* chore: faster mypy
This makes mypy around 26% faster from a cold cache.
Signed-off-by: Henry Schreiner <henryfs@princeton.edu>
* chore: enable more mypy error codes
Turn on possibly-undefined, exhaustive-match, and other strict flags, and
fix what they report. Two real bugs: pyodide never set `repaired_wheel`
when it reused a compatible wheel, so the test step failed with a
NameError; the OCI shell read loop spun forever if the shell exited.
Assisted-by: ClaudeCode:claude-opus-5
* test: carry default OCI runtime into podman vfs test config
Podman ignores its usual config files when CONTAINERS_CONF is set, so it
falls back to the first runtime found on PATH. On current GitHub Ubuntu
runner images that is crun 1.14.1, which cannot parse the OCI spec v1.2.x
config that podman 5.8.4 generates ("crun: unknown version specified").
Query the default runtime path and set it in the generated config.
Assisted-by: ClaudeCode:claude-fable-5
* fix: annotate vfs config dict so mypy passes on Linux
mypy on macOS marks the rest of the function unreachable after the
darwin pytest.skip, so the strict index error only appears on Linux.
Assisted-by: ClaudeCode:claude-fable-5
* chore: minor cleanup of variable name
Signed-off-by: Henry Schreiner <henryfs@princeton.edu>
* test: cover container shell exiting during call
Assisted-by: ClaudeCode:claude-opus-5
---------
Signed-off-by: Henry Schreiner <henryfs@princeton.edu>
* ci: improve Azure test reliability
Azure has intermittent failures, often the macOS framework-Python
`posix_spawn: Undefined error: 0` spawn race under load, plus transient
download flakiness. Address both:
- Retry integration tests via pytest-rerunfailures (already required):
add `--reruns=2 --reruns-delay=5` to the serial and non-serial runs so a
single transient flake self-heals instead of failing the whole job.
- Cap Azure at `--num-processes 3` to reduce concurrent process spawning
(the macOS runner was using 4 xdist workers), lowering the spawn-race
probability and peak resource pressure.
- Cache downloads across runs: relocate CIBW_CACHE_PATH to a stable path
and add a Cache@2 task (interpreter downloads + per-worker test pip
caches live under it), cutting the network-download flake surface.
- Bump the Azure host interpreter to 3.13.
Assisted-by: ClaudeCode:claude-opus-4.8
* ci: stabilize iOS tests, bound rerun cost
An iOS run on Azure (build 9043) hung for the full 40-min pytest timeout
on the second build config of test_ios_platforms, then reran twice
(reruns=2), blowing past the 180-min job cap with no useful signal. The
hang was a stuck simulator/xcodebuild on the second config, after the
first config had run.
- Shut down running simulators before each parametrized config via a
`clean_ios_simulators` fixture, so a simulator left booted/wedged by the
previous config isn't reused.
- Drop iOS reruns from 2 to 1. One retry still covers the documented
"fails the first time" simulator-boot flake, while halving the
worst-case retry cost (3x40=120min -> 2x40=80min) on a hang.
Assisted-by: ClaudeCode:claude-opus-4.8
* ci: don't limit num processes
Signed-off-by: Henry Schreiner <henryfs@princeton.edu>
* ci: rerun OCI unit tests that pull from Docker Hub
test_local_image et al. occasionally fail on a transient Docker Hub
anonymous-pull blip ("unauthorized: authentication required") when
pulling debian:trixie-slim. The integration runs already self-heal via
pytest-rerunfailures, but the unit run had no reruns, so a single flake
failed the whole job. Mark the three network-dependent OCI tests
(test_local_image, test_enter_error, test_multiarch_image) flaky so they
retry instead of blanket-rerunning the suite.
Assisted-by: ClaudeCode:claude-opus-4.8
* Drop iOS clean step
Co-authored-by: Henry Schreiner <HenrySchreinerIII@gmail.com>
* ci: scope integration reruns to test_0_basic::test
Drop the blanket --reruns from the serial and non-serial integration
runs and instead mark test_0_basic.py::test as flaky, so only the known
flaky basic test is retried.
Assisted-by: ClaudeCode:claude-opus-4.8
---------
Signed-off-by: Henry Schreiner <henryfs@princeton.edu>
`OCIContainer.__enter__` was hardened in #2879 to always clean up on
failure, but `__exit__` was left unguarded. If the container/bash had
already died, `bash_stdin.write("exit 0")` raises `BrokenPipeError`; if
bash refuses to exit, `process.wait(timeout=30)` raises `TimeoutExpired`.
Either propagated out of `__exit__` before `_remove_container()` ran,
leaking the container (and, on timeout, the `start` process too).
Wrap the teardown so a broken pipe or timeout instead forces the process
down (kill + wait) and always falls through to container removal, while
still respecting CIBW_DEBUG_KEEP_CONTAINER. Pipe closes are now also
guarded so a flush-on-close against a dead pipe can't mask cleanup.
Add non-docker unit tests for the clean-exit, already-dead-bash, and
shutdown-timeout paths.
Assisted-by: ClaudeCode:claude-opus-4.8
This was the case when running `nox -s tests -- --run-podman -v -s 'unit_test/oci_container_test.py::test_multiarch_image[podman-OCIPlatform.i386]'` on macOS arm64.
* fix: ensure clean-up on container start failure and warn on removal failure
Properly release resources on container start failure.
If we fail to remove the created container, warn when not running in CI.
* Potential fix for pull request finding
Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com>
---------
Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com>
* chore: add unit tests for `OCIContainer._get_platform_args`
While this was already tested indirectly through `test_local_image`, this makes the behaviour check of `OCIContainer._get_platform_args` clear.
* fix: re-add `check=False` removed at some point in local testing
* tests: fully type the test suite
* chore: require more typing
Signed-off-by: Henry Schreiner <henryfs@princeton.edu>
* [pre-commit.ci] auto fixes from pre-commit.com hooks
for more information, see https://pre-commit.ci
---------
Signed-off-by: Henry Schreiner <henryfs@princeton.edu>
Co-authored-by: pre-commit-ci[bot] <66853113+pre-commit-ci[bot]@users.noreply.github.com>
* chore: clean up config a bit
* chore: add an extra check
* Apply suggestions from code review
Co-authored-by: Henry Schreiner <HenrySchreinerIII@gmail.com>
* fix doctest
* Update cibuildwheel/oci_container.py
Co-authored-by: Joe Rickerby <joerick@mac.com>
* Update cibuildwheel/oci_container.py
Co-authored-by: Joe Rickerby <joerick@mac.com>
* Update cibuildwheel/oci_container.py
Co-authored-by: Joe Rickerby <joerick@mac.com>
* Add xdoctest to CI
* Add doctests to run tests
* Replace test map with new native method
* Forgot key for arm64
* Allow doctests to be filtered on circleci
---------
Co-authored-by: Joe Rickerby <joerick@mac.com>
* feat: initial support for riscv64
* use enable for riscv64
* Apply review suggestion
Co-authored-by: Joe Rickerby <joerick@mac.com>
* update documentation
---------
Co-authored-by: Joe Rickerby <joerick@mac.com>
* drop EOL manylinux images
* chore: use multi-arch manylinux images as a source for image tag
Using multi-arch images directly messes with parallel tests for now.
Using them as a source for image tag ensures that all architecture specific tags are pointing to the same tag for a given manylinux / musllinux policy.
* Apply review suggestion
Co-authored-by: Joe Rickerby <joerick@mac.com>
---------
Co-authored-by: Joe Rickerby <joerick@mac.com>
* feat: add armv7l in auto_archs when running on aarch64
This depends on aarch32 EL0 support and thus is done conditionally.
* ci(travis): move to Ubuntu 22.04 / cp312
* Update dependencies
* ci(fix): use tonistiigi/binfmt:qemu-v8.1.5 image for qemu
* fix(test): implement retry for test_container_removed
The test is flaky on some platforms. Implement retry rather than just skip.
---------
Co-authored-by: cibuildwheel-bot[bot] <83877280+cibuildwheel-bot[bot]@users.noreply.github.com>
Co-authored-by: mayeut <mayeut@users.noreply.github.com>
* fix: parse version strings that include dashes
It's possible for some container engines to report their versions with a dash (e.g., "4.9.4-rhel"), which breaks packaging.version.Version's ability to parse the string. This commit introduces a version_from_string method which santizies the version string and returns an instance of Version.
* [pre-commit.ci] auto fixes from pre-commit.com hooks
for more information, see https://pre-commit.ci
* cleanup: pacify ruff
* cleanup: further pacify ruff
* fix: properly define _version_from_string method
Also, lift the method up and prefix with a "_" to better match the existing conventions
* [pre-commit.ci] auto fixes from pre-commit.com hooks
for more information, see https://pre-commit.ci
* refactor: more robust podman ver check
Use the "podman --version" command instead of "podman version -f {{json .}}" for better reliability across distributions.
* [pre-commit.ci] auto fixes from pre-commit.com hooks
for more information, see https://pre-commit.ci
* fix: oci engine version check
Lower Docker API check to 1.41
Podman versions are not PEP440 compliant, remove distro specific suffixes before parsing.
Add tests with real-world outputs and some made up ones.
* fix: UX on OCIEngineTooOldError
* Add FlexibleVersion
per review comment
---------
Co-authored-by: pre-commit-ci[bot] <66853113+pre-commit-ci[bot]@users.noreply.github.com>
Co-authored-by: mayeut <mayeut@users.noreply.github.com>
* fix: enforce minimum version of docker/podman
This allows to always pass `--platform` to the OCI engine
thus fixing issues with multiarch images.
* Allow older versions with warnings
* Upgrade docker on Travis CI
* fix: use `docker cp` instead of `tar`
* Enforce docker>=24.0
* move log to include container.copy_into
* fix: travis-ci, only update docker on aarch64
* skip test_multiarch_image on s390x / ppc64le
* skip flaky test
* chore: only install test deps on Travis CI
* fix: do not try to pull images tagged `cibw_local`
* use "--pull=never" for local images
* Use docker image inspect to check if an image needs to be pulled
Henry Schreiner