Merge branch 'main' into fix-26848-userns-pod-validation

Signed-off-by: N E I L   O H E N E <[email protected]>

Author: 0xDVC

.cirrus.yml

@@ -28,10 +28,10 @@ env:
     FEDORA_AARCH64_NAME: "${FEDORA_NAME}-aarch64"
     PRIOR_FEDORA_NAME: "fedora-41"
     RAWHIDE_NAME: "rawhide"
-    DEBIAN_NAME: "debian-13"
+    DEBIAN_NAME: "debian-14"
 
     # Image identifiers
-    IMAGE_SUFFIX: "c20250910t092246z-f42f41d13"
+    IMAGE_SUFFIX: "c20251120t131229z-f42f41d14"
 
     # EC2 images
     FEDORA_AMI: "fedora-aws-${IMAGE_SUFFIX}"
@@ -1090,7 +1090,9 @@ upgrade_test_task:
     depends_on: *build
     matrix:
         - env:
-              PODMAN_UPGRADE_FROM: v4.8.0
+              PODMAN_UPGRADE_FROM: v5.3.1
+        - env:
+              PODMAN_UPGRADE_FROM: v5.6.2
     gce_instance: *standardvm
     env:
         TEST_FLAVOR: upgrade_test

.github/workflows/check_cirrus_cron.yml

@@ -44,7 +44,7 @@ jobs:
         runs-on: ubuntu-latest
         steps:
             # This is where the scripts live
-            - uses: actions/checkout@v5
+            - uses: actions/checkout@v6
               with:
                   repository: containers/podman
                   ref: 'main'
@@ -73,7 +73,7 @@ jobs:
                 body: file://./artifacts/email_body.txt
 
             - if: always()
-              uses: actions/upload-artifact@v4
+              uses: actions/upload-artifact@v5
               with:
                   name: ${{ github.job }}_artifacts
                   path: artifacts/*

.github/workflows/dev-bump.yml

@@ -8,7 +8,7 @@ jobs:
     name: Bump to -dev
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v5
+      - uses: actions/checkout@v6
         with:
           ref: ${{ github.ref_name }}
           token: ${{ secrets.PODMANBOT_TOKEN }}
@@ -80,7 +80,7 @@ jobs:
     env:
       GH_TOKEN: ${{ github.token }}
     steps:
-      - uses: actions/checkout@v5
+      - uses: actions/checkout@v6
         with:
           ref: main
           token: ${{ secrets.PODMANBOT_TOKEN }}

.github/workflows/first_contrib_cert_generator.yml

@@ -56,7 +56,7 @@ jobs:
       # Step 2: Checkout the repository containing the certificate HTML file.
       - name: Checkout containers/automation repository
         if: ${{ github.event_name == 'workflow_dispatch' || steps.check_first_pr.outputs.is_first_pr == 'true' }}
-        uses: actions/checkout@v5
+        uses: actions/checkout@v6
         with:
           repository: containers/automation
           path: automation-repo

.github/workflows/mac-pkg.yml

@@ -96,7 +96,7 @@ jobs:
         steps.check.outputs.buildarm == 'true' ||
         steps.check.outputs.builduniversal == 'true' ||
         steps.actual_dryrun.outputs.dryrun == 'true'
-      uses: actions/checkout@v5
+      uses: actions/checkout@v6
       with:
         ref: ${{steps.getversion.outputs.version}}
     - name: Set up Go
@@ -151,7 +151,7 @@ jobs:
         steps.check.outputs.buildarm == 'true' ||
         steps.check.outputs.builduniversal == 'true' ||
         steps.actual_dryrun.outputs.dryrun == 'true'
-      uses: actions/upload-artifact@v4
+      uses: actions/upload-artifact@v5
       with:
         name: installers
         path: |

.github/workflows/machine-os-pr.yml

@@ -65,7 +65,7 @@ jobs:
         run: |
           pip3 install git+https://github.com/packit/wait-for-copr.git@main
 
-      - uses: actions/checkout@v5
+      - uses: actions/checkout@v6
         if: steps.getversion.outputs.update == 'true'
         id: checkout
         with:

.github/workflows/release-artifacts.yml

@@ -99,7 +99,7 @@ jobs:
             fi
 
       - name: Checkout Version
-        uses: actions/checkout@v5
+        uses: actions/checkout@v6
         with:
           ref: ${{steps.getversion.outputs.version}}
 
@@ -173,7 +173,7 @@ jobs:
         if: >-
           steps.check.outputs.buildartifacts == 'true' ||
           steps.actual_dryrun.outputs.dryrun == 'true'
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@v5
         with:
           name: artifacts
           path: |

.github/workflows/release.yml

@@ -66,7 +66,7 @@ jobs:
     needs: check
     steps:
     - name: Checkout Version
-      uses: actions/checkout@v5
+      uses: actions/checkout@v6
       with:
         ref: ${{needs.check.outputs.version}}
     - name: Set up Go
@@ -80,7 +80,7 @@ jobs:
       run: |
           make release-artifacts
     - name: Upload to Actions as artifact
-      uses: actions/upload-artifact@v4
+      uses: actions/upload-artifact@v5
       with:
         name: release-artifacts
         path: release/*
@@ -103,7 +103,7 @@ jobs:
       KEYCHAIN_PWD: ${{ secrets.MACOS_CI_KEYCHAIN_PWD }}
     steps:
     - name: Checkout Version
-      uses: actions/checkout@v5
+      uses: actions/checkout@v6
       with:
         ref: ${{needs.check.outputs.version}}
     - name: Set up Go
@@ -136,7 +136,7 @@ jobs:
       run: |
         make ARCH=universal notarize &> /dev/null
     - name: Artifact
-      uses: actions/upload-artifact@v4
+      uses: actions/upload-artifact@v5
       with:
         name: mac-installers
         path: |
@@ -161,9 +161,9 @@ jobs:
           }
         Write-Output "version=$version" | Out-File -FilePath $env:GITHUB_OUTPUT -Append
     - name: Checkout Podman
-      uses: actions/checkout@v5
+      uses: actions/checkout@v6
     - name: Download Windows zip artifact
-      uses: actions/download-artifact@v5
+      uses: actions/download-artifact@v6
     - name: Set up Go
       uses: actions/setup-go@v6
       with:
@@ -230,21 +230,21 @@ jobs:
         Copy-Item -Path podman-${{steps.getversion.outputs.version}}-setup.exe -Destination podman-installer-windows-${{ matrix.arch }}.exe
         Pop-Location
     - name: Upload the MSI
-      uses: actions/upload-artifact@v4
+      uses: actions/upload-artifact@v5
       with:
         name: win-msi-${{ matrix.arch }}
         path: |
           .\contrib\win-installer\podman-installer-windows-${{ matrix.arch }}.msi
     - name: Upload the bundle (legacy)
-      uses: actions/upload-artifact@v4
+      uses: actions/upload-artifact@v5
       with:
         name: win-installer-${{ matrix.arch }}
         path: |
           .\contrib\win-installer-legacy\podman-installer-windows-${{ matrix.arch }}.exe
       # For backwards compatibility, we also upload the amd64 windows
       # installer using the old name
     - name: Upload the bundle with the old name (legacy)
-      uses: actions/upload-artifact@v4
+      uses: actions/upload-artifact@v5
       if: ${{ matrix.arch == 'amd64' }}
       with:
         name: win-installer
@@ -262,7 +262,7 @@ jobs:
       VERSION: ${{needs.check.outputs.version}}
     steps:
     - name: Checkout Version
-      uses: actions/checkout@v5
+      uses: actions/checkout@v6
       with:
         ref: ${{needs.check.outputs.version}}
     - name: Get release notes
@@ -281,7 +281,7 @@ jobs:
     - name: Display release notes
       run: cat $VERSION-release-notes.md
     - name: Download all artifacts
-      uses: actions/download-artifact@v5
+      uses: actions/download-artifact@v6
     - name: Show artifacts
       run: |
         mv win-installer/* release-artifacts

.github/workflows/update-podmanio.yml

@@ -65,7 +65,7 @@ jobs:
         env:
           GH_TOKEN: ${{ secrets.PODMANBOT_TOKEN }}
 
-      - uses: actions/checkout@v5
+      - uses: actions/checkout@v6
         if: >-
             steps.getversion.outputs.notRC == 'true' &&
             steps.checkpr.outputs.prexists == 'false'

.github/workflows/upload-win-installer.yml

@@ -53,7 +53,7 @@ jobs:
     # Note this purposefully checks out the same branch the action runs in, as the
     # installer build script is designed to support older releases (uses the archives
     # on the release tag).
-    - uses: actions/checkout@v5
+    - uses: actions/checkout@v6
     # This step is super-duper critical for the built/signed windows installer .exe file.
     # It ensures the referenced $version github release page does NOT already contain
     # this file.  Windows assigns a UUID to the installer at build time, it's assumed
@@ -120,7 +120,7 @@ jobs:
         Exit $code
     - name: Artifact
       if: steps.check.outputs.already-exists != 'true' || steps.actual_dryrun.outputs.dryrun == 'true'
-      uses: actions/upload-artifact@v4
+      uses: actions/upload-artifact@v5
       with:
         name: installer
         path: |