github/containerd
4
0
Fork 0
Code Issues Pull Requests Packages Projects Releases 2 Wiki Activity
14,210 Commits 3 Branches 4 Tags
a26a33c3d9fd7ea0cf4d72595780eca679eb8a6a
Commit Graph

486 Commits

Author SHA1 Message Date
Derek McGowan
a26a33c3d9 Merge pull request #10543 from vishalRGurrala/feature/generate-attestation-for-artifacts 
Generate attestation for artifacts during release CI job
 2024-08-26 23:36:04 +00:00
dependabot[bot]
429085c84d build(deps): bump google-github-actions/upload-cloud-storage 
Bumps [google-github-actions/upload-cloud-storage](https://github.com/google-github-actions/upload-cloud-storage) from 2.1.2 to 2.1.3.
- [Release notes](https://github.com/google-github-actions/upload-cloud-storage/releases)
- [Changelog](https://github.com/google-github-actions/upload-cloud-storage/blob/main/CHANGELOG.md)
- [Commits](https://github.com/google-github-actions/upload-cloud-storage/compare/v2.1.2...v2.1.3)

---
updated-dependencies:
- dependency-name: google-github-actions/upload-cloud-storage
  dependency-type: direct:production
  update-type: version-update:semver-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
 2024-08-19 23:20:08 +00:00
Akhil Mohan
20ee6de0b5 update golangci-lint to v1.60.1 
Signed-off-by: Akhil Mohan <akhilerm@gmail.com>
 2024-08-14 12:40:37 +05:30
Akhil Mohan
fb8cd045b8 add go1.23.0 
Signed-off-by: Akhil Mohan <akhilerm@gmail.com>
 2024-08-14 12:30:37 +05:30
dependabot[bot]
1de84c29f1 build(deps): bump google-github-actions/upload-cloud-storage 
Bumps [google-github-actions/upload-cloud-storage](https://github.com/google-github-actions/upload-cloud-storage) from 2.1.1 to 2.1.2.
- [Release notes](https://github.com/google-github-actions/upload-cloud-storage/releases)
- [Changelog](https://github.com/google-github-actions/upload-cloud-storage/blob/main/CHANGELOG.md)
- [Commits](https://github.com/google-github-actions/upload-cloud-storage/compare/v2.1.1...v2.1.2)

---
updated-dependencies:
- dependency-name: google-github-actions/upload-cloud-storage
  dependency-type: direct:production
  update-type: version-update:semver-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
 2024-08-12 23:07:43 +00:00
Kazuyoshi Kato
6b04c9dfac Merge pull request #10550 from containerd/dependabot/github_actions/google-github-actions/upload-cloud-storage-2.1.1 
build(deps): bump google-github-actions/upload-cloud-storage from 2.1.0 to 2.1.1
 2024-08-09 23:08:42 +00:00
Sebastiaan van Stijn
a100b055cb update to go1.22.6 
- https://github.com/golang/go/issues?q=milestone%3AGo1.22.6+label%3ACherryPickApproved
- full diff: https://github.com/golang/go/compare/go1.22.5...go1.22.6

go1.22.6 (released 2024-08-06) includes fixes to the go command, the compiler,
the linker, the trace command, the covdata command, and the bytes, go/types,
and os/exec packages. See the Go 1.22.6 milestone on our issue tracker for
details.

Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
 2024-08-09 17:02:18 +02:00
Vishal Reddy Gurrala
fc1637d16e Attest artifacts in release workflow 
Signed-off-by: Vishal Reddy Gurrala <vishalgurrala21@gmail.com>
 2024-08-05 20:54:34 -05:00
Vishal Reddy Gurrala
337d8c52c5 Update release job to generate artifacts attestation 
Signed-off-by: Vishal Reddy Gurrala <vishalgurrala21@gmail.com>
 2024-08-05 20:50:26 -05:00
dependabot[bot]
6814cc3549 build(deps): bump google-github-actions/upload-cloud-storage 
Bumps [google-github-actions/upload-cloud-storage](https://github.com/google-github-actions/upload-cloud-storage) from 2.1.0 to 2.1.1.
- [Release notes](https://github.com/google-github-actions/upload-cloud-storage/releases)
- [Changelog](https://github.com/google-github-actions/upload-cloud-storage/blob/main/CHANGELOG.md)
- [Commits](https://github.com/google-github-actions/upload-cloud-storage/compare/v2.1.0...v2.1.1)

---
updated-dependencies:
- dependency-name: google-github-actions/upload-cloud-storage
  dependency-type: direct:production
  update-type: version-update:semver-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
 2024-08-05 23:17:47 +00:00
dependabot[bot]
71b5b34de0 build(deps): bump ossf/scorecard-action from 2.3.3 to 2.4.0 
Bumps [ossf/scorecard-action](https://github.com/ossf/scorecard-action) from 2.3.3 to 2.4.0.
- [Release notes](https://github.com/ossf/scorecard-action/releases)
- [Changelog](https://github.com/ossf/scorecard-action/blob/main/RELEASE.md)
- [Commits](dc50aa9510...62b2cac7ed)

---
updated-dependencies:
- dependency-name: ossf/scorecard-action
  dependency-type: direct:production
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <support@github.com>
 2024-07-29 23:04:31 +00:00
Derek McGowan
edd84f4a65 Add read permission limit on link workflow 
Signed-off-by: Derek McGowan <derek@mcg.dev>
 2024-07-15 07:05:34 -07:00
Akihiro Suda
cbb2fc78e9 Merge pull request #10436 from AkihiroSuda/fedora-40 
CI: update Fedora to 40
 2024-07-07 11:15:11 +00:00
Akihiro Suda
51f34ff491 CI: update Fedora to 40 
Signed-off-by: Akihiro Suda <akihiro.suda.cz@hco.ntt.co.jp>
 2024-07-04 23:50:35 +09:00
Akhil Mohan
56495b404d update go version to 1.22.5 
Signed-off-by: Akhil Mohan <akhilerm@gmail.com>
 2024-07-03 11:55:48 +05:30
Akhil Mohan
9077968119 update release runners to ubuntu 24.04 
update all runners except the binary building job to ubuntu-24.04

Signed-off-by: Akhil Mohan <akhilerm@gmail.com>
 2024-06-20 07:07:18 +05:30
Akhil Mohan
c25183ff19 use older version of OVMF package 
use ovmf 2022.02-3ubuntu0.22.04.2 so that the OVMF_CODE.fd which vagrant
looks for is still available

Signed-off-by: Akhil Mohan <akhilerm@gmail.com>
 2024-06-19 22:28:03 +05:30
Akhil Mohan
1bfdccee09 use vagrant from jammy in noble 
Signed-off-by: Akhil Mohan <akhilerm@gmail.com>
 2024-06-19 02:26:02 +05:30
Akhil Mohan
769e0c8c16 add debian sources for ubuntu-24 
Signed-off-by: Akhil Mohan <akhilerm@gmail.com>
 2024-06-19 00:07:28 +05:30
Akhil Mohan
027414ee50 enable ubuntu 24 runners 
Signed-off-by: Akhil Mohan <akhilerm@gmail.com>
 2024-06-19 00:07:27 +05:30
Derek McGowan
531da99606 Reduce scope of permissions in stale workflow 
Signed-off-by: Derek McGowan <derek@mcg.dev>
 2024-06-17 12:04:15 -07:00
Kohei Tokunaga
939135ae36 CI: golangci-lint v1.59.1 
Signed-off-by: Kohei Tokunaga <ktokunaga.mail@gmail.com>
 2024-06-11 20:17:35 +09:00
Akihiro Suda
08c1e12e9b CI: add back EL 8 
Add back EL 8 to test legacy compatibility

Follow-up to PR 10297

Signed-off-by: Akihiro Suda <akihiro.suda.cz@hco.ntt.co.jp>
 2024-06-08 19:50:39 +09:00
Derek McGowan
1c123efb41 Update Go version to 1.22.4 
Includes fix for a symlink race on remove.
Updates 1.21 to 1.21.11 for runc install which also includes the
symlink fix.

Signed-off-by: Derek McGowan <derek@mcg.dev>
 2024-06-04 15:46:09 -07:00
Derek McGowan
e1e793e4ab Update rockylinux vagrant build 
Signed-off-by: Derek McGowan <derek@mcg.dev>
 2024-06-04 14:38:12 -07:00
Austin Vazquez
2d73340c2c Explicitly set release latest to false 
This change explicitly sets mainline releases as not latest.

Signed-off-by: Austin Vazquez <macedonv@amazon.com>
 2024-05-25 15:27:48 +00:00
Maksym Pavlenko
a673c3452a Merge pull request #10222 from containerd/dependabot/github_actions/ossf/scorecard-action-2.3.3 
build(deps): bump ossf/scorecard-action from 2.3.1 to 2.3.3
 2024-05-14 16:13:17 +00:00
dependabot[bot]
8b2a69c19a build(deps): bump golangci/golangci-lint-action from 5 to 6 
Bumps [golangci/golangci-lint-action](https://github.com/golangci/golangci-lint-action) from 5 to 6.
- [Release notes](https://github.com/golangci/golangci-lint-action/releases)
- [Commits](https://github.com/golangci/golangci-lint-action/compare/v5...v6)

---
updated-dependencies:
- dependency-name: golangci/golangci-lint-action
  dependency-type: direct:production
  update-type: version-update:semver-major
...

Signed-off-by: dependabot[bot] <support@github.com>
 2024-05-13 23:54:52 +00:00
dependabot[bot]
96ff18d37c build(deps): bump ossf/scorecard-action from 2.3.1 to 2.3.3 
Bumps [ossf/scorecard-action](https://github.com/ossf/scorecard-action) from 2.3.1 to 2.3.3.
- [Release notes](https://github.com/ossf/scorecard-action/releases)
- [Changelog](https://github.com/ossf/scorecard-action/blob/main/RELEASE.md)
- [Commits](0864cf1902...dc50aa9510)

---
updated-dependencies:
- dependency-name: ossf/scorecard-action
  dependency-type: direct:production
  update-type: version-update:semver-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
 2024-05-13 23:54:50 +00:00
Austin Vazquez
25c2f690a8 Update toolchain to Go 1.22.3 
Go 1.22.3 release includes bug fixes for the core net/http package.

Full release notes: https://go.dev/doc/devel/release#go1.22.minor

Signed-off-by: Austin Vazquez <macedonv@amazon.com>
 2024-05-10 15:49:18 +00:00
Maksym Pavlenko
9a9a8c46a6 Don't require vagrant tests in merge queues 
Signed-off-by: Maksym Pavlenko <pavlenko.maksym@gmail.com>
 2024-05-08 15:41:41 -07:00
Kohei Tokunaga
41dc94ee17 CI: bump up golangci-lint to v1.58.0 
This also fixes the following warnings:

```
WARN [config_reader] The configuration option `run.skip-dirs` is deprecated, please use `issues.exclude-dirs`.
WARN [lintersdb] The name "vet" is deprecated. The linter has been renamed to: govet.
```

Signed-off-by: Kohei Tokunaga <ktokunaga.mail@gmail.com>
 2024-05-08 12:09:30 +09:00
Akihiro Suda
bfdc224861 Merge pull request #9920 from AkihiroSuda/cri-tools-20240304 
critools-version: v1.30.0
 2024-05-07 21:27:53 +00:00
Phil Estes
c5f538c4c4 Merge pull request #10147 from containerd/dependabot/github_actions/lycheeverse/lychee-action-1.10.0 
build(deps): bump lycheeverse/lychee-action from 1.9.3 to 1.10.0
 2024-05-07 14:21:21 +00:00
Wei Fu
3b065cdddb CI: skip test in arm64 CI 
Co-authored-by: Wei Fu <fuweid89@gmail.com>
Signed-off-by: Akihiro Suda <akihiro.suda.cz@hco.ntt.co.jp>
 2024-05-07 21:24:28 +09:00
Akhil Mohan
13f2fa1de1 remove go1.21.9 from CI matrix 
since go.mod got updated to go1.22, 1.22 is the minimum version to build
containerd. even if 1.21.9 is the version present on the host, go
command will build using 1.22.0 go version.

Signed-off-by: Akhil Mohan <akhilerm@gmail.com>
 2024-05-06 16:00:41 +05:30
Derek McGowan
b811a88793 Add API release action 
Signed-off-by: Derek McGowan <derek@mcg.dev>
 2024-05-03 16:26:11 -07:00
Akihiro Suda
53160fb4b6 Merge pull request #10110 from AkihiroSuda/go-mod-1.22 
go.mod: go 1.22
 2024-04-30 09:19:17 +00:00
Akihiro Suda
2d5689434d CI: use Go 1.22 by default 
Signed-off-by: Akihiro Suda <akihiro.suda.cz@hco.ntt.co.jp>
 2024-04-30 11:52:36 +09:00
dependabot[bot]
c001a70562 build(deps): bump lycheeverse/lychee-action from 1.9.3 to 1.10.0 
Bumps [lycheeverse/lychee-action](https://github.com/lycheeverse/lychee-action) from 1.9.3 to 1.10.0.
- [Release notes](https://github.com/lycheeverse/lychee-action/releases)
- [Commits](https://github.com/lycheeverse/lychee-action/compare/v1.9.3...v1.10.0)

---
updated-dependencies:
- dependency-name: lycheeverse/lychee-action
  dependency-type: direct:production
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <support@github.com>
 2024-04-29 23:19:13 +00:00
dependabot[bot]
6df759e243 build(deps): bump golangci/golangci-lint-action from 4 to 5 
Bumps [golangci/golangci-lint-action](https://github.com/golangci/golangci-lint-action) from 4 to 5.
- [Release notes](https://github.com/golangci/golangci-lint-action/releases)
- [Commits](https://github.com/golangci/golangci-lint-action/compare/v4...v5)

---
updated-dependencies:
- dependency-name: golangci/golangci-lint-action
  dependency-type: direct:production
  update-type: version-update:semver-major
...

Signed-off-by: dependabot[bot] <support@github.com>
 2024-04-29 23:19:10 +00:00
Sebastiaan van Stijn
13e6b2b686 update to go1.21.9, go1.22.2 
go1.21.9 (released 2024-04-03) includes a security fix to the net/http
package, as well as bug fixes to the linker, and the go/types and
net/http packages. See the Go 1.21.9 milestone for more details;
https://github.com/golang/go/issues?q=milestone%3AGo1.21.9+label%3ACherryPickApproved

These minor releases include 1 security fixes following the security policy:

- http2: close connections when receiving too many headers

Maintaining HPACK state requires that we parse and process all HEADERS
and CONTINUATION frames on a connection. When a request's headers exceed
MaxHeaderBytes, we don't allocate memory to store the excess headers but
we do parse them. This permits an attacker to cause an HTTP/2 endpoint
to read arbitrary amounts of header data, all associated with a request
which is going to be rejected. These headers can include Huffman-encoded
data which is significantly more expensive for the receiver to decode
than for an attacker to send.

Set a limit on the amount of excess header frames we will process before
closing a connection.

Thanks to Bartek Nowotarski (https://nowotarski.info/) for reporting this issue.

This is CVE-2023-45288 and Go issue https://go.dev/issue/65051.

View the release notes for more information:
https://go.dev/doc/devel/release#go1.22.2

- https://github.com/golang/go/issues?q=milestone%3AGo1.21.9+label%3ACherryPickApproved
- full diff: https://github.com/golang/go/compare/go1.21.8...go1.21.9

Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
 2024-04-22 19:43:32 +02:00
Derek McGowan
357c59b799 Update github actions ci to run on forks 
Excludes actuated when on fork.
Runs some project tests on fork.

Signed-off-by: Derek McGowan <derek@mcg.dev>
 2024-03-12 18:20:02 -07:00
dependabot[bot]
21d3fedf44 build(deps): bump softprops/action-gh-release from 1 to 2 
Bumps [softprops/action-gh-release](https://github.com/softprops/action-gh-release) from 1 to 2.
- [Release notes](https://github.com/softprops/action-gh-release/releases)
- [Changelog](https://github.com/softprops/action-gh-release/blob/master/CHANGELOG.md)
- [Commits](https://github.com/softprops/action-gh-release/compare/v1...v2)

---
updated-dependencies:
- dependency-name: softprops/action-gh-release
  dependency-type: direct:production
  update-type: version-update:semver-major
...

Signed-off-by: dependabot[bot] <support@github.com>
 2024-03-11 23:09:36 +00:00
Phil Estes
249db79d6d Merge pull request #9923 from containerd/dependabot/github_actions/azure/login-2 
build(deps): bump azure/login from 1 to 2
 2024-03-08 02:54:36 +00:00
Austin Vazquez
7ac9d6909c Use the Go toolchain in CI matrix to build binaries 
Signed-off-by: Austin Vazquez <macedonv@amazon.com>
 2024-03-08 00:35:36 +00:00
Akihiro Suda
7ecdebff93 update to go 1.21.8, 1.22.1 
See https://groups.google.com/g/golang-announce/c/5pwGVUPoMbg

Signed-off-by: Akihiro Suda <akihiro.suda.cz@hco.ntt.co.jp>
 2024-03-07 08:32:40 +09:00
dependabot[bot]
ab4de3e4c3 build(deps): bump azure/login from 1 to 2 
Bumps [azure/login](https://github.com/azure/login) from 1 to 2.
- [Release notes](https://github.com/azure/login/releases)
- [Commits](https://github.com/azure/login/compare/v1...v2)

---
updated-dependencies:
- dependency-name: azure/login
  dependency-type: direct:production
  update-type: version-update:semver-major
...

Signed-off-by: dependabot[bot] <support@github.com>
 2024-03-04 23:06:36 +00:00
Wei Fu
5351ad6b4a .github: windows should use fix critool version 
Signed-off-by: Wei Fu <fuweid89@gmail.com>
 2024-02-24 22:48:53 +08:00
Austin Vazquez
6a759713ad Update golangci-lint to v1.56.1 
Signed-off-by: Austin Vazquez <macedonv@amazon.com>
 2024-02-19 15:15:01 +00:00