feat: Add support for checking out release tags - #35
Closed
j4n wants to merge 14 commits into
Closed
Conversation
j4n
force-pushed
the
j4n/incus-container-hardening
branch
from
August 5, 2026 10:32
6e58c52 to
0f9dd1c
Compare
j4n
force-pushed
the
j4n/source-ref-sha-support
branch
from
August 5, 2026 10:32
19a2e2a to
e1c990e
Compare
j4n
force-pushed
the
j4n/incus-container-hardening
branch
from
August 5, 2026 11:43
0f9dd1c to
74ab76e
Compare
j4n
force-pushed
the
j4n/source-ref-sha-support
branch
from
August 5, 2026 11:43
e1c990e to
c1c5884
Compare
j4n
force-pushed
the
j4n/incus-container-hardening
branch
from
August 5, 2026 11:57
74ab76e to
d7cb3cf
Compare
j4n
force-pushed
the
j4n/source-ref-sha-support
branch
from
August 5, 2026 11:57
c1c5884 to
9f7ecb5
Compare
j4n
changed the title
j4n
force-pushed
the
j4n/source-ref-sha-support
branch
2 times, most recently
from
August 6, 2026 11:23
f3cac4b to
ee9d4ba
Compare
j4n
force-pushed
the
j4n/incus-container-hardening
branch
from
August 6, 2026 11:23
b54535a to
a2eb39e
Compare
j4n
force-pushed
the
j4n/source-ref-sha-support
branch
from
August 6, 2026 11:35
ee9d4ba to
5bb1716
Compare
j4n
force-pushed
the
j4n/incus-container-hardening
branch
from
August 6, 2026 11:35
a2eb39e to
2604f7d
Compare
j4n
force-pushed
the
j4n/source-ref-sha-support
branch
from
August 11, 2026 10:39
5bb1716 to
b1969ca
Compare
j4n
force-pushed
the
j4n/incus-container-hardening
branch
from
August 11, 2026 10:39
2604f7d to
9ed3326
Compare
hpk42
force-pushed
the
j4n/incus-container-hardening
branch
from
August 11, 2026 12:36
9ed3326 to
11c8d1a
Compare
hpk42
force-pushed
the
j4n/source-ref-sha-support
branch
from
August 11, 2026 12:36
b1969ca to
bce82b0
Compare
hpk42
force-pushed
the
j4n/incus-container-hardening
branch
from
August 11, 2026 12:53
11c8d1a to
d2759fe
Compare
hpk42
force-pushed
the
j4n/source-ref-sha-support
branch
from
August 11, 2026 12:53
bce82b0 to
65db096
Compare
Resolve it from the git main clone that prep_builder already fetched and update the source spec to records the tag instead of "latest".
- Dropped v1 support entirely rather - Go toolchain block replaced with rustup, installed if missing or below Cargo.toml's requirement - Web admin UI build is handled by the main build process now - on_init_relay now tries a download first when the resolved source is a released tag (`^v\d+\.\d+\.\d+$`, using the musl static asset; otherwise, and on download failure, falls back to the source build. - driver_base.py: pass source through on_init_relay() so drivers can inspect source.kind/source.ref to decide whether a download is possible.
…g behavior
test_delivery_port_blocked: Updated journal grep pattern to current values.
test_hide_senders_ip_address: imap_tools.MailBox.fetch() uses UID SEARCH,
implement workaround with raw imaplib sequence-range FETCH ("1:*"); allows us
to drop imaplib import.
Gate the prebuilt-binary download on the checked-out commit via `git describe --tags --exact-match --dirty` instead of matching the requested ref textually. Madmail's semantic-release tags the version-bump commit on main, so the @main default still hits the download; when main is ahead of the last release we build from source.
The -git-main cache clone is only ever fetched, never checked out, so test-madmail ran a stale test suite against a freshly built binary.
A cold run that compiles madmail in the builder does not fit in 30.
Containers with Docker or other networking can expose IPs on multiple interfaces. Extend _extract_ip() to accepts an optional subnet filter and add bridge_subnet() to get the bridge subnet so wait_ready() and list_managed() only pick addresses on incusbr0.
Move the initialization check (DNS container running + base image present) from cli._check_init() into Incus.check_init() so drivers can call it without depending on the CLI module.
…ure() Allows drivers to pass additional Incus config keys (e.g. security.nesting=true for Docker-in-LXC) when launching containers. Passed through Container and RelayContainer.
When the source ref is a full 40-char SHA, e.g., from CI dispatch, the shallow git-main clone won't have it. Detect this case and fetch just that commit with --depth 1 before checkout.
The `git reset --hard origin/{ref}` is only useful for branch refs,
for SHA refs it always fails silently since there's no remote tracking branch.
Only run it for branch refs.
Every @ref ends up in `bash -ec` inside `git fetch/checkout` on the builder. Route all three remote SourceSpec construction sites through _remote_spec(), which makes it safe and surfaces typos cleanly as ValueError.
j4n
force-pushed
the
j4n/incus-container-hardening
branch
from
August 12, 2026 07:04
d2759fe to
118563f
Compare
j4n
force-pushed
the
j4n/source-ref-sha-support
branch
from
August 12, 2026 07:04
65db096 to
aa78a29
Compare
j4n
force-pushed
the
j4n/incus-container-hardening
branch
2 times, most recently
from
August 13, 2026 15:46
41ca883 to
ea8d2c2
Compare
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Add
feat(driver_base): support SHA-based source refs in init_builder
When the source ref is a full 40-char SHA, e.g. from CI dispatch, the git-main clone may not carry it if it is not reachable from a fetched branch. Detect that case and fetch just that commit with
--depth 1before checkout.fix(init_builder): skip git reset --hard for SHA refs
git reset --hard origin/{ref}is only meaningful for branch refs. For a SHA it always fails silently, since there is no remote tracking branch. Only run it for branch refs.fix(driver_base): fetch tags so RELAY_REF and --source can checkout release tags
Needed to build Docker images of release tags. It also hardens
@latestfrom #31, which resolves againstgit tag -lin the builder's cache clone, so the refresh fetch has to bring tags in explicitly.Refactor, helper
fix(driver_base): validate refs before they reach the builder shell
Refs are interpolated into
git fetchandgit checkoutinsidebash -econ the builder, so restrict them to the characters git actually permits in a ref.feat(cli): auto-detect RUNNER_DEBUG for verbose output
Pass
-vvvwhen the runner is in debug mode.