Custom mirror

.github/actions/retry-go-network/action.yml

@@ -0,0 +1,29 @@
+name: Retry transient Go downloads
+description: Run a command again when a Go proxy download fails transiently, retaining Docker's build cache.
+inputs:
+  command:
+    description: Command to execute, including a Docker build that downloads Go modules.
+    required: true
+runs:
+  using: composite
+  steps:
+    - shell: bash
+      env:
+        RETRY_COMMAND: ${{ inputs.command }}
+      run: |
+        log=$(mktemp)
+        trap 'rm -f "$log"' EXIT
+        for attempt in 1 2 3; do
+          echo "Attempt $attempt/3"
+          if bash --noprofile --norc -eo pipefail -c "$RETRY_COMMAND" 2>&1 | tee "$log"; then
+            exit 0
+          else
+            status=${PIPESTATUS[0]}
+          fi
+          if [[ "$status" == 130 || "$status" == 143 ]] || ! grep -Eq 'https?://(proxy\.golang\.org|sum\.golang\.org)/.*(INTERNAL_ERROR|unexpected EOF|i/o timeout|TLS handshake timeout|connection reset by peer|502 Bad Gateway|503 Service Unavailable|504 Gateway Timeout)' "$log"; then
+            exit "$status"
+          fi
+          ((attempt < 3)) || exit "$status"
+          echo "::warning::Transient Go download failure; retrying in 10 seconds"
+          sleep 10
+        done

.github/workflows/.test.yml

@@ -43,20 +43,17 @@ jobs:
       tags: ${{ steps.set.outputs.tags }}
       includes: ${{ steps.set.outputs.includes }}
     steps:
-      -
-        name: Set up QEMU
-        uses: docker/setup-qemu-action@ce360397dd3f832beb865e1373c09c0e9f86d70a # v4.0.0
       -
         name: Set up Docker Buildx
-        uses: docker/setup-buildx-action@4d04d5d9486b7bd6fa91e7baf45bbb4f8b9deedd # v4.0.0
+        uses: docker/setup-buildx-action@594f3bf4285d9ea8dc53c9a0c9c4092420091003 # v4.4.0
         with:
           version: ${{ env.SETUP_BUILDX_VERSION }}
           driver-opts: image=${{ env.SETUP_BUILDKIT_IMAGE }}
           buildkitd-flags: --debug
       -
         name: Deps
         run: |
-          npm install js-yaml
+          npm install --no-save js-yaml@5.1.0
       -
         name: Set outputs
         id: set
@@ -88,13 +85,14 @@ jobs:
               core.setOutput('tags', JSON.stringify(matrix));
             });
             await core.group(`Set includes`, async () => {
-              const includes = yaml.load(core.getInput('includes'));
+              const input = core.getInput('includes').trim();
+              const includes = input ? yaml.load(input) : [];
               core.info(JSON.stringify(includes, null, 2));
               core.setOutput('includes', JSON.stringify(includes ?? []));
             });
       -
         name: Build
-        uses: docker/bake-action@a66e1c87e2eca0503c343edf1d208c716d54b8a8 # v7.1.0
+        uses: docker/bake-action@018cb6412ab401ebaa809aa5f85966b74628600f # v7.4.0
         with:
           targets: integration-tests-base
           set: |
@@ -116,7 +114,7 @@ jobs:
           - containerd
           - containerd-rootless
           - containerd-1.7
-          - containerd-2.1
+          - containerd-2.3
           - containerd-snapshotter-stargz
           - oci
           - oci-rootless
@@ -147,27 +145,27 @@ jobs:
           echo "TESTFLAGS=${testFlags}" >> $GITHUB_ENV
       -
         name: Checkout
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
       -
         name: Expose GitHub Runtime
         uses: crazy-max/ghaction-github-runtime@04d248b84655b509d8c44dc1d6f990c879747487 # v4.0.0
       -
-        name: Set up QEMU
-        uses: docker/setup-qemu-action@ce360397dd3f832beb865e1373c09c0e9f86d70a # v4.0.0
+        name: Set up QEMU # required by TestNamedMultiplatformInputContext, TestMultiPlatformProvenance, etc.
+        uses: docker/setup-qemu-action@99012661954931238ded8c8b007157a8430204e1 # v4.4.0
       -
         name: Set up Docker Buildx
-        uses: docker/setup-buildx-action@4d04d5d9486b7bd6fa91e7baf45bbb4f8b9deedd # v4.0.0
+        uses: docker/setup-buildx-action@594f3bf4285d9ea8dc53c9a0c9c4092420091003 # v4.4.0
         with:
           version: ${{ env.SETUP_BUILDX_VERSION }}
           driver-opts: image=${{ env.SETUP_BUILDKIT_IMAGE }}
           buildkitd-flags: --debug
       -
         name: Build test image
-        uses: docker/bake-action@a66e1c87e2eca0503c343edf1d208c716d54b8a8 # v7.1.0
+        uses: ./.github/actions/retry-go-network
         with:
-          targets: integration-tests
-          set: |
-            *.cache-from=type=gha,scope=${{ inputs.cache_scope }}
+          command: |
+            docker buildx bake --progress=plain integration-tests \
+              --set '*.cache-from=type=gha,scope=${{ inputs.cache_scope }}'
         env:
           BUILDKITD_TAGS: ${{ matrix.tags }}
           TEST_COVERAGE: 1
@@ -185,7 +183,7 @@ jobs:
       -
         name: Send to Codecov
         if: always()
-        uses: codecov/codecov-action@57e3a136b779b570ffcdbf80b3bdc90e7fab3de2 # v6.0.0
+        uses: codecov/codecov-action@303a32d7a59b442fa8d48b6a1cc6825c09c847a5 # v7.1.1
         with:
           directory: ./bin/testreports
           flags: ${{ matrix.codecov_flags }}
@@ -194,7 +192,7 @@ jobs:
       -
         name: Generate annotations
         if: always()
-        uses: crazy-max/.github/.github/actions/gotest-annotations@64a0bfaf6e6bb1c448d6e4c42b11034ee7094f16 # v1.7.1
+        uses: crazy-max/.github/.github/actions/gotest-annotations@f91220cba053bd54299ba645a599ee8ed436f222 # v1.11.0
         with:
           directory: ./bin/testreports
       -

.github/workflows/buildkit.yml

@@ -8,8 +8,6 @@ permissions:
   contents: read
 
 on:
-  schedule:
-    - cron: '0 10 * * *'
   workflow_dispatch:
   push:
     branches:
@@ -28,7 +26,7 @@ env:
   SETUP_BUILDX_VERSION: "edge"
   SETUP_BUILDKIT_IMAGE: "moby/buildkit:latest"
   SCOUT_VERSION: "1.20.2"
-  IMAGE_NAME: "moby/buildkit"
+  IMAGE_NAME: "ghcr.io/gitpod-io/buildkit"
   DESTDIR: "./bin"
 
 jobs:
@@ -39,28 +37,29 @@ jobs:
     steps:
       -
         name: Checkout
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
       -
         name: Platforms matrix
         id: platforms
-        uses: docker/bake-action/subaction/matrix@a66e1c87e2eca0503c343edf1d208c716d54b8a8 # v7.1.0
+        uses: docker/bake-action/subaction/matrix@018cb6412ab401ebaa809aa5f85966b74628600f # v7.4.0
         with:
           target: release
           fields: platforms
 
   binaries:
-    uses: docker/github-builder/.github/workflows/bake.yml@7d2a02426d4b989616ba5aaee4e879afd4134b0d # v1.6.0
+    uses: docker/github-builder/.github/workflows/bake.yml@58cb9f5b71b1836d6f690c1e95effdeb9b98cb8a # v1.17.0
     permissions:
       contents: read # same as global permission
       id-token: write # for signing attestation(s) with GitHub OIDC Token
     with:
-      runner: amd64
-      setup-qemu: true
+      runner: ubuntu-24.04
       artifact-name: buildkit-binaries
       artifact-upload: true
       cache: true
       cache-scope: binaries
       target: release
+      set: |
+        release.platform=linux/amd64
       output: local
       sbom: true
       sign: ${{ github.event_name != 'pull_request' }}
@@ -146,22 +145,22 @@ jobs:
     steps:
       -
         name: Set up Docker Buildx
-        uses: docker/setup-buildx-action@4d04d5d9486b7bd6fa91e7baf45bbb4f8b9deedd # v4.0.0
+        uses: docker/setup-buildx-action@594f3bf4285d9ea8dc53c9a0c9c4092420091003 # v4.4.0
         with:
           version: ${{ env.SETUP_BUILDX_VERSION }}
           driver-opts: image=${{ env.SETUP_BUILDKIT_IMAGE }}
           buildkitd-flags: --debug
       -
         name: Run
-        uses: docker/bake-action@a66e1c87e2eca0503c343edf1d208c716d54b8a8 # v7.1.0
+        uses: docker/bake-action@018cb6412ab401ebaa809aa5f85966b74628600f # v7.4.0
         with:
           targets: govulncheck
         env:
           GOVULNCHECK_FORMAT: sarif
       -
         name: Upload SARIF report
         if: ${{ github.ref == 'refs/heads/master' && github.repository == 'moby/buildkit' }}
-        uses: github/codeql-action/upload-sarif@95e58e9a2cdfd71adc6e0353d5c52f41a045d225 # v4.35.2
+        uses: github/codeql-action/upload-sarif@2892aa5e19bbd11bc0cff5427e3b750a04d9e3c2 # v4.38.2
         with:
           sarif_file: ${{ env.DESTDIR }}/govulncheck.out
 
@@ -206,9 +205,7 @@ jobs:
             }
 
             const matrix = [
-              { base: 'alpine' },
-              { base: 'alpine', target: 'rootless'},
-              { base: 'ubuntu', buildTags: 'nvidia venus' }
+              { base: 'alpine' }
             ]
 
             for (const entry of matrix) {
@@ -222,25 +219,26 @@ jobs:
             core.setOutput('includes', JSON.stringify(matrix));
 
   image:
-    uses: docker/github-builder/.github/workflows/bake.yml@7d2a02426d4b989616ba5aaee4e879afd4134b0d # v1.6.0
+    uses: docker/github-builder/.github/workflows/bake.yml@58cb9f5b71b1836d6f690c1e95effdeb9b98cb8a # v1.17.0
     needs:
       - image-prepare
-      - test
     strategy:
       fail-fast: false
       matrix:
         include: ${{ fromJson(needs.image-prepare.outputs.includes) }}
     permissions:
       contents: read # same as global permission
-      id-token: write # for signing attestation(s) with GitHub OIDC Token
+      id-token: write # for signing attestations and cache entries
+      packages: write # for publishing the fork image to GHCR
     with:
-      runner: amd64
-      setup-qemu: true
+      runner: ubuntu-24.04
       target: image-cross
+      set: |
+        image-cross.platform=linux/amd64
       cache: true
       cache-scope: image
       output: image
-      push: ${{ github.repository == 'moby/buildkit' && (github.event_name == 'schedule' || github.ref == 'refs/heads/master' || startsWith(github.ref, 'refs/tags/v')) }}
+      push: ${{ github.repository == 'gitpod-io/buildkit' && (github.event_name == 'schedule' || github.ref == 'refs/heads/master' || startsWith(github.ref, 'refs/tags/v')) }}
       sbom: true
       vars: |
         IMAGE_TARGET=${{ matrix.target }}
@@ -283,18 +281,16 @@ jobs:
       meta-bake-target: meta-helper
     secrets:
       registry-auths: |
-        - registry: docker.io
-          username: ${{ secrets.DOCKERHUB_USERNAME }}
-          password: ${{ secrets.DOCKERHUB_TOKEN }}
+        - registry: ghcr.io
+          username: ${{ github.actor }}
+          password: ${{ secrets.GITHUB_TOKEN }}
 
   scout:
     runs-on: ubuntu-24.04
     if: ${{ github.ref == 'refs/heads/master' && github.repository == 'moby/buildkit' }}
     permissions:
-      # same as global permission
-      contents: read
-      # required to write sarif report
-      security-events: write
+      contents: read # same as global permission
+      security-events: write # required to write sarif report
     needs:
       - image
     strategy:
@@ -306,17 +302,18 @@ jobs:
     steps:
       -
         name: Checkout
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
       -
+        # FIXME: switch to OIDC once Scout supports it
         name: Login to DockerHub
-        uses: docker/login-action@4907a6ddec9925e35a0a9e82d7399ccc52663121 # v4.1.0
+        uses: docker/login-action@dbcb813823bdd20940b903addbd779551569679f # v4.6.0
         with:
           username: ${{ secrets.DOCKERHUB_USERNAME }}
           password: ${{ secrets.DOCKERHUB_TOKEN }}
       -
         name: Scout
         id: scout
-        uses: crazy-max/.github/.github/actions/docker-scout@64a0bfaf6e6bb1c448d6e4c42b11034ee7094f16 # v1.7.1
+        uses: crazy-max/.github/.github/actions/docker-scout@f91220cba053bd54299ba645a599ee8ed436f222 # v1.11.0
         with:
           version: ${{ env.SCOUT_VERSION }}
           format: sarif
@@ -327,7 +324,7 @@ jobs:
           jq . ${{ steps.scout.outputs.result-file }}
       -
         name: Upload SARIF report
-        uses: github/codeql-action/upload-sarif@95e58e9a2cdfd71adc6e0353d5c52f41a045d225 # v4.35.2
+        uses: github/codeql-action/upload-sarif@2892aa5e19bbd11bc0cff5427e3b750a04d9e3c2 # v4.38.2
         with:
           sarif_file: ${{ steps.scout.outputs.result-file }}
 
@@ -337,7 +334,6 @@ jobs:
       # required to create GitHub release
       contents: write
     needs:
-      - test
       - binaries-finalize
       - image
     steps:
@@ -350,7 +346,7 @@ jobs:
       -
         name: GitHub Release
         if: startsWith(github.ref, 'refs/tags/v')
-        uses: softprops/action-gh-release@b4309332981a82ec1c5618f44dd2e27cc8bfbfda  # v3.0.0
+        uses: softprops/action-gh-release@efb35369e0ad2afab669f228072c1b0d510eae64  # v3.0.3
         env:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
         with: