Merge branch 'main' into add-init-decoder-for-attachment-and-network-config

Author: JaewonHur

.github/workflows/common.yml

@@ -49,9 +49,11 @@ jobs:
           DEVELOPER_DIR: "/Applications/Xcode-latest.app/Contents/Developer"
 
       - name: Set build configuration
+        env:
+          RELEASE: ${{ inputs.release }}
         run: |
           echo "BUILD_CONFIGURATION=debug" >> $GITHUB_ENV
-          if [[ "${{ inputs.release }}" == "true" ]]; then
+          if [[ "${RELEASE}" == "true" ]]; then
             echo "BUILD_CONFIGURATION=release" >> $GITHUB_ENV
           fi
 
@@ -65,8 +67,8 @@ jobs:
       - name: Create package
         run: |
           mkdir -p outputs
-          mv bin/${{ env.BUILD_CONFIGURATION }}/container-installer-unsigned.pkg outputs
-          mv bin/${{ env.BUILD_CONFIGURATION }}/bundle/container-dSYM.zip outputs
+          mv "bin/${BUILD_CONFIGURATION}/container-installer-unsigned.pkg" outputs
+          mv "bin/${BUILD_CONFIGURATION}/bundle/container-dSYM.zip" outputs
 
       - name: Test the container project
         run: |
@@ -87,6 +89,11 @@ jobs:
       - name: Archive test logs
         if: always()
         run: |
+          if [ -d "${APP_ROOT}/containers" ] && [ -n "${LOG_ROOT}" ]; then
+            rsync -a --include='*/' --include='*.log' --exclude='*' \
+              "${APP_ROOT}/containers/" \
+              "${LOG_ROOT}/containers/"
+          fi
           if [ -n "${LOG_ROOT}" ] && [ -d "${LOG_ROOT}" ] ; then
             echo "Collecting logs from ${LOG_ROOT}..."
             tar czf container-logs.tar.gz -C "$(dirname "${LOG_ROOT}")" "$(basename "${LOG_ROOT}")"
@@ -99,22 +106,22 @@ jobs:
 
       - name: Upload logs if present
         if: always()
-        uses: actions/upload-artifact@b7c566a772e6b6bfb58ed0dc250532a479d7789f # v6
+        uses: actions/upload-artifact@bbbca2ddaa5d8feaa63e36b76fdaad77386f024f # v7.0.0
         with:
           name: container-test-logs
           path: container-logs.tar.gz
           retention-days: 14
           if-no-files-found: ignore
 
       - name: Save documentation artifact
-        uses: actions/upload-artifact@b7c566a772e6b6bfb58ed0dc250532a479d7789f # v6
+        uses: actions/upload-artifact@bbbca2ddaa5d8feaa63e36b76fdaad77386f024f # v7.0.0
         with:
           name: api-docs
           path: "./_site.tgz"
           retention-days: 14
 
       - name: Save package artifacts
-        uses: actions/upload-artifact@b7c566a772e6b6bfb58ed0dc250532a479d7789f # v6
+        uses: actions/upload-artifact@bbbca2ddaa5d8feaa63e36b76fdaad77386f024f # v7.0.0
         with:
           name: container-package
           path: ${{ github.workspace }}/outputs
@@ -131,7 +138,7 @@ jobs:
         uses: actions/configure-pages@v5
 
       - name: Download a single artifact
-        uses: actions/download-artifact@37930b1c2abaa49bbe596cd826c3c89aef350131 # v7
+        uses: actions/download-artifact@70fc10c6e5e1ce46ad2ea6f2b72d43f7d47b13c3 # v8.0.0
         with:
           name: api-docs
 

.github/workflows/docs-release.yml

@@ -14,7 +14,9 @@ jobs:
     if: github.ref == 'refs/heads/main' || startsWith(github.ref, 'refs/tags') || startsWith(github.ref, 'refs/heads/release')
     steps:
       - name: Branch validation
-        run: echo "Branch ${{ github.ref_name }} is allowed"
+        env:
+          REF_NAME: ${{ github.ref_name }}
+        run: echo "Branch ${REF_NAME} is allowed"
 
   buildSite:
     name: Build application website

.github/workflows/pr-build.yml

@@ -15,8 +15,10 @@ jobs:
       - name: Check all commits are signed
         env:
           GH_TOKEN: ${{ github.token }}
+          REPO: ${{ github.repository }}
+          PR_NUMBER: ${{ github.event.pull_request.number }}
         run: |
-          commits=$(gh api repos/${{ github.repository }}/pulls/${{ github.event.pull_request.number }}/commits --paginate)
+          commits=$(gh api "repos/${REPO}/pulls/${PR_NUMBER}/commits" --paginate)
           unsigned_commits=""
 
           while IFS='|' read -r sha author verified; do

.github/workflows/pr-label-analysis.yml

@@ -14,12 +14,14 @@ jobs:
 
     steps:
       - name: Save PR metadata
+        env:
+          PR_NUMBER: ${{ github.event.pull_request.number }}
         run: |
           mkdir -p ./pr-metadata
-          echo "${{ github.event.pull_request.number }}" > ./pr-metadata/pr-number.txt
+          echo "${PR_NUMBER}" > ./pr-metadata/pr-number.txt
       
       - name: Upload PR metadata as artifact
-        uses: actions/upload-artifact@b7c566a772e6b6bfb58ed0dc250532a479d7789f # v6
+        uses: actions/upload-artifact@bbbca2ddaa5d8feaa63e36b76fdaad77386f024f # v7.0.0
         with:
           name: pr-metadata-${{ github.event.pull_request.number }}
           path: pr-metadata/

.github/workflows/pr-label-apply.yml

@@ -23,7 +23,7 @@ jobs:
         uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
 
       - name: Download PR metadata artifact
-        uses: actions/download-artifact@37930b1c2abaa49bbe596cd826c3c89aef350131 # v7
+        uses: actions/download-artifact@70fc10c6e5e1ce46ad2ea6f2b72d43f7d47b13c3 # v8.0.0
         with:
           github-token: ${{ secrets.GITHUB_TOKEN }}
           run-id: ${{ github.event.workflow_run.id }}

.github/workflows/release-build.yml

@@ -32,7 +32,7 @@ jobs:
       pages: write
     steps:
       - name: Download artifacts
-        uses: actions/download-artifact@37930b1c2abaa49bbe596cd826c3c89aef350131 # v7
+        uses: actions/download-artifact@70fc10c6e5e1ce46ad2ea6f2b72d43f7d47b13c3 # v8.0.0
         with:
           path: outputs
 

.github/workflows/release.yml

@@ -32,7 +32,7 @@ jobs:
       pages: write
     steps:
       - name: Download artifacts
-        uses: actions/download-artifact@37930b1c2abaa49bbe596cd826c3c89aef350131 # v7
+        uses: actions/download-artifact@70fc10c6e5e1ce46ad2ea6f2b72d43f7d47b13c3 # v8.0.0
         with:
           path: outputs
 

BUILDING.md

@@ -127,6 +127,29 @@ To revert to using the Containerization dependency from your `Package.swift`:
     bin/container system start
     ```
 
+## Develop using a local copy of container-builder-shim
+
+To test changes that require the `container-builder-shim` project:
+
+1. Clone the [container-builder-shim](https://github.com/apple/container-builder-shim) repository and navigate to its directory.
+
+2. After making the necessary changes, build the custom builder image, set it as the active builder image, and remove the existing `buildkit` container so the new image will be used:
+
+```bash
+container build -t builder .
+container system property set image.builder builder:latest
+container rm -f buildkit
+```
+
+3. Run the `container` build as usual:
+
+```bash
+container build ...
+```
+
+> [!IMPORTANT]
+> If your modified builder image is broken, make sure to rebuild and correctly tag the builder image before attempting to build `container-builder-shim` again.
+
 ## Debug XPC Helpers
 
 Attach debugger to the XPC helpers using their launchd service labels:

Makefile

@@ -187,6 +187,7 @@ integration: init-block
 	echo "Starting CLI integration tests" && \
 	{ \
 		exit_code=0; \
+		CLITEST_LOG_ROOT=$(LOG_ROOT) && export CLITEST_LOG_ROOT ; \
 		$(SWIFT) test -c $(BUILD_CONFIGURATION) $(SWIFT_CONFIGURATION) --filter TestCLINetwork || exit_code=1 ; \
 		$(SWIFT) test -c $(BUILD_CONFIGURATION) $(SWIFT_CONFIGURATION) --filter TestCLIRunLifecycle || exit_code=1 ; \
 		$(SWIFT) test -c $(BUILD_CONFIGURATION) $(SWIFT_CONFIGURATION) --filter TestCLIExecCommand || exit_code=1 ; \