From 88f75d26d36fde11310ee46db7818a7d03f05c07 Mon Sep 17 00:00:00 2001 From: Samuel K Date: Thu, 7 May 2026 10:01:10 -0500 Subject: [PATCH 01/12] fix(ci): install kind directly on Windows to avoid docker-desktop dep Chocolatey's `kind` package pulls `docker-desktop` as a dependency, which hangs on Windows CI runners. Since we use podman as the kind provider, docker-desktop is not needed. Download the kind binary directly from GitHub releases instead. --- .github/workflows/pr-ci.yml | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/.github/workflows/pr-ci.yml b/.github/workflows/pr-ci.yml index 503ffb41b..83768daa2 100644 --- a/.github/workflows/pr-ci.yml +++ b/.github/workflows/pr-ci.yml @@ -402,7 +402,8 @@ jobs: DOCKER_HOST: npipe:////./pipe/podman-machine-default run: | wsl --set-default-version 2 - choco install podman-cli kind -y + choco install podman-cli -y + curl -Lo /c/ProgramData/chocolatey/bin/kind.exe https://kind.sigs.k8s.io/dl/v0.24.0/kind-windows-amd64 podman machine init podman machine set --rootful From 2f0dd0b33d6f94207522293260c354549b4084d3 Mon Sep 17 00:00:00 2001 From: Samuel K Date: Thu, 7 May 2026 10:25:42 -0500 Subject: [PATCH 02/12] fix(ci): install podman via direct MSI download instead of Chocolatey Replace `choco install podman-cli` with a direct download of the podman MSI installer from GitHub releases. This eliminates all Chocolatey dependencies from the Windows CI steps, matching the direct-download approach already used for kind. --- .github/workflows/pr-ci.yml | 11 +++++++++-- 1 file changed, 9 insertions(+), 2 deletions(-) diff --git a/.github/workflows/pr-ci.yml b/.github/workflows/pr-ci.yml index 83768daa2..98e9b6f1c 100644 --- a/.github/workflows/pr-ci.yml +++ b/.github/workflows/pr-ci.yml @@ -402,8 +402,15 @@ jobs: DOCKER_HOST: npipe:////./pipe/podman-machine-default run: | wsl --set-default-version 2 - choco install podman-cli -y - curl -Lo /c/ProgramData/chocolatey/bin/kind.exe https://kind.sigs.k8s.io/dl/v0.24.0/kind-windows-amd64 + + # Install podman via MSI (includes gvproxy needed for podman machine) + curl -Lo "$RUNNER_TEMP/podman.msi" "https://github.com/containers/podman/releases/download/v5.8.2/podman-installer-windows-amd64.msi" + powershell.exe -Command "Start-Process msiexec.exe -Wait -ArgumentList '/i','$(cygpath -w "$RUNNER_TEMP/podman.msi")','/qn','/norestart'" + export PATH="/c/Program Files/RedHat/Podman:$PATH" + echo 'C:\Program Files\RedHat\Podman' >> "$GITHUB_PATH" + + # Install kind directly + curl -Lo "/c/Program Files/RedHat/Podman/kind.exe" "https://kind.sigs.k8s.io/dl/v0.24.0/kind-windows-amd64" podman machine init podman machine set --rootful From 489821d7e934c21c3e4713646016c2df9a3c6d79 Mon Sep 17 00:00:00 2001 From: Samuel K Date: Thu, 7 May 2026 11:15:51 -0500 Subject: [PATCH 03/12] fix(ci): download kind.exe to temp dir and use direct GitHub releases URL The kind download was failing because: 1. curl tried to write directly to C:\Program Files\RedHat\Podman\kind.exe before the MSI had created that directory 2. The kind.sigs.k8s.io redirect URL returned a 99-byte HTML page instead of following through to the binary Fix by downloading to RUNNER_TEMP first (always exists) then moving, and using the direct GitHub releases URL which doesn't have redirect issues. --- .github/workflows/pr-ci.yml | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-) diff --git a/.github/workflows/pr-ci.yml b/.github/workflows/pr-ci.yml index 98e9b6f1c..701ba0325 100644 --- a/.github/workflows/pr-ci.yml +++ b/.github/workflows/pr-ci.yml @@ -409,8 +409,9 @@ jobs: export PATH="/c/Program Files/RedHat/Podman:$PATH" echo 'C:\Program Files\RedHat\Podman' >> "$GITHUB_PATH" - # Install kind directly - curl -Lo "/c/Program Files/RedHat/Podman/kind.exe" "https://kind.sigs.k8s.io/dl/v0.24.0/kind-windows-amd64" + # Install kind directly (download to RUNNER_TEMP first, then move) + curl -Lo "$RUNNER_TEMP/kind.exe" "https://github.com/kubernetes-sigs/kind/releases/download/v0.24.0/kind-windows-amd64" + mv "$RUNNER_TEMP/kind.exe" "/c/Program Files/RedHat/Podman/kind.exe" podman machine init podman machine set --rootful From aac5b7124c8ce5e4a12bde21d3aeb946f31df0c3 Mon Sep 17 00:00:00 2001 From: Samuel K Date: Thu, 7 May 2026 12:16:27 -0500 Subject: [PATCH 04/12] fix(ci): place kind.exe in RUNNER_TEMP and generate UUID inline on Windows The podman MSI may not create the install directory synchronously before the next shell command runs, causing `mv kind.exe` to fail with "No such file or directory". Place kind.exe in RUNNER_TEMP instead and add it to PATH independently. Also generate the cluster UUID inline since the uuid step is skipped on Windows runners. --- .github/workflows/pr-ci.yml | 17 ++++++++++++++--- 1 file changed, 14 insertions(+), 3 deletions(-) diff --git a/.github/workflows/pr-ci.yml b/.github/workflows/pr-ci.yml index 701ba0325..4c24e55e9 100644 --- a/.github/workflows/pr-ci.yml +++ b/.github/workflows/pr-ci.yml @@ -406,18 +406,29 @@ jobs: # Install podman via MSI (includes gvproxy needed for podman machine) curl -Lo "$RUNNER_TEMP/podman.msi" "https://github.com/containers/podman/releases/download/v5.8.2/podman-installer-windows-amd64.msi" powershell.exe -Command "Start-Process msiexec.exe -Wait -ArgumentList '/i','$(cygpath -w "$RUNNER_TEMP/podman.msi")','/qn','/norestart'" + + # Verify podman installed to expected location + if [ -d "/c/Program Files/RedHat/Podman" ]; then + echo "Podman installed to /c/Program Files/RedHat/Podman" + else + echo "WARNING: Expected podman directory not found, checking alternatives..." + ls "/c/Program Files/RedHat/" 2>/dev/null || true + find "/c/Program Files/" -maxdepth 1 -iname "*podman*" -o -iname "*redhat*" 2>/dev/null || true + fi export PATH="/c/Program Files/RedHat/Podman:$PATH" echo 'C:\Program Files\RedHat\Podman' >> "$GITHUB_PATH" - # Install kind directly (download to RUNNER_TEMP first, then move) + # Install kind to RUNNER_TEMP (avoid depending on podman install dir existing) curl -Lo "$RUNNER_TEMP/kind.exe" "https://github.com/kubernetes-sigs/kind/releases/download/v0.24.0/kind-windows-amd64" - mv "$RUNNER_TEMP/kind.exe" "/c/Program Files/RedHat/Podman/kind.exe" + export PATH="$RUNNER_TEMP:$PATH" + echo "$RUNNER_TEMP" >> "$GITHUB_PATH" podman machine init podman machine set --rootful podman machine start - kind create cluster --name "${{ steps.uuid.outputs.result }}" --image kindest/node:v1.34.0@sha256:7416a61b42b1662ca6ca89f02028ac133a309a2a30ba309614e8ec94d976dc5a + CLUSTER_NAME=$(python -c "import uuid; print(uuid.uuid4().hex)") + kind create cluster --name "$CLUSTER_NAME" --image kindest/node:v1.34.0@sha256:7416a61b42b1662ca6ca89f02028ac133a309a2a30ba309614e8ec94d976dc5a # NOTE: skevetter/setup-kind does not work on Windows runners - name: setup kind From 0b8bc97618fedbf418a174d0da83b69f83705731 Mon Sep 17 00:00:00 2001 From: Samuel K Date: Thu, 7 May 2026 13:07:28 -0500 Subject: [PATCH 05/12] fix(ci): use Docker for Windows kind cluster and fix podman install for WSL test The podman MSI install via bash was silently failing because Start-Process didn't properly wait. Split the approach: - provider test: use pre-installed Docker (no podman needed) - up-docker-wsl test: install podman via PowerShell with proper wait/error handling, then start podman machine in a separate step - Only set DOCKER_HOST to podman pipe for the up-docker-wsl test --- .github/workflows/pr-ci.yml | 52 +++++++++++++++++++------------------ 1 file changed, 27 insertions(+), 25 deletions(-) diff --git a/.github/workflows/pr-ci.yml b/.github/workflows/pr-ci.yml index 4c24e55e9..43e179ccc 100644 --- a/.github/workflows/pr-ci.yml +++ b/.github/workflows/pr-ci.yml @@ -394,39 +394,37 @@ jobs: UUID=$(python -c "import uuid; print(uuid.uuid4().hex)") echo "result=$UUID" >> "$GITHUB_OUTPUT" + - name: setup podman (Windows) + if: matrix.label == 'up-docker-wsl' && runner.os == 'Windows' && (matrix.requires-secret == false || needs.can-read-secret.outputs.secret-set == 'true') + shell: pwsh + run: | + $msiPath = "$env:RUNNER_TEMP\podman.msi" + Invoke-WebRequest -Uri "https://github.com/containers/podman/releases/download/v5.8.2/podman-installer-windows-amd64.msi" -OutFile $msiPath + $proc = Start-Process msiexec.exe -Wait -PassThru -ArgumentList "/i `"$msiPath`" /qn /norestart ADDLOCAL=ALL" + if ($proc.ExitCode -ne 0) { throw "MSI install failed with exit code $($proc.ExitCode)" } + $podmanDir = "C:\Program Files\RedHat\Podman" + if (!(Test-Path $podmanDir)) { throw "Podman directory not found after MSI install" } + echo "$podmanDir" | Out-File -Append -FilePath $env:GITHUB_PATH -Encoding utf8 + + - name: start podman machine (Windows) + if: matrix.label == 'up-docker-wsl' && runner.os == 'Windows' && (matrix.requires-secret == false || needs.can-read-secret.outputs.secret-set == 'true') + shell: pwsh + run: | + wsl --set-default-version 2 + podman machine init + podman machine set --rootful + podman machine start + - name: setup kind (Windows) if: matrix.install-kind == true && runner.os == 'Windows' && (matrix.requires-secret == false || needs.can-read-secret.outputs.secret-set == 'true') shell: bash env: - KIND_EXPERIMENTAL_PROVIDER: podman - DOCKER_HOST: npipe:////./pipe/podman-machine-default + KIND_EXPERIMENTAL_PROVIDER: ${{ matrix.label == 'up-docker-wsl' && 'podman' || 'docker' }} run: | - wsl --set-default-version 2 - - # Install podman via MSI (includes gvproxy needed for podman machine) - curl -Lo "$RUNNER_TEMP/podman.msi" "https://github.com/containers/podman/releases/download/v5.8.2/podman-installer-windows-amd64.msi" - powershell.exe -Command "Start-Process msiexec.exe -Wait -ArgumentList '/i','$(cygpath -w "$RUNNER_TEMP/podman.msi")','/qn','/norestart'" - - # Verify podman installed to expected location - if [ -d "/c/Program Files/RedHat/Podman" ]; then - echo "Podman installed to /c/Program Files/RedHat/Podman" - else - echo "WARNING: Expected podman directory not found, checking alternatives..." - ls "/c/Program Files/RedHat/" 2>/dev/null || true - find "/c/Program Files/" -maxdepth 1 -iname "*podman*" -o -iname "*redhat*" 2>/dev/null || true - fi - export PATH="/c/Program Files/RedHat/Podman:$PATH" - echo 'C:\Program Files\RedHat\Podman' >> "$GITHUB_PATH" - - # Install kind to RUNNER_TEMP (avoid depending on podman install dir existing) curl -Lo "$RUNNER_TEMP/kind.exe" "https://github.com/kubernetes-sigs/kind/releases/download/v0.24.0/kind-windows-amd64" export PATH="$RUNNER_TEMP:$PATH" echo "$RUNNER_TEMP" >> "$GITHUB_PATH" - podman machine init - podman machine set --rootful - podman machine start - CLUSTER_NAME=$(python -c "import uuid; print(uuid.uuid4().hex)") kind create cluster --name "$CLUSTER_NAME" --image kindest/node:v1.34.0@sha256:7416a61b42b1662ca6ca89f02028ac133a309a2a30ba309614e8ec94d976dc5a @@ -476,13 +474,17 @@ jobs: GOROOT="${GOROOT}" \ go test -v -ginkgo.v -timeout 1500s --ginkgo.label-filter="${{ matrix.label }}" else + DOCKER_HOST_VAL="" + if [ "${{ matrix.label }}" == "up-docker-wsl" ]; then + DOCKER_HOST_VAL="npipe:////./pipe/podman-machine-default" + fi GH_USERNAME="${GH_USERNAME}" \ GH_ACCESS_TOKEN="${GH_ACCESS_TOKEN}" \ GH_CREDENTIAL_USERNAME="${GH_CREDENTIAL_USERNAME}" \ KUBECONFIG="${KUBECONFIG:-$HOME/.kube/config}" \ PATH="${PATH}" \ GOROOT="${GOROOT}" \ - DOCKER_HOST="npipe:////./pipe/podman-machine-default" \ + DOCKER_HOST="${DOCKER_HOST_VAL}" \ go test -v -ginkgo.v -timeout 1500s --ginkgo.label-filter="${{ matrix.label }}" fi From b360d876e4889e949ae3685303e334bf5d07eee8 Mon Sep 17 00:00:00 2001 From: Samuel K Date: Thu, 7 May 2026 13:32:09 -0500 Subject: [PATCH 06/12] fix(ci): use redhat-actions/podman-install for Windows CI Windows Docker is in Windows-container mode and cannot pull Linux images like kindest/node. All Windows kind tests need podman for its Linux VM (via WSL2). Replace the failing manual MSI install with the redhat-actions/podman-install action which handles this reliably. --- .github/workflows/pr-ci.yml | 24 ++++++------------------ 1 file changed, 6 insertions(+), 18 deletions(-) diff --git a/.github/workflows/pr-ci.yml b/.github/workflows/pr-ci.yml index 43e179ccc..987a413f7 100644 --- a/.github/workflows/pr-ci.yml +++ b/.github/workflows/pr-ci.yml @@ -394,20 +394,12 @@ jobs: UUID=$(python -c "import uuid; print(uuid.uuid4().hex)") echo "result=$UUID" >> "$GITHUB_OUTPUT" - - name: setup podman (Windows) - if: matrix.label == 'up-docker-wsl' && runner.os == 'Windows' && (matrix.requires-secret == false || needs.can-read-secret.outputs.secret-set == 'true') - shell: pwsh - run: | - $msiPath = "$env:RUNNER_TEMP\podman.msi" - Invoke-WebRequest -Uri "https://github.com/containers/podman/releases/download/v5.8.2/podman-installer-windows-amd64.msi" -OutFile $msiPath - $proc = Start-Process msiexec.exe -Wait -PassThru -ArgumentList "/i `"$msiPath`" /qn /norestart ADDLOCAL=ALL" - if ($proc.ExitCode -ne 0) { throw "MSI install failed with exit code $($proc.ExitCode)" } - $podmanDir = "C:\Program Files\RedHat\Podman" - if (!(Test-Path $podmanDir)) { throw "Podman directory not found after MSI install" } - echo "$podmanDir" | Out-File -Append -FilePath $env:GITHUB_PATH -Encoding utf8 + - name: install podman (Windows) + if: matrix.install-kind == true && runner.os == 'Windows' && (matrix.requires-secret == false || needs.can-read-secret.outputs.secret-set == 'true') + uses: redhat-actions/podman-install@v1 - name: start podman machine (Windows) - if: matrix.label == 'up-docker-wsl' && runner.os == 'Windows' && (matrix.requires-secret == false || needs.can-read-secret.outputs.secret-set == 'true') + if: matrix.install-kind == true && runner.os == 'Windows' && (matrix.requires-secret == false || needs.can-read-secret.outputs.secret-set == 'true') shell: pwsh run: | wsl --set-default-version 2 @@ -419,7 +411,7 @@ jobs: if: matrix.install-kind == true && runner.os == 'Windows' && (matrix.requires-secret == false || needs.can-read-secret.outputs.secret-set == 'true') shell: bash env: - KIND_EXPERIMENTAL_PROVIDER: ${{ matrix.label == 'up-docker-wsl' && 'podman' || 'docker' }} + KIND_EXPERIMENTAL_PROVIDER: podman run: | curl -Lo "$RUNNER_TEMP/kind.exe" "https://github.com/kubernetes-sigs/kind/releases/download/v0.24.0/kind-windows-amd64" export PATH="$RUNNER_TEMP:$PATH" @@ -474,17 +466,13 @@ jobs: GOROOT="${GOROOT}" \ go test -v -ginkgo.v -timeout 1500s --ginkgo.label-filter="${{ matrix.label }}" else - DOCKER_HOST_VAL="" - if [ "${{ matrix.label }}" == "up-docker-wsl" ]; then - DOCKER_HOST_VAL="npipe:////./pipe/podman-machine-default" - fi GH_USERNAME="${GH_USERNAME}" \ GH_ACCESS_TOKEN="${GH_ACCESS_TOKEN}" \ GH_CREDENTIAL_USERNAME="${GH_CREDENTIAL_USERNAME}" \ KUBECONFIG="${KUBECONFIG:-$HOME/.kube/config}" \ PATH="${PATH}" \ GOROOT="${GOROOT}" \ - DOCKER_HOST="${DOCKER_HOST_VAL}" \ + DOCKER_HOST="npipe:////./pipe/podman-machine-default" \ go test -v -ginkgo.v -timeout 1500s --ginkgo.label-filter="${{ matrix.label }}" fi From 0ae2e917003860778b3aaf82950423993455aaa3 Mon Sep 17 00:00:00 2001 From: Samuel K Date: Thu, 7 May 2026 13:49:41 -0500 Subject: [PATCH 07/12] fix(ci): use MSI with INSTALLDIR and verbose logging for podman install The redhat-actions/podman-install action has no v1 tag. Revert to MSI approach with explicit INSTALLDIR parameter, verbose MSI logging for diagnostics, and full path to podman.exe to avoid PATH race conditions. --- .github/workflows/pr-ci.yml | 31 +++++++++++++++++++++++-------- 1 file changed, 23 insertions(+), 8 deletions(-) diff --git a/.github/workflows/pr-ci.yml b/.github/workflows/pr-ci.yml index 987a413f7..c98bacead 100644 --- a/.github/workflows/pr-ci.yml +++ b/.github/workflows/pr-ci.yml @@ -394,18 +394,33 @@ jobs: UUID=$(python -c "import uuid; print(uuid.uuid4().hex)") echo "result=$UUID" >> "$GITHUB_OUTPUT" - - name: install podman (Windows) - if: matrix.install-kind == true && runner.os == 'Windows' && (matrix.requires-secret == false || needs.can-read-secret.outputs.secret-set == 'true') - uses: redhat-actions/podman-install@v1 - - - name: start podman machine (Windows) + - name: install and start podman (Windows) if: matrix.install-kind == true && runner.os == 'Windows' && (matrix.requires-secret == false || needs.can-read-secret.outputs.secret-set == 'true') shell: pwsh run: | + $msiUrl = "https://github.com/containers/podman/releases/download/v5.8.2/podman-installer-windows-amd64.msi" + $msiPath = "$env:RUNNER_TEMP\podman.msi" + Invoke-WebRequest -Uri $msiUrl -OutFile $msiPath + + $installDir = "C:\Program Files\RedHat\Podman" + $logFile = "$env:RUNNER_TEMP\podman-install.log" + $proc = Start-Process msiexec.exe -Wait -PassThru -ArgumentList "/i `"$msiPath`" /qn /norestart /l*v `"$logFile`" INSTALLDIR=`"$installDir`"" + Write-Host "MSI exit code: $($proc.ExitCode)" + + if (!(Test-Path "$installDir\podman.exe")) { + Write-Host "--- MSI install log (last 50 lines) ---" + Get-Content $logFile -Tail 50 + Write-Host "--- Searching for podman.exe ---" + Get-ChildItem "C:\" -Filter "podman.exe" -Recurse -Depth 4 -ErrorAction SilentlyContinue | ForEach-Object { Write-Host $_.FullName } + throw "podman.exe not found at $installDir" + } + + echo "$installDir" | Out-File -Append -FilePath $env:GITHUB_PATH -Encoding utf8 + wsl --set-default-version 2 - podman machine init - podman machine set --rootful - podman machine start + & "$installDir\podman.exe" machine init + & "$installDir\podman.exe" machine set --rootful + & "$installDir\podman.exe" machine start - name: setup kind (Windows) if: matrix.install-kind == true && runner.os == 'Windows' && (matrix.requires-secret == false || needs.can-read-secret.outputs.secret-set == 'true') From 2f556977c2b067a943d793e6c1c626cb24ebf2c0 Mon Sep 17 00:00:00 2001 From: Samuel K Date: Thu, 7 May 2026 14:58:54 -0500 Subject: [PATCH 08/12] fix(ci): add SHA256 checksum verification for podman and kind downloads Verify integrity of downloaded binaries before execution to harden against supply-chain attacks on Windows CI runners. --- .github/workflows/pr-ci.yml | 18 ++++++++++++++++++ 1 file changed, 18 insertions(+) diff --git a/.github/workflows/pr-ci.yml b/.github/workflows/pr-ci.yml index c98bacead..71cb01dc6 100644 --- a/.github/workflows/pr-ci.yml +++ b/.github/workflows/pr-ci.yml @@ -402,6 +402,15 @@ jobs: $msiPath = "$env:RUNNER_TEMP\podman.msi" Invoke-WebRequest -Uri $msiUrl -OutFile $msiPath + $shasumsUrl = "https://github.com/containers/podman/releases/download/v5.8.2/shasums" + $shasums = (Invoke-WebRequest -Uri $shasumsUrl).Content + $expectedHash = ($shasums -split "`n" | Where-Object { $_ -match "podman-installer-windows-amd64.msi" }) -replace '\s+.*$','' + $actualHash = (Get-FileHash -Path $msiPath -Algorithm SHA256).Hash.ToLower() + if ($actualHash -ne $expectedHash) { + throw "SHA256 mismatch for podman MSI! Expected: $expectedHash, Got: $actualHash" + } + Write-Host "Podman MSI checksum verified: $actualHash" + $installDir = "C:\Program Files\RedHat\Podman" $logFile = "$env:RUNNER_TEMP\podman-install.log" $proc = Start-Process msiexec.exe -Wait -PassThru -ArgumentList "/i `"$msiPath`" /qn /norestart /l*v `"$logFile`" INSTALLDIR=`"$installDir`"" @@ -429,6 +438,15 @@ jobs: KIND_EXPERIMENTAL_PROVIDER: podman run: | curl -Lo "$RUNNER_TEMP/kind.exe" "https://github.com/kubernetes-sigs/kind/releases/download/v0.24.0/kind-windows-amd64" + curl -Lo "$RUNNER_TEMP/kind.sha256sum" "https://github.com/kubernetes-sigs/kind/releases/download/v0.24.0/kind-windows-amd64.sha256sum" + expected=$(awk '{print $1}' "$RUNNER_TEMP/kind.sha256sum") + actual=$(sha256sum "$RUNNER_TEMP/kind.exe" | awk '{print $1}') + if [ "$actual" != "$expected" ]; then + echo "SHA256 mismatch for kind.exe! Expected: $expected, Got: $actual" + exit 1 + fi + echo "kind.exe checksum verified: $actual" + export PATH="$RUNNER_TEMP:$PATH" echo "$RUNNER_TEMP" >> "$GITHUB_PATH" From 0b13136aef965b3ff1b2f9eeb29632076610be1a Mon Sep 17 00:00:00 2001 From: Samuel K Date: Thu, 7 May 2026 16:19:27 -0500 Subject: [PATCH 09/12] fix(ci): use pinned SHA256 hash for podman MSI checksum verification The Invoke-WebRequest of the shasums file returned binary content on Windows PowerShell, causing the hash extraction regex to produce an empty string. Pin the known hash directly instead. --- .github/workflows/pr-ci.yml | 4 +--- 1 file changed, 1 insertion(+), 3 deletions(-) diff --git a/.github/workflows/pr-ci.yml b/.github/workflows/pr-ci.yml index 71cb01dc6..9baf70431 100644 --- a/.github/workflows/pr-ci.yml +++ b/.github/workflows/pr-ci.yml @@ -402,9 +402,7 @@ jobs: $msiPath = "$env:RUNNER_TEMP\podman.msi" Invoke-WebRequest -Uri $msiUrl -OutFile $msiPath - $shasumsUrl = "https://github.com/containers/podman/releases/download/v5.8.2/shasums" - $shasums = (Invoke-WebRequest -Uri $shasumsUrl).Content - $expectedHash = ($shasums -split "`n" | Where-Object { $_ -match "podman-installer-windows-amd64.msi" }) -replace '\s+.*$','' + $expectedHash = "eda54f26f9695d198d9a679fa45ae24ba35b78444f432b5fe0c122c5a3624c57" $actualHash = (Get-FileHash -Path $msiPath -Algorithm SHA256).Hash.ToLower() if ($actualHash -ne $expectedHash) { throw "SHA256 mismatch for podman MSI! Expected: $expectedHash, Got: $actualHash" From a26fb8236a660d938285580ca5ea97fc71cc5e2b Mon Sep 17 00:00:00 2001 From: Samuel K Date: Thu, 7 May 2026 16:32:01 -0500 Subject: [PATCH 10/12] fix(ci): use correct named pipe for Podman 5.x rootful mode on Windows Podman 5.x in rootful mode exposes the API on \\.\pipe\docker_engine, not \\.\pipe\podman-machine-default. Update DOCKER_HOST in both the kind setup step and the test runner step. --- .github/workflows/pr-ci.yml | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/.github/workflows/pr-ci.yml b/.github/workflows/pr-ci.yml index 9baf70431..b5d89a1e6 100644 --- a/.github/workflows/pr-ci.yml +++ b/.github/workflows/pr-ci.yml @@ -434,6 +434,7 @@ jobs: shell: bash env: KIND_EXPERIMENTAL_PROVIDER: podman + DOCKER_HOST: npipe:////./pipe/docker_engine run: | curl -Lo "$RUNNER_TEMP/kind.exe" "https://github.com/kubernetes-sigs/kind/releases/download/v0.24.0/kind-windows-amd64" curl -Lo "$RUNNER_TEMP/kind.sha256sum" "https://github.com/kubernetes-sigs/kind/releases/download/v0.24.0/kind-windows-amd64.sha256sum" @@ -503,7 +504,7 @@ jobs: KUBECONFIG="${KUBECONFIG:-$HOME/.kube/config}" \ PATH="${PATH}" \ GOROOT="${GOROOT}" \ - DOCKER_HOST="npipe:////./pipe/podman-machine-default" \ + DOCKER_HOST="npipe:////./pipe/docker_engine" \ go test -v -ginkgo.v -timeout 1500s --ginkgo.label-filter="${{ matrix.label }}" fi From b6317bdacfcbcc643896f68f004962058ba2e0c7 Mon Sep 17 00:00:00 2001 From: Samuel K Date: Thu, 7 May 2026 16:56:11 -0500 Subject: [PATCH 11/12] fix(ci): pin kind SHA256 hash and strip backslash from sha256sum output On Windows Git Bash, sha256sum outputs a leading backslash when the file path contains backslashes. Strip it with awk gsub. Also pin the kind hash directly and set DOCKER_HOST to the pipe podman actually uses. --- .github/workflows/pr-ci.yml | 9 ++++----- 1 file changed, 4 insertions(+), 5 deletions(-) diff --git a/.github/workflows/pr-ci.yml b/.github/workflows/pr-ci.yml index b5d89a1e6..c4a70fa89 100644 --- a/.github/workflows/pr-ci.yml +++ b/.github/workflows/pr-ci.yml @@ -434,12 +434,11 @@ jobs: shell: bash env: KIND_EXPERIMENTAL_PROVIDER: podman - DOCKER_HOST: npipe:////./pipe/docker_engine + DOCKER_HOST: npipe:////./pipe/podman-machine-default run: | curl -Lo "$RUNNER_TEMP/kind.exe" "https://github.com/kubernetes-sigs/kind/releases/download/v0.24.0/kind-windows-amd64" - curl -Lo "$RUNNER_TEMP/kind.sha256sum" "https://github.com/kubernetes-sigs/kind/releases/download/v0.24.0/kind-windows-amd64.sha256sum" - expected=$(awk '{print $1}' "$RUNNER_TEMP/kind.sha256sum") - actual=$(sha256sum "$RUNNER_TEMP/kind.exe" | awk '{print $1}') + expected="6f724188289cc79395f45afae0f2b85e0d220c2b84c6ed2f5047d9d0c9a67028" + actual=$(sha256sum "$RUNNER_TEMP/kind.exe" | awk '{gsub(/^\\\\/, ""); print $1}') if [ "$actual" != "$expected" ]; then echo "SHA256 mismatch for kind.exe! Expected: $expected, Got: $actual" exit 1 @@ -504,7 +503,7 @@ jobs: KUBECONFIG="${KUBECONFIG:-$HOME/.kube/config}" \ PATH="${PATH}" \ GOROOT="${GOROOT}" \ - DOCKER_HOST="npipe:////./pipe/docker_engine" \ + DOCKER_HOST="npipe:////./pipe/podman-machine-default" \ go test -v -ginkgo.v -timeout 1500s --ginkgo.label-filter="${{ matrix.label }}" fi From 5b15df4536897c266f0f30cc0033550dd61cdc4d Mon Sep 17 00:00:00 2001 From: Samuel K Date: Thu, 7 May 2026 17:27:05 -0500 Subject: [PATCH 12/12] fix(ci): use sed to strip leading backslash from sha256sum on Windows The awk gsub approach didn't strip the backslash due to YAML escaping complexity. Use sed with a character class to strip any non-hex prefix. --- .github/workflows/pr-ci.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.github/workflows/pr-ci.yml b/.github/workflows/pr-ci.yml index c4a70fa89..f3f57aa79 100644 --- a/.github/workflows/pr-ci.yml +++ b/.github/workflows/pr-ci.yml @@ -438,7 +438,7 @@ jobs: run: | curl -Lo "$RUNNER_TEMP/kind.exe" "https://github.com/kubernetes-sigs/kind/releases/download/v0.24.0/kind-windows-amd64" expected="6f724188289cc79395f45afae0f2b85e0d220c2b84c6ed2f5047d9d0c9a67028" - actual=$(sha256sum "$RUNNER_TEMP/kind.exe" | awk '{gsub(/^\\\\/, ""); print $1}') + actual=$(sha256sum "$RUNNER_TEMP/kind.exe" | awk '{print $1}' | sed 's/^[^a-f0-9]*//') if [ "$actual" != "$expected" ]; then echo "SHA256 mismatch for kind.exe! Expected: $expected, Got: $actual" exit 1