Merge branch 'main' into use-tar-hash-as-checksum

Author: JaewonHur

.github/workflows/common.yml

@@ -8,7 +8,7 @@ on:
 
 jobs:
   build:
-    runs-on: [self-hosted, macos, sequoia, ARM64]
+    runs-on: [self-hosted, macos, tahoe, ARM64]
     timeout-minutes: 30
     steps: 
       - uses: actions/setup-go@v5

pkg/build/buildopts.go

@@ -219,9 +219,31 @@ func NewBuildOpts(ctx context.Context, basePath string, contextMap map[string][]
 	// to ExcludePatterns(dockerignore) patterns
 	addedGlobs := []string{}
 	for _, node := range dockerfile.AST.Children {
-		if node.Value == "COPY" || node.Value == "ADD" {
+		if strings.EqualFold(node.Value, "COPY") || strings.EqualFold(node.Value, "ADD") {
 			addedGlobs = append(addedGlobs, node.Next.Value)
 		}
+
+		// Extract source paths from bind mount flags in RUN commands
+		if strings.EqualFold(node.Value, "RUN") {
+			cmd, err := instructions.ParseInstruction(node)
+			if err != nil {
+				continue
+			} else if runCmd, ok := cmd.(*instructions.RunCommand); ok {
+				runCmd.Expand(func(word string) (string, error) {
+					// Single word expander to normalize source path
+					source := strings.TrimPrefix(word, "/")
+					normalized := filepath.Clean(source)
+					return normalized, nil
+				})
+				mounts := instructions.GetMounts(runCmd)
+				for _, mount := range mounts {
+					// Only add source paths from bind mounts (not from other stages)
+					if mount.Type == instructions.MountTypeBind && mount.Source != "" && mount.From == "" {
+						addedGlobs = append(addedGlobs, mount.Source)
+					}
+				}
+			}
+		}
 	}
 
 	fssyncProxy, err := fssync.NewFSSyncProxy(".", basePath, addedGlobs)

pkg/fssync/walk.go

@@ -23,6 +23,7 @@ import (
 	"strings"
 
 	"github.com/google/uuid"
+	"github.com/moby/patternmatcher"
 
 	"github.com/apple/container-builder-shim/pkg/api"
 	"github.com/apple/container-builder-shim/pkg/fileutils"
@@ -83,6 +84,10 @@ func (f *FS) Walk(ctx context.Context, target string, fn fs.WalkDirFunc) error {
 	if err != nil {
 		return err
 	}
+	excludeMatcher, err := patternmatcher.New(strings.Split(walkMeta.ExcludedPatterns, ","))
+	if err != nil {
+		return err
+	}
 
 	id := uuid.NewString()
 	demux := stream.NewDemuxWithContext(cancellableCtx, id, stream.FilterByBuildID(id), func(any) {})
@@ -119,7 +124,14 @@ func (f *FS) Walk(ctx context.Context, target string, fn fs.WalkDirFunc) error {
 	switch walkMeta.Mode {
 	case ModeTAR:
 		receiver := fileutils.NewTarReceiver(f.fsPath, demux)
-		checksum, err := receiver.Receive(ctx, fn)
+		checksum, err := receiver.Receive(ctx, func(path string, d fs.DirEntry, err error) error {
+			excluded, err := excludeMatcher.MatchesOrParentMatches(path)
+			if excluded {
+				return nil
+			}
+
+			return fn(path, d, err)
+		})
 		if err != nil {
 			return err
 		}
@@ -145,16 +157,18 @@ type RawFileInfo struct {
 }
 
 type WalkMetadata struct {
-	IncludePatterns string
-	FollowPaths     string
-	DirName         string
-	Mode            TransferMode
+	IncludePatterns  string
+	ExcludedPatterns string
+	FollowPaths      string
+	DirName          string
+	Mode             TransferMode
 }
 
 func unmarshalWalkMetadata(ctx context.Context) (*WalkMetadata, error) {
 	md := &WalkMetadata{}
 	if m, ok := metadata.FromIncomingContext(ctx); ok {
 		md.IncludePatterns = strings.Join(m["include-patterns"], ",")
+		md.ExcludedPatterns = strings.Join(m["exclude-patterns"], ",")
 		md.FollowPaths = strings.Join(m["followpaths"], ",")
 		md.DirName = strings.Join(m["dir-name"], ",")
 		modeStr := strings.Join(m["mode"], ",")