Skip to content

Commit f450502

Browse files
AkihiroSudaapostasie
AkihiroSuda
authored and
apostasie
committed
Merge pull request #3723 from apostasie/namespace-validate
Cleanup namespace validation
2 parents 3206b49 + b8f4d9c commit f450502

File tree

18 files changed

+664
-765
lines changed

18 files changed

+664
-765
lines changed

‎.github/workflows/ghcr-image-build-and-publish.yml‎

Lines changed: 21 additions & 16 deletions
Original file line numberDiff line numberDiff line change
@@ -16,51 +16,56 @@ on:
1616
- '**.md'
1717

1818
env:
19-
# Use docker.io for Docker Hub if empty
20-
REGISTRY: ghcr.io
2119
# github.repository as <account>/<repo>
2220
IMAGE_NAME: ${{ github.repository }}
2321

2422
jobs:
25-
build:
23+
# Source the common environment
24+
environment:
25+
name: " "
26+
uses: ./.github/workflows/reusable_environment.yml
2627

27-
runs-on: ubuntu-24.04
28+
build:
29+
name: "project checks"
30+
timeout-minutes: ${{ fromJSON(needs.environment.outputs.LONG_TIMEOUT) }}
31+
runs-on: ${{ needs.environment.outputs.HOST_UBUNTU_LTS }}
32+
needs: environment
2833
permissions:
2934
contents: read
3035
packages: write
3136

3237
steps:
33-
- name: Checkout repository
34-
uses: actions/checkout@v4.2.2
38+
- name: "Checkout"
39+
uses: actions/checkout@v4
3540

36-
- name: Set up QEMU
41+
- name: "Set up QEMU"
3742
uses: docker/setup-qemu-action@v3
3843

39-
- name: Set up Docker Buildx
44+
- name: "Set up Docker Buildx"
4045
uses: docker/setup-buildx-action@v3
4146

4247
# Login against a Docker registry except on PR
4348
# https://github.com/docker/login-action
44-
- name: Log into registry ${{ env.REGISTRY }}
49+
- name: "Log into registry ${{ env.REGISTRY }}"
4550
if: github.event_name != 'pull_request'
46-
uses: docker/login-action@v3.3.0
51+
uses: docker/login-action@v3
4752
with:
48-
registry: ${{ env.REGISTRY }}
53+
registry: ${{ needs.environment.outputs.REGISTRY }}
4954
username: ${{ github.actor }}
5055
password: ${{ secrets.GITHUB_TOKEN }}
5156

5257
# Extract metadata (tags, labels) for Docker
5358
# https://github.com/docker/metadata-action
54-
- name: Extract Docker metadata
59+
- name: "Extract Docker metadata"
5560
id: meta
56-
uses: docker/metadata-action@v5.6.1
61+
uses: docker/metadata-action@v5
5762
with:
58-
images: ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}
63+
images: ${{ needs.environment.outputs.REGISTRY }}/${{ env.IMAGE_NAME }}
5964

6065
# Build and push Docker image with Buildx (don't push on PR)
6166
# https://github.com/docker/build-push-action
62-
- name: Build and push Docker image
63-
uses: docker/build-push-action@v6.10.0
67+
- name: "Build and push Docker image"
68+
uses: docker/build-push-action@v6
6469
with:
6570
context: .
6671
platforms: linux/amd64,linux/arm64

‎.github/workflows/lint.yml‎

Lines changed: 37 additions & 66 deletions
Original file line numberDiff line numberDiff line change
@@ -1,4 +1,5 @@
1-
name: lint
1+
# "Hide" the name from the GitHub check status line, as it just clutters the display
2+
name: " "
23

34
on:
45
push:
@@ -7,72 +8,42 @@ on:
78
- 'release/**'
89
pull_request:
910

10-
env:
11-
GO_VERSION: 1.23.x
12-
1311
jobs:
14-
go:
15-
timeout-minutes: 5
16-
name: "go | ${{ matrix.goos }} | ${{ matrix.canary }}"
17-
runs-on: "${{ matrix.os }}"
18-
defaults:
19-
run:
20-
shell: bash
12+
# Source the common environment
13+
environment:
14+
name: "lint"
15+
uses: ./.github/workflows/reusable_environment.yml
16+
17+
# Linting go
18+
lint-go:
19+
# Define the matrix we want to lint on: every supported OS, with the current go version, and additionally go canary on linux
2120
strategy:
2221
matrix:
22+
# The GOOS-es we run golint for, with no canary (eg: the base supported GO_VERSION)
23+
goos: [linux, freebsd, windows]
24+
# And no canary
25+
canary: [false]
2326
include:
24-
- os: ubuntu-24.04
25-
goos: linux
26-
- os: ubuntu-24.04
27-
goos: freebsd
28-
# FIXME: this is currently failing in a non-sensical way, so, running on linux instead...
29-
# - os: windows-2022
30-
- os: ubuntu-24.04
31-
goos: windows
32-
- os: ubuntu-24.04
33-
goos: linux
34-
# This allows the canary script to select any upcoming golang alpha/beta/RC
35-
canary: go-canary
36-
env:
37-
GOOS: "${{ matrix.goos }}"
38-
steps:
39-
- uses: actions/checkout@v4.2.2
40-
with:
41-
fetch-depth: 1
42-
- name: Set GO env
43-
run: |
44-
# If canary is specified, get the latest available golang pre-release instead of the major version
45-
if [ "$canary" != "" ]; then
46-
. ./hack/build-integration-canary.sh
47-
canary::golang::latest
48-
fi
49-
- uses: actions/setup-go@v5
50-
with:
51-
go-version: ${{ env.GO_VERSION }}
52-
check-latest: true
53-
cache: true
54-
- name: golangci-lint
55-
uses: golangci/golangci-lint-action@v6
56-
with:
57-
args: --verbose
58-
other:
59-
timeout-minutes: 5
60-
name: yaml | shell | imports order
61-
runs-on: ubuntu-24.04
62-
steps:
63-
- uses: actions/checkout@v4.2.2
64-
with:
65-
fetch-depth: 1
66-
- uses: actions/setup-go@v5
67-
with:
68-
go-version: ${{ env.GO_VERSION }}
69-
check-latest: true
70-
cache: true
71-
- name: yaml
72-
run: make lint-yaml
73-
- name: shell
74-
run: make lint-shell
75-
- name: go imports ordering
76-
run: |
77-
go install -v github.com/incu6us/goimports-reviser/v3@latest
78-
make lint-imports
27+
# Only run canary on linux (note: the canary script will select any upcoming golang alpha/beta/RC when the `canary` param is set to a non-empty string)
28+
- goos: linux
29+
canary: true
30+
31+
# If we do not "collapse" the name using a bogux matrix var, it will display all matrix parameters, which we do not want
32+
name: "lint${{ matrix.c }}"
33+
uses: ./.github/workflows/reusable_lint_go.yml
34+
needs: environment
35+
with:
36+
goos: ${{ matrix.goos }}
37+
canary: ${{ matrix.canary }}
38+
os: ${{ needs.environment.outputs.HOST_UBUNTU_LTS }}
39+
goversion: ${{ needs.environment.outputs.GO_VERSION }}
40+
timeout-minutes: ${{ fromJSON(needs.environment.outputs.SHORT_TIMEOUT) }}
41+
42+
# Linting other filetypes
43+
lint-other:
44+
name: "lint"
45+
uses: ./.github/workflows/reusable_lint_other.yml
46+
needs: environment
47+
with:
48+
os: ${{ needs.environment.outputs.HOST_UBUNTU_LTS }}
49+
timeout-minutes: ${{ fromJSON(needs.environment.outputs.SHORT_TIMEOUT) }}

‎.github/workflows/project.yml‎

Lines changed: 27 additions & 11 deletions
Original file line numberDiff line numberDiff line change
@@ -1,4 +1,4 @@
1-
name: project
1+
name: " "
22

33
on:
44
push:
@@ -8,24 +8,40 @@ on:
88
pull_request:
99

1010
jobs:
11+
# Source the common environment
12+
environment:
13+
name: "project checks"
14+
uses: ./.github/workflows/reusable_environment.yml
15+
1116
project:
12-
name: checks
13-
runs-on: ubuntu-24.04
14-
timeout-minutes: 20
17+
name: "project checks"
18+
timeout-minutes: ${{ fromJSON(needs.environment.outputs.SHORT_TIMEOUT) }}
19+
runs-on: ${{ needs.environment.outputs.HOST_UBUNTU_LTS }}
20+
needs: environment
21+
1522
steps:
16-
- uses: actions/checkout@v4.2.2
23+
- name: "Checkout"
24+
uses: actions/checkout@v4
1725
with:
1826
path: src/github.com/containerd/nerdctl
27+
# Fetch the last 100 commits
1928
fetch-depth: 100
20-
- uses: actions/setup-go@v5
29+
30+
- name: "Install go"
31+
uses: actions/setup-go@v5
2132
with:
22-
go-version: ${{ env.GO_VERSION }}
33+
go-version: ${{ needs.environment.outputs.GO_VERSION }}
2334
cache-dependency-path: src/github.com/containerd/nerdctl
24-
- uses: containerd/project-checks@v1.1.0
35+
36+
- name: "Install and run default containerd project checks"
37+
uses: containerd/project-checks@v1.1.0
2538
with:
2639
working-directory: src/github.com/containerd/nerdctl
27-
repo-access-token: ${{ secrets.GITHUB_TOKEN }}
28-
- run: ./hack/verify-no-patent.sh
40+
41+
- name: "Verify no patent"
42+
run: ./hack/verify-no-patent.sh
2943
working-directory: src/github.com/containerd/nerdctl
30-
- run: ./hack/verify-pkg-isolation.sh
44+
45+
- name: "Verify package isolation"
46+
run: ./hack/verify-pkg-isolation.sh
3147
working-directory: src/github.com/containerd/nerdctl

‎.github/workflows/release.yml‎

Lines changed: 23 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -1,27 +1,44 @@
11
# See https://github.com/containerd/nerdctl/blob/main/MAINTAINERS_GUIDE.md for how to make a release.
22
name: Release
3+
34
on:
45
push:
56
tags:
67
- 'v*'
78
- 'test-action-release-*'
89
jobs:
10+
# Source the common environment
11+
environment:
12+
name: " "
13+
uses: ./.github/workflows/reusable_environment.yml
14+
915
release:
10-
runs-on: ubuntu-24.04
11-
timeout-minutes: 40
16+
name: "checks"
17+
timeout-minutes: ${{ fromJSON(needs.environment.outputs.LONG_TIMEOUT) }}
18+
runs-on: ${{ needs.environment.outputs.HOST_UBUNTU_LTS }}
19+
needs: environment
20+
1221
steps:
13-
- uses: actions/checkout@v4.2.2
14-
- uses: actions/setup-go@v5
22+
- name: "Checkout"
23+
uses: actions/checkout@v4
24+
25+
- name: "Install go"
26+
uses: actions/setup-go@v5
1527
with:
16-
go-version: 1.23.x
28+
go-version: ${{ needs.environment.outputs.GO_VERSION }}
29+
check-latest: true
30+
1731
- name: "Compile binaries"
1832
run: make artifacts
33+
1934
- name: "SHA256SUMS"
2035
run: |
2136
( cd _output; sha256sum nerdctl-* ) | tee /tmp/SHA256SUMS
2237
mv /tmp/SHA256SUMS _output/SHA256SUMS
38+
2339
- name: "The sha256sum of the SHA256SUMS file"
2440
run: (cd _output; sha256sum SHA256SUMS)
41+
2542
- name: "Prepare the release note"
2643
run: |
2744
shasha=$(sha256sum _output/SHA256SUMS | awk '{print $1}')
@@ -35,6 +52,7 @@ jobs:
3552
- - -
3653
Release manager: [ADD YOUR NAME HERE] (@[ADD YOUR GITHUB ID HERE])
3754
EOF
55+
3856
- name: "Create release"
3957
env:
4058
GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}

‎.github/workflows/reusable_environment.yml‎

Lines changed: 73 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,73 @@
1+
name: common_environment
2+
3+
env:
4+
GO_VERSION: 1.23.x
5+
HOST_UBUNTU_LTS: ubuntu-24.04
6+
SHORT_TIMEOUT: 5
7+
LONG_TIMEOUT: 20
8+
# Will use docker.io for Docker Hub if empty
9+
REGISTRY: ghcr.io
10+
11+
# Versions for images we maintain
12+
BUSYBOX_VERSION: 5ad83957fa74aafd061afbfb8da14ce3220659a9
13+
DISTRIBUTION_VERSION: v2.8.3
14+
CURL_VERSION: 8.11.0_4
15+
16+
on:
17+
workflow_call:
18+
outputs:
19+
GO_VERSION:
20+
description: "The major golang version we are targeting"
21+
value: ${{ jobs.environment.outputs.output_go }}
22+
HOST_UBUNTU_LTS:
23+
description: "The major LTS ubuntu host runner we run our tasks on"
24+
value: ${{ jobs.environment.outputs.output_ubuntu_lts }}
25+
SHORT_TIMEOUT:
26+
description: "The timeout for tasks that are supposed to run fast (lint, etc)"
27+
value: ${{ jobs.environment.outputs.output_short_timeout }}
28+
LONG_TIMEOUT:
29+
description: "The timeout for tasks that are going to run up to 20 minutes (building, integration, etc)"
30+
value: ${{ jobs.environment.outputs.output_long_timeout }}
31+
REGISTRY:
32+
description: "The registry where to push our images"
33+
value: ${{ jobs.environment.outputs.output_registry }}
34+
BUSYBOX_VERSION:
35+
description: "Busybox version"
36+
value: ${{ jobs.environment.outputs.output_busybox }}
37+
DISTRIBUTION_VERSION:
38+
description: "Distribution version"
39+
value: ${{ jobs.environment.outputs.output_distribution }}
40+
CURL_VERSION:
41+
description: "Curl version"
42+
value: ${{ jobs.environment.outputs.output_curl }}
43+
44+
jobs:
45+
environment:
46+
name: "environ"
47+
runs-on: ubuntu-24.04
48+
steps:
49+
- id: go
50+
run: echo "GO_VERSION=$GO_VERSION" >> $GITHUB_OUTPUT
51+
- id: ubuntu_lts
52+
run: echo "HOST_UBUNTU_LTS=$HOST_UBUNTU_LTS" >> $GITHUB_OUTPUT
53+
- id: short_timeout
54+
run: echo "SHORT_TIMEOUT=$SHORT_TIMEOUT" >> $GITHUB_OUTPUT
55+
- id: long_timeout
56+
run: echo "LONG_TIMEOUT=$LONG_TIMEOUT" >> $GITHUB_OUTPUT
57+
- id: registry
58+
run: echo "REGISTRY=$REGISTRY" >> $GITHUB_OUTPUT
59+
- id: busybox
60+
run: echo "BUSYBOX_VERSION=$BUSYBOX_VERSION" >> $GITHUB_OUTPUT
61+
- id: distribution
62+
run: echo "DISTRIBUTION_VERSION=$DISTRIBUTION_VERSION" >> $GITHUB_OUTPUT
63+
- id: curl
64+
run: echo "CURL_VERSION=$CURL_VERSION" >> $GITHUB_OUTPUT
65+
outputs:
66+
output_go: ${{ steps.go.outputs.GO_VERSION }}
67+
output_ubuntu_lts: ${{ steps.ubuntu_lts.outputs.HOST_UBUNTU_LTS }}
68+
output_short_timeout: ${{ steps.short_timeout.outputs.SHORT_TIMEOUT }}
69+
output_long_timeout: ${{ steps.long_timeout.outputs.LONG_TIMEOUT }}
70+
output_registry: ${{ steps.registry.outputs.REGISTRY }}
71+
output_busybox: ${{ steps.registry.outputs.BUSYBOX_VERSION }}
72+
output_distribution: ${{ steps.registry.outputs.DISTRIBUTION_VERSION }}
73+
output_curl: ${{ steps.registry.outputs.CURL_VERSION }}

0 commit comments

Comments
 (0)