[v2.4-dd] Merge v2.4.2 from upstream (#20)

* tests: replace fmt.Println with log for better logging

Replace all occurrences of fmt.Println with log.Println across multiple test files and the proxy main.go to
standardize logging output and improve log formatting.

Add log output for command execution functions in tool/util.go to enhance debugging and traceability
during test runs.

Configure log flags and output in tests/main_test.go to include timestamps and file info in logs.

Signed-off-by: Peng Tao <bergwolf@hyper.sh>

* ci: add Dependabot configuration for weekly updates

Add a new Dependabot configuration file to automate dependency updates for gomod,
cargo, and GitHub Actions workflows on a weekly schedule. This helps keep dependencies
up to date and improves project security and stability.

Signed-off-by: Peng Tao <bergwolf@hyper.sh>

* security: add ignore rule for RUSTSEC-2025-0141

│ bincode 1.3.3 registry+https://github.com/rust-lang/crates.io-index
│ ━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━ unmaintained advisory detected
│
├ ID: RUSTSEC-2025-0141
├ Advisory: https://rustsec.org/advisories/RUSTSEC-2025-0141
├ Due to a doxxing and harassment incident, the bincode team has taken the decision to cease development permanently.

  The team considers version 1.3.3 a complete version of bincode that is not in need of any updates.

Add a new ignore entry for the security advisory RUSTSEC-2025-0141 in deny.toml. This
advisory is ignored because no safe upgrade is available, and the team considers
version 1.3.3 of bincode stable and not requiring updates.

Signed-off-by: Peng Tao <bergwolf@hyper.sh>

* build(deps): bump golang.org/x/crypto in /contrib/nydusify

Bumps [golang.org/x/crypto](https://github.com/golang/crypto) from 0.37.0 to 0.45.0.
- [Commits](golang/crypto@v0.37.0...v0.45.0)

---
updated-dependencies:
- dependency-name: golang.org/x/crypto
  dependency-version: 0.45.0
  dependency-type: indirect
...

Signed-off-by: dependabot[bot] <support@github.com>

* build(deps): bump github.com/opencontainers/selinux in /contrib/nydusify

Bumps [github.com/opencontainers/selinux](https://github.com/opencontainers/selinux) from 1.12.0 to 1.13.0.
- [Release notes](https://github.com/opencontainers/selinux/releases)
- [Commits](opencontainers/selinux@v1.12.0...v1.13.0)

---
updated-dependencies:
- dependency-name: github.com/opencontainers/selinux
  dependency-version: 1.13.0
  dependency-type: indirect
...

Signed-off-by: dependabot[bot] <support@github.com>

* build(deps): bump actions/stale from 9.1.0 to 10.1.1

Bumps [actions/stale](https://github.com/actions/stale) from 9.1.0 to 10.1.1.
- [Release notes](https://github.com/actions/stale/releases)
- [Changelog](https://github.com/actions/stale/blob/main/CHANGELOG.md)
- [Commits](actions/stale@5bef64f...9971854)

---
updated-dependencies:
- dependency-name: actions/stale
  dependency-version: 10.1.1
  dependency-type: direct:production
  update-type: version-update:semver-major
...

Signed-off-by: dependabot[bot] <support@github.com>

* build(deps): bump actions/upload-artifact from 4 to 6

Bumps [actions/upload-artifact](https://github.com/actions/upload-artifact) from 4 to 6.
- [Release notes](https://github.com/actions/upload-artifact/releases)
- [Commits](actions/upload-artifact@v4...v6)

---
updated-dependencies:
- dependency-name: actions/upload-artifact
  dependency-version: '6'
  dependency-type: direct:production
  update-type: version-update:semver-major
...

Signed-off-by: dependabot[bot] <support@github.com>

* build(deps): bump actions/download-artifact from 4 to 7

Bumps [actions/download-artifact](https://github.com/actions/download-artifact) from 4 to 7.
- [Release notes](https://github.com/actions/download-artifact/releases)
- [Commits](actions/download-artifact@v4...v7)

---
updated-dependencies:
- dependency-name: actions/download-artifact
  dependency-version: '7'
  dependency-type: direct:production
  update-type: version-update:semver-major
...

Signed-off-by: dependabot[bot] <support@github.com>

* build(deps): bump goreleaser/goreleaser-action from 6.2.1 to 6.4.0

Bumps [goreleaser/goreleaser-action](https://github.com/goreleaser/goreleaser-action) from 6.2.1 to 6.4.0.
- [Release notes](https://github.com/goreleaser/goreleaser-action/releases)
- [Commits](goreleaser/goreleaser-action@90a3faa...e435ccd)

---
updated-dependencies:
- dependency-name: goreleaser/goreleaser-action
  dependency-version: 6.4.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <support@github.com>

* build(deps): bump golangci/golangci-lint-action from 6 to 9

Bumps [golangci/golangci-lint-action](https://github.com/golangci/golangci-lint-action) from 6 to 9.
- [Release notes](https://github.com/golangci/golangci-lint-action/releases)
- [Commits](golangci/golangci-lint-action@v6...v9)

---
updated-dependencies:
- dependency-name: golangci/golangci-lint-action
  dependency-version: '9'
  dependency-type: direct:production
  update-type: version-update:semver-major
...

Signed-off-by: dependabot[bot] <support@github.com>

* build(deps): bump github.com/containerd/containerd in /contrib/nydusify

Bumps [github.com/containerd/containerd](https://github.com/containerd/containerd) from 1.7.27 to 1.7.29.
- [Release notes](https://github.com/containerd/containerd/releases)
- [Changelog](https://github.com/containerd/containerd/blob/main/RELEASES.md)
- [Commits](containerd/containerd@v1.7.27...v1.7.29)

---
updated-dependencies:
- dependency-name: github.com/containerd/containerd
  dependency-version: 1.7.29
  dependency-type: direct:production
...

Signed-off-by: dependabot[bot] <support@github.com>

* build(deps): bump crc from 3.2.1 to 3.4.0

Bumps [crc](https://github.com/mrhooray/crc-rs) from 3.2.1 to 3.4.0.
- [Commits](mrhooray/crc-rs@3.2.1...3.4.0)

---
updated-dependencies:
- dependency-name: crc
  dependency-version: 3.4.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <support@github.com>

* build(deps): bump procfs from 0.17.0 to 0.18.0

Bumps [procfs](https://github.com/eminence/procfs) from 0.17.0 to 0.18.0.
- [Release notes](https://github.com/eminence/procfs/releases)
- [Commits](eminence/procfs@v0.17.0...v0.18.0)

---
updated-dependencies:
- dependency-name: procfs
  dependency-version: 0.18.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <support@github.com>

* build(deps): bump google.golang.org/protobuf in /smoke

Bumps google.golang.org/protobuf from 1.32.0 to 1.33.0.

---
updated-dependencies:
- dependency-name: google.golang.org/protobuf
  dependency-version: 1.33.0
  dependency-type: indirect
...

Signed-off-by: dependabot[bot] <support@github.com>

* build(deps): bump github.com/containerd/containerd/v2 in /smoke

Bumps [github.com/containerd/containerd/v2](https://github.com/containerd/containerd) from 2.1.2 to 2.1.5.
- [Release notes](https://github.com/containerd/containerd/releases)
- [Changelog](https://github.com/containerd/containerd/blob/main/RELEASES.md)
- [Commits](containerd/containerd@v2.1.2...v2.1.5)

---
updated-dependencies:
- dependency-name: github.com/containerd/containerd/v2
  dependency-version: 2.1.5
  dependency-type: indirect
...

Signed-off-by: dependabot[bot] <support@github.com>

* build(deps): bump github.com/opencontainers/selinux in /smoke

Bumps [github.com/opencontainers/selinux](https://github.com/opencontainers/selinux) from 1.12.0 to 1.13.0.
- [Release notes](https://github.com/opencontainers/selinux/releases)
- [Commits](opencontainers/selinux@v1.12.0...v1.13.0)

---
updated-dependencies:
- dependency-name: github.com/opencontainers/selinux
  dependency-version: 1.13.0
  dependency-type: indirect
...

Signed-off-by: dependabot[bot] <support@github.com>

* build(deps): bump golang.org/x/crypto from 0.37.0 to 0.45.0 in /smoke

Bumps [golang.org/x/crypto](https://github.com/golang/crypto) from 0.37.0 to 0.45.0.
- [Commits](golang/crypto@v0.37.0...v0.45.0)

---
updated-dependencies:
- dependency-name: golang.org/x/crypto
  dependency-version: 0.45.0
  dependency-type: indirect
...

Signed-off-by: dependabot[bot] <support@github.com>

* Upgrade golangci-lint to v2.1 for golangci-lint-action@v9 compatibility

Signed-off-by: imeoer <yansong.ys@antgroup.com>

* build(deps): bump codecov/codecov-action from 4 to 5

Signed-off-by: Zephyrcf <zinsist777@gmail.com>

* build(deps): bump actions/checkout from 4 to 6

Bumps [actions/checkout](https://github.com/actions/checkout) from 4 to 6.
- [Release notes](https://github.com/actions/checkout/releases)
- [Commits](actions/checkout@v4...v6)

---
updated-dependencies:
- dependency-name: actions/checkout
  dependency-version: '6'
  dependency-type: direct:production
  update-type: version-update:semver-major
...

Signed-off-by: dependabot[bot] <support@github.com>

* docs: update version 3 containerd config format for snapshotter

Signed-off-by: Yang Kaiyong <yangkaiyong.yky@antgroup.com>

* smoke: optimize PrepareImage to reuse existing local image

Modify PrepareImage to first attempt pulling the image from the local registry.
If the image exists locally, return early to avoid redundant pulls and pushes.

This reduces unnecessary network operations and speeds up test setup when the image
is already available in the local registry.

Signed-off-by: Peng Tao <bergwolf@hyper.sh>

* smoke: fix unmount command to use lazy unmount

Update the Umount method to use "umount -l" for lazy unmounting, preventing errors if the mount
point is busy or in use during tests. This improves test reliability and cleanup.

Signed-off-by: Peng Tao <bergwolf@hyper.sh>

* Fix clippy errors in api, upgrade, storage, rafs, and service crates for Rust 1.93.0

Co-authored-by: imeoer <1524576+imeoer@users.noreply.github.com>

* Fix remaining clippy errors in builder, service, and binary crates for Rust 1.93.0

Co-authored-by: imeoer <1524576+imeoer@users.noreply.github.com>

* Fix cargo fmt formatting issues

Co-authored-by: imeoer <1524576+imeoer@users.noreply.github.com>

* Revert is_multiple_of() to use modulo operator for Rust 1.84.0 compatibility

Co-authored-by: imeoer <1524576+imeoer@users.noreply.github.com>

* security: remove ignore for RUSTSEC-2024-0436 advisory

RUSTSEC-2024-0436 refers to crate paste that is no longer a dependency of
nydus.

Signed-off-by: Peng Tao <bergwolf@hyper.sh>

* deps: update bytes crate to version 1.11.1 to fix RUSTSEC-2026-0007

Upgrade the bytes dependency from version 1.9.0 to 1.11.1 to address the security
advisory RUSTSEC-2024-0436. This update includes important fixes and improvements
to ensure safer and more reliable handling of byte buffers.

Advisory: https://rustsec.org/advisories/RUSTSEC-2026-0007

Signed-off-by: Peng Tao <bergwolf@hyper.sh>

* ci: enable coverage instrumentation and reporting

Add support for code coverage collection and reporting in the CI workflow by enabling
debug mode and coverage flags during test and smoke runs. Update GitHub Actions to run
tests with coverage instrumentation and upload coverage artifacts from the coverage
directory.

Makefile and smoke/Makefile are updated to pass coverage-related environment variables
and flags to cargo and test binaries. Add new targets to generate coverage reports using
grcov and configure Rust profiles for debug builds with coverage instrumentation.

Signed-off-by: Peng Tao <bergwolf@hyper.sh>

* ci: remove incorrect 'files' parameter from codecov upload step

The action searches for codecov files automatically.

Signed-off-by: Peng Tao <bergwolf@hyper.sh>

* ci: drop nydus-unit-test-coverage

There is no need to run the nydus unit tests twice, once in
nydus-unit-test-coverage, the other in nydus-unit-test.

Signed-off-by: Peng Tao <bergwolf@hyper.sh>

* ci: generate coverage for both UT and smoke tests

Introduce a new nydus-build-debug job to build debug binaries with coverage enabled,
upload profraw files for build, smoke, unit test, and takeover stages.

Add a nydus-coverage job to aggregate coverage data from various test jobs,
generate combined codecov report, and upload coverage artifacts.

Update existing jobs to enable debug mode and upload corresponding coverage files,
improving code coverage tracking and analysis in CI workflows.

Signed-off-by: Peng Tao <bergwolf@hyper.sh>

* ci: update coverage upload to use coverage.info files

Replace profraw artifact uploads with coverage.info files generated by make generate-codecov
in smoke, unit test, and takeover jobs for more accurate coverage reporting.

Simplify artifact download steps in nydus-coverage job to match new coverage info files and ensure
correct coverage data is uploaded to Codecov.

Signed-off-by: Peng Tao <bergwolf@hyper.sh>

* fix soundness issue of `nydus_storage::utils::alloc_buf`

Signed-off-by: lihuan <lihuan0530@gmail.com>

* nydusd: upgrade rust-vmm dependencies to latest versions

Update all rust-vmm crate dependencies to their latest versions:
- vhost: 0.11.0 -> 0.15.0
- vhost-user-backend: 0.15.0 -> 0.21.0
- virtio-bindings: 0.1 -> 0.2.7
- virtio-queue: 0.12.0 -> 0.17.0
- vm-memory: 0.14.1 -> 0.17.1
- vmm-sys-util: 0.12.1 -> 0.15.0
- fuse-backend-rs: 0.13.1 -> 0.14.0

virtiofs DAX is dropped as part of upgrading fuse-backend-rs, since the feature never made it to the spec.

Remove virtio-v5_0_0 feature flag from virtio-bindings dependency as it's no longer needed.

Update virtiofs.rs to use the new event API (EventConsumer/EventNotifier) instead of the deprecated EventFd,
and adapt to API changes in vhost-user-backend including the start() method now taking a mutable listener reference.

Signed-off-by: Peng Tao <bergwolf@hyper.sh>

* ci: switch smoke tests to release builds

The llvm profraw tracing files constantly caused ENOSPC error on github
smoke action. Let's switch back to release build to run smoke tests.

Signed-off-by: Peng Tao <bergwolf@hyper.sh>

* docs(maintainers) add Fricounet to maintainer list

Ref: dragonflyoss/community#142

Signed-off-by: imeoer <yansong.ys@antgroup.com>

* chore: bump crate versions

Bump minor versions for workspace crates:
- nydus-api: 0.4.0 -> 0.4.1
- nydus-storage: 0.7.1 -> 0.7.2
- nydus-utils: 0.5.0 -> 0.5.1
- nydus-rafs: 0.4.0 -> 0.4.1

Update all dependent crates across the workspace.

Signed-off-by: Yang Kaiyong <yangkaiyong.yky@antgroup.com>

* fix: ignore RUSTSEC-2026-0009 for time crate in cargo deny check

Co-authored-by: imeoer <1524576+imeoer@users.noreply.github.com>

* tests: improve unit test coverage across multiple modules

Add comprehensive unit tests to improve code coverage across builder, rafs, logger, storage and other core modules. The new tests cover edge cases, error conditions, and previously untested functionality.

Key improvements include:
- Enhanced test coverage for Attributes parsing with various edge cases (relative paths, hex formats, whitespace handling)
- Expanded HashChunkDict tests covering chunk management, blob indexing, and argument parsing
- Comprehensive V5IoChunk tests for flag combinations, CRC32 handling, and type conversions
- Logger tests for formatting functions, file name extraction, and verbosity level mapping
- Additional tests for storage backend, cache deduplication, device operations, and metadata handling

Signed-off-by: Peng Tao <bergwolf@hyper.sh>

* api: support hot reload of registry authentication

Add HTTP API endpoints to update and query daemon configuration at
runtime without restarting nydusd. This is particularly useful for
refreshing registry credentials when tokens expire.

Key changes:
- Add GET/PUT /api/v1/config endpoints for configuration management
- Add config module in utils for centralized configuration updates
- Add smoke test cases for hot reload configuration API
- Update documentation with hot reload usage examples

Signed-off-by: imeoer <yansong.ys@antgroup.com>

* fix soundness issue of `nydus_utils::FileMapState::get_slice(_mut)`

Signed-off-by: lihuan <lihuan0530@gmail.com>

* docs: deprecate local approvers and maintainers files

- remove local lists for approvers and maintainers
- add migration notices pointing to community repository
- include links to updated lists in community repo

Signed-off-by: mingcheng <mingcheng@apache.org>

* ci(ut): add ut for test coverage

Signed-off-by: imeoer <yansong.ys@antgroup.com>

* ci: add ut tests for coverage

1. add unit tests with a coverage rate of 70%;
2. setup codecov gate: overall coverage >= 70%,
    and changed lines coverage >= 90%;

Signed-off-by: imeoer <yansong.ys@antgroup.com>

* chore: update CODEOWNERS to use nydus-approvers team

Signed-off-by: Gaius <gaius.qi@gmail.com>

* build(deps): bump containerd/nydus-snapshotter from 0.15.9 to 0.15.12 in contrib/nydusify

Signed-off-by: Yang Kaiyong <yangkaiyong.yky@antgroup.com>

* ci: align cargo-deny with pinned rust toolchain

Signed-off-by: 106umao <106umao@users.noreply.github.com>

* ci: upgrade setup-go to v6

Signed-off-by: 106umao <106umao@users.noreply.github.com>

* fix(deps): bump tar to fix cargo-deny security vulnerability

Signed-off-by: Zephyr <zinsist777@gmail.com>

* ci: Only run if ubuntu-latest-16-cores will be available

Signed-off-by: Josh Soref <2119212+jsoref@users.noreply.github.com>

* ci: Only publish codecov if credentials are avail

Signed-off-by: Josh Soref <2119212+jsoref@users.noreply.github.com>

* [registry] Move config auth refresh to background thread

The per-request refresh_cached_auth_from_config call can cause
a thundering herd on the auth server when config changes while
multiple requests are in flight as each concurrent request
independently calls get_token(). Additionally, performing the
refresh in the hot request path adds latency to the first
request after a config update.

Move the check to the existing refresh token thread, polling
every 5 seconds. This keeps a single thread responsible for
auth updates while still picking up config changes promptly.

Signed-off-by: Baptiste Girard-Carrabin <baptiste.girardcarrabin@datadoghq.com>

* [registry] Remove disable_token_refresh feature

This was introduced in dragonflyoss#1784 to silence noisy 401/403 errors from
the refresh thread using expired tokens when prefetch was enabled.
With the config auth refresh now handled properly, the thread no
longer produces spurious errors on credential changes, so the
workaround is no longer needed.

Always starting the refresh thread also ensures that config auth
updates via the API are picked up promptly regardless of whether
prefetch is enabled.

Signed-off-by: Baptiste Girard-Carrabin <baptiste.girardcarrabin@datadoghq.com>

* nydusify commit: fix mount option parsing in manager.go (#19)

The Inspect() function parsed snapshot mount options by hardcoded array
index, assuming Options[0]=workdir, Options[1]=upperdir,
Options[2]=lowerdir. The nydus snapshotter can return a "volatile" flag
at index 0, shifting all other options by one position. This produced
malformed overlay mount data ("lowerdir=upperdir=/path:...") causing
"no such file or directory" errors.

Replace hardcoded indices with prefix-based iteration, matching the
pattern already used in overlay_linux.go:GetOverlayLayers. Extract
parseMountOptions() helper with unit tests covering volatile prefix,
different orderings, and error cases.

Signed-off-by: Eric Mountain <eric.mountain@datadoghq.com>

* chore: sync go.mod after rebase

Signed-off-by: Eric Mountain <eric.mountain@datadoghq.com>

* test: cover Inspect parseMountOptions paths for codecov gate

Add TestInspectParseMountOptionsPaths covering the two branches in
Inspect that were missing: parseMountOptions returning an error, and
the full success path returning LowerDirs/UpperDir.

Signed-off-by: Eric Mountain <eric.mountain@datadoghq.com>

* [Registry] Disable HTTPS-to-HTTP fallback unless skip_verify is set

When skip_verify is false (the default), TLS errors now propagate
as-is instead of silently falling back to plaintext HTTP. This
prevents unintended exposure of image pull traffic in production
environments. The fallback is still available when skip_verify is
true, aligning with nerdctl's --insecure-registry semantics.

Fixes: dragonflyoss#1910
Signed-off-by: Baptiste Girard-Carrabin <baptiste.girardcarrabin@datadoghq.com>

* chore: bump acceleration-service to v0.2.26

Signed-off-by: chengyue <yue.cheng.ted@gmail.com>

* [doc] Document skip_verify controls HTTP fallback

Update docs, config examples, and the RegistryConfig doc comment
to note that skip_verify also gates HTTPS-to-HTTP fallback on TLS
errors.

Signed-off-by: Baptiste Girard-Carrabin <baptiste.girardcarrabin@datadoghq.com>

* Revert "[registry] Add skip_http_fallback config option (#18)"

This reverts commit 3d01b05.

---------

Signed-off-by: Peng Tao <bergwolf@hyper.sh>
Signed-off-by: dependabot[bot] <support@github.com>
Signed-off-by: imeoer <yansong.ys@antgroup.com>
Signed-off-by: Zephyrcf <zinsist777@gmail.com>
Signed-off-by: Yang Kaiyong <yangkaiyong.yky@antgroup.com>
Signed-off-by: lihuan <lihuan0530@gmail.com>
Signed-off-by: mingcheng <mingcheng@apache.org>
Signed-off-by: Gaius <gaius.qi@gmail.com>
Signed-off-by: 106umao <106umao@users.noreply.github.com>
Signed-off-by: Zephyr <zinsist777@gmail.com>
Signed-off-by: Josh Soref <2119212+jsoref@users.noreply.github.com>
Signed-off-by: Baptiste Girard-Carrabin <baptiste.girardcarrabin@datadoghq.com>
Signed-off-by: Eric Mountain <eric.mountain@datadoghq.com>
Signed-off-by: chengyue <yue.cheng.ted@gmail.com>
Co-authored-by: Peng Tao <bergwolf@hyper.sh>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Co-authored-by: imeoer <yansong.ys@antgroup.com>
Co-authored-by: Zephyrcf <zinsist777@gmail.com>
Co-authored-by: Yang Kaiyong <yangkaiyong.yky@antgroup.com>
Co-authored-by: copilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com>
Co-authored-by: imeoer <1524576+imeoer@users.noreply.github.com>
Co-authored-by: lihuan <lihuan0530@gmail.com>
Co-authored-by: mingcheng <mingcheng@apache.org>
Co-authored-by: Gaius <gaius.qi@gmail.com>
Co-authored-by: 106umao <106umao@users.noreply.github.com>
Co-authored-by: Josh Soref <2119212+jsoref@users.noreply.github.com>
Co-authored-by: Eric Mountain <eric.mountain@datadoghq.com>
Co-authored-by: chengyue <yue.cheng.ted@gmail.com>

Author: 14 people

.github/CODEOWNERS

@@ -3,5 +3,5 @@
 # standard @username or @org/team-name format. You can also refer to a user by an
 # email address that has been added to their GitHub account, for example user@example.com
 
-*                                          @dragonflyoss/nydus-reviewers
+*                                          @dragonflyoss/nydus-approvers
 .github                                    @dragonflyoss/nydus-maintainers

.github/codecov.yml

@@ -3,11 +3,13 @@ coverage:
     project:
       default:
         enabled: yes
-        target: auto  # auto compares coverage to the previous base commit
-        # adjust accordingly based on how flaky your tests are
-        # this allows a 0.2% drop from the previous base commit coverage
-        threshold: 0.2%
-    patch: false
+        target: 70%
+        threshold: 0%
+    patch:
+      default:
+        enabled: yes
+        target: 90%
+        threshold: 0%
 
 comment:
   layout: "reach, diff, flags, files"
@@ -20,4 +22,4 @@ codecov:
     wait_for_ci: true
 
 # When modifying this file, please validate using
-# curl -X POST --data-binary @codecov.yml https://codecov.io/validate
+# curl -X POST --data-binary @codecov.yml https://codecov.io/validate

.github/dependabot.yml

@@ -0,0 +1,18 @@
+version: 2
+updates:
+  - package-ecosystem: "gomod"
+    directory: "/contrib/"
+    schedule:
+      interval: "weekly"
+
+  - package-ecosystem: "cargo"
+    directory: "/"
+    schedule:
+      interval: "weekly"
+
+  - package-ecosystem: "github-actions"
+    # Workflow files stored in the default location of `.github/workflows`
+    # You don't need to specify `/.github/workflows` for `directory`. You can use `directory: "/"`.
+    directory: "/"
+    schedule:
+      interval: "weekly"

.github/workflows/benchmark.yml

@@ -13,30 +13,45 @@ env:
   CARGO_TERM_COLOR: always
 
 jobs:
+  has:
+    runs-on: ubuntu-slim
+    outputs:
+      latest-16: ${{ env.HAS_LATEST_16 }}
+    env:
+      HAS_LATEST_16: ${{ (github.repository_owner == 'dragonflyoss' || vars.HAS_LATEST_16) && '1' || '' }}
+    steps:
+      - run: |
+          true
   contrib-build:
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-latest-16-cores
+    needs:
+      - has
+    if: needs.has.outputs.latest-16
     steps:
     - name: Checkout
-      uses: actions/checkout@v4
+      uses: actions/checkout@v6
     - name: Setup Golang
-      uses: actions/setup-go@v5
+      uses: actions/setup-go@v6
       with:
         go-version-file: 'go.work'
         cache-dependency-path: "**/*.sum"
     - name: Build Contrib
       run: |
         make -e DOCKER=false nydusify-release
     - name: Upload Nydusify
-      uses: actions/upload-artifact@v4
+      uses: actions/upload-artifact@v6
       with:
         name: nydusify-artifact
         path: contrib/nydusify/cmd/nydusify
 
   nydus-build:
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-latest-16-cores
+    needs:
+      - has
+    if: needs.has.outputs.latest-16
     steps:
     - name: Checkout
-      uses: actions/checkout@v4
+      uses: actions/checkout@v6
     - name: Rust Cache
       uses: Swatinem/rust-cache@v2
       with:
@@ -47,15 +62,18 @@ jobs:
       run: |
         make release
     - name: Upload Nydus Binaries
-      uses: actions/upload-artifact@v4
+      uses: actions/upload-artifact@v6
       with:
         name: nydus-artifact
         path: |
           target/release/nydus-image
           target/release/nydusd
 
   benchmark-description:
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-latest-16-cores
+    needs:
+      - has
+    if: needs.has.outputs.latest-16
     steps:
     - name: Description
       run: |
@@ -65,8 +83,12 @@ jobs:
         echo "| ubuntu-22.04 | 2-core CPU (x86_64) | 7GB |" >> $GITHUB_STEP_SUMMARY
 
   benchmark-oci:
-    runs-on: ubuntu-latest
-    needs: [contrib-build, nydus-build]
+    runs-on: ubuntu-latest-16-cores
+    if: needs.has.outputs.latest-16
+    needs:
+      - has
+      - contrib-build
+      - nydus-build
     strategy:
       matrix:
         include:
@@ -84,14 +106,14 @@ jobs:
             tag: 8-al2022-jdk
     steps:
     - name: Checkout
-      uses: actions/checkout@v4
+      uses: actions/checkout@v6
     - name: Download Nydus
-      uses: actions/download-artifact@v4
+      uses: actions/download-artifact@v7
       with:
         name: nydus-artifact
         path: target/release
     - name: Download Nydusify
-      uses: actions/download-artifact@v4
+      uses: actions/download-artifact@v7
       with:
         name: nydusify-artifact
         path: contrib/nydusify/cmd
@@ -106,14 +128,18 @@ jobs:
         export SNAPSHOTTER=overlayfs
         sudo -E make smoke-benchmark
     - name: Save BenchMark Result
-      uses: actions/upload-artifact@v4
+      uses: actions/upload-artifact@v6
       with:
         name: benchmark-oci-${{ matrix.image }}
         path: smoke/${{ matrix.image }}-oci.json
 
   benchmark-fsversion-v5:
-    runs-on: ubuntu-latest
-    needs: [contrib-build, nydus-build]
+    runs-on: ubuntu-latest-16-cores
+    needs:
+      - has
+      - contrib-build
+      - nydus-build
+    if: needs.has.outputs.latest-16
     strategy:
       matrix:
         include:
@@ -131,14 +157,14 @@ jobs:
             tag: 8-al2022-jdk
     steps:
     - name: Checkout
-      uses: actions/checkout@v4
+      uses: actions/checkout@v6
     - name: Download Nydus
-      uses: actions/download-artifact@v4
+      uses: actions/download-artifact@v7
       with:
         name: nydus-artifact
         path: target/release
     - name: Download Nydusify
-      uses: actions/download-artifact@v4
+      uses: actions/download-artifact@v7
       with:
         name: nydusify-artifact
         path: contrib/nydusify/cmd
@@ -152,14 +178,18 @@ jobs:
         export BENCHMARK_METRIC_FILE=${{ matrix.image }}-fsversion-v5.json
         sudo -E make smoke-benchmark
     - name: Save BenchMark Result
-      uses: actions/upload-artifact@v4
+      uses: actions/upload-artifact@v6
       with:
         name: benchmark-fsversion-v5-${{ matrix.image }}
         path: smoke/${{ matrix.image }}-fsversion-v5.json
 
   benchmark-fsversion-v6:
-    runs-on: ubuntu-latest
-    needs: [contrib-build, nydus-build]
+    runs-on: ubuntu-latest-16-cores
+    needs:
+      - has
+      - contrib-build
+      - nydus-build
+    if: needs.has.outputs.latest-16
     strategy:
       matrix:
         include:
@@ -177,14 +207,14 @@ jobs:
             tag: 8-al2022-jdk
     steps:
     - name: Checkout
-      uses: actions/checkout@v4
+      uses: actions/checkout@v6
     - name: Download Nydus
-      uses: actions/download-artifact@v4
+      uses: actions/download-artifact@v7
       with:
         name: nydus-artifact
         path: target/release
     - name: Download Nydusify
-      uses: actions/download-artifact@v4
+      uses: actions/download-artifact@v7
       with:
         name: nydusify-artifact
         path: contrib/nydusify/cmd
@@ -198,14 +228,18 @@ jobs:
         export BENCHMARK_METRIC_FILE=${{ matrix.image }}-fsversion-v6.json
         sudo -E make smoke-benchmark
     - name: Save BenchMark Result
-      uses: actions/upload-artifact@v4
+      uses: actions/upload-artifact@v6
       with:
         name: benchmark-fsversion-v6-${{ matrix.image }}
         path: smoke/${{ matrix.image }}-fsversion-v6.json
 
   benchmark-zran:
-    runs-on: ubuntu-latest
-    needs: [contrib-build, nydus-build]
+    runs-on: ubuntu-latest-16-cores
+    needs:
+      - has
+      - contrib-build
+      - nydus-build
+    if: needs.has.outputs.latest-16
     strategy:
       matrix:
         include:
@@ -223,14 +257,14 @@ jobs:
             tag: 8-al2022-jdk
     steps:
     - name: Checkout
-      uses: actions/checkout@v4
+      uses: actions/checkout@v6
     - name: Download Nydus
-      uses: actions/download-artifact@v4
+      uses: actions/download-artifact@v7
       with:
         name: nydus-artifact
         path: target/release
     - name: Download Nydusify
-      uses: actions/download-artifact@v4
+      uses: actions/download-artifact@v7
       with:
         name: nydusify-artifact
         path: contrib/nydusify/cmd
@@ -244,14 +278,20 @@ jobs:
         export BENCHMARK_METRIC_FILE=${{ matrix.image }}-zran.json
         sudo -E make smoke-benchmark
     - name: Save BenchMark Result
-      uses: actions/upload-artifact@v4
+      uses: actions/upload-artifact@v6
       with:
         name: benchmark-zran-${{ matrix.image }}
         path: smoke/${{ matrix.image }}-zran.json
 
   benchmark-result:
-    runs-on: ubuntu-latest
-    needs: [benchmark-oci, benchmark-fsversion-v5, benchmark-fsversion-v6, benchmark-zran]
+    runs-on: ubuntu-latest-16-cores
+    needs:
+      - has
+      - benchmark-oci
+      - benchmark-fsversion-v5
+      - benchmark-fsversion-v6
+      - benchmark-zran
+    if: needs.has.outputs.latest-16
     strategy:
       matrix:
         include:
@@ -269,24 +309,24 @@ jobs:
             tag: 8-al2022-jdk
     steps:
     - name: Checkout
-      uses: actions/checkout@v4
+      uses: actions/checkout@v6
     - name: Download benchmark-oci
-      uses: actions/download-artifact@v4
+      uses: actions/download-artifact@v7
       with:
         name: benchmark-oci-${{ matrix.image }}
         path: benchmark-result
     - name: Download benchmark-fsversion-v5
-      uses: actions/download-artifact@v4
+      uses: actions/download-artifact@v7
       with:
         name: benchmark-fsversion-v5-${{ matrix.image }}
         path: benchmark-result
     - name: Download benchmark-fsversion-v6
-      uses: actions/download-artifact@v4
+      uses: actions/download-artifact@v7
       with:
         name: benchmark-fsversion-v6-${{ matrix.image }}
         path: benchmark-result
     - name: Download benchmark-zran
-      uses: actions/download-artifact@v4
+      uses: actions/download-artifact@v7
       with:
         name: benchmark-zran-${{ matrix.image }}
         path: benchmark-result