From 0cc5e7c06ae8a3129a9c11550c3eb4c422296c3d Mon Sep 17 00:00:00 2001 From: bilby91 Date: Mon, 24 Aug 2026 19:43:52 -0300 Subject: [PATCH 1/2] ci: remove Apple Containers jobs --- .github/workflows/ci.yml | 162 +-------------------------------------- 1 file changed, 2 insertions(+), 160 deletions(-) diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml index 33a0b00..43f23c8 100644 --- a/.github/workflows/ci.yml +++ b/.github/workflows/ci.yml @@ -43,46 +43,6 @@ jobs: - run: go vet ./... - run: go test -race -count=1 ./... - # Apple-container backend lives in runtime/applecontainer and is - # darwin/arm64-only (see build tags). This job builds the Swift - # bridge and runs the Go test suite on macOS so we get coverage of - # cgo compilation, go:embed of libACBridge.dylib, and the - # daemon-free unit tests. Daemon-dependent tests skip cleanly via - # runtimeOrSkip when Apple's `container` apiserver isn't running. - test-darwin: - runs-on: macos-26 - strategy: - fail-fast: false - matrix: - go: ["1.25", "1.26"] - steps: - - uses: actions/checkout@v6 - - uses: actions/setup-go@v6 - with: - go-version: ${{ matrix.go }} - cache: true - - name: Select Xcode with Swift 6.2 - # apple/container 0.12.3 declares swift-tools-version 6.2; - # the macos-15 image ships an older Xcode by default. Pick - # the newest installed so SwiftPM can resolve the package. - run: sudo xcode-select -s /Applications/Xcode_latest.app || sudo xcode-select -s "$(ls -d /Applications/Xcode_*.app | sort -V | tail -1)" - - name: Cache SwiftPM artifacts - uses: actions/cache@v5 - with: - path: | - applecontainer-bridge/.build - ~/Library/Caches/org.swift.swiftpm - # Key on Package.resolved so the cache busts when dependency - # versions move. Bump the `v1` prefix to force a full miss - # after a toolchain change that breaks artifact compat. - key: swiftpm-v1-${{ runner.os }}-${{ runner.arch }}-${{ hashFiles('applecontainer-bridge/Package.resolved') }} - restore-keys: | - swiftpm-v1-${{ runner.os }}-${{ runner.arch }}- - - name: Build Swift bridge - run: make bridge - - run: go vet ./... - - run: go test -race -count=1 ./... - test-integration-linux: runs-on: ubuntu-latest needs: [lint, test-linux] @@ -108,8 +68,8 @@ jobs: run: | # Enumerate tests under the integration tag, partition them # deterministically by sorted-index modulo SHARD_TOTAL, and - # run only this shard's subset. Apple-container tests are - # build-tagged darwin/arm64, so they don't appear here. + # run only this shard's subset. Platform-specific tests are + # excluded here by their build constraints. set -euo pipefail tests=$(go test -tags=integration -list '.*' ./test/integration/... \ | grep -E '^Test' | sort -u) @@ -163,121 +123,3 @@ jobs: --security-opt label=disable \ -v "$PWD":/w -w /w \ quay.io/podman/stable bash /w/.github/scripts/podman-cr.sh - - # Integration tests against a live Apple `container` daemon. - # - # Verified-on-CI status: - # - pkg install : OK on macos-15 and macos-26 - # - system start : OK - # - kernel set : OK - # - builder start : FAILS on both macos-15 and macos-26 with - # "VZErrorDomain Code=2 Virtualization is not available on - # this hardware." - # - # i.e. GitHub-hosted macOS runners do not expose - # Virtualization.framework for Linux guests, regardless of image - # version. Apple's `container` runtime is hardcoded to VZ (no QEMU - # fallback like Colima/Lima), so there is no workaround at the - # workflow level. The only paths to a passing job today are: - # 1. Self-hosted macOS runner with virtualization entitlements - # 2. GH exposing VZ on hosted runners (no announced timeline) - # - # continue-on-error keeps the failure visible without blocking - # merges. Drop it once a real green run is available. - test-integration-darwin: - runs-on: macos-26 - needs: [test-darwin] - strategy: - fail-fast: false - matrix: - go: ["1.25", "1.26"] - shard: [1, 2, 3] - steps: - - uses: actions/checkout@v6 - - uses: actions/setup-go@v6 - with: - go-version: ${{ matrix.go }} - cache: true - - name: Install apple/container - env: - GH_TOKEN: ${{ secrets.GITHUB_TOKEN }} - run: | - # `gh release download` authenticates with GH_TOKEN, dodging - # the strict anonymous rate limit on api.github.com that - # bit us when curling the unauth'd releases endpoint. - gh release download --repo apple/container \ - --pattern '*installer-signed.pkg' \ - --output /tmp/container.pkg - sudo installer -pkg /tmp/container.pkg -target / - container --version - - name: Select Xcode with Swift 6.2 - # apple/container 0.12.3 declares swift-tools-version 6.2; - # the macos-15 image ships an older Xcode by default. Pick - # the newest installed so SwiftPM can resolve the package. - run: sudo xcode-select -s /Applications/Xcode_latest.app || sudo xcode-select -s "$(ls -d /Applications/Xcode_*.app | sort -V | tail -1)" - - name: Cache SwiftPM artifacts - uses: actions/cache@v5 - with: - path: | - applecontainer-bridge/.build - ~/Library/Caches/org.swift.swiftpm - key: swiftpm-v1-${{ runner.os }}-${{ runner.arch }}-${{ hashFiles('applecontainer-bridge/Package.resolved') }} - restore-keys: | - swiftpm-v1-${{ runner.os }}-${{ runner.arch }}- - - name: Build Swift bridge - run: make bridge - - name: Start container apiserver - run: | - # --disable-kernel-install skips the interactive kernel prompt - # that would otherwise hang in CI; we install the recommended - # kernel explicitly in the next step. - container system start --disable-kernel-install - container system status - - name: Install default kernel - # The builder (and any container) needs a configured kernel. - # `--recommended` pulls Apple's recommended binary - # non-interactively, which `--disable-kernel-install` skipped. - run: container system kernel set --recommended - - name: Start builder - id: builder - # On GH-hosted macOS runners VZ is unavailable, so this step - # always fails. Mark it continue-on-error so the JOB stays - # green (continue-on-error at job level wouldn't — that only - # affects workflow status, not the per-job check). The next - # step gates on this step's outcome so we don't run the - # integration tests against a missing daemon. - continue-on-error: true - run: container builder start - - name: Run apple-container integration tests (shard ${{ matrix.shard }}/3) - if: steps.builder.outcome == 'success' - env: - SHARD_INDEX: ${{ matrix.shard }} - SHARD_TOTAL: 3 - run: | - # Filter to TestAppleContainer_* — the docker-backed tests - # share the `integration` build tag and would fail without a - # Docker daemon on this runner. Then partition that subset - # across shards. - set -euo pipefail - tests=$(go test -tags=integration -list '^TestAppleContainer_' ./test/integration/... \ - | grep -E '^TestAppleContainer_' | sort -u) - if [ -z "$tests" ]; then - echo "no apple-container integration tests discovered" >&2 - exit 1 - fi - selected=$(echo "$tests" | awk -v s="$SHARD_INDEX" -v t="$SHARD_TOTAL" \ - '{ if ((NR - 1) % t == (s - 1)) print }') - echo "Shard ${SHARD_INDEX}/${SHARD_TOTAL} will run:" - echo "$selected" - if [ -z "$selected" ]; then - echo "shard is empty; nothing to run" - exit 0 - fi - pattern="^($(echo "$selected" | paste -sd '|' -))$" - go test -race -count=1 -tags=integration -timeout=15m \ - -run "$pattern" ./test/integration/... - - name: Stop container services - if: always() - run: | - container builder stop || true - container system stop || true From df112b045e595da0925a08bbb9a79cf199b068ad Mon Sep 17 00:00:00 2001 From: bilby91 Date: Mon, 24 Aug 2026 19:57:21 -0300 Subject: [PATCH 2/2] docs: reflect hosted CI coverage --- README.md | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/README.md b/README.md index 47a4347..932d3c7 100644 --- a/README.md +++ b/README.md @@ -296,9 +296,9 @@ Docker daemon isn't reachable. Apple-container integration tests are tagged `integration && darwin && arm64` and run against a live `container` -apiserver — skipped when the daemon isn't running. CI runs both the -Linux + Docker suite and a `macos-26` job that builds the Swift -bridge and runs the applecontainer unit tests. +apiserver — skipped when the daemon isn't running. They are not +currently run in hosted CI; CI covers the Linux + Docker and Podman +suites. ## Design