chore(deps): Bump the backend group across 1 directory with 14 updates

.github/workflows/ci_main.yml

@@ -1,13 +1,8 @@
-name: Build & Upload
+name: Build and push binaries for rolling release
 
 on:
   push:
     branches: ["main"]
-  workflow_dispatch:
-
-concurrency:
-  group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.ref }}
-  cancel-in-progress: true
 
 permissions:
   contents: read
@@ -19,18 +14,26 @@ permissions:
 jobs:
   build:
     name: Build
+    # A newer push supersedes an in-flight build of the same ref.
+    concurrency:
+      group: ${{ github.workflow }}-build-${{ github.ref }}
+      cancel-in-progress: true
     uses: ./.github/workflows/build.yml
     with:
       ref: ${{ github.sha }}
       go_version: "1.26.4"
 
-  upload:
-    name: Upload
+  release:
+    name: Rolling release
     needs: build
-    uses: ./.github/workflows/upload_s3.yml
+    # Publishing is not atomic (tag move + asset delete/re-upload), so never
+    # cancel a publish in progress; queue the next one behind it instead.
+    concurrency:
+      group: ${{ github.workflow }}-release
+      cancel-in-progress: false
+    permissions:
+      contents: write
+    uses: ./.github/workflows/rolling_release.yml
     with:
       ref: ${{ github.sha }}
-    secrets:
-      AWS_ACCESS_KEY: ${{ secrets.AWS_ACCESS_KEY }}
-      AWS_SECRET_ACCESS_KEY: ${{ secrets.AWS_SECRET_ACCESS_KEY }}
-
+      tag: nightly

.github/workflows/rolling_release.yml

@@ -0,0 +1,84 @@
+name: Rolling release
+
+on:
+  workflow_call:
+    inputs:
+      ref:
+        description: 'Commit SHA the binaries were built from'
+        required: true
+        type: string
+      tag:
+        description: 'Rolling release tag to (re)point at the commit'
+        required: true
+        type: string
+
+jobs:
+  publish:
+    name: Publish ${{ inputs.tag }} pre-release
+    runs-on: ubuntu-22.04
+    permissions:
+      contents: write
+
+    steps:
+    - name: Harden the runner (Audit all outbound calls)
+      uses: step-security/harden-runner@b09bb98e06d4d774595224525879c09bc6e98c40 # v2.20.1
+      with:
+        egress-policy: audit
+
+    # A re-run of an old run keeps its original github.sha, and a slow build can
+    # finish after a newer push has already published. Either would rewind the
+    # rolling release, so only the current tip of the branch may publish.
+    - name: Check that ${{ inputs.ref }} is still the tip of ${{ github.ref_name }}
+      id: tip
+      env:
+        GH_TOKEN: ${{ github.token }}
+        REPO: ${{ github.repository }}
+        BRANCH: ${{ github.ref_name }}
+        SHA: ${{ inputs.ref }}
+      run: |
+        tip=$(gh api "repos/${REPO}/git/ref/heads/${BRANCH}" --jq .object.sha)
+        if [ "${tip}" = "${SHA}" ]; then
+          echo "current=true" >> "$GITHUB_OUTPUT"
+        else
+          echo "::notice::${BRANCH} has moved on to ${tip}; not publishing ${SHA}. The run for ${tip} publishes it."
+          echo "current=false" >> "$GITHUB_OUTPUT"
+        fi
+
+    - name: Download build artifacts
+      if: steps.tip.outputs.current == 'true'
+      uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
+      with:
+        pattern: '*_static_*-${{ github.run_id }}'
+        path: dist
+        merge-multiple: true
+
+    - name: Publish pre-release
+      if: steps.tip.outputs.current == 'true'
+      uses: softprops/action-gh-release@efb35369e0ad2afab669f228072c1b0d510eae64 # v3.0.3
+      with:
+        tag_name: ${{ inputs.tag }}
+        target_commitish: ${{ inputs.ref }}
+        name: ${{ inputs.tag }} (${{ github.ref_name }} @ ${{ inputs.ref }})
+        body: |
+          Rolling build of `${{ github.ref_name }}` at commit ${{ inputs.ref }}.
+
+        prerelease: true
+        make_latest: false
+        draft: false
+        generate_release_notes: false
+        overwrite_files: true
+        preserve_order: true
+        fail_on_unmatched_files: true
+        files: |
+          dist/*_static_*
+
+    - name: Move ${{ inputs.tag }} tag to ${{ inputs.ref }}
+      if: steps.tip.outputs.current == 'true'
+      env:
+        GH_TOKEN: ${{ github.token }}
+        REPO: ${{ github.repository }}
+        TAG: ${{ inputs.tag }}
+        SHA: ${{ inputs.ref }}
+      run: |
+        gh api --method PATCH "repos/${REPO}/git/refs/tags/${TAG}" \
+          -f sha="${SHA}" -F force=true

docs/installation.md

@@ -527,12 +527,14 @@ sudo mv $CONTAINERD_BINARY_FILENAME /usr/local/bin/containerd-shim-urunc-v2
 
 #### Option 3: Install from latest artifacts (tip of the main branch)
 
-Alternatively, to get a `urunc` binary based on the main branch:
+Alternatively, to get a `urunc` binary based on the main branch, use the
+rolling [`nightly`](https://github.com/urunc-dev/urunc/releases/tag/nightly)
+pre-release.
 
 ```bash
-URUNC_VERSION=main
+URUNC_VERSION=nightly
 URUNC_BINARY_FILENAME="urunc_static_$(dpkg --print-architecture)"
-wget -q https://s3.nbfc.io/nbfc-assets/github/urunc/dist/$URUNC_VERSION/$(dpkg --print-architecture)/$URUNC_BINARY_FILENAME
+wget -q https://github.com/urunc-dev/urunc/releases/download/$URUNC_VERSION/$URUNC_BINARY_FILENAME
 chmod +x $URUNC_BINARY_FILENAME
 sudo mv $URUNC_BINARY_FILENAME /usr/local/bin/urunc
 ```
@@ -541,7 +543,7 @@ And for `containerd-shim-urunc-v2`:
 
 ```bash
 CONTAINERD_BINARY_FILENAME="containerd-shim-urunc-v2_static_$(dpkg --print-architecture)"
-wget -q https://s3.nbfc.io/nbfc-assets/github/urunc/dist/$URUNC_VERSION/$(dpkg --print-architecture)/$CONTAINERD_BINARY_FILENAME
+wget -q https://github.com/urunc-dev/urunc/releases/download/$URUNC_VERSION/$CONTAINERD_BINARY_FILENAME
 chmod +x $CONTAINERD_BINARY_FILENAME
 sudo mv $CONTAINERD_BINARY_FILENAME /usr/local/bin/containerd-shim-urunc-v2
 ```

go.mod

@@ -7,33 +7,33 @@ require (
 	github.com/asaskevich/govalidator v0.0.0-20230301143203-a9d515a09cc2
 	github.com/cavaliergopher/cpio v1.0.1
 	github.com/containerd/containerd v1.7.33
-	github.com/containerd/containerd/api v1.10.0
-	github.com/containerd/log v0.1.0
-	github.com/containerd/ttrpc v1.2.9
+	github.com/containerd/containerd/api v1.12.0
+	github.com/containerd/log v0.2.0
+	github.com/containerd/ttrpc v1.2.10
 	github.com/creack/pty v1.1.24
 	github.com/cyphar/filepath-securejoin v0.7.0
 	github.com/elastic/go-seccomp-bpf v1.6.0
 	github.com/hashicorp/go-version v1.9.0
 	github.com/jackpal/gateway v1.2.0
 	github.com/moby/sys/mountinfo v0.7.2
-	github.com/moby/sys/userns v0.1.0
+	github.com/moby/sys/userns v0.2.1
 	github.com/nubificus/hedge_cli v0.0.3
-	github.com/onsi/ginkgo/v2 v2.32.0
-	github.com/onsi/gomega v1.42.1
-	github.com/opencontainers/cgroups v0.0.4
+	github.com/onsi/ginkgo/v2 v2.33.1
+	github.com/onsi/gomega v1.44.0
+	github.com/opencontainers/cgroups v0.1.0
 	github.com/opencontainers/image-spec v1.1.1
 	github.com/opencontainers/runc v1.3.6
-	github.com/opencontainers/runtime-spec v1.2.1
+	github.com/opencontainers/runtime-spec v1.3.0
 	github.com/prometheus-community/pro-bing v0.9.1
 	github.com/rs/zerolog v1.35.1
-	github.com/sirupsen/logrus v1.9.4
-	github.com/stretchr/testify v1.11.1
-	github.com/urfave/cli/v3 v3.10.1
+	github.com/sirupsen/logrus v1.10.2
+	github.com/stretchr/testify v1.12.1
+	github.com/urfave/cli/v3 v3.14.0
 	github.com/vishvananda/netlink v1.3.1
 	github.com/vishvananda/netns v0.0.5
-	golang.org/x/sys v0.47.0
-	google.golang.org/grpc v1.83.0
-	k8s.io/cri-api v0.36.3
+	golang.org/x/sys v0.49.0
+	google.golang.org/grpc v1.84.0
+	k8s.io/cri-api v0.37.1
 )
 
 require (
@@ -53,7 +53,6 @@ require (
 	github.com/containerd/platforms v1.0.0-rc.4 // indirect
 	github.com/containerd/typeurl/v2 v2.3.0 // indirect
 	github.com/coreos/go-systemd/v22 v22.7.0 // indirect
-	github.com/davecgh/go-spew v1.1.2-0.20180830191138-d8f796af33cc // indirect
 	github.com/docker/go-events v0.0.0-20260608200158-dbf6103125a4 // indirect
 	github.com/docker/go-units v0.5.0 // indirect
 	github.com/go-logr/logr v1.4.3 // indirect
@@ -73,17 +72,15 @@ require (
 	github.com/opencontainers/go-digest v1.0.0 // indirect
 	github.com/opencontainers/selinux v1.13.1 // indirect
 	github.com/pkg/errors v0.9.1 // indirect
-	github.com/pmezard/go-difflib v1.0.1-0.20181226105442-5d4384ee4fb2 // indirect
 	github.com/seccomp/libseccomp-golang v0.10.0 // indirect
 	go.opencensus.io v0.24.0 // indirect
-	go.yaml.in/yaml/v3 v3.0.4 // indirect
-	golang.org/x/mod v0.36.0 // indirect
-	golang.org/x/net v0.56.0 // indirect
-	golang.org/x/sync v0.21.0 // indirect
-	golang.org/x/text v0.38.0 // indirect
-	golang.org/x/tools v0.45.0 // indirect
+	go.yaml.in/yaml/v3 v3.0.5 // indirect
+	golang.org/x/mod v0.37.0 // indirect
+	golang.org/x/net v0.57.0 // indirect
+	golang.org/x/sync v0.22.0 // indirect
+	golang.org/x/text v0.40.0 // indirect
+	golang.org/x/tools v0.47.0 // indirect
 	google.golang.org/genproto v0.0.0-20260622175928-b703f567277d // indirect
-	google.golang.org/genproto/googleapis/rpc v0.0.0-20260622175928-b703f567277d // indirect
+	google.golang.org/genproto/googleapis/rpc v0.0.0-20260706201446-f0a921348800 // indirect
 	google.golang.org/protobuf v1.36.12-0.20260120151049-f2248ac996af // indirect
-	gopkg.in/yaml.v3 v3.0.1 // indirect
 )