From ccd2336ac6058cb909230b4ffb32ef9cf79f06fd Mon Sep 17 00:00:00 2001 From: Akihiro Suda Date: Tue, 14 Oct 2025 14:41:27 +0900 Subject: [PATCH 1/4] CI: remove deprecated lima-vm/lima-actions/ssh `lima-vm/lima-actions/ssh` is now merged into `lima-vm/lima-actions/setup`. https://github.com/lima-vm/lima-actions/releases/tag/v1.1.0 Signed-off-by: Akihiro Suda (cherry picked from commit c0e6f42427ff66a60e12c89eeec8741f3d463dc3) Signed-off-by: lifubang --- .github/workflows/test.yml | 2 -- 1 file changed, 2 deletions(-) diff --git a/.github/workflows/test.yml b/.github/workflows/test.yml index 80fb4b2e6..7444381b8 100644 --- a/.github/workflows/test.yml +++ b/.github/workflows/test.yml @@ -217,8 +217,6 @@ jobs: # NOTE the execution environment lacks a terminal, needed for # some integration tests. So we use `ssh -tt` command to fake a terminal. - - uses: lima-vm/lima-actions/ssh@v1 - - name: "Run unit tests" run: ssh -tt lima-default sudo -i make -C /tmp/runc localunittest From 72e673cf136f61dec7d8c57a7385079fa4d6f1c3 Mon Sep 17 00:00:00 2001 From: Kir Kolyshkin Date: Tue, 7 Oct 2025 17:07:50 -0700 Subject: [PATCH 2/4] all: format sources with gofumpt v0.9.1 Since gofumpt v0.9.0 there's a new formatting rule to "clothe" any naked returns. Signed-off-by: Kir Kolyshkin (cherry picked from commit b2f8a74de58e69a1cf92997f50f9a4be1bfd1462) Signed-off-by: lifubang --- libcontainer/exeseal/cloned_binary_linux.go | 6 +++--- libcontainer/integration/utils_test.go | 2 +- libcontainer/internal/userns/usernsfd_linux.go | 2 +- libcontainer/mount_linux.go | 2 +- libcontainer/nsenter/nsenter_test.go | 2 +- libcontainer/rootfs_linux.go | 2 +- libcontainer/seccomp/patchbpf/enosys_linux.go | 4 ++-- libcontainer/utils/utils.go | 2 +- 8 files changed, 11 insertions(+), 11 deletions(-) diff --git a/libcontainer/exeseal/cloned_binary_linux.go b/libcontainer/exeseal/cloned_binary_linux.go index 3bafc96a6..459b60d68 100644 --- a/libcontainer/exeseal/cloned_binary_linux.go +++ b/libcontainer/exeseal/cloned_binary_linux.go @@ -125,7 +125,7 @@ func getSealableFile(comment, tmpDir string) (file *os.File, sealFn SealFunc, er // First, try an executable memfd (supported since Linux 3.17). file, sealFn, err = Memfd(comment) if err == nil { - return + return file, sealFn, err } logrus.Debugf("memfd cloned binary failed, falling back to O_TMPFILE: %v", err) @@ -154,7 +154,7 @@ func getSealableFile(comment, tmpDir string) (file *os.File, sealFn SealFunc, er file.Close() continue } - return + return file, sealFn, err } logrus.Debugf("O_TMPFILE cloned binary failed, falling back to mktemp(): %v", err) // Finally, try a classic unlinked temporary file. @@ -168,7 +168,7 @@ func getSealableFile(comment, tmpDir string) (file *os.File, sealFn SealFunc, er file.Close() continue } - return + return file, sealFn, err } return nil, nil, fmt.Errorf("could not create sealable file for cloned binary: %w", err) } diff --git a/libcontainer/integration/utils_test.go b/libcontainer/integration/utils_test.go index 9b4121bc5..091f96dda 100644 --- a/libcontainer/integration/utils_test.go +++ b/libcontainer/integration/utils_test.go @@ -209,7 +209,7 @@ func runContainer(t testing.TB, config *configs.Config, args ...string) (buffers } else { return buffers, -1, err } - return + return buffers, exitCode, err } // runContainerOk is a wrapper for runContainer, simplifying its use for cases diff --git a/libcontainer/internal/userns/usernsfd_linux.go b/libcontainer/internal/userns/usernsfd_linux.go index 2eb64cf76..00b5cd0a2 100644 --- a/libcontainer/internal/userns/usernsfd_linux.go +++ b/libcontainer/internal/userns/usernsfd_linux.go @@ -34,7 +34,7 @@ func (m Mapping) toSys() (uids, gids []syscall.SysProcIDMap) { Size: int(gid.Size), }) } - return + return uids, gids } // id returns a unique identifier for this mapping, agnostic of the order of diff --git a/libcontainer/mount_linux.go b/libcontainer/mount_linux.go index 683b5e624..9d4b5dcef 100644 --- a/libcontainer/mount_linux.go +++ b/libcontainer/mount_linux.go @@ -236,7 +236,7 @@ func syscallMode(i fs.FileMode) (o uint32) { o |= unix.S_ISVTX } // No mapping for Go's ModeTemporary (plan9 only). - return + return o } // mountFd creates a "mount source fd" (either through open_tree(2) or just diff --git a/libcontainer/nsenter/nsenter_test.go b/libcontainer/nsenter/nsenter_test.go index c0b4e9b47..123448bc2 100644 --- a/libcontainer/nsenter/nsenter_test.go +++ b/libcontainer/nsenter/nsenter_test.go @@ -199,7 +199,7 @@ func newPipe(t *testing.T) (parent *os.File, child *os.File) { parent.Close() child.Close() }) - return + return parent, child } func reapChildren(t *testing.T, parent *os.File) { diff --git a/libcontainer/rootfs_linux.go b/libcontainer/rootfs_linux.go index e57ce80eb..0eb25b2cf 100644 --- a/libcontainer/rootfs_linux.go +++ b/libcontainer/rootfs_linux.go @@ -1158,7 +1158,7 @@ func msMoveRoot(rootfs string) error { strings.HasPrefix(info.Mountpoint, rootfs) { skip = true } - return + return skip, stop }) if err != nil { return err diff --git a/libcontainer/seccomp/patchbpf/enosys_linux.go b/libcontainer/seccomp/patchbpf/enosys_linux.go index 86de31378..14c03f277 100644 --- a/libcontainer/seccomp/patchbpf/enosys_linux.go +++ b/libcontainer/seccomp/patchbpf/enosys_linux.go @@ -665,7 +665,7 @@ func filterFlags(config *configs.Seccomp, filter *libseccomp.ScmpFilter) (flags } } - return + return flags, noNewPrivs, err } func sysSeccompSetFilter(flags uint, filter []unix.SockFilter) (fd int, err error) { @@ -695,7 +695,7 @@ func sysSeccompSetFilter(flags uint, filter []unix.SockFilter) (fd int, err erro } runtime.KeepAlive(filter) runtime.KeepAlive(fprog) - return + return fd, err } // PatchAndLoad takes a seccomp configuration and a libseccomp filter which has diff --git a/libcontainer/utils/utils.go b/libcontainer/utils/utils.go index 23003e177..17a7d8043 100644 --- a/libcontainer/utils/utils.go +++ b/libcontainer/utils/utils.go @@ -111,5 +111,5 @@ func Annotations(labels []string) (bundle string, userAnnotations map[string]str userAnnotations[name] = value } } - return + return bundle, userAnnotations } From 1e425cc71e693b747e7c9a06a22576b34231c649 Mon Sep 17 00:00:00 2001 From: Kir Kolyshkin Date: Tue, 7 Oct 2025 16:59:48 -0700 Subject: [PATCH 3/4] ci: bump golangci-lint to v2.5 Signed-off-by: Kir Kolyshkin (cherry picked from commit 2aea8617ea5079a7b9a63eb3e6aa2401803e9067) Signed-off-by: lifubang --- .github/workflows/validate.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.github/workflows/validate.yml b/.github/workflows/validate.yml index faa7f1f8b..90a6634a2 100644 --- a/.github/workflows/validate.yml +++ b/.github/workflows/validate.yml @@ -41,7 +41,7 @@ jobs: sudo apt -qy install libseccomp-dev - uses: golangci/golangci-lint-action@v7 with: - version: v2.1 + version: v2.5 # Extra linters, only checking new code from a pull request. - name: lint-extra if: github.event_name == 'pull_request' From 1c78b1ff02d44260947faac3332829d66b1be626 Mon Sep 17 00:00:00 2001 From: Kir Kolyshkin Date: Tue, 14 Oct 2025 16:15:13 -0700 Subject: [PATCH 4/4] ci: only run lint-extra job on PRs to main All the new code appears in main (not in the release branches), and we only want extra linter rules to apply to new code. Disable lint-extra job if the PR is not to the main branch. Signed-off-by: Kir Kolyshkin (cherry picked from commit 1c4dba693ffc843086781e456f5cb3aae1426430) Signed-off-by: lifubang --- .github/workflows/validate.yml | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/.github/workflows/validate.yml b/.github/workflows/validate.yml index 90a6634a2..e62bed7e7 100644 --- a/.github/workflows/validate.yml +++ b/.github/workflows/validate.yml @@ -42,9 +42,9 @@ jobs: - uses: golangci/golangci-lint-action@v7 with: version: v2.5 - # Extra linters, only checking new code from a pull request. + # Extra linters, only checking new code from a pull request to main. - name: lint-extra - if: github.event_name == 'pull_request' + if: github.event_name == 'pull_request' && github.base_ref == 'main' run: | golangci-lint run --config .golangci-extra.yml --new-from-rev=HEAD~1