Create limactl template command

.github/workflows/codeql.yaml

@@ -32,7 +32,7 @@ jobs:
       uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683  # v4.2.2
 
     - name: Initialize CodeQL
-      uses: github/codeql-action/init@dd746615b3b9d728a6a37ca2045b68ca76d4841a  # v3.28.8
+      uses: github/codeql-action/init@b56ba49b26e50535fa1e7f7db0f4f7b4bf65d80d  # v3.28.10
       with:
         languages: ${{ matrix.language }}
         build-mode: ${{ matrix.build-mode }}
@@ -48,6 +48,6 @@ jobs:
         exit 1
 
     - name: Perform CodeQL Analysis
-      uses: github/codeql-action/analyze@dd746615b3b9d728a6a37ca2045b68ca76d4841a  # v3.28.8
+      uses: github/codeql-action/analyze@b56ba49b26e50535fa1e7f7db0f4f7b4bf65d80d  # v3.28.10
       with:
         category: "/language:${{matrix.language}}"

.github/workflows/release.yml

@@ -39,11 +39,11 @@ jobs:
         fetch-depth: 1
     - uses: actions/setup-go@f111f3307d8850f501ac008e886eec1fd1932a34  # v5.3.0
       with:
-        go-version: 1.23.x
+        go-version: 1.24.x
     - name: Make darwin artifacts
       run: make artifacts-darwin
     - name: "Upload artifacts"
-      uses: actions/upload-artifact@65c4c4a1ddee5b72f698fdd19549f0f0fb45cf08  # v4.6.0
+      uses: actions/upload-artifact@4cec3d8aa04e39d1a68397de0c4cd6fb9dce8ec1  # v4.6.1
       with:
         name: artifacts-darwin
         path: _artifacts/
@@ -60,13 +60,13 @@ jobs:
       attestations: write  # for provenances
     steps:
     - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683  # v4.2.2
-    - uses: actions/download-artifact@fa0a91b85d4f404e444e00e005971372dc801d16  # v4.1.8
+    - uses: actions/download-artifact@cc203385981b70ca67e1cc392babf9cc229d5806  # v4.1.9
       with:
         name: artifacts-darwin
         path: _artifacts/
     - uses: actions/setup-go@f111f3307d8850f501ac008e886eec1fd1932a34  # v5.3.0
       with:
-        go-version: 1.23.x
+        go-version: 1.24.x
     - name: Install gcc-x86-64-linux-gnu
       run: |
         sudo apt-get update
@@ -110,7 +110,7 @@ jobs:
         - - -
         Release manager: [ADD YOUR NAME HERE] (@[ADD YOUR GITHUB ID HERE])
         EOF
-    - uses: actions/attest-build-provenance@520d128f165991a6c774bcb264f323e3d70747f4  # v2.2.0
+    - uses: actions/attest-build-provenance@bd77c077858b8d561b7a36cbe48ef4cc642ca39d  # v2.2.2
       if: github.event_name == 'push' && startsWith(github.ref, 'refs/tags/v')
       with:
         subject-path: _artifacts/*

.github/workflows/scorecard.yml

@@ -32,7 +32,7 @@ jobs:
         persist-credentials: false
 
     - name: "Run analysis"
-      uses: ossf/scorecard-action@62b2cac7ed8198b15735ed49ab1e5cf35480ba46  # v2.4.0
+      uses: ossf/scorecard-action@f49aabe0b5af0936a0987cfb85d86b75731b0186  # v2.4.1
       with:
         results_file: results.sarif
         results_format: sarif
@@ -51,7 +51,7 @@ jobs:
     # Upload the results as artifacts (optional). Commenting out will disable uploads of run results in SARIF
     # format to the repository Actions tab.
     - name: "Upload artifact"
-      uses: actions/upload-artifact@65c4c4a1ddee5b72f698fdd19549f0f0fb45cf08  # v3.pre.node20
+      uses: actions/upload-artifact@4cec3d8aa04e39d1a68397de0c4cd6fb9dce8ec1  # v3.pre.node20
       with:
         name: SARIF file
         path: results.sarif
@@ -60,6 +60,6 @@ jobs:
     # Upload the results to GitHub's code scanning dashboard (optional).
     # Commenting out will disable upload of results to your repo's Code Scanning dashboard
     - name: "Upload to code-scanning"
-      uses: github/codeql-action/upload-sarif@dd746615b3b9d728a6a37ca2045b68ca76d4841a  # v3.28.8
+      uses: github/codeql-action/upload-sarif@b56ba49b26e50535fa1e7f7db0f4f7b4bf65d80d  # v3.28.10
       with:
         sarif_file: results.sarif

.github/workflows/test.yml

@@ -31,17 +31,17 @@ jobs:
         fetch-depth: 0
     - uses: actions/setup-go@f111f3307d8850f501ac008e886eec1fd1932a34  # v5.3.0
       with:
-        go-version: 1.23.x
+        go-version: 1.24.x
     - name: Install protoc
       run: |
         sudo apt-get update
         sudo apt-get install -y protobuf-compiler
     - name: Verify generated files
       run: make install-tools generate check-generated
     - name: Run golangci-lint
-      uses: golangci/golangci-lint-action@e60da84bfae8c7920a47be973d75e15710aa8bd7  # v6.3.0
+      uses: golangci/golangci-lint-action@2226d7cb06a077cd73e56eedd38eecad18e5d837  # v6.5.0
       with:
-        version: v1.62.0
+        version: v1.64.2
         args: --verbose --timeout=10m
     - name: Run yamllint
       run: yamllint .
@@ -66,6 +66,19 @@ jobs:
     - name: Check licenses
       # the allow list corresponds to https://github.com/cncf/foundation/blob/e5db022a0009f4db52b89d9875640cf3137153fe/allowed-third-party-license-policy.md
       run: go-licenses check --include_tests  ./... --allowed_licenses=Apache-2.0,BSD-2-Clause,BSD-2-Clause-FreeBSD,BSD-3-Clause,MIT,ISC,Python-2.0,PostgreSQL,X11,Zlib
+    - name: Install ltag
+      # The GitHub repo has been moved from kunalkushwaha/ltag to containerd/ltag,
+      # but the Go module name is not changed yet: https://github.com/containerd/ltag/issues/17
+      run: go install github.com/kunalkushwaha/[email protected]
+    - name: Check license boilerplates
+      run: ltag -t ./hack/ltag --check -v
+
+  security:
+    name: "Vulncheck"
+    runs-on: ubuntu-24.04
+    timeout-minutes: 5
+    steps:
+    - uses: golang/govulncheck-action@b625fbe08f3bccbe446d94fbf87fcc875a4f50ee  # v1.0.4
 
   spell:
     name: "Spell check"
@@ -89,7 +102,7 @@ jobs:
       fail-fast: false
       matrix:
         # For non-Homebrew we have to support an old release of Go
-        go-version: ["1.22.x", "1.23.x"]
+        go-version: ["1.23.x", "1.24.x"]
     steps:
     - name: Install test dependencies
       run: |
@@ -122,12 +135,10 @@ jobs:
     - name: Enable WSL2
       run: |
         wsl --set-default-version 2
-        # Manually install the latest kernel from MSI
-        Invoke-WebRequest -Uri "https://wslstorestorage.blob.core.windows.net/wslblob/wsl_update_x64.msi" -OutFile "wsl_update_x64.msi"
-        $pwd = (pwd).Path
-        Start-Process msiexec.exe -Wait -ArgumentList "/I $pwd\wsl_update_x64.msi /quiet"
+        wsl --shutdown
         wsl --update
         wsl --status
+        wsl --version
         wsl --list --online
     - name: Install WSL2 distro
       timeout-minutes: 1
@@ -148,27 +159,20 @@ jobs:
         fetch-depth: 1
     - uses: actions/setup-go@f111f3307d8850f501ac008e886eec1fd1932a34  # v5.3.0
       with:
-        go-version: 1.23.x
+        go-version: 1.24.x
     - name: Unit tests
       run: go test -v ./...
     - name: Make
       run: make
-# FIXME: Windows CI began to fail on Oct 21, 2024.
-# Something seems to have changed between win22/20241006.1 and win22/20241015.1.
-# https://github.com/lima-vm/lima/issues/2775
-#    - name: Smoke test
-#      # Make sure the path is set properly and then run limactl
-#      run: |
-#        $env:Path = 'C:\Program Files\Git\usr\bin;' + $env:Path
-#        Set-ItemProperty -Path 'Registry::HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Session Manager\Environment' -Name PATH -Value $env:Path
-#        .\_output\bin\limactl.exe start template://experimental/wsl2
-#      # TODO: run the full integration tests
-#    - name: Debug
-#      if: always()
-#      run: type C:\Users\runneradmin\.lima\wsl2\ha.stdout.log
-#    - name: Debug
-#      if: always()
-#      run: type C:\Users\runneradmin\.lima\wsl2\ha.stderr.log
+    - name: Integration tests (WSL2, Windows host)
+      run: |
+        $env:Path = "$pwd\_output\bin;" + 'C:\Program Files\Git\usr\bin;' + $env:Path
+        Set-ItemProperty -Path 'Registry::HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Session Manager\Environment' -Name PATH -Value $env:Path
+        $env:MSYS2_ENV_CONV_EXCL='HOME_HOST;HOME_GUEST'
+        $env:HOME_HOST=$(cygpath.exe "$env:USERPROFILE")
+        $env:HOME_GUEST="/mnt$env:HOME_HOST"
+        $env:LIMACTL_CREATE_ARGS='--vm-type=wsl2 --mount-type=wsl2 --containerd=system'
+        bash.exe -c "./hack/test-templates.sh templates/experimental/wsl2.yaml"
 
   qemu:
     name: "Integration tests (QEMU, macOS host)"
@@ -181,7 +185,7 @@ jobs:
         fetch-depth: 0
     - uses: actions/setup-go@f111f3307d8850f501ac008e886eec1fd1932a34  # v5.3.0
       with:
-        go-version: 1.23.x
+        go-version: 1.24.x
     - name: Unit tests
       run: go test -v ./...
     - name: Make
@@ -211,7 +215,7 @@ jobs:
     - name: "Show cache"
       run: ./hack/debug-cache.sh
     - name: "Test default.yaml"
-      uses: nick-fields/retry@7152eba30c6575329ac0576536151aca5a72780e  # v3.0.0
+      uses: nick-fields/retry@ce71cc2ab81d554ebbe88c79ab5975992d79ba08  # v3.0.2
       with:
         timeout_minutes: 30
         retry_on: error
@@ -249,10 +253,11 @@ jobs:
     steps:
     - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683  # v4.2.2
       with:
-        fetch-depth: 1
+        # To avoid "failed to load YAML file \"templates/experimental/riscv64.yaml\": can't parse builtin Lima version \"3f3a6f6\": 3f3a6f6 is not in dotted-tri format"
+        fetch-depth: 0
     - uses: actions/setup-go@f111f3307d8850f501ac008e886eec1fd1932a34  # v5.3.0
       with:
-        go-version: 1.23.x
+        go-version: 1.24.x
     - name: Make
       run: make
     - name: Install
@@ -275,7 +280,7 @@ jobs:
     - name: "Show cache"
       run: ./hack/debug-cache.sh
     - name: "Test"
-      uses: nick-fields/retry@7152eba30c6575329ac0576536151aca5a72780e  # v3.0.0
+      uses: nick-fields/retry@ce71cc2ab81d554ebbe88c79ab5975992d79ba08  # v3.0.2
       with:
         timeout_minutes: 30
         retry_on: error
@@ -303,8 +308,8 @@ jobs:
         ref: ${{ github.event.pull_request.head.sha }}
     - uses: actions/setup-go@f111f3307d8850f501ac008e886eec1fd1932a34  # v5.3.0
       with:
-        go-version: 1.23.x
-    - uses: actions/cache@1bd1e32a3bdc45362d1e726936510720a7c30a57  # v4.2.0
+        go-version: 1.24.x
+    - uses: actions/cache@d4323d4df104b026a6aa633fdb11d772146be0bf  # v4.2.2
       with:
         path: ~/.cache/lima/download
         key: ${{ runner.os }}-colima-${{ matrix.colima-version }}
@@ -329,7 +334,7 @@ jobs:
     - name: "Show cache"
       run: ./hack/debug-cache.sh
     - name: "Test"
-      uses: nick-fields/retry@7152eba30c6575329ac0576536151aca5a72780e  # v3.0.0
+      uses: nick-fields/retry@ce71cc2ab81d554ebbe88c79ab5975992d79ba08  # v3.0.2
       with:
         timeout_minutes: 30
         retry_on: error
@@ -348,7 +353,7 @@ jobs:
         fetch-depth: 1
     - uses: actions/setup-go@f111f3307d8850f501ac008e886eec1fd1932a34  # v5.3.0
       with:
-        go-version: 1.23.x
+        go-version: 1.24.x
     - name: Make
       run: make
     - name: Install
@@ -381,7 +386,7 @@ jobs:
       # Set -count=1 to disable cache
       run: go test -v -count=1 ./pkg/networks/...
     - name: Test socket_vmnet
-      uses: nick-fields/retry@7152eba30c6575329ac0576536151aca5a72780e  # v3.0.0
+      uses: nick-fields/retry@ce71cc2ab81d554ebbe88c79ab5975992d79ba08  # v3.0.2
       with:
         timeout_minutes: 30
         retry_on: error
@@ -411,7 +416,7 @@ jobs:
         filter: tree:0
     - uses: actions/setup-go@f111f3307d8850f501ac008e886eec1fd1932a34  # v5.3.0
       with:
-        go-version: 1.23.x
+        go-version: 1.24.x
     - name: Cache image used by ${{ matrix.oldver }}/examples/ubuntu-lts.yaml
       uses: ./.github/actions/setup_cache_for_template
       with:
@@ -423,7 +428,7 @@ jobs:
         # We revert back to 8.2.1, which seems to work fine
         ./hack/brew-install-version.sh qemu 8.2.1
     - name: Test
-      uses: nick-fields/retry@7152eba30c6575329ac0576536151aca5a72780e  # v3.0.0
+      uses: nick-fields/retry@ce71cc2ab81d554ebbe88c79ab5975992d79ba08  # v3.0.2
       with:
         timeout_minutes: 30
         retry_on: error
@@ -448,7 +453,7 @@ jobs:
         fetch-depth: 1
     - uses: actions/setup-go@f111f3307d8850f501ac008e886eec1fd1932a34  # v5.3.0
       with:
-        go-version: 1.23.x
+        go-version: 1.24.x
     - name: Make
       run: make
     - name: Install
@@ -469,3 +474,35 @@ jobs:
       uses: ./.github/actions/upload_failure_logs_if_exists
       with:
         suffix: ${{ matrix.template }}
+
+  # gomodjail is a library sandbox for Go
+  # https://github.com/AkihiroSuda/gomodjail
+  #
+  # This is an early experiment.
+  # CI failures that only occurs with gomodjail shall not block merging PRs.
+  gomodjail:
+    name: "gomodjail (experimental; failures shall not block merging PRs)"
+    runs-on: macos-15-large  # Intel
+    timeout-minutes: 30
+    steps:
+    - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683  # v4.2.2
+      with:
+        fetch-depth: 1
+    - uses: actions/setup-go@f111f3307d8850f501ac008e886eec1fd1932a34  # v5.3.0
+      with:
+        go-version: 1.24.x
+    - name: Install gomodjail
+      run: |
+        set -eux -o pipefail
+        git clone https://github.com/AkihiroSuda/gomodjail
+        cd gomodjail
+        make binaries install
+    - name: Install Lima
+      # gomodjail depends on symbols
+      run: make KEEP_SYMBOLS=1 binaries install
+    - name: Cache image used by templates/default.yaml
+      uses: ./.github/actions/setup_cache_for_template
+      with:
+        template: templates/default.yaml
+    - name: Smoke test
+      run: gomodjail run --go-mod=./go.mod -- limactl start --tty=false