chore: merge v0.14.1 unresolved

.github/SECURITY.md

@@ -6,6 +6,9 @@ issue, please bring it to their attention right away!
 **Please _DO NOT_ file a public issue**, instead send your report privately to
 [security@docker.com](mailto:security@docker.com).
 
+
+Explanation of BuildKit security boundary and what we consider a security issue can be found in [here](/PROJECT.md#security-boundary). If you are unsure if you have found a security issue, it is always better to check privately first.
+
 Security reports are greatly appreciated, and we will publicly thank you for it
 (if you want to). We also like to send gifts—if you're into schwag, make
 sure to let us know. We currently do not offer a paid security bounty program,

.github/dependabot.yml

@@ -5,6 +5,11 @@ updates:
     directory: "/"
     schedule:
       interval: "daily"
+    ignore:
+      # ignore this dependency
+      # it seems a bug with dependabot as pining to commit sha should not
+      # trigger a new version: https://github.com/docker/buildx/pull/2222#issuecomment-1919092153
+      - dependency-name: "docker/docs"
     labels:
       - "dependencies"
       - "bot"

.github/issue_template.md

@@ -0,0 +1,5 @@
+<!---
+Thank you for contributing to BuildKit through issue submission! If you're new to this repository, we encourage you to review our issue reporting guide https://github.com/moby/buildkit/blob/master/.github/issue_reporting_guide.md which outlines the key information you should provide for the process to go smoothly.
+
+Feel free to report bugs, suggest features, or submit proposals here. For general questions about using BuildKit, consider joining the #buildkit channel on the Docker Community Slack, where a broader community can provide support and insights.
+--->

.github/workflows/.test.yml

@@ -63,7 +63,7 @@ jobs:
       -
         name: Set outputs
         id: set
-        uses: actions/github-script@d7906e4ad0b1822421a7e6a35d5ca353c962f410  # v6.4.1
+        uses: actions/github-script@f28e40c7f34bde8b3046d885e986cb6290c5673b  # v7.1.0
         with:
           script: |
             const yaml = require('js-yaml');
@@ -118,19 +118,28 @@ jobs:
           - containerd-snapshotter-stargz
           - oci
           - oci-rootless
+          - oci-rootless-slirp4netns-detachnetns
           - oci-snapshotter-stargz
         pkg: ${{ fromJson(needs.prepare.outputs.pkgs) }}
         kind: ${{ fromJson(needs.prepare.outputs.kinds) }}
         tags: ${{ fromJson(needs.prepare.outputs.tags) }}
         include: ${{ fromJson(needs.prepare.outputs.includes) }}
     steps:
       -
-        name: Environment variables
+        name: Prepare
         run: |
           for l in "${{ inputs.env }}"; do
             echo "${l?}" >> $GITHUB_ENV
           done
           echo "TEST_REPORT_NAME=${{ github.job }}-$(echo "${{ matrix.pkg }}-${{ matrix.skip-integration-tests }}-${{ matrix.kind }}-${{ matrix.worker }}-${{ matrix.tags }}" | tr -dc '[:alnum:]-\n\r' | tr '[:upper:]' '[:lower:]')" >> $GITHUB_ENV
+          testFlags="${{ env.TESTFLAGS }}"
+          if [ -n "${{ matrix.tags }}" ]; then
+            testFlags="${testFlags} --tags=${{ matrix.tags }}"
+          fi
+          if [ -n "${{ matrix.worker }}" ]; then
+            testFlags="${testFlags} --run=//worker=${{ matrix.worker }}$"
+          fi
+          echo "TESTFLAGS=${testFlags}" >> $GITHUB_ENV
       -
         name: Checkout
         uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262  # v4.4.0
@@ -158,20 +167,13 @@ jobs:
             *.output=type=docker,name=${{ env.TEST_IMAGE_ID }}
         env:
           BUILDKITD_TAGS: ${{ matrix.tags }}
+          TEST_COVERAGE: 1
       -
         name: Test
-        continue-on-error: ${{ matrix.tags == 'nydus' }}
         run: |
-          export TEST_REPORT_SUFFIX=-${{ github.job }}-$(echo "${{ matrix.pkg }}-${{ matrix.skip-integration-tests }}-${{ matrix.kind }}-${{ matrix.worker }}-${{ matrix.tags }}" | tr -dc '[:alnum:]-\n\r' | tr '[:upper:]' '[:lower:]')
-          if [ -n "${{ matrix.tags }}" ]; then
-            TESTFLAGS="${TESTFLAGS} --tags=${{ matrix.tags }}"
-          fi
-          if [ -n "${{ matrix.worker }}" ]; then
-            export TESTFLAGS="${TESTFLAGS} --run=//worker=${{ matrix.worker }}$"
-          fi
-          echo TESTFLAGS=$TESTFLAGS
           ./hack/test ${{ matrix.kind }}
         env:
+          TEST_REPORT_SUFFIX: -${{ env.TEST_REPORT_NAME }}
           TEST_COVERAGE: 1
           TESTPKGS: ${{ matrix.pkg }}
           SKIP_INTEGRATION_TESTS: 1
@@ -180,10 +182,12 @@ jobs:
       -
         name: Send to Codecov
         if: always()
-        uses: codecov/codecov-action@ab904c41d6ece82784817410c45d8b8c02684457  # v3.1.6
+        uses: codecov/codecov-action@b9fd7d16f6d7d1b5d2bec1a2887e65ceed900238  # v4.6.0
         with:
           directory: ./bin/testreports
           flags: ${{ matrix.codecov_flags }}
+          disable_file_fixes: false
+          token: ${{ secrets.CODECOV_TOKEN }}  # used to upload coverage reports: https://github.com/moby/buildkit/pull/4660#issue-2142122533
       -
         name: Generate annotations
         if: always()
@@ -197,7 +201,7 @@ jobs:
         with:
           name: test-reports-${{ env.TEST_REPORT_NAME }}
           path: ./bin/testreports
-          overwrite: true
+          retention-days: 1
       -
         name: Dump context
         if: failure()

.github/workflows/buildkit.yml

@@ -29,30 +29,6 @@
   DESTDIR: "./bin"
 
 jobs:
-  test:
-    uses: ./.github/workflows/.test.yml
-    with:
-      cache_scope: build-integration-tests
-      pkgs: ./client ./cmd/buildctl ./worker/containerd ./solver ./frontend
-      kinds: integration
-      codecov_flags: core
-      includes: |
-        - pkg: ./...
-          skip-integration-tests: 1
-          typ: integration gateway
-        - pkg: ./client
-          worker: containerd
-          tags: nydus
-          typ: integration
-        - pkg: ./client
-          worker: oci
-          tags: nydus
-          typ: integration
-        - pkg: ./...
-          tags: nydus
-          skip-integration-tests: 1
-          typ: integration
-
   prepare:
     runs-on: ubuntu-22.04
     outputs:
@@ -81,6 +57,9 @@
               PUSH=push
             fi
           fi
+          if [ "$GITHUB_REPOSITORY" != "moby/buildkit" ]; then
+            PUSH=false
+          fi
           echo "tag=${TAG}" >>${GITHUB_OUTPUT}
           echo "push=${PUSH}" >>${GITHUB_OUTPUT}
           platforms=$(docker buildx bake release --print | jq -cr '.target."release".platforms')
@@ -135,8 +114,36 @@
           name: buildkit-${{ env.PLATFORM_PAIR }}
           path: ${{ env.DESTDIR }}/*
           if-no-files-found: error
+          retention-days: 1
+
+  test:
+    uses: ./.github/workflows/.test.yml
+    secrets: inherit
+    needs:
+      - binaries
+    with:
+      cache_scope: build-integration-tests
+      pkgs: ./client ./cmd/buildctl ./worker/containerd ./solver ./frontend
+      kinds: integration
+      codecov_flags: core
+      includes: |
+        - pkg: ./...
+          skip-integration-tests: 1
+          typ: integration gateway
+        - pkg: ./client
+          worker: containerd
+          tags: nydus
+          typ: integration
+        - pkg: ./client
+          worker: oci
+          tags: nydus
+          typ: integration
+        - pkg: ./...
+          tags: nydus
+          skip-integration-tests: 1
+          typ: integration
 
   image:
     runs-on: ubuntu-22.04
     needs:
       - prepare
@@ -204,7 +211,7 @@
       -
         name: GitHub Release
         if: startsWith(github.ref, 'refs/tags/v')
-        uses: softprops/action-gh-release@de2c0eb89ae2a093876385947365aca7b0e5f844  # v0.1.15
+        uses: softprops/action-gh-release@69320dbe05506a9a39fc8ae11030b214ec2d1f87  # v2.0.5
         env:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
         with:

.github/workflows/dockerd.yml

@@ -7,7 +7,7 @@ on:
       version:
         description: 'Docker version'
         required: true
-        default: '23.0.1'
+        default: '25.0.2'
 
 env:
   SETUP_BUILDX_VERSION: "v0.14.1"  # TODO(jhorsts): replace with upstream
@@ -20,10 +20,10 @@ jobs:
     steps:
       -
         name: Prepare
-        uses: actions/github-script@d7906e4ad0b1822421a7e6a35d5ca353c962f410  # v6.4.1
+        uses: actions/github-script@f28e40c7f34bde8b3046d885e986cb6290c5673b  # v7.1.0
         with:
           script: |
-            const version = `${{ inputs.version }}` || '23.0.1';
+            const version = `${{ inputs.version }}` || '25.0.2';
             let build = 'true';
             try {
               new URL(version);
@@ -68,6 +68,7 @@ jobs:
           name: dockerd
           path: /tmp/moby/dockerd
           if-no-files-found: error
+          retention-days: 1
 
   test:
     runs-on: ubuntu-22.04

.github/workflows/docs-upstream.yml

@@ -1,8 +1,6 @@
-# this workflow runs the remote validate bake target from docker/docker.github.io
-# to check if yaml reference docs and markdown files used in this repo are still
-# valid: https://github.com/docker/docs/blob/98c7c9535063ae4cd2cd0a31478a21d16d2f07a3/docker-bake.hcl#L34-L36
-# path filters reflects the files that are used as remote resource in this
-# repo: https://github.com/docker/docs/blob/d5312d53e255a24e421dfe6c3344359e10271cb8/_config.yml#L202-L217
+# this workflow runs the remote validate bake target from docker/docs to check
+# if yaml reference docs and markdown files used in this repo are still valid
+# https://github.com/docker/docker.github.io/blob/98c7c9535063ae4cd2cd0a31478a21d16d2f07a3/docker-bake.hcl#L34-L36
 name: docs-upstream
 
 concurrency:
@@ -30,6 +28,6 @@
 
 jobs:
   validate:
-    uses: docker/docs/.github/workflows/validate-upstream.yml@main
+    uses: docker/docs/.github/workflows/validate-upstream.yml@919a9b9104a34a40b30d116529bcce589a544d1c  # pin for artifact v4 support: https://github.com/docker/docs/pull/19220
     with:
       module-name: moby/buildkit

.github/workflows/frontend.yml

@@ -28,6 +28,7 @@ env:
 jobs:
   test:
     uses: ./.github/workflows/.test.yml
+    secrets: inherit
     with:
       cache_scope: frontend-integration-tests
       pkgs: ./frontend/dockerfile
@@ -63,6 +64,9 @@ jobs:
               PUSH=push
             fi
           fi
+          if [ "$GITHUB_REPOSITORY" != "moby/buildkit" ]; then
+            PUSH=false
+          fi
           echo "typ=${TYP}" >>${GITHUB_OUTPUT}
           echo "push=${PUSH}" >>${GITHUB_OUTPUT}
           echo "tag=${TAG}" >>${GITHUB_OUTPUT}
@@ -133,7 +137,7 @@ jobs:
     steps:
       -
         name: GitHub Release
-        uses: softprops/action-gh-release@de2c0eb89ae2a093876385947365aca7b0e5f844  # v0.1.15
+        uses: softprops/action-gh-release@69320dbe05506a9a39fc8ae11030b214ec2d1f87  # v2.0.5
         env:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
         with: