minor point releases.
These releases include 2 security fixes following the security policy:
- os: Root escape via symlink plus trailing slash
On Unix systems, opening a file in an os.Root improperly
followed symlinks to locations outside of the Root when
the final path component of the a path is a symbolic link
and the path ends in /.
For example, root.Open("symlink/") would open "symlink"
even when "symlink" is a symbolic link pointing outside of the root.
On Unix, openat(fd, path, O_NOFOLLOW) will follow symlinks
in path when path ends in a /. Root failed to account for
this behavior, permitting paths with a trailing / to escape.
It now properly sanitizes the path parameter provided to openat.
hanks to Mundur for reporting this issue.
This is CVE-2026-39822 and Go issue https://go.dev/issue/79005.
- crypto/tls: Encrypted Client Hello privacy leak
he Encrypted Client Hello implementation would leak the pre-shared key
dentities during the handshake, allowing a passive network observer who can
ollect handshakes to de-anonymize the hostname of the server, even when ECH was
eing used.
Thanks to Coia Prant (github.com/rbqvq) for reporting this issue.
This is CVE-2026-42505 and Go issue https://go.dev/issue/79282.
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
Allows PR authors to stress-test specific integration tests for
flakiness even when the diff doesn't touch them.
Add a /flaky-check directive on its own line in the PR body:
/flaky-check=TestFoo,TestBar
The GHA integration-flaky job parses the directive from the PR body and
exports the names as FLAKY_EXTRA_TESTS, which the script appends to the
diff-detected set before running the stress loop.
Signed-off-by: Paweł Gronowski <pawel.gronowski@docker.com>
In Docker org, QEMU exits before SSH is available on GitHub-hosted
runners because the VM job asks KVM for 12 GiB of guest memory:
```
qemu-system-x86_64: cannot set up guest memory 'pc.ram': Cannot
allocate memory
```
Set the Lima guest size to the runner's detected memory minus 2 GiB.
This keeps headroom for the host while avoiding fixed assumptions about
which organization or runner size is executing the workflow.
Signed-off-by: Paweł Gronowski <pawel.gronowski@docker.com>
