Merge pull request #4867 from AkihiroSuda/split-containerd-version

CI: Windows: downgrade containerd to v2.2

Author: ChengyuZhu6

.github/workflows/job-test-in-host.yml

@@ -15,6 +15,10 @@ on:
         required: false
         default: false
         type: boolean
+      no-hyperv:
+        required: false
+        default: false
+        type: boolean
       binary:
         required: false
         default: nerdctl
@@ -25,13 +29,19 @@ on:
       docker-version:
         required: true
         type: string
-      containerd-version:
+      windows-containerd-version:
+        required: true
+        type: string
+      windows-containerd-sha:
+        required: true
+        type: string
+      linux-containerd-version:
         required: true
         type: string
-      containerd-sha:
+      linux-containerd-sha:
         required: true
         type: string
-      containerd-service-sha:
+      linux-containerd-service-sha:
         required: true
         type: string
       windows-cni-version:
@@ -66,15 +76,22 @@ jobs:
       GO_VERSION: ${{ inputs.go-version }}
       # Both Docker and nerdctl on linux need rootful right now
       WITH_SUDO: ${{ contains(inputs.runner, 'ubuntu') }}
-      CONTAINERD_VERSION: ${{ inputs.containerd-version }}
-      CONTAINERD_SHA: ${{ inputs.containerd-sha }}
+      WINDOWS_CONTAINERD_VERSION: ${{ inputs.windows-containerd-version }}
+      WINDOWS_CONTAINERD_SHA: ${{ inputs.windows-containerd-sha }}
+      LINUX_CONTAINERD_VERSION: ${{ inputs.linux-containerd-version }}
+      LINUX_CONTAINERD_SHA: ${{ inputs.linux-containerd-sha }}
 
     steps:
       - name: "Init: checkout"
         uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd  # v6.0.2
         with:
           fetch-depth: 1
 
+      - if: ${{ inputs.no-hyperv }}
+        name: "Init (no-hyperv): Disable Hyper-V"
+        run: |
+          printf "NO_HYPERV=1\n" >> "$GITHUB_ENV"
+
       - if: ${{ inputs.canary }}
         name: "Init (canary): retrieve latest go and containerd"
         env:
@@ -85,11 +102,22 @@ jobs:
 
           [ "$latest_go" == "" ] || \
             printf "GO_VERSION=%s\n" "$latest_go" >> "$GITHUB_ENV"
-          [ "${latest_containerd:1}" == "$CONTAINERD_VERSION" ] || {
-            printf "CONTAINERD_VERSION=%s\n" "${latest_containerd:1}" >> "$GITHUB_ENV"
-            printf "CONTAINERD_SHA=canary is volatile and I accept the risk\n" >> "$GITHUB_ENV"
+
+          if [[ "${{ inputs.runner }}" == *windows* ]]; then
+            containerd_version="$WINDOWS_CONTAINERD_VERSION"
+          else
+            containerd_version="$LINUX_CONTAINERD_VERSION"
+          fi
+          [ "${latest_containerd:1}" == "$containerd_version" ] || {
+            if [[ "${{ inputs.runner }}" == *windows* ]]; then
+              printf "WINDOWS_CONTAINERD_VERSION=%s\n" "${latest_containerd:1}" >> "$GITHUB_ENV"
+              printf "WINDOWS_CONTAINERD_SHA=canary is volatile and I accept the risk\n" >> "$GITHUB_ENV"
+            else
+              printf "LINUX_CONTAINERD_VERSION=%s\n" "${latest_containerd:1}" >> "$GITHUB_ENV"
+              printf "LINUX_CONTAINERD_SHA=canary is volatile and I accept the risk\n" >> "$GITHUB_ENV"
+            fi
           }
-          if [ "$latest_go" == "" ] && [ "${latest_containerd:1}" == "$CONTAINERD_VERSION" ]; then
+          if [ "$latest_go" == "" ] && [ "${latest_containerd:1}" == "$containerd_version" ]; then
             echo "::warning title=No canary::There is currently no canary versions to test. Steps will not run.";
             printf "SHOULD_RUN=no\n" >> "$GITHUB_ENV"
           fi
@@ -128,7 +156,7 @@ jobs:
             # FIXME: this is missing runc (see top level workflow note about the state of this)
             echo "::group:: install dependencies"
             sudo ./hack/provisioning/linux/containerd.sh uninstall
-            ./hack/provisioning/linux/containerd.sh rootful "$CONTAINERD_VERSION" "amd64" "$CONTAINERD_SHA" "${{ inputs.containerd-service-sha }}"
+            ./hack/provisioning/linux/containerd.sh rootful "$LINUX_CONTAINERD_VERSION" "amd64" "$LINUX_CONTAINERD_SHA" "${{ inputs.linux-containerd-service-sha }}"
             sudo ./hack/provisioning/linux/cni.sh uninstall
             ./hack/provisioning/linux/cni.sh install "${{ inputs.linux-cni-version }}" "amd64" "${{ inputs.linux-cni-sha }}"
             echo "::endgroup::"
@@ -164,7 +192,8 @@ jobs:
       - if: ${{ contains(inputs.runner, 'windows') && env.SHOULD_RUN == 'yes' }}
         name: "Init (windows): prepare host"
         env:
-          ctrdVersion: ${{ env.CONTAINERD_VERSION }}
+          ctrdVersion: ${{ env.WINDOWS_CONTAINERD_VERSION }}
+          ctrdSha: ${{ env.WINDOWS_CONTAINERD_SHA }}
         run: |
           # Install WinCNI
           echo "::group:: install wincni"

.github/workflows/workflow-test.yml

@@ -143,14 +143,23 @@ jobs:
       runner: ${{ matrix.runner }}
       binary: ${{ matrix.binary != '' && matrix.binary || 'nerdctl' }}
       canary: ${{ matrix.canary && true || false }}
+      # Hyper-V is broken on canary.
+      # [v2.3.0-beta.2 regression] The virtual machine or container JSON document is invalid. (Hyper-V container)
+      # https://github.com/containerd/containerd/issues/13254
+      no-hyperv: ${{ matrix.canary && true || false }}
       go-version: 1.26
       windows-cni-version: v0.3.1
       docker-version: 5:28.0.4-1~ubuntu.24.04~noble
-      containerd-version: 2.3.0-beta.2
-      # FIXME: containerd-sha is not verified (only affects tests)
+      # Windows CI still requires containerd v2.2.
+      # [v2.3.0-beta.2 regression] The virtual machine or container JSON document is invalid. (Hyper-V container)
+      # https://github.com/containerd/containerd/issues/13254
+      windows-containerd-version: 2.2.3
+      windows-containerd-sha: 81314dd5e3baad958acae0e4d1ff21eb27b7c8f8809232ab06c9f397cd221e02
+      linux-containerd-version: 2.3.0-beta.2
+      # FIXME: containerd SHAs are not verified for authenticity (only affects tests)
       # https://github.com/containerd/nerdctl/issues/4666
-      # Note: these as for amd64
-      containerd-sha: sha256:feabdaf784298c5389972a93bf670b80abf7e674cd20a9d629fe133552046d0e
-      containerd-service-sha: 1941362cbaa89dd591b99c32b050d82c583d3cd2e5fa63085d7017457ec5fca8
+      # Note: these are for amd64
+      linux-containerd-sha: feabdaf784298c5389972a93bf670b80abf7e674cd20a9d629fe133552046d0e
+      linux-containerd-service-sha: 1941362cbaa89dd591b99c32b050d82c583d3cd2e5fa63085d7017457ec5fca8
       linux-cni-version: v1.9.1
       linux-cni-sha: b98f74a0f8522f0a83867178729c1aa70f2158f90c45a2ca8fa791db1c76b303

hack/provisioning/windows/containerd.ps1

@@ -2,8 +2,22 @@ $ErrorActionPreference = "Stop"
 
 #install containerd
 $version=$env:ctrdVersion
+$expectedSha=$env:ctrdSha
 echo "Installing containerd $version"
 curl.exe -L https://github.com/containerd/containerd/releases/download/v$version/containerd-$version-windows-amd64.tar.gz -o containerd-windows-amd64.tar.gz
+
+if ($expectedSha -eq "canary is volatile and I accept the risk") {
+    echo "Skipping SHA256 verification (canary)"
+} else {
+    $expected = $expectedSha.ToLower()
+    $actual = (Get-FileHash -Algorithm SHA256 containerd-windows-amd64.tar.gz).Hash.ToLower()
+    if ($actual -ne $expected) {
+        Write-Error "SHA256 mismatch for containerd-windows-amd64.tar.gz: expected $expected, got $actual"
+        exit 1
+    }
+    echo "SHA256 verified: $actual"
+}
+
 tar.exe xvf containerd-windows-amd64.tar.gz
 mkdir -force "$Env:ProgramFiles\containerd"
 cp ./bin/* "$Env:ProgramFiles\containerd"