diff --git a/.github/dependabot.yml b/.github/dependabot.yml new file mode 100644 index 00000000..3e141601 --- /dev/null +++ b/.github/dependabot.yml @@ -0,0 +1,16 @@ +version: 2 +updates: + - package-ecosystem: github-actions + directory: / + schedule: + interval: weekly + # Wait a week before proposing a newly published action version, so a + # compromised release has time to be caught and pulled. + cooldown: + default-days: 7 + commit-message: + prefix: "ci" + groups: + github-actions: + patterns: + - "*" diff --git a/.github/workflows/unit_test.yml b/.github/workflows/unit_test.yml index 4fb73b76..70963d8e 100644 --- a/.github/workflows/unit_test.yml +++ b/.github/workflows/unit_test.yml @@ -15,6 +15,8 @@ jobs: strategy: matrix: ruby: + - '4.0' + - 3.4 - 3.3 - 3.2 - 3.1 @@ -28,8 +30,8 @@ jobs: - ':27.' fail-fast: false steps: - - uses: actions/checkout@v4 - - uses: ruby/setup-ruby@v1 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 + - uses: ruby/setup-ruby@95ef2b042f9d7a56d8268cba8559e2842e2ad01b # v1.321.0 with: ruby-version: ${{ matrix.ruby }} bundler-cache: true @@ -42,19 +44,26 @@ jobs: set -x sudo apt-get remove -y docker docker-engine docker.io containerd runc ||: sudo apt-get update -y - sudo apt-get install -y apt-transport-https ca-certificates curl gnupg-agent software-properties-common - curl -fsSL https://download.docker.com/linux/ubuntu/gpg | sudo apt-key add - - sudo add-apt-repository "deb [arch=amd64] https://download.docker.com/linux/ubuntu $(lsb_release -cs) stable" + sudo apt-get install -y apt-transport-https ca-certificates curl gnupg + # apt-key is deprecated and slated for removal; use a keyring instead. + sudo install -m 0755 -d /etc/apt/keyrings + curl -fsSL https://download.docker.com/linux/ubuntu/gpg | sudo tee /etc/apt/keyrings/docker.asc > /dev/null + sudo chmod a+r /etc/apt/keyrings/docker.asc + echo "deb [arch=$(dpkg --print-architecture) signed-by=/etc/apt/keyrings/docker.asc] https://download.docker.com/linux/ubuntu $(lsb_release -cs) stable" | sudo tee /etc/apt/sources.list.d/docker.list > /dev/null sudo apt-get update -y sudo apt-cache gencaches - sudo apt-get install -y docker-ce=$( apt-cache madison docker-ce | grep -e $DOCKER_VERSION | cut -f 2 -d '|' | head -1 | sed 's/\s//g' ) - if [ $? -ne 0 ]; then - echo "Error: Could not install ${DOCKER_VERSION}" + version=$( apt-cache madison docker-ce | grep -e "$DOCKER_VERSION" | cut -f 2 -d '|' | head -1 | sed 's/\s//g' ) + if [ -z "$version" ]; then + echo "Error: Could not find a docker-ce package matching ${DOCKER_VERSION}" echo "Available docker versions:" apt-cache madison docker-ce exit 1 fi + # The runner image preinstalls a newer docker-ce than the versions + # pinned in the matrix, so installing the pin is a downgrade. + sudo apt-get install -y --allow-downgrades docker-ce="$version" sudo systemctl start docker + docker version - name: spec tests run: bundle exec rake @@ -64,6 +73,8 @@ jobs: strategy: matrix: ruby: + - '4.0' + - 3.4 - 3.3 - 3.2 - 3.1 @@ -74,8 +85,8 @@ jobs: - 2.4 fail-fast: false steps: - - uses: actions/checkout@v4 - - uses: ruby/setup-ruby@v1 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 + - uses: ruby/setup-ruby@95ef2b042f9d7a56d8268cba8559e2842e2ad01b # v1.321.0 with: ruby-version: ${{ matrix.ruby }} bundler-cache: true diff --git a/docker-api.gemspec b/docker-api.gemspec index 1a131c76..86694c7b 100644 --- a/docker-api.gemspec +++ b/docker-api.gemspec @@ -14,6 +14,9 @@ Gem::Specification.new do |gem| gem.version = Docker::VERSION gem.add_dependency 'excon', '>= 0.64.0' gem.add_dependency 'multi_json' + # base64 stopped being a default gem in Ruby 3.4, so `require 'base64'` in + # lib/docker.rb raises LoadError under Bundler unless it is declared. + gem.add_dependency 'base64' gem.add_development_dependency 'rake' gem.add_development_dependency 'rspec', '~> 3.0' gem.add_development_dependency 'rspec-its' diff --git a/script/install_podman.sh b/script/install_podman.sh index f5d48789..83cd055e 100755 --- a/script/install_podman.sh +++ b/script/install_podman.sh @@ -1,12 +1,16 @@ #!/bin/sh set -ex -. /etc/os-release - -curl -L https://download.opensuse.org/repositories/devel:/kubic:/libcontainers:/stable/xUbuntu_${VERSION_ID}/Release.key | sudo apt-key add - - -echo "deb https://download.opensuse.org/repositories/devel:/kubic:/libcontainers:/stable/xUbuntu_${VERSION_ID}/ /" > /etc/apt/sources.list.d/podman.list +# Ubuntu ships podman in the universe repository (4.9.3 on 24.04), so no +# third-party repository is required. +# +# This previously pulled podman from the openSUSE Build Service repo +# devel:kubic:libcontainers:stable. That project was retired and the repo now +# serves an HTML "Resource is no longer available!" page in place of +# Release.key, so `apt-key add` failed with "no valid OpenPGP data found". apt-get update apt-get install -y podman + +podman --version diff --git a/spec/docker/connection_spec.rb b/spec/docker/connection_spec.rb index 86291298..43bc7260 100644 --- a/spec/docker/connection_spec.rb +++ b/spec/docker/connection_spec.rb @@ -66,7 +66,11 @@ end describe '#resource' do - its(:resource) { should be_a Excon::Connection } + # #resource is private, so it cannot go through `its`, which uses + # public_send on Ruby 3.0+. + it 'is an Excon::Connection' do + expect(subject.send(:resource)).to be_a Excon::Connection + end end describe '#request' do diff --git a/spec/docker/container_spec.rb b/spec/docker/container_spec.rb index d5c8a34f..927556bd 100644 --- a/spec/docker/container_spec.rb +++ b/spec/docker/container_spec.rb @@ -503,7 +503,14 @@ described_class.create('Cmd' => %w[true], 'Image' => 'debian:stable') } - before { subject.tap(&:start).stop('timeout' => '10') } + # POST /containers/{id}/stop returns once the daemon has signalled the + # container, which can land just before it leaves the running list. Wait on + # the not-running condition so the assertion below is not racing that + # transition. + before do + subject.tap(&:start).stop('timeout' => '10') + subject.wait(10) + end after { subject.remove } it 'stops the container' do