Skip to content

ci: remove Apple Containers jobs #121

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
bilby91 wants to merge 2 commits into
base: main
Choose a base branch
from
Open

ci: remove Apple Containers jobs #121

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
0cc5e7c
ci: remove Apple Containers jobs
bilby91 Aug 24, 2026
df112b0
docs: reflect hosted CI coverage
bilby91 Aug 24, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
162 changes: 2 additions & 160 deletions .github/workflows/ci.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -43,46 +43,6 @@ jobs:
- run: go vet ./...
- run: go test -race -count=1 ./...

# Apple-container backend lives in runtime/applecontainer and is
# darwin/arm64-only (see build tags). This job builds the Swift
# bridge and runs the Go test suite on macOS so we get coverage of
# cgo compilation, go:embed of libACBridge.dylib, and the
# daemon-free unit tests. Daemon-dependent tests skip cleanly via
# runtimeOrSkip when Apple's `container` apiserver isn't running.
test-darwin:
runs-on: macos-26
strategy:
fail-fast: false
matrix:
go: ["1.25", "1.26"]
steps:
- uses: actions/checkout@v6
- uses: actions/setup-go@v6
with:
go-version: ${{ matrix.go }}
cache: true
- name: Select Xcode with Swift 6.2
# apple/container 0.12.3 declares swift-tools-version 6.2;
# the macos-15 image ships an older Xcode by default. Pick
# the newest installed so SwiftPM can resolve the package.
run: sudo xcode-select -s /Applications/Xcode_latest.app || sudo xcode-select -s "$(ls -d /Applications/Xcode_*.app | sort -V | tail -1)"
- name: Cache SwiftPM artifacts
uses: actions/cache@v5
with:
path: |
applecontainer-bridge/.build
~/Library/Caches/org.swift.swiftpm
# Key on Package.resolved so the cache busts when dependency
# versions move. Bump the `v1` prefix to force a full miss
# after a toolchain change that breaks artifact compat.
key: swiftpm-v1-${{ runner.os }}-${{ runner.arch }}-${{ hashFiles('applecontainer-bridge/Package.resolved') }}
restore-keys: |
swiftpm-v1-${{ runner.os }}-${{ runner.arch }}-
- name: Build Swift bridge
run: make bridge
- run: go vet ./...
- run: go test -race -count=1 ./...
Comment on lines -46 to -84

@dap-code-review-by-crunchloop dap-code-review-by-crunchloop Bot Aug 24, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

[MEDIUM] [R8] Removing the only macOS job leaves the supported Apple backend completely outside CI

  • Witness: The deleted test-darwin job was the only workflow job that ran make bridge and go vet ./.../go test ./... on macOS. Verbatim checks on the new workflow: grep -nE 'go test|go vet|runs-on|test-darwin|test-integration-darwin' .github/workflows/ci.yml returns only runs-on: ubuntu-latest and the Linux/Podman commands; separately, grep -RIl '^//go:build darwin && arm64' runtime/applecontainer test/integration returns the Apple runtime and test files. Thus a broken cgo/Swift embed or any Darwin-only compile/test regression can pass every remaining CI job.
  • Consumer: runtime/applecontainer/runtime_darwin_arm64.go:1 is guarded by //go:build darwin && arm64, so the remaining Ubuntu go test ./... at .github/workflows/ci.yml:44 excludes the supported Apple implementation and its Darwin tests; macOS consumers can consequently receive a release that CI never compiled.
  • Fix: Retain a Darwin/arm64 compile-and-unit-test job (it can omit the unavailable live-daemon integration job), or add an explicit supported-backend validation elsewhere that builds the bridge and runs the Darwin-tagged package/tests.

Comment on lines -46 to -84

@dap-code-review-by-crunchloop dap-code-review-by-crunchloop Bot Aug 24, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

[LOW] [D11] README still claims CI runs the removed macOS Apple-container job

  • Witness: The new workflow contains no test-darwin or test-integration-darwin job (the deleted jobs are the only matching entries in the base workflow), but README.md:297-301 still says: CI runs both the Linux + Docker suite and a macos-26 job that builds the Swift bridge and runs the applecontainer unit tests. A contributor or user checking the documented CI guarantee will therefore be told that Apple builds are validated when they are no longer run.
  • Consumer: README.md:297-301 is the documentation consumed by contributors/users to determine which backend CI validates; reading it yields a macOS validation guarantee that .github/workflows/ci.yml no longer provides.
  • Fix: Update the Tests section to state that Apple-container tests are not currently run in hosted CI and explain the supported/manual validation path, or restore a matching macOS job.

Comment on lines -46 to -84

@dap-code-review-by-crunchloop dap-code-review-by-crunchloop Bot Aug 24, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

[MEDIUM] [R8] Removing the only macOS job leaves the supported Apple backend completely outside CI

  • Witness: The deleted test-darwin job was the only workflow job that ran make bridge and go vet ./.../go test ./... on macOS. Verbatim checks on the new workflow: grep -nE 'go test|go vet|runs-on|test-darwin|test-integration-darwin' .github/workflows/ci.yml returns only runs-on: ubuntu-latest and the Linux/Podman commands; separately, grep -RIl '^//go:build darwin && arm64' runtime/applecontainer test/integration returns the Apple runtime and test files. Thus a broken cgo/Swift embed or any Darwin-only compile/test regression can pass every remaining CI job.
  • Consumer: runtime/applecontainer/runtime_darwin_arm64.go:1 is guarded by //go:build darwin && arm64, so the remaining Ubuntu go test ./... at .github/workflows/ci.yml:44 excludes the supported Apple implementation and its Darwin tests; macOS consumers can consequently receive a release that CI never compiled.
  • Fix: Retain a Darwin/arm64 compile-and-unit-test job (it can omit the unavailable live-daemon integration job), or add an explicit supported-backend validation elsewhere that builds the bridge and runs the Darwin-tagged package/tests.


test-integration-linux:
runs-on: ubuntu-latest
needs: [lint, test-linux]
Expand All @@ -108,8 +68,8 @@ jobs:
run: |
# Enumerate tests under the integration tag, partition them
# deterministically by sorted-index modulo SHARD_TOTAL, and
# run only this shard's subset. Apple-container tests are
# build-tagged darwin/arm64, so they don't appear here.
# run only this shard's subset. Platform-specific tests are
# excluded here by their build constraints.
set -euo pipefail
tests=$(go test -tags=integration -list '.*' ./test/integration/... \
| grep -E '^Test' | sort -u)
Expand Down Expand Up @@ -163,121 +123,3 @@ jobs:
--security-opt label=disable \
-v "$PWD":/w -w /w \
quay.io/podman/stable bash /w/.github/scripts/podman-cr.sh

# Integration tests against a live Apple `container` daemon.
#
# Verified-on-CI status:
# - pkg install : OK on macos-15 and macos-26
# - system start : OK
# - kernel set : OK
# - builder start : FAILS on both macos-15 and macos-26 with
# "VZErrorDomain Code=2 Virtualization is not available on
# this hardware."
#
# i.e. GitHub-hosted macOS runners do not expose
# Virtualization.framework for Linux guests, regardless of image
# version. Apple's `container` runtime is hardcoded to VZ (no QEMU
# fallback like Colima/Lima), so there is no workaround at the
# workflow level. The only paths to a passing job today are:
# 1. Self-hosted macOS runner with virtualization entitlements
# 2. GH exposing VZ on hosted runners (no announced timeline)
#
# continue-on-error keeps the failure visible without blocking
# merges. Drop it once a real green run is available.
test-integration-darwin:
runs-on: macos-26
needs: [test-darwin]
strategy:
fail-fast: false
matrix:
go: ["1.25", "1.26"]
shard: [1, 2, 3]
steps:
- uses: actions/checkout@v6
- uses: actions/setup-go@v6
with:
go-version: ${{ matrix.go }}
cache: true
- name: Install apple/container
env:
GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
run: |
# `gh release download` authenticates with GH_TOKEN, dodging
# the strict anonymous rate limit on api.github.com that
# bit us when curling the unauth'd releases endpoint.
gh release download --repo apple/container \
--pattern '*installer-signed.pkg' \
--output /tmp/container.pkg
sudo installer -pkg /tmp/container.pkg -target /
container --version
- name: Select Xcode with Swift 6.2
# apple/container 0.12.3 declares swift-tools-version 6.2;
# the macos-15 image ships an older Xcode by default. Pick
# the newest installed so SwiftPM can resolve the package.
run: sudo xcode-select -s /Applications/Xcode_latest.app || sudo xcode-select -s "$(ls -d /Applications/Xcode_*.app | sort -V | tail -1)"
- name: Cache SwiftPM artifacts
uses: actions/cache@v5
with:
path: |
applecontainer-bridge/.build
~/Library/Caches/org.swift.swiftpm
key: swiftpm-v1-${{ runner.os }}-${{ runner.arch }}-${{ hashFiles('applecontainer-bridge/Package.resolved') }}
restore-keys: |
swiftpm-v1-${{ runner.os }}-${{ runner.arch }}-
- name: Build Swift bridge
run: make bridge
- name: Start container apiserver
run: |
# --disable-kernel-install skips the interactive kernel prompt
# that would otherwise hang in CI; we install the recommended
# kernel explicitly in the next step.
container system start --disable-kernel-install
container system status
- name: Install default kernel
# The builder (and any container) needs a configured kernel.
# `--recommended` pulls Apple's recommended binary
# non-interactively, which `--disable-kernel-install` skipped.
run: container system kernel set --recommended
- name: Start builder
id: builder
# On GH-hosted macOS runners VZ is unavailable, so this step
# always fails. Mark it continue-on-error so the JOB stays
# green (continue-on-error at job level wouldn't — that only
# affects workflow status, not the per-job check). The next
# step gates on this step's outcome so we don't run the
# integration tests against a missing daemon.
continue-on-error: true
run: container builder start
- name: Run apple-container integration tests (shard ${{ matrix.shard }}/3)
if: steps.builder.outcome == 'success'
env:
SHARD_INDEX: ${{ matrix.shard }}
SHARD_TOTAL: 3
run: |
# Filter to TestAppleContainer_* — the docker-backed tests
# share the `integration` build tag and would fail without a
# Docker daemon on this runner. Then partition that subset
# across shards.
set -euo pipefail
tests=$(go test -tags=integration -list '^TestAppleContainer_' ./test/integration/... \
| grep -E '^TestAppleContainer_' | sort -u)
if [ -z "$tests" ]; then
echo "no apple-container integration tests discovered" >&2
exit 1
fi
selected=$(echo "$tests" | awk -v s="$SHARD_INDEX" -v t="$SHARD_TOTAL" \
'{ if ((NR - 1) % t == (s - 1)) print }')
echo "Shard ${SHARD_INDEX}/${SHARD_TOTAL} will run:"
echo "$selected"
if [ -z "$selected" ]; then
echo "shard is empty; nothing to run"
exit 0
fi
pattern="^($(echo "$selected" | paste -sd '|' -))$"
go test -race -count=1 -tags=integration -timeout=15m \
-run "$pattern" ./test/integration/...
- name: Stop container services
if: always()
run: |
container builder stop || true
container system stop || true
6 changes: 3 additions & 3 deletions README.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -296,9 +296,9 @@ Docker daemon isn't reachable.

Apple-container integration tests are tagged
`integration && darwin && arm64` and run against a live `container`
apiserver — skipped when the daemon isn't running. CI runs both the
Linux + Docker suite and a `macos-26` job that builds the Swift
bridge and runs the applecontainer unit tests.
apiserver — skipped when the daemon isn't running. They are not
currently run in hosted CI; CI covers the Linux + Docker and Podman
suites.

## Design

Expand Down