* ci: improve Azure test reliability
Azure has intermittent failures, often the macOS framework-Python
`posix_spawn: Undefined error: 0` spawn race under load, plus transient
download flakiness. Address both:
- Retry integration tests via pytest-rerunfailures (already required):
add `--reruns=2 --reruns-delay=5` to the serial and non-serial runs so a
single transient flake self-heals instead of failing the whole job.
- Cap Azure at `--num-processes 3` to reduce concurrent process spawning
(the macOS runner was using 4 xdist workers), lowering the spawn-race
probability and peak resource pressure.
- Cache downloads across runs: relocate CIBW_CACHE_PATH to a stable path
and add a Cache@2 task (interpreter downloads + per-worker test pip
caches live under it), cutting the network-download flake surface.
- Bump the Azure host interpreter to 3.13.
Assisted-by: ClaudeCode:claude-opus-4.8
* ci: stabilize iOS tests, bound rerun cost
An iOS run on Azure (build 9043) hung for the full 40-min pytest timeout
on the second build config of test_ios_platforms, then reran twice
(reruns=2), blowing past the 180-min job cap with no useful signal. The
hang was a stuck simulator/xcodebuild on the second config, after the
first config had run.
- Shut down running simulators before each parametrized config via a
`clean_ios_simulators` fixture, so a simulator left booted/wedged by the
previous config isn't reused.
- Drop iOS reruns from 2 to 1. One retry still covers the documented
"fails the first time" simulator-boot flake, while halving the
worst-case retry cost (3x40=120min -> 2x40=80min) on a hang.
Assisted-by: ClaudeCode:claude-opus-4.8
* ci: don't limit num processes
Signed-off-by: Henry Schreiner <henryfs@princeton.edu>
* ci: rerun OCI unit tests that pull from Docker Hub
test_local_image et al. occasionally fail on a transient Docker Hub
anonymous-pull blip ("unauthorized: authentication required") when
pulling debian:trixie-slim. The integration runs already self-heal via
pytest-rerunfailures, but the unit run had no reruns, so a single flake
failed the whole job. Mark the three network-dependent OCI tests
(test_local_image, test_enter_error, test_multiarch_image) flaky so they
retry instead of blanket-rerunning the suite.
Assisted-by: ClaudeCode:claude-opus-4.8
* Drop iOS clean step
Co-authored-by: Henry Schreiner <HenrySchreinerIII@gmail.com>
* ci: scope integration reruns to test_0_basic::test
Drop the blanket --reruns from the serial and non-serial integration
runs and instead mark test_0_basic.py::test as flaky, so only the known
flaky basic test is retried.
Assisted-by: ClaudeCode:claude-opus-4.8
---------
Signed-off-by: Henry Schreiner <henryfs@princeton.edu>
`OCIContainer.__enter__` was hardened in #2879 to always clean up on
failure, but `__exit__` was left unguarded. If the container/bash had
already died, `bash_stdin.write("exit 0")` raises `BrokenPipeError`; if
bash refuses to exit, `process.wait(timeout=30)` raises `TimeoutExpired`.
Either propagated out of `__exit__` before `_remove_container()` ran,
leaking the container (and, on timeout, the `start` process too).
Wrap the teardown so a broken pipe or timeout instead forces the process
down (kill + wait) and always falls through to container removal, while
still respecting CIBW_DEBUG_KEEP_CONTAINER. Pipe closes are now also
guarded so a flush-on-close against a dead pipe can't mask cleanup.
Add non-docker unit tests for the clean-exit, already-dead-bash, and
shutdown-timeout paths.
Assisted-by: ClaudeCode:claude-opus-4.8
This was the case when running `nox -s tests -- --run-podman -v -s 'unit_test/oci_container_test.py::test_multiarch_image[podman-OCIPlatform.i386]'` on macOS arm64.
* fix: ensure clean-up on container start failure and warn on removal failure
Properly release resources on container start failure.
If we fail to remove the created container, warn when not running in CI.
* Potential fix for pull request finding
Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com>
---------
Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com>
* chore: add unit tests for `OCIContainer._get_platform_args`
While this was already tested indirectly through `test_local_image`, this makes the behaviour check of `OCIContainer._get_platform_args` clear.
* fix: re-add `check=False` removed at some point in local testing
* tests: fully type the test suite
* chore: require more typing
Signed-off-by: Henry Schreiner <henryfs@princeton.edu>
* [pre-commit.ci] auto fixes from pre-commit.com hooks
for more information, see https://pre-commit.ci
---------
Signed-off-by: Henry Schreiner <henryfs@princeton.edu>
Co-authored-by: pre-commit-ci[bot] <66853113+pre-commit-ci[bot]@users.noreply.github.com>
* chore: clean up config a bit
* chore: add an extra check
* Apply suggestions from code review
Co-authored-by: Henry Schreiner <HenrySchreinerIII@gmail.com>
* fix doctest
* Update cibuildwheel/oci_container.py
Co-authored-by: Joe Rickerby <joerick@mac.com>
* Update cibuildwheel/oci_container.py
Co-authored-by: Joe Rickerby <joerick@mac.com>
* Update cibuildwheel/oci_container.py
Co-authored-by: Joe Rickerby <joerick@mac.com>
* Add xdoctest to CI
* Add doctests to run tests
* Replace test map with new native method
* Forgot key for arm64
* Allow doctests to be filtered on circleci
---------
Co-authored-by: Joe Rickerby <joerick@mac.com>
* feat: initial support for riscv64
* use enable for riscv64
* Apply review suggestion
Co-authored-by: Joe Rickerby <joerick@mac.com>
* update documentation
---------
Co-authored-by: Joe Rickerby <joerick@mac.com>
* drop EOL manylinux images
* chore: use multi-arch manylinux images as a source for image tag
Using multi-arch images directly messes with parallel tests for now.
Using them as a source for image tag ensures that all architecture specific tags are pointing to the same tag for a given manylinux / musllinux policy.
* Apply review suggestion
Co-authored-by: Joe Rickerby <joerick@mac.com>
---------
Co-authored-by: Joe Rickerby <joerick@mac.com>
* feat: add armv7l in auto_archs when running on aarch64
This depends on aarch32 EL0 support and thus is done conditionally.
* ci(travis): move to Ubuntu 22.04 / cp312
* Update dependencies
* ci(fix): use tonistiigi/binfmt:qemu-v8.1.5 image for qemu
* fix(test): implement retry for test_container_removed
The test is flaky on some platforms. Implement retry rather than just skip.
---------
Co-authored-by: cibuildwheel-bot[bot] <83877280+cibuildwheel-bot[bot]@users.noreply.github.com>
Co-authored-by: mayeut <mayeut@users.noreply.github.com>
* fix: parse version strings that include dashes
It's possible for some container engines to report their versions with a dash (e.g., "4.9.4-rhel"), which breaks packaging.version.Version's ability to parse the string. This commit introduces a version_from_string method which santizies the version string and returns an instance of Version.
* [pre-commit.ci] auto fixes from pre-commit.com hooks
for more information, see https://pre-commit.ci
* cleanup: pacify ruff
* cleanup: further pacify ruff
* fix: properly define _version_from_string method
Also, lift the method up and prefix with a "_" to better match the existing conventions
* [pre-commit.ci] auto fixes from pre-commit.com hooks
for more information, see https://pre-commit.ci
* refactor: more robust podman ver check
Use the "podman --version" command instead of "podman version -f {{json .}}" for better reliability across distributions.
* [pre-commit.ci] auto fixes from pre-commit.com hooks
for more information, see https://pre-commit.ci
* fix: oci engine version check
Lower Docker API check to 1.41
Podman versions are not PEP440 compliant, remove distro specific suffixes before parsing.
Add tests with real-world outputs and some made up ones.
* fix: UX on OCIEngineTooOldError
* Add FlexibleVersion
per review comment
---------
Co-authored-by: pre-commit-ci[bot] <66853113+pre-commit-ci[bot]@users.noreply.github.com>
Co-authored-by: mayeut <mayeut@users.noreply.github.com>
* fix: enforce minimum version of docker/podman
This allows to always pass `--platform` to the OCI engine
thus fixing issues with multiarch images.
* Allow older versions with warnings
* Upgrade docker on Travis CI
* fix: use `docker cp` instead of `tar`
* Enforce docker>=24.0
* move log to include container.copy_into
* fix: travis-ci, only update docker on aarch64
* skip test_multiarch_image on s390x / ppc64le
* skip flaky test
* chore: only install test deps on Travis CI
* fix: do not try to pull images tagged `cibw_local`
* use "--pull=never" for local images
* Use docker image inspect to check if an image needs to be pulled
Henry Schreiner