chore: update buildkit to v0.14.1

.github/dependabot.yml

@@ -0,0 +1,10 @@
+version: 2
+updates:
+  - package-ecosystem: "github-actions"
+    open-pull-requests-limit: 10
+    directory: "/"
+    schedule:
+      interval: "daily"
+    labels:
+      - "dependencies"
+      - "bot"

.github/workflows/ci.yml

@@ -4,16 +4,20 @@ concurrency:
   group: ${{ github.workflow }}-${{ github.ref }}
   cancel-in-progress: true
 
+env:
+  DESTDIR: ./bin
+
 on:
+  workflow_dispatch:
   schedule:
     - cron: '0 8 */6 * *' # every 6 days
   push:
     branches:
       - earthly-main
       - gh_test_ci
+  # No branch filter, so PRs stacked on other PR branches
+  # (not just PRs into earthly-main) get CI too.
   pull_request:
-    branches:
-      - earthly-main
 
 jobs:
   validate:
@@ -27,13 +31,22 @@ jobs:
     steps:
       -
         name: Checkout
-        uses: actions/checkout@v3
+        uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0
+      -
+        name: Login to Docker Hub
+        # Authenticated pulls avoid Docker Hub's anonymous rate limit (429).
+        # Secrets are unavailable to fork PRs, so skip the login there.
+        if: ${{ github.event_name != 'pull_request' || github.event.pull_request.head.repo.full_name == github.repository }}
+        uses: docker/login-action@c94ce9fb468520275223c153574b00df6fe4bcc9 # v3.7.0
+        with:
+          username: ${{ vars.DOCKERHUB_USERNAME }}
+          password: ${{ secrets.DOCKERHUB_TOKEN }}
       -
         name: Set up Docker Buildx
-        uses: docker/setup-buildx-action@v2
+        uses: docker/setup-buildx-action@8d2750c68a42422c14e847fe6c8ac0403b4cbd6f # v3.12.0
       -
         name: Run
-        uses: docker/bake-action@v3
+        uses: docker/bake-action@4a9a8d494466d37134e2bfca2d3a8de8fb2681ad # v5.13.0
         with:
           targets: ${{ matrix.target }}
 
@@ -47,80 +60,157 @@ jobs:
     steps:
       -
         name: Checkout
-        uses: actions/checkout@v3
+        uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0
+      -
+        name: Login to Docker Hub
+        # Authenticated pulls avoid Docker Hub's anonymous rate limit (429).
+        # Secrets are unavailable to fork PRs, so skip the login there.
+        if: ${{ github.event_name != 'pull_request' || github.event.pull_request.head.repo.full_name == github.repository }}
+        uses: docker/login-action@c94ce9fb468520275223c153574b00df6fe4bcc9 # v3.7.0
+        with:
+          username: ${{ vars.DOCKERHUB_USERNAME }}
+          password: ${{ secrets.DOCKERHUB_TOKEN }}
       -
         name: Set up Docker Buildx
-        uses: docker/setup-buildx-action@v2
+        uses: docker/setup-buildx-action@8d2750c68a42422c14e847fe6c8ac0403b4cbd6f # v3.12.0
       -
         name: Run
-        uses: docker/bake-action@v3
+        uses: docker/bake-action@4a9a8d494466d37134e2bfca2d3a8de8fb2681ad # v5.13.0
         with:
           targets: ${{ matrix.target }}
 
   test:
     runs-on: ubuntu-latest
     strategy:
       matrix:
-        go_version:
-          - "1.19"
+        go:
+          - "1.21"
           - "1.20"
+        mode:
+          - "root"
+          - "noroot"
     env:
-      GO_VERSION: ${{ matrix.go_version }}
+      GO_VERSION: ${{ matrix.go }}
     steps:
       -
         name: Checkout
-        uses: actions/checkout@v3
+        uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0
+      -
+        name: Login to Docker Hub
+        # Authenticated pulls avoid Docker Hub's anonymous rate limit (429).
+        # Secrets are unavailable to fork PRs, so skip the login there.
+        if: ${{ github.event_name != 'pull_request' || github.event.pull_request.head.repo.full_name == github.repository }}
+        uses: docker/login-action@c94ce9fb468520275223c153574b00df6fe4bcc9 # v3.7.0
+        with:
+          username: ${{ vars.DOCKERHUB_USERNAME }}
+          password: ${{ secrets.DOCKERHUB_TOKEN }}
       -
         name: Set up Docker Buildx
-        uses: docker/setup-buildx-action@v2
+        uses: docker/setup-buildx-action@8d2750c68a42422c14e847fe6c8ac0403b4cbd6f # v3.12.0
       -
         name: Test
-        uses: docker/bake-action@v3
+        uses: docker/bake-action@4a9a8d494466d37134e2bfca2d3a8de8fb2681ad # v5.13.0
         with:
-          targets: test
+          targets: test-${{ matrix.mode }}
+      -
+        name: Upload coverage
+        uses: codecov/codecov-action@b9fd7d16f6d7d1b5d2bec1a2887e65ceed900238 # v4.6.0
+        with:
+          directory: ${{ env.DESTDIR }}/coverage
+          flags: unit,${{ matrix.mode }},go-${{ matrix.go }}
+          token: ${{ secrets.CODECOV_TOKEN }}
 
-  test-macos:
-    runs-on: macos-latest
+  test-os:
+    runs-on: ${{ matrix.os }}
     strategy:
       fail-fast: false
       matrix:
+        os:
+          - macos-latest
+          - windows-latest
         go:
-          - "1.19"
+          - "1.21"
           - "1.20"
+        exclude:
+          # Go 1.21 test binaries abort on current macOS runner images
+          # ("dyld: missing LC_UUID load command"); Go 1.20 still covers macOS.
+          - os: macos-latest
+            go: "1.21"
     steps:
       -
         name: Checkout
-        uses: actions/checkout@v3
+        uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0
       -
         name: Set up Go
-        uses: actions/setup-go@v4
+        uses: actions/setup-go@40f1582b2485089dde7abd97c1529aa768e1baff # v5.6.0
         with:
           go-version: ${{ matrix.go }}
       -
         name: Test
+        shell: bash
         run: |
-          go test ./...
+          go test -coverprofile="coverage.txt" -covermode="atomic" ./...
+          go tool cover -func="coverage.txt"
+      -
+        name: Upload coverage
+        if: always()
+        uses: codecov/codecov-action@b9fd7d16f6d7d1b5d2bec1a2887e65ceed900238 # v4.6.0
+        with:
+          file: ./coverage.txt
+          env_vars: RUNNER_OS
+          flags: unit,go-${{ matrix.go }}
+          token: ${{ secrets.CODECOV_TOKEN }}
 
   test-freebsd-amd64:
-    runs-on: macos-latest
-    timeout-minutes: 60
+    # macos-13 (and Vagrant/VirtualBox on it) is retired; run FreeBSD in a VM
+    # on Linux the way upstream tonistiigi/fsutil does.
+    runs-on: ubuntu-latest
     env:
-      VAGRANT_VAGRANTFILE: hack/Vagrantfile.freebsd13
+      GO_VERSION: "1.21"
     steps:
+      -
+        name: Prepare
+        shell: bash
+        run: |
+          goVersion=$(curl --fail --silent --show-error "https://go.dev/dl/?mode=json&include=all" | jq -er --arg version "go${GO_VERSION}." '[.[] | select(.stable and (.version | startswith($version)))][0].version')
+          echo "GO_VERSION=${goVersion#go}" >> "$GITHUB_ENV"
       -
         name: Checkout
-        uses: actions/checkout@v3
+        uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0
       -
-        name: Cache Vagrant boxes
-        uses: actions/cache@v3
+        name: Set up FreeBSD
+        uses: vmactions/freebsd-vm@c46abacb49f09938ca4e1702d15d836285d694cc # v1.5.9
         with:
-          path: ~/.vagrant.d/boxes
-          key: ${{ runner.os }}-vagrant-${{ hashFiles('hack/Vagrantfile.freebsd13') }}
-          restore-keys: |
-            ${{ runner.os }}-vagrant-
-      -
-        name: Set up vagrant
-        run: vagrant up
+          release: "14.5"
+          envs: GO_VERSION
+          custom-shell-name: bsd
+          prepare: |
+            set -ex
+            mkdir -p /var/tmp
+            chmod 1777 /var/tmp
+            archive="go${GO_VERSION}.freebsd-amd64.tar.gz"
+            fetch -o "/var/tmp/$archive" "https://go.dev/dl/$archive"
+            tar -C /var/tmp -xzf "/var/tmp/$archive"
+            pw useradd -n fsutil -m -s /bin/sh
       -
         name: Test
-        run: vagrant ssh -- "cd /vagrant; go test -buildvcs=false ./..."
+        run: |
+          bsd /dev/stdin <<'EOF'
+          set -ex
+          chown -R fsutil "$GITHUB_WORKSPACE"
+          su - fsutil -c '
+            set -ex
+            cd "$1"
+            export TMPDIR=/var/tmp
+            export PATH="/var/tmp/go/bin:$PATH"
+            go test -buildvcs=false -coverprofile=coverage.txt -covermode=atomic ./...
+          ' sh "$GITHUB_WORKSPACE"
+          EOF
+      -
+        name: Upload coverage
+        if: always()
+        uses: codecov/codecov-action@b9fd7d16f6d7d1b5d2bec1a2887e65ceed900238 # v4.6.0
+        with:
+          file: ./coverage.txt
+          flags: unit,freebsd
+          token: ${{ secrets.CODECOV_TOKEN }}

.gitignore

@@ -1,9 +1,5 @@
 # if you want to ignore files created by your editor/tools, consider using a
 # global .gitignore or .git/info/exclude see https://help.github.com/articles/ignoring-files
-.*
-!.github
-!.gitignore
-!.travis.yml
-*.prof
+bin/
 # support running go modules in vendor mode for local development
 vendor/

.golangci.yml

@@ -14,3 +14,17 @@ linters:
     - staticcheck
     - typecheck
   disable-all: true
+
+linters-settings:
+  depguard:
+    rules:
+      main:
+        deny:
+          # The io/ioutil package has been deprecated.
+          # https://go.dev/doc/go1.16#ioutil
+          - pkg: "io/ioutil"
+            desc: The io/ioutil package has been deprecated.
+
+# show all
+max-issues-per-linter: 0
+max-same-issues: 0

Dockerfile

@@ -1,7 +1,9 @@
-#syntax=docker/dockerfile:1
-ARG GO_VERSION=1.20
+# syntax=docker/dockerfile:1
 
-FROM --platform=$BUILDPLATFORM tonistiigi/xx:1.1.0 AS xx
+ARG GO_VERSION=1.21
+ARG XX_VERSION=1.4.0
+
+FROM --platform=$BUILDPLATFORM tonistiigi/xx:${XX_VERSION} AS xx
 
 FROM --platform=$BUILDPLATFORM golang:${GO_VERSION}-alpine AS base
 RUN apk add --no-cache git
@@ -18,13 +20,19 @@ FROM base AS test
 ARG TESTFLAGS
 RUN --mount=target=. --mount=target=/go/pkg/mod,type=cache \
     --mount=target=/root/.cache,type=cache \
-    CGO_ENABLED=0 xx-go test -test.v ${TESTFLAGS} ./...
+    CGO_ENABLED=0 xx-go test -v -coverprofile=/tmp/coverage.txt -covermode=atomic ${TESTFLAGS} ./...
 
 FROM base AS test-noroot
 RUN mkdir /go/pkg && chmod 0777 /go/pkg
 USER 1000:1000
 RUN --mount=target=. \
     --mount=target=/tmp/.cache,type=cache \
-    CGO_ENABLED=0 GOCACHE=/tmp/gocache xx-go test -test.v ./...
+    CGO_ENABLED=0 GOCACHE=/tmp/gocache xx-go test -v -coverprofile=/tmp/coverage.txt -covermode=atomic ./...
+
+FROM scratch AS test-coverage
+COPY --from=test /tmp/coverage.txt /coverage-root.txt
+
+FROM scratch AS test-noroot-coverage
+COPY --from=test-noroot /tmp/coverage.txt /coverage-noroot.txt
 
 FROM build

bench/go.mod

@@ -1,6 +1,6 @@
 module github.com/tonistiigi/fsutil/bench
 
-go 1.19
+go 1.20
 
 require (
 	github.com/containerd/continuity v0.4.1

codecov.yml

@@ -0,0 +1,12 @@
+comment: false
+
+coverage:
+  status:
+    project:  # settings affecting project coverage
+      default:
+        target: auto  # auto % coverage target
+        threshold: 1%  # allow for 1% reduction of coverage without failing
+    patch: off
+
+github_checks:
+  annotations: false