lima/.github/workflows/test.yml

name: test

on:
  push:
    branches:
    - master
    - 'release/**'
    paths-ignore:
    - "docs/**"
    - "website/**"
    - "**.md"
  pull_request:
    paths-ignore:
    - "docs/**"
    - "website/**"
    - "**.md"
env:
  LIMACTL_CREATE_ARGS: ""
  GOTOOLCHAIN: local

permissions:
  contents: read

jobs:
  lints:
    name: "Lints"
    runs-on: ubuntu-24.04
    timeout-minutes: 30
    steps:
    - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7.0.1
      with:
        persist-credentials: false
    - uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e  # v7.0.0
      with:
        go-version: stable
        cache: false
    - name: Install protoc and Go plugins
      run: |
        sudo apt-get update
        sudo apt-get install -y protobuf-compiler
        make install-protoc-tools
    - name: Verify generated files
      run: make generate check-generated
    - name: Install shellcheck
      run: |
        sudo apt-get update
        sudo apt-get install -y shellcheck
    - name: Run shellcheck
      run: make shellcheck
    - name: Run shfmt
      run: make shfmt
    - name: Install go-licenses
      # TODO: move to `go tool` after upgrading to v2
      run: go install github.com/google/go-licenses@v1.6.0
    - name: Check licenses
      run: make go-licenses
    - name: Check the gomodjail confinement of Go dependencies
      run: NO_COLOR=true make gomodjail
    - name: Check social reputation of Go dependencies
      run: make gosocialcheck
    - name: Check license boilerplates
      run: make ltag
    - name: Check protobuf files
      run: make protolint
    - name: Run zizmor
      uses: zizmorcore/zizmor-action@85b2b9fb8e3325e7a23d7d0a9d7ba5ae0f999e3e  # v0.7.1
      with:
        # No need to hide the result in https://github.com/lima-vm/lima/security (private),
        # as anybody can already run zizmor locally to find vulnerabilities.
        # https://github.com/lima-vm/lima/pull/4846#pullrequestreview-4135088525
        advanced-security: false

  lint-go:
    name: "Lint Go"
    timeout-minutes: 30
    strategy:
      matrix:
        runs-on: [ubuntu-24.04, macos-26, windows-2025]
    runs-on: ${{ matrix.runs-on }}
    steps:
    - name: Force git to use LF
      # This step is required on Windows to work around golangci-lint issues with formatters. See https://github.com/golangci/golangci-lint/discussions/5840
      # TODO: replace with a checkout option when https://github.com/actions/checkout/issues/226 is implemented
      if: runner.os == 'Windows'
      run: |
        git config --global core.autocrlf false
        git config --global core.eol lf
    - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7.0.1
      with:
        persist-credentials: false
    - uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e  # v7.0.0
      with:
        go-version: stable
        cache: false
    - id: golangci-lint-version
      shell: bash
      working-directory: hack/tools
      run: |
        echo "GOLANGCI_LINT_VERSION=$(go list -m -f '{{.Version}}' github.com/golangci/golangci-lint/v2)" >> $GITHUB_OUTPUT
    - name: Run golangci-lint
      uses: golangci/golangci-lint-action@ba0d7d2ec06a0ea1cb5fa41b2e4a3ab91d21278a  # v9.3.0
      with:
        version: ${{ steps.golangci-lint-version.outputs.GOLANGCI_LINT_VERSION }}
        args: --verbose
        skip-cache: true

  security:
    name: "Vulncheck"
    runs-on: ubuntu-24.04
    timeout-minutes: 5
    steps:
    - uses: golang/govulncheck-action@032d45514ae346b1db93c04b0c90b841c370344f  # v1.1.0

  unit:
    name: "Unit tests"
    runs-on: ubuntu-24.04
    timeout-minutes: 30
    strategy:
      fail-fast: false
      matrix:
        # For non-Homebrew we have to support an old release of Go
        go-version: ["oldstable", "stable"]
    steps:
    - name: Install test dependencies
      run: |
        sudo apt-get update
        sudo apt-get install -y --no-install-recommends qemu-utils
    - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7.0.1
      with:
        persist-credentials: false
    - uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e  # v7.0.0
      with:
        go-version: ${{ matrix.go-version }}
        cache: false
    - name: Unit tests
      run: go test -v ./...
    - name: Make
      run: make
    - name: Install
      run: sudo make install
    - name: Verify templates match `limactl edit` format
      run: |
        find templates -name '*.yaml' -exec limactl edit --set 'del(.nothing)' {} \;
        git diff-index --exit-code HEAD
    - name: Uninstall
      run: sudo make uninstall

  windows-wsl2:
    name: "Windows tests (WSL2)"
    runs-on: windows-2025
    timeout-minutes: 45
    steps:
    - name: Set gitconfig
      run: |
        git config --global core.autocrlf false
        git config --global core.eol lf
    - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7.0.1
      with:
        # Submodules are required by the BATS port-forwarding test
        submodules: true
        persist-credentials: false
    - uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e  # v7.0.0
      with:
        go-version: stable
        cache: false
    - uses: $/.github/actions/windows_wsl2_setup
    - uses: $/.github/actions/windows_msys2_prep
    - name: Unit tests
      run: go test -v ./...
    - name: Make
      run: make
    - name: Integration tests (WSL2, Windows host)
      run: |
        $env:PATH = "$pwd\_output\bin;" + $env:PATH
        $env:MSYS2_ENV_CONV_EXCL = 'HOME_HOST;HOME_GUEST'
        $env:HOME_HOST = $(cygpath.exe "$env:USERPROFILE")
        $env:HOME_GUEST = "/mnt$env:HOME_HOST"
        $env:LIMACTL_CREATE_ARGS = '--vm-type=wsl2 --mount-type=wsl2 --containerd=system'
        bash.exe -c "./hack/test-templates.sh templates/experimental/wsl2.yaml"
    - name: Run BATS port-forwarding test (WSL2, Windows host)
      run: |
        $env:PATH = "$pwd\_output\bin;" + $env:PATH
        $env:MSYS2_ENV_CONV_EXCL = 'LIMA_BATS_PORT_FORWARDING_BASE_TEMPLATE'
        $env:LIMACTL_CREATE_ARGS = '--vm-type=wsl2 --mount-type=wsl2 --containerd=system'
        $env:LIMA_BATS_PORT_FORWARDING_BASE_TEMPLATE = 'template:experimental/wsl2'
        bash.exe -c "./hack/bats/lib/bats-core/bin/bats --timing ./hack/bats/tests/port-forwarding.bats"

  windows-qemu:
    name: "Windows tests (QEMU)"
    runs-on: windows-2025
    timeout-minutes: 45
    steps:
    - name: Set gitconfig
      run: |
        git config --global core.autocrlf false
        git config --global core.eol lf
    - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7.0.1
      with:
        # Submodules are required by the BATS port-forwarding test
        submodules: true
        persist-credentials: false
    - uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e  # v7.0.0
      with:
        go-version: stable
        cache: false
    - uses: $/.github/actions/windows_qemu_install
    - uses: $/.github/actions/windows_msys2_prep
    - name: Make
      run: make
    - name: Integration tests (QEMU, Windows host)
      run: |
        $env:PATH = "$pwd\_output\bin;" + 'C:\Program Files\QEMU;' + $env:PATH
        $env:MSYS2_ENV_CONV_EXCL = 'HOME_HOST;HOME_GUEST'
        $env:HOME_HOST = $(cygpath.exe "$env:USERPROFILE")
        $env:HOME_GUEST = "$env:HOME_HOST"
        $env:LIMACTL_CREATE_ARGS = '--vm-type=qemu'
        bash.exe -c "./hack/test-templates.sh templates/default.yaml"
    - name: Run BATS port-forwarding test (QEMU, Windows host)
      run: |
        $env:PATH = "$pwd\_output\bin;" + 'C:\Program Files\QEMU;' + $env:PATH
        $env:LIMACTL_CREATE_ARGS = '--vm-type=qemu'
        bash.exe -c "./hack/bats/lib/bats-core/bin/bats --timing ./hack/bats/tests/port-forwarding.bats"

  windows-plain-smoke:
    # Smoke test of Lima's drivers on a host with only what a default
    # Windows 10/11 install ships (native OpenSSH, wsl.exe, tar). If a step
    # ever needs MSYS2 or Git for Windows back to pass, Lima has gained a new
    # external-binary dependency, and that needs review first.
    name: "Windows smoke tests (plain, ${{ matrix.name }})"
    runs-on: windows-2025
    timeout-minutes: 30
    strategy:
      fail-fast: false
      matrix:
        include:
        - name: WSL2
          vm-type: wsl2
          template: .\templates\experimental\wsl2.yaml
        # The reverse-sshfs mount starts through the native sftp-server, but
        # sshocker does not fail when the mount check fails, so the mount
        # itself is not covered.
        - name: QEMU
          vm-type: qemu
          template: .\templates\default.yaml
        # The HCS driver is experimental and lacks features (mounts, port
        # forwarding, ...) that the full test suite needs.
        # The windows-2025 image ships the Hyper-V and Containers features
        # that HCS and HNS need, and the runner user is an Administrator.
        - name: HCS
          vm-type: hcs
          template: .\templates\experimental\hcs.yaml
    steps:
    - name: Set gitconfig
      run: |
        git config --global core.autocrlf false
        git config --global core.eol lf
    - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7.0.1
      with:
        persist-credentials: false
    - uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e  # v7.0.0
      with:
        go-version: stable
        cache: false
    - if: matrix.vm-type == 'wsl2'
      uses: $/.github/actions/windows_wsl2_setup
    - if: matrix.vm-type == 'qemu'
      uses: $/.github/actions/windows_qemu_install
    # Only default.yaml has `base:`; wsl2.yaml and hcs.yaml do not.
    - if: matrix.vm-type == 'qemu'
      uses: $/.github/actions/windows_plain_templates
    - uses: $/.github/actions/windows_plain_host
    # No QEMU on PATH here: limactl appends the default QEMU install dir to
    # its own PATH, and this job tests that.
    - name: Check that QEMU is not on PATH
      if: matrix.vm-type == 'qemu'
      run: |
        $qemu = Get-Command qemu-system-x86_64 -ErrorAction SilentlyContinue
        if ($qemu) { throw "QEMU is on PATH: $($qemu.Source)" }
    - uses: $/.github/actions/windows_plain_build
    - uses: $/.github/actions/windows_plain_smoke_test
      with:
        template: ${{ matrix.template }}
        vm-type: ${{ matrix.vm-type }}
        launch-default-distro-during-stop: ${{ matrix.vm-type == 'wsl2' }}

  qemu:
    name: "Integration tests (QEMU, macOS host)"
    runs-on: macos-15-large  # Intel
    timeout-minutes: 120
    steps:
    - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7.0.1
      with:
        # Submodules are required by the BATS port-forwarding test
        submodules: true
        persist-credentials: false
    - uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e  # v7.0.0
      with:
        go-version: stable
        cache: false
    - name: Unit tests
      run: go test -v ./...
    - name: Make
      run: make
    - name: "Inject `no_timer_check` to kernel cmdline"
      # workaround to https://github.com/lima-vm/lima/issues/84
      run: |
        export PATH="$PWD/_output/bin:$PATH"
        ./hack/inject-cmdline-to-template.sh _output/share/lima/templates/_images/ubuntu.yaml no_timer_check
    - name: Install
      run: sudo make install
    - name: Validate jsonschema
      run: make schema-limayaml.json
    - name: Validate templates
      # Can't validate base templates in `_default` because they have no images
      run: find -L templates -name '*.yaml' ! -path '*/_default/*' | xargs limactl validate
    - name: Install test dependencies
      # QEMU:      required by Lima itself
      # bash:      required by test-templates.sh and BATS (OS version of bash is too old)
      # coreutils: required by test-templates.sh for the "timeout" command
      # w3m :      required by test-templates.sh for port forwarding tests
      # socat:     required by the BATS port-forwarding test
      run: brew install qemu bash coreutils w3m socat
    - name: "Adjust LIMACTL_CREATE_ARGS"
      run: echo "LIMACTL_CREATE_ARGS=${LIMACTL_CREATE_ARGS} --vm-type=qemu" >>$GITHUB_ENV
    - name: Cache image used by default.yaml
      uses: $/.github/actions/setup_cache_for_template
      with:
        template: templates/default.yaml
    - name: "Show cache"
      run: ./hack/debug-cache.sh
    # GHA macOS is slow and flaky, so we only test default.yaml here.
    # Other yamls are tested on Linux instances.
    - name: "Test default.yaml"
      uses: nick-fields/retry@ad984534de44a9489a53aefd81eb77f87c70dc60  # v4.0.0
      with:
        timeout_minutes: 30
        retry_on: error
        max_attempts: 3
        command: ./hack/test-templates.sh templates/default.yaml
    - name: "Run BATS port-forwarding test (QEMU, macOS host)"
      run: ./hack/bats/lib/bats-core/bin/bats --timing ./hack/bats/tests/port-forwarding.bats
      env:
        LIMA_BATS_ALL_TESTS_RETRIES: "2"
    - if: always()
      uses: $/.github/actions/upload_failure_logs_if_exists
    - name: "Show cache"
      if: always()
      run: ./hack/debug-cache.sh

  # Non-default templates are tested on Linux instances of GHA,
  # as they seem more stable than macOS instances.
  qemu-linux:
    name: "Integration tests (QEMU, Linux host)"
    runs-on: ubuntu-24.04
    timeout-minutes: 120
    strategy:
      fail-fast: false
      matrix:
        # Most templates use 9p as the mount type
        template:
        - alpine.yaml
        - debian.yaml  # reverse-sshfs
        - fedora.yaml
        - archlinux.yaml
        - opensuse.yaml
        - docker.yaml
        - ../hack/test-templates/alpine-iso-9p-writable.yaml  # Covers alpine-iso.yaml
        - ../hack/test-templates/net-user-v2.yaml
        - ../hack/test-templates/test-misc.yaml  # TODO: merge net-user-v2 into test-misc
    steps:
    - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7.0.1
      with:
        persist-credentials: false
    - uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e  # v7.0.0
      with:
        go-version: stable
        cache: false
    - name: Make
      run: make
    - name: Install
      run: sudo make install
    - name: Cache image used by templates/${{ matrix.template }}
      uses: $/.github/actions/setup_cache_for_template
      with:
        template: templates/${{ matrix.template }}
    - name: Install test dependencies
      run: |
        sudo apt-get update
        sudo ./hack/install-qemu.sh
        sudo apt-get install -y --no-install-recommends w3m
    - name: Install ansible-playbook
      run: |
        sudo apt-get install -y --no-install-recommends ansible
      if: matrix.template == '../hack/test-templates/test-misc.yaml'
    - name: "Show cache"
      run: ./hack/debug-cache.sh
    - name: "Test"
      uses: nick-fields/retry@ad984534de44a9489a53aefd81eb77f87c70dc60  # v4.0.0
      with:
        timeout_minutes: 30
        retry_on: error
        max_attempts: 3
        command: ./hack/test-templates.sh templates/${{ matrix.template }}
    - if: always()
      uses: $/.github/actions/upload_failure_logs_if_exists
      with:
        suffix: ${{ matrix.template }}
    - name: "Show cache"
      run: ./hack/debug-cache.sh

  bats:
    name: "Integration tests (BATS)"
    runs-on: ubuntu-24.04
    timeout-minutes: 45
    steps:
    - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7.0.1
      with:
        # BATS tests don't expect lima version warnings like:
        # msg="treating lima version \"ea336ae\" from \"/Users/runner/.lima-bats/dummy/lima-version\" as very latest release"
        fetch-depth: 0
        submodules: true
        persist-credentials: false
    - uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e  # v7.0.0
      with:
        go-version: stable
        cache: false
    - name: Make
      run: make
    - name: Install
      run: sudo make install
    - name: Install test dependencies
      run: |
        sudo apt-get update
        # socat is used by the port-forwarding tests
        sudo apt-get install -y socat
        sudo ./hack/install-qemu.sh
    - name: Cache image used by templates/default.yaml
      uses: $/.github/actions/setup_cache_for_template
      with:
        template: templates/default.yaml
    - name: "Run BATS integration tests"
      run: make bats
      env:
        # The url-github.bats tests makes GitHub API requests
        GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
    - name: Cache image used by templates/k8s.yaml
      uses: $/.github/actions/setup_cache_for_template
      with:
        template: templates/k8s.yaml
    - name: "Run BATS k8s tests"
      run: ./hack/bats/lib/bats-core/bin/bats --timing ./hack/bats/extras/k8s.bats
      env:
        LIMA_BATS_ALL_TESTS_RETRIES: 3
    - name: Cache image used by templates/freebsd.yaml
      uses: $/.github/actions/setup_cache_for_template
      with:
        template: templates/freebsd.yaml
    - name: "Run BATS freebsd tests"
      run: |
        set -eux -o pipefail
        # xorriso is required for creating Joliet filesystem
        sudo apt-get install -y xorriso
        ./hack/bats/lib/bats-core/bin/bats --timing ./hack/bats/extras/freebsd.bats

  colima:
    name: "Colima tests (QEMU, Linux host)"
    runs-on: ubuntu-24.04
    timeout-minutes: 120
    steps:
    - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7.0.1
      with:
        # fetch-depth is set to 0 to let `limactl --version` print semver-ish version
        # fetch-depth: 0 is required for Colima integration test because Colima
        # checks Lima's version and requires proper semantic version format
        fetch-depth: 0
        ref: ${{ github.event.pull_request.head.sha }}
        submodules: true
        persist-credentials: false
    - uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e  # v7.0.0
      with:
        go-version: stable
        cache: false
    - name: Make
      run: make
    - name: Install
      run: sudo make install
    - name: Install colima
      id: install-colima
      run: |
        git clone https://github.com/abiosoft/colima
        cd colima
        latest="$(git tag --sort=-v:refname | head -n1)"
        git checkout "$latest"
        make
        sudo make install
        echo "version=$latest" >>$GITHUB_OUTPUT
    - name: Install test dependencies
      run: |
        sudo apt-get update
        sudo ./hack/install-qemu.sh
    - name: Cache colima
      uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9  # v6.1.0
      with:
        path: ~/.cache/colima
        key: colima-${{ steps.install-colima.outputs.version }}
        lookup-only: true
    - name: Run BATS colima tests
      run: ./hack/bats/lib/bats-core/bin/bats --timing ./hack/bats/extras/colima.bats

  vmnet:
    name: "VMNet tests (QEMU)"
    runs-on: macos-15-large  # Intel
    timeout-minutes: 120
    steps:
    - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7.0.1
      with:
        persist-credentials: false
    - uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e  # v7.0.0
      with:
        go-version: stable
        cache: false
    - name: Make
      run: make
    - name: "Inject `no_timer_check` to kernel cmdline"
      # workaround to https://github.com/lima-vm/lima/issues/84
      run: |
        export PATH="$PWD/_output/bin:$PATH"
        ./hack/inject-cmdline-to-template.sh _output/share/lima/templates/_images/ubuntu.yaml no_timer_check
    - name: Install
      run: sudo make install
    - name: "Adjust LIMACTL_CREATE_ARGS"
      run: echo "LIMACTL_CREATE_ARGS=${LIMACTL_CREATE_ARGS} --vm-type=qemu --network=lima:shared" >>$GITHUB_ENV
    - name: Cache image used by default .yaml
      uses: $/.github/actions/setup_cache_for_template
      with:
        template: templates/default.yaml
    - name: Install test dependencies
      run: brew install qemu bash coreutils w3m
    - name: Install socket_vmnet
      env:
        SOCKET_VMNET_VERSION: v1.2.2
      run: |
        (
          cd ~
          git clone https://github.com/lima-vm/socket_vmnet
          cd socket_vmnet
          git checkout $SOCKET_VMNET_VERSION
          sudo git config --global --add safe.directory /Users/runner/socket_vmnet
          sudo make PREFIX=/opt/socket_vmnet install
        )
        limactl sudoers | sudo tee /etc/sudoers.d/lima
    - name: Unit test (pkg/networks) with socket_vmnet
      # Set -count=1 to disable cache
      run: go test -v -count=1 ./pkg/networks/...
    - name: Test socket_vmnet
      uses: nick-fields/retry@ad984534de44a9489a53aefd81eb77f87c70dc60  # v4.0.0
      with:
        timeout_minutes: 30
        retry_on: error
        max_attempts: 3
        command: ./hack/test-templates.sh templates/default.yaml
    - if: always()
      uses: $/.github/actions/upload_failure_logs_if_exists

  upgrade:
    name: "Upgrade tests (QEMU, macOS host)"
    runs-on: macos-15-large  # Intel
    timeout-minutes: 120
    strategy:
      matrix:
        oldver: ["v0.15.1"]  # The default VM type was always QEMU until Lima v1.0
    steps:
    - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7.0.1
      with:
        persist-credentials: false
    - name: Fetch homebrew-core commit messages
      uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7.0.1
      with:
        # needed by ./hack/brew-install-version.sh
        repository: homebrew/homebrew-core
        path: homebrew-core
        fetch-depth: 0
        filter: tree:0
        persist-credentials: false
    - uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e  # v7.0.0
      with:
        go-version: stable
        cache: false
    - name: Cache image used by ${{ matrix.oldver }}/examples/ubuntu-lts.yaml
      uses: $/.github/actions/setup_cache_for_template
      with:
        template: https://raw.githubusercontent.com/lima-vm/lima/${{ matrix.oldver }}/examples/ubuntu-lts.yaml
    - name: Install test dependencies
      run: |
        brew install bash coreutils
        # QEMU 9.1.0 seems to break on GitHub runners, both on Monterey and Ventura
        # We revert back to 8.2.1, which seems to work fine
        git config --global user.name "GitHub Actions Bot"
        git config --global user.email "nobody@localhost"
        ./hack/brew-install-version.sh qemu 8.2.1
    - name: Test
      uses: nick-fields/retry@ad984534de44a9489a53aefd81eb77f87c70dc60  # v4.0.0
      with:
        timeout_minutes: 30
        retry_on: error
        max_attempts: 3
        command: ./hack/test-upgrade.sh ${{ matrix.oldver }} ${{ github.sha }}
    - if: always()
      uses: $/.github/actions/upload_failure_logs_if_exists

  vz:
    name: "Integration tests (vz)"
    runs-on: macos-15-large  # Intel
    timeout-minutes: 120
    strategy:
      fail-fast: false
      matrix:
        template:
        - default.yaml
    steps:
    - name: "Adjust LIMACTL_CREATE_ARGS"
      # --cpus=1 is needed for running vz on GHA: https://github.com/lima-vm/lima/pull/1511#issuecomment-1574937888
      run: echo "LIMACTL_CREATE_ARGS=${LIMACTL_CREATE_ARGS} --cpus 1 --memory 1" >>$GITHUB_ENV
    - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7.0.1
      with:
        # Submodules are required by the BATS port-forwarding test
        submodules: true
        persist-credentials: false
    - uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e  # v7.0.0
      with:
        go-version: stable
        cache: false
    - name: Make
      run: make
    - name: Install
      run: |
        # The privileged helper requires root-owned ancestors; Homebrew owns /usr/local on runners.
        sudo install -d -o root -g wheel -m 0755 /opt/lima
        sudo make PREFIX=/opt/lima install
        echo /opt/lima/bin >>$GITHUB_PATH
    - name: Cache image used by templates/${{ matrix.template }}
      uses: $/.github/actions/setup_cache_for_template
      with:
        template: templates/${{ matrix.template }}
    - name: Install test dependencies
      run: brew install bash coreutils w3m socat
    - name: Uninstall qemu
      run: brew uninstall --ignore-dependencies --force qemu
    - name: Test
      run: ./hack/test-templates.sh templates/${{ matrix.template }}
    - name: "Run BATS port-forwarding test (vz, macOS host)"
      if: matrix.template == 'default.yaml'
      run: ./hack/bats/lib/bats-core/bin/bats --timing ./hack/bats/tests/port-forwarding.bats
      env:
        LIMA_BATS_ALL_TESTS_RETRIES: "2"
    - name: Run BATS VZ block-device tests
      if: matrix.template == 'default.yaml'
      run: ./hack/bats/lib/bats-core/bin/bats --timing ./hack/bats/extras/vz-block-device.bats
    - name: Run BATS VZ host-loopback tests
      if: matrix.template == 'default.yaml'
      run: ./hack/bats/lib/bats-core/bin/bats --timing ./hack/bats/extras/vz-host-loopback.bats
    - if: failure()
      uses: $/.github/actions/upload_failure_logs_if_exists
      with:
        suffix: ${{ matrix.template }}

  # gomodjail is a library sandbox for Go
  # https://github.com/AkihiroSuda/gomodjail
  #
  # The static analysis mode (`gomodjail analyze`) is enforced by the "Lints" job above.
  # This job exercises the legacy dynamic mode (`gomodjail run`), which enforces a similar
  # (but not identical) policy at runtime, via syscall interception.
  #
  # This is an early experiment.
  # CI failures that only occurs with gomodjail shall not block merging PRs.
  gomodjail:
    name: "gomodjail, dynamic mode (experimental; failures shall not block merging PRs)"
    runs-on: macos-15-large  # Intel
    timeout-minutes: 30
    steps:
    - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7.0.1
      with:
        persist-credentials: false
    - uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e  # v7.0.0
      with:
        go-version: stable
        cache: false
    - name: Install gomodjail
      env:
        GOMODJAIL_VERSION: v2.0.1
      run: |
        set -eux -o pipefail
        git clone --depth=1 --branch="${GOMODJAIL_VERSION}" https://github.com/AkihiroSuda/gomodjail
        cd gomodjail
        make binaries install
    - name: Install Lima
      # gomodjail depends on symbols
      run: |
        make KEEP_SYMBOLS=1 binaries
        sudo make install
    - name: Cache image used by templates/default.yaml
      uses: $/.github/actions/setup_cache_for_template
      with:
        template: templates/default.yaml
    - name: Smoke test
      run: gomodjail run --go-mod=./go.mod -- limactl start --tty=false

  cross:
    name: "Cross-compile (NetBSD, DragonFlyBSD)"
    runs-on: ubuntu-24.04
    timeout-minutes: 30
    steps:
    - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7.0.1
      with:
        persist-credentials: false
    - uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e  # v7.0.0
      with:
        go-version: stable
        cache: false
    - run: GOOS=netbsd go build ./...
    - run: GOOS=dragonfly go build ./...

  qemu-linux-old:
    name: "Smoke tests (QEMU, old Linux host)"
    runs-on: ubuntu-22.04  # QEMU 6.2
    timeout-minutes: 30
    steps:
    - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7.0.1
      with:
        persist-credentials: false
    - uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e  # v7.0.0
      with:
        go-version: stable
        cache: false
    - name: Make
      run: make
    - name: Install
      run: sudo make install
    - name: Cache image used by templates/default.yaml
      uses: $/.github/actions/setup_cache_for_template
      with:
        template: templates/default.yaml
    - name: Install test dependencies
      run: |
        sudo apt-get update
        sudo ./hack/install-qemu.sh
    - name: Smoke test
      run: limactl start --tty=false