.github/workflows/validate.yml - external/github.com/opencontainers/runc - Git at Google

 name: validate
 on:
   push:
     tags:
       - v*
     branches:
       - main
       - release-*
   merge_group:
   pull_request:
   workflow_dispatch:

 # Cancel superseded runs of the same pull request. For everything else
 # (in particular, pushes to a branch or a tag) there is no PR number, so
 # the group falls back to the unique run_id and nothing is cancelled.
 concurrency:
   group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.run_id }}
   cancel-in-progress: true

 permissions:
   contents: read

 env:
   GO_VERSION: 1.26
   LIBPATHRS_VERSION: "0.2.6"

 jobs:
   keyring:
     runs-on: ubuntu-24.04
     steps:
     - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
       with:
         persist-credentials: false
     - name: check runc.keyring
       run: make validate-keyring

   lint:
     timeout-minutes: 30
     permissions:
       contents: read
       checks: write # to allow the action to annotate code in the PR.
     runs-on: ubuntu-24.04
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           fetch-depth: 2
           persist-credentials: false
       - uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0
         with:
           go-version: "${{ env.GO_VERSION }}"
       - name: install deps
         run: |
           sudo apt -q update
           sudo apt -qy install libseccomp-dev
       - uses: golangci/golangci-lint-action@ba0d7d2ec06a0ea1cb5fa41b2e4a3ab91d21278a # v9.3.0
         with:
           version: v2.13
           skip-cache: true
       # Extra linters, only checking new code from a pull request to main.
       - name: lint-extra
         if: github.event_name == 'pull_request' && github.base_ref == 'main'
         run: |
           golangci-lint run --config .golangci-extra.yml --new-from-rev=HEAD~1

   govulncheck:
     runs-on: ubuntu-24.04
     steps:
     - uses: golang/govulncheck-action@032d45514ae346b1db93c04b0c90b841c370344f # v1.1.0

   compile-buildtags:
     runs-on: ubuntu-24.04
     env:
       # Don't ignore C warnings. Note that the output of "go env CGO_CFLAGS" by default is "-g -O2", so we keep them.
       CGO_CFLAGS: -g -O2 -Werror
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           persist-credentials: false
       - name: install go
         uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0
         with:
           go-version: "${{ env.GO_VERSION }}"
       - name: install deps
         run: |
           sudo apt update
           sudo apt -y install libseccomp-dev lld
       - name: install libpathrs ${{ env.LIBPATHRS_VERSION }}
         run: |
           sudo -E PATH="$PATH" ./script/build-libpathrs.sh "$LIBPATHRS_VERSION" /usr
       - name: compile with no build tags
         run: make BUILDTAGS=""
       - name: compile with runc_nocriu build tag
         run: make RUNC_BUILDTAGS="runc_nocriu"

   codespell:
     runs-on: ubuntu-24.04
     steps:
     - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
       with:
         persist-credentials: false
     - name: install deps
       # Version of codespell bundled with Ubuntu is way old, so use pip.
       run: pip install --break-system-packages codespell==v2.4.1
     - name: run codespell
       run: codespell

   shfmt:
     runs-on: ubuntu-24.04
     steps:
     - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
       with:
         persist-credentials: false
     - name: shfmt
       run: make shfmt

   shellcheck:
     runs-on: ubuntu-24.04
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           persist-credentials: false
       - name: install shellcheck
         env:
           VERSION: v0.11.0
           BASEURL: https://github.com/koalaman/shellcheck/releases/download
           SHA256: 4da528ddb3a4d1b7b24a59d4e16eb2f5fd960f4bd9a3708a15baddbdf1d5a55b
         run: |
           mkdir ~/bin
           curl -sSfL --retry 5 "$BASEURL/$VERSION/shellcheck-$VERSION.linux.x86_64.tar.xz" |
             tar xfJ - -C ~/bin --strip 1 "shellcheck-$VERSION/shellcheck"
           sha256sum --strict --check - <<<"$SHA256 *$HOME/bin/shellcheck"
           # make sure to remove the old version
           sudo rm -f /usr/bin/shellcheck
           # Add ~/bin to $PATH.
           echo ~/bin >> "$GITHUB_PATH"
       - name: add problem matcher
         # Show shellcheck (tty format) findings as annotations.
         run: echo "::add-matcher::.github/shellcheck-tty.json"
       - name: run
         run: make shellcheck
       - name: check-config.sh
         run : ./script/check-config.sh

   space-at-eol:
     runs-on: ubuntu-24.04
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           persist-credentials: false
       - run: rm -fr vendor
       - run: if git -P grep -I -n '\s$'; then echo "^^^ extra whitespace at EOL, please fix"; exit 1; fi

   deps:
     runs-on: ubuntu-24.04
     steps:
     - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
       with:
         persist-credentials: false
     - name: install go
       uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0
       with:
         go-version: "${{ env.GO_VERSION }}"
         check-latest: true
     - name: verify deps
       run: make verify-dependencies
     - name: no toolchain in go.mod # See https://github.com/opencontainers/runc/pull/4717, https://github.com/dependabot/dependabot-core/issues/11933.
       run: |
         if grep -q '^toolchain ' go.mod; then echo "Error: go.mod must not have toolchain directive, please fix"; exit 1; fi
     - name: no exclude nor replace in go.mod
       run: |
         if grep -Eq '^\s*(exclude|replace) ' go.mod; then echo "Error: go.mod must not have exclude/replace directive, it breaks go install. Please fix"; exit 1; fi


   commit:
     permissions:
       contents: read
       pull-requests: read # Needed to list the PR's commits.
     runs-on: ubuntu-24.04
     steps:
       - name: check commit subject line length
         # Only check commits on pull requests. For other events, the step is
         # skipped and the job succeeds (so that all-done can succeed, too).
         if: github.event_name == 'pull_request'
         env:
           GH_TOKEN: ${{ github.token }}
           PR_NUMBER: ${{ github.event.pull_request.number }}
         run: |
           # Save to a file first, so that a gh failure fails the step (rather
           # than being masked by jq succeeding on empty input).
           gh api --paginate --slurp \
             "/repos/${GITHUB_REPOSITORY}/pulls/${PR_NUMBER}/commits" \
             > "$RUNNER_TEMP/commits.json"

           # A page is an array, and --slurp gives an array of pages, thus
           # the double iteration. Merge commits are skipped.
           long=$(jq -r '
               .[][]
               | select(.parents | length <= 1)
               | (.commit.message | split("\n")[0]) as $subject
               | select(($subject | length) > 72)
               | "\(.sha[0:12]) \($subject)"
             ' "$RUNNER_TEMP/commits.json")

           if [ -z "$long" ]; then
             echo "All commit subject lines are 72 characters or less."
             exit 0
           fi

           while read -r commit; do
             echo "::error::subject line too long (max 72 characters): $commit"
           done <<<"$long"
           exit 1

   cfmt:
     runs-on: ubuntu-24.04
     steps:
     - name: checkout
       uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
       with:
         persist-credentials: false
     - name: install deps
       run: |
         sudo apt -qq update
         sudo apt -qqy install indent
     - name: cfmt
       run: |
         make cfmt
         git diff --exit-code

   check-go:
     runs-on: ubuntu-24.04
     steps:
     - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
       with:
         persist-credentials: false
     - name: check Go version
       run: |
         GO_VER=$(awk -F= '/^ARG\s+GO_VERSION=/ {print $2; quit}' Dockerfile)
         echo "Go version used in Dockerfile: $GO_VER"
         echo -n "Checking if Go $GO_VER is supported ... "
         curl -fsSL https://go.dev/dl/?mode=json | jq -e 'any(.[]; .version | startswith("go'"$GO_VER"'"))'
         echo -n "Checking if Go $GO_VER is tested against ... "
         yq -e '.jobs.test.strategy.matrix.go-version | contains(["'"$GO_VER"'.x"])' .github/workflows/test.yml

   release:
     timeout-minutes: 30
     runs-on: ubuntu-24.04
     steps:
     - name: checkout
       uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
       with:
         persist-credentials: false

     - name: check CHANGELOG.md
       run: make verify-changelog

       # We have to run this under Docker as Ubuntu (host) does not support all
       # the architectures we want to compile test against, and Dockerfile uses
       # Debian (which does).
       #
       # XXX: as currently this is the only job that is using Docker, we are
       # building and using the runcimage locally. In case more jobs running
       # under Docker will emerge, it will be good to have a separate make
       # runcimage job and share its result (the docker image) with whoever
       # needs it.
     - name: build docker image
       run: make runcimage
     - name: make releaseall
       run: make releaseall
     - name: upload artifacts
       uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
       with:
         name: release-${{ github.run_id }}
         path: release/*


   get-images:
     runs-on: ubuntu-24.04
     steps:
     - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
       with:
         persist-credentials: false
     - name: install bashbrew
       env:
         BASEURL: https://github.com/docker-library/bashbrew/releases/download
         VERSION: v0.1.7
         SHA256: 6b71a6fccfb2025d48a2b23324836b5513c29abfd2d16a57b7a2f89bd02fe53a
       run: |
         mkdir ~/bin
         curl -sSfL --retry 5 -o ~/bin/bashbrew \
           "$BASEURL/$VERSION/bashbrew-amd64"
         sha256sum --strict --check - <<<"$SHA256 *$HOME/bin/bashbrew"
         chmod a+x ~/bin/bashbrew
         # Add ~/bin to $PATH.
         echo ~/bin >> "$GITHUB_PATH"
     - name: check that get-images.sh is up to date
       run: |
         cd tests/integration
         ./bootstrap-get-images.sh > get-images.sh
         git diff --exit-code

   conmon:
     runs-on: ubuntu-24.04
     steps:
     - name: checkout
       uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
       with:
         persist-credentials: false

     - name: install runc and conmon deps
       # XXX maybe switch to conmon/hack/github-actions-setup if the burden
       # to maintain the list of needed packages here is too much to handle.
       run: |
         sudo apt update
         sudo apt -y install libseccomp-dev libglib2.0-dev libsystemd-dev socat
     - name: install libpathrs ${{ env.LIBPATHRS_VERSION }}
       run: |
         sudo -E PATH="$PATH" ./script/build-libpathrs.sh "$LIBPATHRS_VERSION" /usr

     - name: install Go
       uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0
       with:
         go-version: "${{ env.GO_VERSION }}"

     - name: build runc
       run: make

     - name: Allow userns for runc
       # https://discourse.ubuntu.com/t/ubuntu-24-04-lts-noble-numbat-release-notes/39890#unprivileged-user-namespace-restrictions-15
       run: |
         sed "s;^profile runc /usr/sbin/;profile runc-test $PWD/;" < /etc/apparmor.d/runc | sudo apparmor_parser

     - name: setup bats
       uses: bats-core/bats-action@77d6fb60505b4d0d1d73e48bd035b55074bbfb43 # 4.0.0
       with:
         bats-version: 1.13.0 # As required by conmon in hack/github-actions-setup.
         support-install: false
         assert-install: false
         detik-install: false
         file-install: false

     - name: checkout conmon
       uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
       with:
         repository: containers/conmon
         path: conmon
         # XXX: this is conmon main, which has a lot of test fixes (including
         # making the tests fail, rather than silently skip, when the test
         # image can not be pulled) that are not in any release yet. Switch to
         # a released version once one is out (> v2.2.1).
         ref: f4cefcd7a33932131ab1a0130ae0b0175368025a
         persist-credentials: false

     - name: build conmon
       run: cd conmon && make

     - name: run conmon tests
       # --strict turns a skipped test into a failure. We do not want any of
       # these tests to be silently skipped here (that is how the breakage
       # fixed by #5401 went unnoticed for a while), and none of them are
       # expected to skip in this environment.
       run: |
         RUNTIME_BINARY="$(pwd)/runc" ./conmon/test/run-tests.sh --strict -j "$(nproc)"

   zizmor:
     runs-on: ubuntu-24.04
     steps:
     - name: checkout
       uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
       with:
         persist-credentials: false

     - uses: zizmorcore/zizmor-action@cc914d7f3750a2d13d75c7f184a1060aa0e9d482 # v0.6.4
       with:
         version: 1.30.0
         advanced-security: false
         annotations: true

   all-done-validate:
     needs:
       - check-go
       - cfmt
       - codespell
       - commit
       - compile-buildtags
       - conmon
       - deps
       - get-images
       - govulncheck
       - keyring
       - lint
       - release
       - shellcheck
       - shfmt
       - space-at-eol
       - zizmor
     runs-on: ubuntu-24.04
     steps:
     - run: echo "All jobs completed"
	name: validate
	on:
	push:
	tags:
	- v*
	branches:
	- main
	- release-*
	merge_group:
	pull_request:
	workflow_dispatch:

	# Cancel superseded runs of the same pull request. For everything else
	# (in particular, pushes to a branch or a tag) there is no PR number, so
	# the group falls back to the unique run_id and nothing is cancelled.
	concurrency:
	group: ${{ github.workflow }}-${{ github.event.pull_request.number \|\| github.run_id }}
	cancel-in-progress: true

	permissions:
	contents: read

	env:
	GO_VERSION: 1.26
	LIBPATHRS_VERSION: "0.2.6"

	jobs:
	keyring:
	runs-on: ubuntu-24.04
	steps:
	- uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
	with:
	persist-credentials: false
	- name: check runc.keyring
	run: make validate-keyring

	lint:
	timeout-minutes: 30
	permissions:
	contents: read
	checks: write # to allow the action to annotate code in the PR.
	runs-on: ubuntu-24.04
	steps:
	- uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
	with:
	fetch-depth: 2
	persist-credentials: false
	- uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0
	with:
	go-version: "${{ env.GO_VERSION }}"
	- name: install deps
	run: \|
	sudo apt -q update
	sudo apt -qy install libseccomp-dev
	- uses: golangci/golangci-lint-action@ba0d7d2ec06a0ea1cb5fa41b2e4a3ab91d21278a # v9.3.0
	with:
	version: v2.13
	skip-cache: true
	# Extra linters, only checking new code from a pull request to main.
	- name: lint-extra
	if: github.event_name == 'pull_request' && github.base_ref == 'main'
	run: \|
	golangci-lint run --config .golangci-extra.yml --new-from-rev=HEAD~1

	govulncheck:
	runs-on: ubuntu-24.04
	steps:
	- uses: golang/govulncheck-action@032d45514ae346b1db93c04b0c90b841c370344f # v1.1.0

	compile-buildtags:
	runs-on: ubuntu-24.04
	env:
	# Don't ignore C warnings. Note that the output of "go env CGO_CFLAGS" by default is "-g -O2", so we keep them.
	CGO_CFLAGS: -g -O2 -Werror
	steps:
	- uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
	with:
	persist-credentials: false
	- name: install go
	uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0
	with:
	go-version: "${{ env.GO_VERSION }}"
	- name: install deps
	run: \|
	sudo apt update
	sudo apt -y install libseccomp-dev lld
	- name: install libpathrs ${{ env.LIBPATHRS_VERSION }}
	run: \|
	sudo -E PATH="$PATH" ./script/build-libpathrs.sh "$LIBPATHRS_VERSION" /usr
	- name: compile with no build tags
	run: make BUILDTAGS=""
	- name: compile with runc_nocriu build tag
	run: make RUNC_BUILDTAGS="runc_nocriu"

	codespell:
	runs-on: ubuntu-24.04
	steps:
	- uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
	with:
	persist-credentials: false
	- name: install deps
	# Version of codespell bundled with Ubuntu is way old, so use pip.
	run: pip install --break-system-packages codespell==v2.4.1
	- name: run codespell
	run: codespell

	shfmt:
	runs-on: ubuntu-24.04
	steps:
	- uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
	with:
	persist-credentials: false
	- name: shfmt
	run: make shfmt

	shellcheck:
	runs-on: ubuntu-24.04
	steps:
	- uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
	with:
	persist-credentials: false
	- name: install shellcheck
	env:
	VERSION: v0.11.0
	BASEURL: https://github.com/koalaman/shellcheck/releases/download
	SHA256: 4da528ddb3a4d1b7b24a59d4e16eb2f5fd960f4bd9a3708a15baddbdf1d5a55b
	run: \|
	mkdir ~/bin
	curl -sSfL --retry 5 "$BASEURL/$VERSION/shellcheck-$VERSION.linux.x86_64.tar.xz" \|
	tar xfJ - -C ~/bin --strip 1 "shellcheck-$VERSION/shellcheck"
	sha256sum --strict --check - <<<"$SHA256 *$HOME/bin/shellcheck"
	# make sure to remove the old version
	sudo rm -f /usr/bin/shellcheck
	# Add ~/bin to $PATH.
	echo ~/bin >> "$GITHUB_PATH"
	- name: add problem matcher
	# Show shellcheck (tty format) findings as annotations.
	run: echo "::add-matcher::.github/shellcheck-tty.json"
	- name: run
	run: make shellcheck
	- name: check-config.sh
	run : ./script/check-config.sh

	space-at-eol:
	runs-on: ubuntu-24.04
	steps:
	- uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
	with:
	persist-credentials: false
	- run: rm -fr vendor
	- run: if git -P grep -I -n '\s$'; then echo "^^^ extra whitespace at EOL, please fix"; exit 1; fi

	deps:
	runs-on: ubuntu-24.04
	steps:
	- uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
	with:
	persist-credentials: false
	- name: install go
	uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0
	with:
	go-version: "${{ env.GO_VERSION }}"
	check-latest: true
	- name: verify deps
	run: make verify-dependencies
	- name: no toolchain in go.mod # See https://github.com/opencontainers/runc/pull/4717, https://github.com/dependabot/dependabot-core/issues/11933.
	run: \|
	if grep -q '^toolchain ' go.mod; then echo "Error: go.mod must not have toolchain directive, please fix"; exit 1; fi
	- name: no exclude nor replace in go.mod
	run: \|
	if grep -Eq '^\s*(exclude\|replace) ' go.mod; then echo "Error: go.mod must not have exclude/replace directive, it breaks go install. Please fix"; exit 1; fi


	commit:
	permissions:
	contents: read
	pull-requests: read # Needed to list the PR's commits.
	runs-on: ubuntu-24.04
	steps:
	- name: check commit subject line length
	# Only check commits on pull requests. For other events, the step is
	# skipped and the job succeeds (so that all-done can succeed, too).
	if: github.event_name == 'pull_request'
	env:
	GH_TOKEN: ${{ github.token }}
	PR_NUMBER: ${{ github.event.pull_request.number }}
	run: \|
	# Save to a file first, so that a gh failure fails the step (rather
	# than being masked by jq succeeding on empty input).
	gh api --paginate --slurp \
	"/repos/${GITHUB_REPOSITORY}/pulls/${PR_NUMBER}/commits" \
	> "$RUNNER_TEMP/commits.json"

	# A page is an array, and --slurp gives an array of pages, thus
	# the double iteration. Merge commits are skipped.
	long=$(jq -r '
	.[][]
	\| select(.parents \| length <= 1)
	\| (.commit.message \| split("\n")[0]) as $subject
	\| select(($subject \| length) > 72)
	\| "\(.sha[0:12]) \($subject)"
	' "$RUNNER_TEMP/commits.json")

	if [ -z "$long" ]; then
	echo "All commit subject lines are 72 characters or less."
	exit 0
	fi

	while read -r commit; do
	echo "::error::subject line too long (max 72 characters): $commit"
	done <<<"$long"
	exit 1

	cfmt:
	runs-on: ubuntu-24.04
	steps:
	- name: checkout
	uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
	with:
	persist-credentials: false
	- name: install deps
	run: \|
	sudo apt -qq update
	sudo apt -qqy install indent
	- name: cfmt
	run: \|
	make cfmt
	git diff --exit-code

	check-go:
	runs-on: ubuntu-24.04
	steps:
	- uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
	with:
	persist-credentials: false
	- name: check Go version
	run: \|
	GO_VER=$(awk -F= '/^ARG\s+GO_VERSION=/ {print $2; quit}' Dockerfile)
	echo "Go version used in Dockerfile: $GO_VER"
	echo -n "Checking if Go $GO_VER is supported ... "
	curl -fsSL https://go.dev/dl/?mode=json \| jq -e 'any(.[]; .version \| startswith("go'"$GO_VER"'"))'
	echo -n "Checking if Go $GO_VER is tested against ... "
	yq -e '.jobs.test.strategy.matrix.go-version \| contains(["'"$GO_VER"'.x"])' .github/workflows/test.yml

	release:
	timeout-minutes: 30
	runs-on: ubuntu-24.04
	steps:
	- name: checkout
	uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
	with:
	persist-credentials: false

	- name: check CHANGELOG.md
	run: make verify-changelog

	# We have to run this under Docker as Ubuntu (host) does not support all
	# the architectures we want to compile test against, and Dockerfile uses
	# Debian (which does).
	#
	# XXX: as currently this is the only job that is using Docker, we are
	# building and using the runcimage locally. In case more jobs running
	# under Docker will emerge, it will be good to have a separate make
	# runcimage job and share its result (the docker image) with whoever
	# needs it.
	- name: build docker image
	run: make runcimage
	- name: make releaseall
	run: make releaseall
	- name: upload artifacts
	uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
	with:
	name: release-${{ github.run_id }}
	path: release/*


	get-images:
	runs-on: ubuntu-24.04
	steps:
	- uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
	with:
	persist-credentials: false
	- name: install bashbrew
	env:
	BASEURL: https://github.com/docker-library/bashbrew/releases/download
	VERSION: v0.1.7
	SHA256: 6b71a6fccfb2025d48a2b23324836b5513c29abfd2d16a57b7a2f89bd02fe53a
	run: \|
	mkdir ~/bin
	curl -sSfL --retry 5 -o ~/bin/bashbrew \
	"$BASEURL/$VERSION/bashbrew-amd64"
	sha256sum --strict --check - <<<"$SHA256 *$HOME/bin/bashbrew"
	chmod a+x ~/bin/bashbrew
	# Add ~/bin to $PATH.
	echo ~/bin >> "$GITHUB_PATH"
	- name: check that get-images.sh is up to date
	run: \|
	cd tests/integration
	./bootstrap-get-images.sh > get-images.sh
	git diff --exit-code

	conmon:
	runs-on: ubuntu-24.04
	steps:
	- name: checkout
	uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
	with:
	persist-credentials: false

	- name: install runc and conmon deps
	# XXX maybe switch to conmon/hack/github-actions-setup if the burden
	# to maintain the list of needed packages here is too much to handle.
	run: \|
	sudo apt update
	sudo apt -y install libseccomp-dev libglib2.0-dev libsystemd-dev socat
	- name: install libpathrs ${{ env.LIBPATHRS_VERSION }}
	run: \|
	sudo -E PATH="$PATH" ./script/build-libpathrs.sh "$LIBPATHRS_VERSION" /usr

	- name: install Go
	uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0
	with:
	go-version: "${{ env.GO_VERSION }}"

	- name: build runc
	run: make

	- name: Allow userns for runc
	# https://discourse.ubuntu.com/t/ubuntu-24-04-lts-noble-numbat-release-notes/39890#unprivileged-user-namespace-restrictions-15
	run: \|
	sed "s;^profile runc /usr/sbin/;profile runc-test $PWD/;" < /etc/apparmor.d/runc \| sudo apparmor_parser

	- name: setup bats
	uses: bats-core/bats-action@77d6fb60505b4d0d1d73e48bd035b55074bbfb43 # 4.0.0
	with:
	bats-version: 1.13.0 # As required by conmon in hack/github-actions-setup.
	support-install: false
	assert-install: false
	detik-install: false
	file-install: false

	- name: checkout conmon
	uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
	with:
	repository: containers/conmon
	path: conmon
	# XXX: this is conmon main, which has a lot of test fixes (including
	# making the tests fail, rather than silently skip, when the test
	# image can not be pulled) that are not in any release yet. Switch to
	# a released version once one is out (> v2.2.1).
	ref: f4cefcd7a33932131ab1a0130ae0b0175368025a
	persist-credentials: false

	- name: build conmon
	run: cd conmon && make

	- name: run conmon tests
	# --strict turns a skipped test into a failure. We do not want any of
	# these tests to be silently skipped here (that is how the breakage
	# fixed by #5401 went unnoticed for a while), and none of them are
	# expected to skip in this environment.
	run: \|
	RUNTIME_BINARY="$(pwd)/runc" ./conmon/test/run-tests.sh --strict -j "$(nproc)"

	zizmor:
	runs-on: ubuntu-24.04
	steps:
	- name: checkout
	uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
	with:
	persist-credentials: false

	- uses: zizmorcore/zizmor-action@cc914d7f3750a2d13d75c7f184a1060aa0e9d482 # v0.6.4
	with:
	version: 1.30.0
	advanced-security: false
	annotations: true

	all-done-validate:
	needs:
	- check-go
	- cfmt
	- codespell
	- commit
	- compile-buildtags
	- conmon
	- deps
	- get-images
	- govulncheck
	- keyring
	- lint
	- release
	- shellcheck
	- shfmt
	- space-at-eol
	- zizmor
	runs-on: ubuntu-24.04
	steps:
	- run: echo "All jobs completed"