integration-tests: use HttpWaitStrategy

Use URL's .path property instead of .path() method when removing stale
control sockets in ControlSocket.run(). The .path() method returns only
the relative component ('control.sock') while .path resolves to the
full absolute path. Since the cwd change happens after the cleanup,
removeItem silently failed to find the socket.

Add unit tests verifying controlSocketURL resolves correctly for both
absolute cleanup and relative binding use cases.

Fixes: https://github.com/cirruslabs/tart/issues/1220

.cirrus.yml

@@ -1,8 +1,74 @@
 use_compute_credits: true
 
+task:
+  name: Test
+  alias: test
+  persistent_worker:
+    labels:
+      name: dev-mini
+    resources:
+      tart-vms: 1
+  build_script:
+    - swift build
+  test_script:
+    # Add /usr/sbin to PATH, otherwise testDiskutilInfo() fails to locate "diskutil"
+    - export PATH=$PATH:/usr/sbin
+    - swift test
+  integration_test_script:
+    - codesign --sign - --entitlements Resources/tart-dev.entitlements --force .build/debug/tart
+    - export PATH=$(pwd)/.build/arm64-apple-macosx/debug:$PATH
+    # Run integration tests
+    - cd integration-tests
+    - python3 -m venv --symlinks venv
+    - source venv/bin/activate
+    - pip install -r requirements.txt
+    - pytest --verbose --junit-xml=pytest-junit.xml
+    - go test -v ./...
+  pytest_junit_result_artifacts:
+    path: "integration-tests/pytest-junit.xml"
+    format: junit
+
+task:
+  name: Markdown Lint
+  only_if: $CIRRUS_BRANCH != 'gh-pages' && changesInclude('**.md')
+  container:
+    image: node:latest
+  install_script: npm install -g markdownlint-cli
+  lint_script: markdownlint --config=docs/.markdownlint.yml docs/
+
+task:
+  name: Lint
+  alias: lint
+  macos_instance:
+    image: ghcr.io/cirruslabs/macos-runner:tahoe
+  lint_script:
+    - swift package plugin --allow-writing-to-package-directory swiftformat --cache ignore --lint --report swiftformat.json .
+  always:
+    swiftformat_report_artifacts:
+      path: swiftformat.json
+      format: swiftformat
+
+task:
+  only_if: $CIRRUS_TAG == ''
+  env:
+    matrix:
+      BUILD_ARCH: arm64
+      BUILD_ARCH: x86_64
+  name: Build ($BUILD_ARCH)
+  alias: build
+  macos_instance:
+    image: ghcr.io/cirruslabs/macos-runner:tahoe
+  build_script: swift build --arch $BUILD_ARCH --product tart
+  sign_script: codesign --sign - --entitlements Resources/tart-dev.entitlements --force .build/$BUILD_ARCH-apple-macosx/debug/tart
+  binary_artifacts:
+    path: .build/$BUILD_ARCH-apple-macosx/debug/tart
+
 task:
   only_if: $CIRRUS_TAG == '' && ($CIRRUS_USER_PERMISSION == 'write' || $CIRRUS_USER_PERMISSION == 'admin')
   name: Release (Dry Run)
+  depends_on:
+    - lint
+    - build
   macos_instance:
     image: ghcr.io/cirruslabs/macos-runner:tahoe
   env:
@@ -31,3 +97,67 @@ task:
   always:
     dist_artifacts:
       path: "dist/*"
+
+task:
+  name: Release
+  only_if: $CIRRUS_TAG != ''
+  depends_on:
+    - lint
+    - build
+  macos_instance:
+    image: ghcr.io/cirruslabs/macos-runner:tahoe
+  env:
+    MACOS_CERTIFICATE: ENCRYPTED[552b9d275d1c2bdbc1bff778b104a8f9a53cbd0d59344d4b7f6d0ca3c811a5cefb97bef9ba0ef31c219cb07bdacdd2c2]
+    AC_PASSWORD: ENCRYPTED[4a761023e7e06fe2eb350c8b6e8e7ca961af193cb9ba47605f25f1d353abc3142606f412e405be48fd897a78787ea8c2]
+    GITHUB_TOKEN: ENCRYPTED[!98ace8259c6024da912c14d5a3c5c6aac186890a8d4819fad78f3e0c41a4e0cd3a2537dd6e91493952fb056fa434be7c!]
+    GORELEASER_KEY: ENCRYPTED[!9b80b6ef684ceaf40edd4c7af93014ee156c8aba7e6e5795f41c482729887b5c31f36b651491d790f1f668670888d9fd!]
+    SENTRY_ORG: cirrus-labs
+    SENTRY_PROJECT: persistent-workers
+    SENTRY_AUTH_TOKEN: ENCRYPTED[!9eaf2875d51b113e2f68598441ff8e6b2e53242e48fcb93633bd75a373fbe2e7caa900d837cc92f0b142b65579731644!]
+  setup_script:
+    - cd $HOME
+    - echo $MACOS_CERTIFICATE | base64 --decode > certificate.p12
+    - security create-keychain -p password101 build.keychain
+    - security default-keychain -s build.keychain
+    - security unlock-keychain -p password101 build.keychain
+    - security import certificate.p12 -k build.keychain -P password101 -T /usr/bin/codesign -T /usr/bin/pkgbuild
+    - security set-key-partition-list -S apple-tool:,apple:,codesign: -s -k password101 build.keychain
+    - xcrun notarytool store-credentials "notarytool" --apple-id "hello@cirruslabs.org" --team-id "9M2P8L4D89" --password $AC_PASSWORD
+  install_script:
+    - brew install go getsentry/tools/sentry-cli
+    - brew install mitchellh/gon/gon
+    - brew install --cask goreleaser/tap/goreleaser-pro
+  info_script:
+    - security find-identity -v
+    - xcodebuild -version
+    - swift -version
+  release_script: goreleaser
+  upload_sentry_debug_files_script:
+    - cd .build/arm64-apple-macosx/release/
+    # Generate and upload symbols
+    - dsymutil tart
+    - sentry-cli debug-files upload tart.dSYM/
+    - SENTRY_PROJECT=tart sentry-cli debug-files upload tart.dSYM/
+    # Bundle and upload sources
+    - sentry-cli debug-files bundle-sources tart.dSYM
+    - sentry-cli debug-files upload tart.src.zip
+    - SENTRY_PROJECT=tart sentry-cli debug-files upload tart.src.zip
+  create_sentry_release_script:
+    - export SENTRY_RELEASE="tart@$CIRRUS_TAG"
+    - sentry-cli releases new $SENTRY_RELEASE
+    - sentry-cli releases set-commits $SENTRY_RELEASE --auto
+    - sentry-cli releases finalize $SENTRY_RELEASE
+
+task:
+  name: Deploy Documentation
+  only_if: $CIRRUS_BRANCH == 'main'
+  container:
+    image: ghcr.io/squidfunk/mkdocs-material:latest
+    registry_config: ENCRYPTED[!cf1a0f25325aa75bad3ce6ebc890bc53eb0044c02efa70d8cefb83ba9766275a994b4831706c52630a0692b2fa9cfb9e!]
+  env:
+    DEPLOY_TOKEN: ENCRYPTED[!45ed45666558902ed1c2400add734ec063103bec31841847e8c8764802fca229bfa6d85c690e16ad159e047574b48793!]
+  deploy_script:
+    - git config --global user.name "Cirrus CI"
+    - git config --global user.name "hello@cirruslabs.org"
+    - git remote set-url origin https://$DEPLOY_TOKEN@github.com/cirruslabs/tart/
+    - mkdocs --verbose gh-deploy --force --remote-branch gh-pages

.goreleaser.yml

@@ -71,6 +71,8 @@ brews:
     install: |
       libexec.install Dir["*"]
       bin.write_exec_script "#{libexec}/tart.app/Contents/MacOS/tart"
-      generate_completions_from_executable(libexec/"tart.app/Contents/MacOS/tart", "--generate-completion-script")
     custom_block: |
       depends_on :macos => :ventura
+      def post_install
+        generate_completions_from_executable(libexec/"tart.app/Contents/MacOS/tart", "--generate-completion-script")
+      end

Sources/tart/ControlSocket.swift

@@ -19,7 +19,7 @@ class ControlSocket {
   func run() async throws {
     // Remove control socket file from previous "tart run" invocations,
     // if any, otherwise we may get the "address already in use" error
-    try? FileManager.default.removeItem(atPath: controlSocketURL.path())
+    try? FileManager.default.removeItem(atPath: controlSocketURL.path)
 
     // Change the current working directory to a VM's base directory
     // to work around Unix domain socket 104 byte limitation [1]

Tests/TartTests/ControlSocketURLTests.swift

@@ -0,0 +1,28 @@
+import XCTest
+@testable import tart
+
+final class ControlSocketURLTests: XCTestCase {
+  func testControlSocketURLResolvesToAbsolutePath() throws {
+    let baseURL = URL(fileURLWithPath: "/Users/test/.tart/vms/myvm/")
+    let vmDir = VMDirectory(baseURL: baseURL)
+
+    // The .path property resolves relative URLs to absolute paths,
+    // which is required for stale socket cleanup in ControlSocket.run()
+    // since it happens before the working directory is changed.
+    XCTAssertEqual(
+      vmDir.controlSocketURL.path,
+      "/Users/test/.tart/vms/myvm/control.sock"
+    )
+  }
+
+  func testControlSocketURLRelativePathIsJustFilename() throws {
+    let baseURL = URL(fileURLWithPath: "/Users/test/.tart/vms/myvm/")
+    let vmDir = VMDirectory(baseURL: baseURL)
+
+    // The .relativePath is used for socket binding after cwd is changed
+    XCTAssertEqual(
+      vmDir.controlSocketURL.relativePath,
+      "control.sock"
+    )
+  }
+}

Tests/TartTests/LayerizerTests.swift

@@ -14,7 +14,7 @@ final class LayerizerTests: XCTestCase {
     do {
       registryRunner = try await RegistryRunner()
     } catch {
-      try XCTSkipIf(ProcessInfo.processInfo.environment["CI"] == nil)
+      try XCTSkip("Registry is unavailable: \(error)")
     }
   }
 
@@ -26,7 +26,7 @@ final class LayerizerTests: XCTestCase {
 
   func testDiskV2() async throws {
     // Original disk file to be pushed to the registry
-    let originalDiskFileURL = try fileWithRandomData(sizeBytes: 5 * 1024 * 1024 * 1024)
+    let originalDiskFileURL = try fileWithRandomData(sizeBytes: 1 * 1024 * 1024 * 1024)
     addTeardownBlock {
       try FileManager.default.removeItem(at: originalDiskFileURL)
     }

Tests/TartTests/RegistryTests.swift

@@ -10,7 +10,7 @@ final class RegistryTests: XCTestCase {
     do {
       registryRunner = try await RegistryRunner()
     } catch {
-      try XCTSkipIf(ProcessInfo.processInfo.environment["CI"] == nil)
+      try XCTSkip("Registry is unavailable: \(error)")
     }
   }
 

Tests/TartTests/Util/RegistryRunner.swift

@@ -13,7 +13,7 @@ class RegistryRunner {
     let stdoutPipe = Pipe()
 
     let proc = Process()
-    proc.executableURL = URL(fileURLWithPath: "/usr/local/bin/docker")
+    proc.executableURL = URL(fileURLWithPath: "/opt/homebrew/bin/docker")
     proc.arguments = arguments
     proc.standardOutput = stdoutPipe
     try proc.run()
@@ -31,7 +31,7 @@ class RegistryRunner {
 
   init() async throws {
     // Start container
-    let container = try Self.dockerCmd("run", "-d", "--rm", "-p", "127.0.0.1:0:5000", "registry:2")
+    let container = try Self.dockerCmd("run", "-d", "--rm", "-p", "127.0.0.1::5000", "registry:2")
       .trimmingCharacters(in: CharacterSet.newlines)
     containerID = container
 

docs/faq.md

@@ -59,7 +59,7 @@ Remote images are pulled into `~/.tart/cache/OCIs/`.
 ## Nested virtualization support?
 
 Tart is limited by functionality of Apple's `Virtualization.Framework`. At the moment `Virtualization.Framework`
-supports nested virtualization only on M3 or M4 chips running macOS 15 (Sequoia) or later. By default, it is disabled, but can be enabled by passing the `--nested` flag to `tart run`.
+supports nested virtualization only on M3 or M4 chips running macOS 15 (Sequoia) or later and [only for Linux VMs](https://github.com/cirruslabs/tart/issues/1231#issuecomment-4410915463). By default, it is disabled, but can be enabled by passing the `--nested` flag to `tart run`.
 
 ## Connecting to a service running on host
 

docs/theme/overrides/home.html

@@ -1,5 +1,11 @@
 {% extends "base.html" %}
 
+{% block announce %}
+<a href="https://cirruslabs.org/">
+  ️🎉🎉🎉️&nbsp&nbspBig milestone for Cirrus Labs &mdash; we’re joining <strong>OpenAI</strong> to work on Agent Infrastructure&nbsp;&nbsp;🎉🎉🎉
+</a>
+{% endblock %}
+
 <!-- Render landing page under tabs -->
 {% block tabs %} {{ super() }}
 

integration-tests/docker_registry.py

@@ -1,7 +1,5 @@
-import requests
-
-from testcontainers.core.waiting_utils import wait_container_is_ready
 from testcontainers.core.container import DockerContainer
+from testcontainers.core.wait_strategies import HttpWaitStrategy
 
 
 class DockerRegistry(DockerContainer):
@@ -10,11 +8,9 @@ class DockerRegistry(DockerContainer):
     def __init__(self):
         super().__init__("registry:2")
         self.with_exposed_ports(self._default_exposed_port)
+        self.waiting_for(HttpWaitStrategy(self._default_exposed_port, "/v2/").for_status_code(200))
 
-    @wait_container_is_ready(requests.exceptions.ConnectionError)
     def remote_name(self, for_vm: str):
         exposed_port = self.get_exposed_port(self._default_exposed_port)
 
-        requests.get(f"http://127.0.0.1:{exposed_port}/v2/")
-
         return f"127.0.0.1:{exposed_port}/tart/{for_vm}:latest"

integration-tests/test_oci.py

@@ -46,7 +46,7 @@ def vm_with_random_disk(tart):
     disk_path = os.path.join(tart.home(), "vms", vm_name, "disk.img")
 
     with tempfile.NamedTemporaryFile(delete=False) as tf:
-        tf.write(os.urandom(amount_to_transfer.bytes))
+        tf.write(os.urandom(int(amount_to_transfer.bytes)))
         tf.close()
         os.rename(tf.name, disk_path)