## Summary
Add Dependabot configuration to automatically keep GitHub Actions up to
date.
## Changes
Adds `.github/dependabot.yml` configured to:
- Check for GitHub Actions updates weekly
- Group all action updates together for easier review
- Use `ci` prefix for commit messages
## Why
As discussed in #958, this helps:
- Keep actions up to date with security patches automatically
- Handle Node runtime deprecations proactively (e.g., Node 20 → Node 24)
- Reduce manual maintenance burden
## Reference
Based on the pattern used in
[swift-nio](https://github.com/apple/swift-nio/blob/main/.github/dependabot.yml).
## Summary
Upgrade GitHub Actions to their latest versions to ensure compatibility
with Node 24, as Node 20 will reach end-of-life in April 2026.
## Changes
| Action | Old Version(s) | New Version | SHA |
|--------|---------------|-------------|-----|
| `actions/checkout` | v4 | v6 | `8e8c483` |
| `actions/download-artifact` | v4 | v7 | `37930b1` |
| `actions/upload-artifact` | v4 | v6 | `b7c566a` |
| `actions/labeler` | v5 | v6 | `634933e` |
| `actions/configure-pages` | v5 | v5 | `983d773` |
| `actions/upload-pages-artifact` | v3 | v3 | `56afc60` |
| `softprops/action-gh-release` | v2 | v2 | `a06a81a` |
## Context
Per [GitHub's
announcement](https://github.blog/changelog/2025-09-19-deprecation-of-node-20-on-github-actions-runners/),
Node 20 is being deprecated and runners will begin using Node 24 by
default starting March 4th, 2026.
### Why this matters
- **Node 20 EOL**: April 2026
- **Node 24 default**: March 4th, 2026
- **Action**: Update to latest action versions that support Node 24
### Security
All actions are now **pinned to commit SHAs** instead of mutable version
tags. This provides:
- Protection against tag hijacking attacks
- Immutable, reproducible builds
- Version comments for readability
### Automated Updates
A follow-up PR (#960) adds Dependabot configuration to automatically
keep these actions updated with new SHA-pinned versions.
### Testing
These changes only affect CI/CD workflow configurations and should not
impact application functionality. The workflows should be tested by
running them on a branch before merging.
Signed-off-by: Salman Muin Kayser Chishti <13schishti@gmail.com>
- This can basically Help teams know what changes are made in pr
- Added the split approach @katiewasnothere suggested using openssf
- Added additional feature for colors
- Currently this is for CLI only later we can add multiple
- Labeling flow
- TRIGGER: Pull Request Opened (untrusted code)
- READ-ONLY stage: just save job number to artifact
- WRITE: load job number artifact, use GH labeler
action with `labeler.yml` from repo
Reverts apple/container#741
The action does not have permissions to add labels. Reverting this while
we investigate the right fix
@Ronitsabhaya75 heads up
## Type of Change
- [ ] New feature : This can help dev teams to particularly look on
those things are differently and understand what has been changed
through labels
@dcantah can you please review this pr and suggest me if any changes
require
---------
Signed-off-by: Kathryn Baldauf <k_baldauf@apple.com>
Co-authored-by: Kathryn Baldauf <k_baldauf@apple.com>
Co-authored-by: Bisman Sahni <139563284+bismansahni@users.noreply.github.com>
Co-authored-by: J Logan <john_logan@apple.com>
## Type of Change
- [x] Process update
## Description
Remove description field in PR template
## Motivation and Context
I think having separate `Description` and `Motivation and Context`
sections have been redundant in recent usage of the PR template. This PR
removes the `Description` section. Ideally the PR title should cover the
same content previously in the `Description` section.
Signed-off-by: Kathryn Baldauf <k_baldauf@apple.com>
- Disabled tests that failed with release config.
- Changed so merge builds build with release config so this doesn't burn
us next release.
- Added `swift --version` to Makefile so we can see what we're running
up in CI.
Tags on the repo should be a way to classify an item instead of denoting
workflow or status of the item. Remove the addition of the triage label
on bug and feature issues.
Signed-off-by: Kathryn Baldauf <k_baldauf@apple.com>
Github now has a "Type" feature for issues. Types are set at the
organization level and can be used for consistent classification of
issues across an organization. We'd like to switch to using these to
classify if an issue is a bug or feature instead of labels. Labels will
be used for more granular classification within a repo.
See [github
docs](https://docs.github.com/en/issues/tracking-your-work-with-issues/configuring-issues/managing-issue-types-in-an-organization)
for more information about GitHub Issue Types.
Signed-off-by: Kathryn Baldauf <k_baldauf@apple.com>
## 🔧 Improvements Summary
This PR introduces three improvements focused on safety,
maintainability, and readability of the GitHub Actions workflow.
---
### 1. Define Global Environment Variable
**Before:**
Environment variable `CURRENT_SDK` was defined repeatedly in multiple
steps.
**After:**
Declared in gloabally one time.
#### Why This Matters:
- Eliminates duplication across steps.
- Makes it easier to update or remove the variable in the future.
- Still allows per-step override when necessary.
### 2. Fix Unsafe Shell Conditional on inputs.release
- Using **[[ ... ]]** **instea**d of **[ ... ]** for conditionals.
- Adding **double quotes** around inputs and refs to **avoid**
evaluation issues.
**PREVIOUSLY FIXED** Containerization project.
[https://github.com/apple/containerization/pull/68](url)
### 3. Removed EXCLUSION AND TODO comment.
#### Affected Steps:
`check Formatting`
`make proto`
### Improvements:
Now that the repositories are public, we no longer need to exclude files
like Package.swift and Package.resolved from formatting and proto
checks.
- Removed EXCLUDES logic
- Removed related TODO comments
- Updated git diff checks to include all files
@wlan0 @katiewasnothere
## 🔧 Summary
This PR improves the release.yml GitHub Actions workflow by addressing
several critical issues to ensure consistent and reliable behavior
during tag-based releases.
## ✅ Changes Included
### 1. Fixed tag trigger regex
- Escaped dots in the tag regex ([0-9]+\\.[0-9]+\\.[0-9]+) to ensure
only semantic version tags like 1.2.3 trigger the workflow.
##### Explanation
- Old **Regex** is incorrect because . matches **any character**, so it
matched:
`1-2-3`, `1_2_3`, even `1a2b3`, which is invalid for versioning.
- Fixed **Regex** is strict — matches only 1.2.3.
#### Find attached tested SCREEN SHOT BELOW .
**Bad Match with Old Regex:**
**Proper Match with Fixed Regex:**
---
### 💬 Note: If you're planning to adopt alternate version tag formats in
the future — such as:
- v1.0.2 (semantic with prefix)
- release-1.0.2 or rel-1.0.2
- 1.0.2-beta, 1.0.2-rc.1 (prereleases with suffixes)
- x1.0.2x (custom wrapping formats)
**…feel free to reach out. I'm happy to help extend the workflow to
support those formats reliably and safely.**
---
### 2. Added strict release job guard
- Prevented **accidental release runs** on non-tag events using if:
startsWith(github.ref, 'refs/tags/').
### 3. Explicit artifact validation
- **Introduced a shell check** using ls and test to ensure .zip and .pkg
files exist before attempting release. This gives early, clear failure
instead of a **vague error** from `action-gh-release`.
### 4. Clarified GitHub token usage
- Switched from ${{ secrets.GITHUB_TOKEN }} to ${{ github.token }} for
better readability and consistency with GitHub Actions best practices.
@katiewasnothere @wlan0
When we were setting up the repos, we needed these environment variables
for the GitHub Actions CI to be able to run the tests. Now that the
images are public, these can be removed.
Signed-off-by: Kathryn Baldauf <k_baldauf@apple.com>
I would love feedback on how people feel about these issue templates, if
there should be more or less templates, or if there are any fields that
people think we should add.
You can see an example of how to use these by testing opening an issue
on my fork [here](https://github.com/katiewasnothere/container/issues).
Signed-off-by: Kathryn Baldauf <k_baldauf@apple.com>
This token was needed when the repos were private. Now that they are
public, this should no longer be needed.
Signed-off-by: Kathryn Baldauf <k_baldauf@apple.com>
We eventually only want to support building docs from release branches
and tags, however, while we're working to initially set up the docs, we
may have some churn. So we want to be able to publish from main during
that churn.
Signed-off-by: Kathryn Baldauf <k_baldauf@apple.com>
Replaces the `--install-dependencies` flag with the
`(enable/disable)-kernel-install` flag. If the flag is not passed - the
default behavior is prompting the user for a response.
Also adds a make target `install-kernel`
```
➜ bin/container system start
Verifying apiserver is running...
Installing base container filesystem...
No default kernel configured.
Install the recommended default kernel from [https://github.com/kata-containers/kata-containers/releases/download/3.17.0/kata-static-3.17.0-arm64.tar.xz]? [Y/n]: n
Please use the `container system kernel set --recommended` command to configure the default kernel
➜ bin/container system start --disable-kernel-install
Verifying apiserver is running...
➜ bin/container system start --enable-kernel-install
Verifying apiserver is running...
Installing kernel...
➜ bin/container system start --help
USAGE: container system start ... [--enable-kernel-install] [--disable-kernel-install]
...
--enable-kernel-install/--disable-kernel-install
Specify if the default kernel should be installed or not.
```
---------
Signed-off-by: Aditya Ramani <a_ramani@apple.com>
This removes the ability to deploy docs on the main branch and instead
only allows docs deployment on either a tag or a release branch. Docs
are also built (but not deployed) in the common job run by the build and
release pipelines.
Signed-off-by: Kathryn Baldauf <k_baldauf@apple.com>
Salman Chishti