runc/.github/workflows/validate.yml

name: validate
on:
  push:
    tags:
      - v*
    branches:
      - main
      - release-*
  merge_group:
  pull_request:
  workflow_dispatch:

# Cancel superseded runs of the same pull request. For everything else
# (in particular, pushes to a branch or a tag) there is no PR number, so
# the group falls back to the unique run_id and nothing is cancelled.
concurrency:
  group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.run_id }}
  cancel-in-progress: true

permissions:
  contents: read

env:
  GO_VERSION: 1.26
  LIBPATHRS_VERSION: "0.2.6"

jobs:
  keyring:
    runs-on: ubuntu-24.04
    steps:
    - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
      with:
        persist-credentials: false
    - name: check runc.keyring
      run: make validate-keyring

  lint:
    timeout-minutes: 30
    permissions:
      contents: read
      checks: write # to allow the action to annotate code in the PR.
    runs-on: ubuntu-24.04
    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          fetch-depth: 2
          persist-credentials: false
      - uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0
        with:
          go-version: "${{ env.GO_VERSION }}"
      - name: install deps
        run: |
          sudo apt -q update
          sudo apt -qy install libseccomp-dev
      - uses: golangci/golangci-lint-action@ba0d7d2ec06a0ea1cb5fa41b2e4a3ab91d21278a # v9.3.0
        with:
          version: v2.15
          skip-cache: true
      # Extra linters, only checking new code from a pull request to main.
      - name: lint-extra
        if: github.event_name == 'pull_request' && github.base_ref == 'main'
        run: |
          golangci-lint run --config .golangci-extra.yml --new-from-rev=HEAD~1

  govulncheck:
    runs-on: ubuntu-24.04
    steps:
    - uses: golang/govulncheck-action@032d45514ae346b1db93c04b0c90b841c370344f # v1.1.0

  compile-buildtags:
    runs-on: ubuntu-24.04
    env:
      # Don't ignore C warnings. Note that the output of "go env CGO_CFLAGS" by default is "-g -O2", so we keep them.
      CGO_CFLAGS: -g -O2 -Werror
    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          persist-credentials: false
      - name: install go
        uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0
        with:
          go-version: "${{ env.GO_VERSION }}"
      - name: install deps
        run: |
          sudo apt update
          sudo apt -y install libseccomp-dev lld
      - name: install libpathrs ${{ env.LIBPATHRS_VERSION }}
        run: |
          sudo -E PATH="$PATH" ./script/build-libpathrs.sh "$LIBPATHRS_VERSION" /usr
      - name: compile with no build tags
        run: make BUILDTAGS=""
      - name: compile with runc_nocriu build tag
        run: make RUNC_BUILDTAGS="runc_nocriu"
      - name: verify linker dead code elimination is not disabled
        run: make verify-dce

  binary-size:
    if: github.event_name == 'pull_request'
    permissions:
      contents: read
      pull-requests: read # Needed to read the PR's labels.
    runs-on: ubuntu-24.04
    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          persist-credentials: false
          # Check out the PR head (not the merge commit), with full history.
          ref: ${{ github.event.pull_request.head.sha }}
          fetch-depth: 0
      - name: install go
        uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0
        with:
          go-version: "${{ env.GO_VERSION }}"
      - name: install deps
        run: |
          sudo apt update
          sudo apt -y install libseccomp-dev
      - name: install libpathrs ${{ env.LIBPATHRS_VERSION }}
        run: |
          sudo -E PATH="$PATH" ./script/build-libpathrs.sh "$LIBPATHRS_VERSION" /usr
      - name: build each commit and check binary size
        env:
          GH_TOKEN: ${{ github.token }}
          PR_NUMBER: ${{ github.event.pull_request.number }}
          BASE_SHA: ${{ github.event.pull_request.base.sha }}
          LABEL: bloat-approved
        run: |
          # Labels are read via the API (rather than from the event payload)
          # so that re-running the job after adding the label works.
          labels=$(gh api "/repos/${GITHUB_REPOSITORY}/pulls/${PR_NUMBER}" --jq '.labels[].name')
          if grep -Fxq "$LABEL" <<<"$labels"; then
            echo "Found $LABEL label, binary growth above the limit is allowed."
            export ALLOW_GROWTH=1
          fi
          ./script/check-binary-size.sh "$BASE_SHA"

  codespell:
    runs-on: ubuntu-24.04
    steps:
    - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
      with:
        persist-credentials: false
    - name: install deps
      # Version of codespell bundled with Ubuntu is way old, so use pip.
      run: pip install --break-system-packages codespell==v2.4.1
    - name: run codespell
      run: codespell

  shfmt:
    runs-on: ubuntu-24.04
    steps:
    - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
      with:
        persist-credentials: false
    - name: shfmt
      run: make shfmt

  shellcheck:
    runs-on: ubuntu-24.04
    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          persist-credentials: false
      - name: install shellcheck
        env:
          VERSION: v0.11.0
          BASEURL: https://github.com/koalaman/shellcheck/releases/download
          SHA256: 4da528ddb3a4d1b7b24a59d4e16eb2f5fd960f4bd9a3708a15baddbdf1d5a55b
        run: |
          mkdir ~/bin
          curl -sSfL --retry 5 "$BASEURL/$VERSION/shellcheck-$VERSION.linux.x86_64.tar.xz" |
            tar xfJ - -C ~/bin --strip 1 "shellcheck-$VERSION/shellcheck"
          sha256sum --strict --check - <<<"$SHA256 *$HOME/bin/shellcheck"
          # make sure to remove the old version
          sudo rm -f /usr/bin/shellcheck
          # Add ~/bin to $PATH.
          echo ~/bin >> "$GITHUB_PATH"
      - name: add problem matcher
        # Show shellcheck (tty format) findings as annotations.
        run: echo "::add-matcher::.github/shellcheck-tty.json"
      - name: run
        run: make shellcheck
      - name: check-config.sh
        run : ./script/check-config.sh

  space-at-eol:
    runs-on: ubuntu-24.04
    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          persist-credentials: false
      - run: rm -fr vendor
      - run: if git -P grep -I -n '\s$'; then echo "^^^ extra whitespace at EOL, please fix"; exit 1; fi

  deps:
    runs-on: ubuntu-24.04
    steps:
    - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
      with:
        persist-credentials: false
    - name: install go
      uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0
      with:
        go-version: "${{ env.GO_VERSION }}"
        check-latest: true
    - name: verify deps
      run: make verify-dependencies
    - name: no toolchain in go.mod # See https://github.com/opencontainers/runc/pull/4717, https://github.com/dependabot/dependabot-core/issues/11933.
      run: |
        if grep -q '^toolchain ' go.mod; then echo "Error: go.mod must not have toolchain directive, please fix"; exit 1; fi
    - name: no exclude nor replace in go.mod
      run: |
        if grep -Eq '^\s*(exclude|replace) ' go.mod; then echo "Error: go.mod must not have exclude/replace directive, it breaks go install. Please fix"; exit 1; fi


  commit:
    if: github.event_name == 'pull_request'
    permissions:
      contents: read
      pull-requests: read # Needed to list the PR's commits.
    runs-on: ubuntu-24.04
    steps:
      - name: check commit subject line length
        env:
          GH_TOKEN: ${{ github.token }}
          PR_NUMBER: ${{ github.event.pull_request.number }}
        run: |
          # Save to a file first, so that a gh failure fails the step (rather
          # than being masked by jq succeeding on empty input).
          gh api --paginate --slurp \
            "/repos/${GITHUB_REPOSITORY}/pulls/${PR_NUMBER}/commits" \
            > "$RUNNER_TEMP/commits.json"

          # A page is an array, and --slurp gives an array of pages, thus
          # the double iteration. Merge commits are skipped.
          long=$(jq -r '
              .[][]
              | select(.parents | length <= 1)
              | (.commit.message | split("\n")[0]) as $subject
              | select(($subject | length) > 72)
              | "\(.sha[0:12]) \($subject)"
            ' "$RUNNER_TEMP/commits.json")

          if [ -z "$long" ]; then
            echo "All commit subject lines are 72 characters or less."
            exit 0
          fi

          while read -r commit; do
            echo "::error::subject line too long (max 72 characters): $commit"
          done <<<"$long"
          exit 1

  cfmt:
    runs-on: ubuntu-24.04
    steps:
    - name: checkout
      uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
      with:
        persist-credentials: false
    - name: install deps
      run: |
        sudo apt -qq update
        sudo apt -qqy install indent
    - name: cfmt
      run: |
        make cfmt
        git diff --exit-code

  check-go:
    runs-on: ubuntu-24.04
    steps:
    - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
      with:
        persist-credentials: false
    - name: check Go version
      run: |
        GO_VER=$(awk -F= '/^ARG\s+GO_VERSION=/ {print $2; quit}' Dockerfile)
        echo "Go version used in Dockerfile: $GO_VER"
        echo -n "Checking if Go $GO_VER is supported ... "
        curl -fsSL https://go.dev/dl/?mode=json | jq -e 'any(.[]; .version | startswith("go'"$GO_VER"'"))'
        echo -n "Checking if Go $GO_VER is tested against ... "
        yq -e '.jobs.test.strategy.matrix.go-version | contains(["'"$GO_VER"'.x"])' .github/workflows/test.yml

  release:
    timeout-minutes: 30
    runs-on: ubuntu-24.04
    steps:
    - name: checkout
      uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
      with:
        persist-credentials: false

    - name: check CHANGELOG.md
      run: make verify-changelog

      # We have to run this under Docker as Ubuntu (host) does not support all
      # the architectures we want to compile test against, and Dockerfile uses
      # Debian (which does).
      #
      # XXX: as currently this is the only job that is using Docker, we are
      # building and using the runcimage locally. In case more jobs running
      # under Docker will emerge, it will be good to have a separate make
      # runcimage job and share its result (the docker image) with whoever
      # needs it.
    - name: build docker image
      run: make runcimage
    - name: smoke test docker image
      run: make integration TESTPATH=/run.bats
    - name: make releaseall
      run: make releaseall
    - name: upload artifacts
      uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
      with:
        name: release-${{ github.run_id }}
        path: release/*


  get-images:
    runs-on: ubuntu-24.04
    steps:
    - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
      with:
        persist-credentials: false
    - name: install bashbrew
      env:
        BASEURL: https://github.com/docker-library/bashbrew/releases/download
        VERSION: v0.1.7
        SHA256: 6b71a6fccfb2025d48a2b23324836b5513c29abfd2d16a57b7a2f89bd02fe53a
      run: |
        mkdir ~/bin
        curl -sSfL --retry 5 -o ~/bin/bashbrew \
          "$BASEURL/$VERSION/bashbrew-amd64"
        sha256sum --strict --check - <<<"$SHA256 *$HOME/bin/bashbrew"
        chmod a+x ~/bin/bashbrew
        # Add ~/bin to $PATH.
        echo ~/bin >> "$GITHUB_PATH"
    - name: check that get-images.sh is up to date
      run: |
        cd tests/integration
        ./bootstrap-get-images.sh > get-images.sh
        git diff --exit-code

  conmon:
    runs-on: ubuntu-24.04
    steps:
    - name: checkout
      uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
      with:
        persist-credentials: false

    - name: install runc and conmon deps
      # XXX maybe switch to conmon/hack/github-actions-setup if the burden
      # to maintain the list of needed packages here is too much to handle.
      run: |
        sudo apt update
        sudo apt -y install libseccomp-dev libglib2.0-dev libsystemd-dev socat
    - name: install libpathrs ${{ env.LIBPATHRS_VERSION }}
      run: |
        sudo -E PATH="$PATH" ./script/build-libpathrs.sh "$LIBPATHRS_VERSION" /usr

    - name: install Go
      uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0
      with:
        go-version: "${{ env.GO_VERSION }}"

    - name: build runc
      run: make

    - name: Allow userns for runc
      # https://discourse.ubuntu.com/t/ubuntu-24-04-lts-noble-numbat-release-notes/39890#unprivileged-user-namespace-restrictions-15
      run: |
        sed "s;^profile runc /usr/sbin/;profile runc-test $PWD/;" < /etc/apparmor.d/runc | sudo apparmor_parser

    - name: setup bats
      uses: bats-core/bats-action@77d6fb60505b4d0d1d73e48bd035b55074bbfb43 # 4.0.0
      with:
        bats-version: 1.13.0 # As required by conmon in hack/github-actions-setup.
        support-install: false
        assert-install: false
        detik-install: false
        file-install: false

    - name: checkout conmon
      uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
      with:
        repository: containers/conmon
        path: conmon
        # XXX: this is conmon main, which has a lot of test fixes (including
        # making the tests fail, rather than silently skip, when the test
        # image can not be pulled) that are not in any release yet. Switch to
        # a released version once one is out (> v2.2.1).
        ref: f4cefcd7a33932131ab1a0130ae0b0175368025a
        persist-credentials: false

    - name: build conmon
      run: cd conmon && make

    - name: run conmon tests
      # --strict turns a skipped test into a failure. We do not want any of
      # these tests to be silently skipped here (that is how the breakage
      # fixed by #5401 went unnoticed for a while), and none of them are
      # expected to skip in this environment.
      run: |
        RUNTIME_BINARY="$(pwd)/runc" ./conmon/test/run-tests.sh --strict -j "$(nproc)"

  zizmor:
    runs-on: ubuntu-24.04
    steps:
    - name: checkout
      uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
      with:
        persist-credentials: false

    - uses: zizmorcore/zizmor-action@53290badfa369cb0bf7ad16342cb62c2fa47ac7b # v0.8.0
      with:
        version: 1.30.0
        advanced-security: false
        annotations: true

  all-done-validate:
    # Jobs that are not applicable to the event (e.g. PR-only jobs on push)
    # are skipped, which by default skips this job, too. Run it anyway, and
    # fail if any of the needed jobs has failed or was cancelled.
    if: ${{ !cancelled() }}
    needs:
      - binary-size
      - check-go
      - cfmt
      - codespell
      - commit
      - compile-buildtags
      - conmon
      - deps
      - get-images
      - govulncheck
      - keyring
      - lint
      - release
      - shellcheck
      - shfmt
      - space-at-eol
      - zizmor
    runs-on: ubuntu-24.04
    steps:
    - name: check that all jobs succeeded
      env:
        NEEDS: ${{ toJSON(needs) }}
      run: |
        failed=$(jq -r 'to_entries[]
            | select(.value.result != "success" and .value.result != "skipped")
            | "::error::Job \(.key) result: \(.value.result)"' <<<"$NEEDS")
        if [ -n "$failed" ]; then
          echo "$failed"
          exit 1
        fi
        echo "All jobs completed"