Merge branch 'main' into dockerCLI

* main:
  feat(wait): add human-readable String() methods to all wait strategies (docker#119)
  feat(image): display formatted pull progress on Windows terminals (docker#118)
  chore(release): add Go proxy refresh automation (docker#117)
  chore(release): bump module versions
  chore(release): prevent for pushing to personal forks (docker#115)
  chore(release): add pre-release checks to make the release process more consistent (docker#114)
  chore(volume): return pointer in FindByID (docker#105)
  fix(container): proper error message on empty container names (docker#113)
  fix(container): add to nil modifiers (docker#112)
  feat(container): add new functional options to add container config, hostConfig and endpointSettings (docker#111)
  feat(container): configure pull handler at container creation (docker#110)

Author: mdelapenya

.github/scripts/check-pre-release.sh

@@ -0,0 +1,82 @@
+#!/bin/bash
+
+# =============================================================================
+# Pre-Release Check Script
+# =============================================================================
+# Description: Verifies that pre-release was completed successfully for a module
+#              by checking if the next-tag file exists and matches version.go
+#
+# Usage: ./.github/scripts/check-pre-release.sh <module>
+#
+# Arguments:
+#   module           - Name of the module to check (required)
+#                      Examples: client, container, config, context, image, network
+#
+# Exit Codes:
+#   0 - Check passed
+#   1 - Check failed (missing files or version mismatch)
+#
+# Examples:
+#   ./.github/scripts/check-pre-release.sh client
+#   ./.github/scripts/check-pre-release.sh container
+#
+# Dependencies:
+#   - grep (for parsing version.go)
+#
+# Files Checked:
+#   - .github/scripts/.build/<module>-next-tag  - Pre-release version file
+#   - <module>/version.go                       - Current version file
+#
+# =============================================================================
+
+set -e
+
+# Source common functions
+readonly SCRIPT_DIR="$( cd "$( dirname "${BASH_SOURCE[0]}" )" && pwd )"
+source "${SCRIPT_DIR}/common.sh"
+
+# Get module name from argument and lowercase it
+readonly MODULE=$(echo "${1:-}" | tr '[:upper:]' '[:lower:]')
+
+if [[ -z "$MODULE" ]]; then
+  echo "Error: Module name is required"
+  echo "Usage: $0 <module>"
+  echo "Example: $0 client"
+  exit 1
+fi
+
+echo "Checking if pre-release was completed for module: ${MODULE}"
+
+# Check if next-tag file exists
+readonly BUILD_FILE="${BUILD_DIR}/${MODULE}-next-tag"
+if [[ ! -f "${BUILD_FILE}" ]]; then
+  echo "Error: Missing build file for module '${MODULE}' at ${BUILD_FILE}"
+  echo "Please run 'make pre-release-all' or 'make pre-release' first (with DRY_RUN=false)"
+  exit 1
+fi
+
+# Read next version from build file
+readonly NEXT_VERSION=$(cat "${BUILD_FILE}" | tr -d '\n')
+readonly NEXT_VERSION_NO_V="${NEXT_VERSION#v}"
+
+# Check if version.go exists
+readonly VERSION_FILE="${ROOT_DIR}/${MODULE}/version.go"
+if [[ ! -f "${VERSION_FILE}" ]]; then
+  echo "Error: version.go not found at ${VERSION_FILE}"
+  exit 1
+fi
+
+# Read current version from version.go
+readonly CURRENT_VERSION=$(get_version_from_file "${VERSION_FILE}")
+
+# Compare versions
+if [[ "${CURRENT_VERSION}" != "${NEXT_VERSION_NO_V}" ]]; then
+  echo "Error: Version mismatch for module '${MODULE}'"
+  echo "  Expected (from ${BUILD_FILE}): ${NEXT_VERSION_NO_V}"
+  echo "  Actual (from ${VERSION_FILE}): ${CURRENT_VERSION}"
+  echo "Please run 'make pre-release-all' or 'make pre-release' again (with DRY_RUN=false)"
+  exit 1
+fi
+
+echo "✅ Pre-release check passed for module: ${MODULE} (version: ${NEXT_VERSION_NO_V})"
+exit 0

.github/scripts/common.sh

@@ -39,6 +39,8 @@ readonly CURRENT_DIR="$(get_script_dir)"
 readonly ROOT_DIR="$(dirname $(dirname "${CURRENT_DIR}"))"
 readonly BUILD_DIR="${ROOT_DIR}/.github/scripts/.build"
 readonly GITHUB_REPO="github.com/docker/go-sdk"
+readonly EXPECTED_ORIGIN_SSH="[email protected]:docker/go-sdk.git"
+readonly EXPECTED_ORIGIN_HTTPS="https://${GITHUB_REPO}.git"
 readonly DRY_RUN="${DRY_RUN:-true}"
 
 # This function is used to trigger the Go proxy to fetch the module.
@@ -67,6 +69,34 @@ execute_or_echo() {
   fi
 }
 
+# Validate that git remote origin points to the correct repository
+# This prevents accidentally pushing to the wrong remote
+validate_git_remote() {
+  local actual_origin="$(git -C "${ROOT_DIR}" remote get-url origin 2>/dev/null || echo "")"
+
+  if [[ -z "$actual_origin" ]]; then
+    echo "❌ Error: No 'origin' remote found"
+    echo "Please configure the origin remote first:"
+    echo "  git remote add origin ${EXPECTED_ORIGIN_SSH}"
+    exit 1
+  fi
+
+  # Accept both SSH and HTTPS formats for the docker/go-sdk repository
+  if [[ "$actual_origin" != "$EXPECTED_ORIGIN_SSH" ]] && \
+     [[ "$actual_origin" != "$EXPECTED_ORIGIN_HTTPS" ]]; then
+    echo "❌ Error: Git remote 'origin' points to the wrong repository"
+    echo "  Expected: ${EXPECTED_ORIGIN_SSH}"
+    echo "            (or ${EXPECTED_ORIGIN_HTTPS})"
+    echo "  Actual:   ${actual_origin}"
+    echo ""
+    echo "To fix this, update your origin remote:"
+    echo "  git remote set-url origin ${EXPECTED_ORIGIN_SSH}"
+    exit 1
+  fi
+
+  echo "✅ Git remote validation passed: origin → ${actual_origin}"
+}
+
 # Function to get modules from go.work
 get_modules() {
   go work edit -json | jq -r '.Use[] | "\(.DiskPath | ltrimstr("./"))"' | tr '\n' ' ' && echo
@@ -85,11 +115,20 @@ get_next_tag() {
   echo "${next_tag_path}"
 }
 
+# Extract version string from a version.go file
+# Usage: get_version_from_file <path_to_version.go>
+# Returns: version string (e.g., "0.1.0-alpha011")
+get_version_from_file() {
+  local file="$1"
+  # Use pattern that allows arbitrary whitespace around = sign
+  grep -o 'version[[:space:]]*=[[:space:]]*"[^"]*"' "$file" | cut -d'"' -f2
+}
+
 # Portable in-place sed editing that works on both BSD (macOS) and GNU (Linux) sed
 portable_sed() {
   local pattern="$1"
   local file="$2"
-  
+
   # Detect sed version and use appropriate syntax
   if sed --version >/dev/null 2>&1; then
     # GNU sed (Linux)

.github/scripts/refresh-proxy.sh

@@ -0,0 +1,70 @@
+#!/bin/bash
+
+# =============================================================================
+# Go Proxy Refresh Script
+# =============================================================================
+# Description: Triggers the Go proxy to refresh/fetch a module version
+#              This is useful to ensure pkg.go.dev has the latest version
+#
+# Usage: ./.github/scripts/refresh-proxy.sh <module>
+#
+# Arguments:
+#   module           - Name of the module to refresh (required)
+#                      Examples: client, container, config, context, image, network
+#
+# Examples:
+#   ./.github/scripts/refresh-proxy.sh client
+#   ./.github/scripts/refresh-proxy.sh container
+#
+# Dependencies:
+#   - git (for finding latest tag)
+#   - curl (for triggering Go proxy)
+#
+# =============================================================================
+
+set -e
+
+# Source common functions
+readonly SCRIPT_DIR="$( cd "$( dirname "${BASH_SOURCE[0]}" )" && pwd )"
+source "${SCRIPT_DIR}/common.sh"
+
+# Get module name from argument and lowercase it
+readonly MODULE=$(echo "${1:-}" | tr '[:upper:]' '[:lower:]')
+
+if [[ -z "$MODULE" ]]; then
+  echo "Error: Module name is required"
+  echo "Usage: $0 <module>"
+  echo "Example: $0 client"
+  exit 1
+fi
+
+echo "Refreshing Go proxy for module: ${MODULE}"
+
+# Check if version.go exists
+readonly VERSION_FILE="${ROOT_DIR}/${MODULE}/version.go"
+if [[ ! -f "${VERSION_FILE}" ]]; then
+  echo "Error: version.go not found at ${VERSION_FILE}"
+  exit 1
+fi
+
+# Read version from version.go
+VERSION=$(get_version_from_file "${VERSION_FILE}")
+
+if [[ -z "$VERSION" ]]; then
+  echo "Error: Could not extract version from ${VERSION_FILE}"
+  exit 1
+fi
+
+# Ensure version has v prefix for the tag
+if [[ ! "${VERSION}" =~ ^v ]]; then
+  VERSION="v${VERSION}"
+fi
+
+echo "Current version: ${VERSION}"
+echo "Triggering Go proxy refresh..."
+
+# Trigger Go proxy (bypass dry-run since this is a read-only operation)
+DRY_RUN=false curlGolangProxy "${MODULE}" "${VERSION}"
+
+echo "✅ Go proxy refresh completed for ${MODULE}@${VERSION}"
+echo "The module should be available at: https://pkg.go.dev/${GITHUB_REPO}/${MODULE}@${VERSION}"

.github/scripts/release.sh

@@ -47,6 +47,9 @@ set -e
 readonly SCRIPT_DIR="$( cd "$( dirname "${BASH_SOURCE[0]}" )" && pwd )"
 source "${SCRIPT_DIR}/common.sh"
 
+# Validate git remote before doing anything
+validate_git_remote
+
 MODULE="${1:-}"
 
 # Collect and stage changes across modules, then create a single commit

Makefile

@@ -24,9 +24,17 @@ clean-build-dir:
 	@rm -rf .github/scripts/.build
 	@mkdir -p .github/scripts/.build
 
-# Release version for all modules
-release-all: clean-build-dir
+# Pre-release version for all modules
+pre-release-all: clean-build-dir
 	@echo "Preparing releasing versions for all modules..."
 	$(call for-all-modules,make pre-release)
 
+# Release version for all modules. It must be run after pre-release-all.
+release-all:
+	$(call for-all-modules,make check-pre-release)
 	@./.github/scripts/release.sh
+
+# Refresh Go proxy for all modules
+refresh-proxy-all:
+	@echo "Refreshing Go proxy for all modules..."
+	$(call for-all-modules,make refresh-proxy)

RELEASING.md

@@ -14,6 +14,8 @@ Each module's version is defined in the `version.go` file at the root of the mod
 
 The primary way to perform releases is through GitHub Actions workflows.
 
+**Important**: GitHub Actions release workflows can only be run from the `main` branch. The workflows will automatically be skipped if triggered from any other branch. This is a safety measure to ensure releases are only performed from the primary branch.
+
 #### Releasing All Modules
 
 1. Go to the [Actions tab](../../actions) in the GitHub repository
@@ -43,6 +45,8 @@ The primary way to perform releases is through GitHub Actions workflows.
 
 If you need to perform releases manually or troubleshoot issues:
 
+**Note**: Manual releases using `make` commands can technically be run from any branch, but should be run from the `main` branch for consistency with the GitHub Actions workflows.
+
 #### Prerequisites
 - Docker installed (for semver-tool)
 - jq installed (`brew install jq` on macOS)
@@ -51,16 +55,21 @@ If you need to perform releases manually or troubleshoot issues:
 
 #### Releasing All Modules
 ```bash
-# Dry run to preview changes (no git changes made)
-DRY_RUN=true make release-all
+# Step 1: Dry run to preview version changes (no build files created)
+DRY_RUN=true make pre-release-all  # Explicit dry run, safe to run
+
+# Step 2: Prepare release for real (creates build files in .github/scripts/.build/)
+DRY_RUN=false make pre-release-all
 
-# Actual release (creates commits, tags, and pushes)
+# Step 3: Actual release (automatically checks pre-release, creates commits, tags, and pushes)
 DRY_RUN=false make release-all
 
 # With specific bump type
 BUMP_TYPE=patch DRY_RUN=false make release-all
 ```
 
+**Note**: The `release-all` target automatically runs `check-pre-release` for all modules to verify that `pre-release-all` was completed successfully (with `DRY_RUN=false`). If you try to run `release-all` without first running `pre-release-all` with `DRY_RUN=false`, it will fail with an error.
+
 #### Releasing a Single Module
 ```bash
 # From the module directory
@@ -107,19 +116,44 @@ DRY_RUN=false ./.github/scripts/release.sh container
 
 ## What Happens During Release
 
-### 1. Version Calculation
+### 1. Pre-Release Phase
+The `pre-release-all` or `pre-release` command must be run first:
 - Finds latest tag for each module
 - Uses semver-tool to calculate next version
 - Handles prerelease numbering with leading zeros
+- Writes the next version to a file in the build directory, located at `.github/scripts/.build/<module>-next-tag`
+
+### 2. Release Validation Checks
+Before creating any commits or tags, the release script performs the following validation checks:
+
+**Git Remote Validation:**
+- Verifies that the `origin` remote points to `[email protected]:docker/go-sdk.git` (or HTTPS equivalent)
+- Prevents accidentally pushing releases to forks or personal repositories
+- If validation fails, the script aborts immediately with instructions to fix the remote
+
+**Pre-Release Verification:**
+- The `release-all` command automatically runs `check-pre-release` for all modules
+- Verifies the `.github/scripts/.build` directory exists
+- Checks each module has a corresponding `<module>-next-tag` file
+- Validates the version in `<module>-next-tag` matches the version in `<module>/version.go`
+- If any checks fail, the release is aborted with an error message
+- Implemented in `.github/scripts/check-pre-release.sh`
+- Ensures `pre-release-all` was completed successfully (with `DRY_RUN=false`)
+
+You can manually run the check for a specific module:
+```bash
+make -C client check-pre-release
+# or
+cd client && make check-pre-release
+```
 
-### 2. File Updates
+### 3. File Updates
 For each module:
-- Writes the next version to a file in the build directory, located at `.github/scripts/.build/<module>-next-tag`. This is a temporary file that is used to store the next version for the module.
 - Updates `<module>/version.go` with new version
 - Updates all `go.mod` files with new cross-module dependencies
 - Runs `go mod tidy` to update `go.sum` files
 
-### 3. Git Operations
+### 4. Git Operations
 When `DRY_RUN=false`:
 - Creates a single commit with all version changes
 - Creates git tags for each module (e.g., `client/v0.1.0-alpha006`)
@@ -131,7 +165,7 @@ When `DRY_RUN=true`:
 - Shows diffs of version files
 - Completely safe to run multiple times
 
-### 4. Go Proxy Registration
+### 5. Go Proxy Registration
 When `DRY_RUN=false`:
 - Triggers Go proxy to fetch new module versions
 - Makes modules immediately available for download via `go get`

client/go.mod

@@ -8,7 +8,6 @@ require (
 	github.com/docker/cli v28.5.1+incompatible
 	github.com/docker/docker v28.3.2+incompatible
 	github.com/docker/go-connections v0.5.0
-	github.com/docker/go-sdk/config v0.1.0-alpha010
 	github.com/opencontainers/image-spec v1.1.1
 	github.com/stretchr/testify v1.11.1
 )
@@ -66,4 +65,5 @@ require (
 	google.golang.org/grpc v1.75.0 // indirect
 	google.golang.org/protobuf v1.36.8 // indirect
 	gopkg.in/yaml.v3 v3.0.1 // indirect
+	gotest.tools/v3 v3.5.2 // indirect
 )

client/go.sum

@@ -49,8 +49,6 @@ github.com/docker/go-connections v0.5.0 h1:USnMq7hx7gwdVZq1L49hLXaFtUdTADjXGp+uj
 github.com/docker/go-connections v0.5.0/go.mod h1:ov60Kzw0kKElRwhNs9UlUHAE/F9Fe6GLaXnqyDdmEXc=
 github.com/docker/go-metrics v0.0.0-20180209012529-399ea8c73916 h1:yWHOI+vFjEsAakUTSrtqc/SAHrhSkmn48pqjidZX3QA=
 github.com/docker/go-metrics v0.0.0-20180209012529-399ea8c73916/go.mod h1:/u0gXw0Gay3ceNrsHubL3BtdOL2fHf93USgMTe0W5dI=
-github.com/docker/go-sdk/config v0.1.0-alpha010 h1:OkNQeadloIEbTi1qIEXbDY5PqAYQg3igkBnKffHMGXg=
-github.com/docker/go-sdk/config v0.1.0-alpha010/go.mod h1:2lhg2sMZMKTtBVrsTG2Hn9P0dXMp1weecaJrE7OtNDM=
 github.com/docker/go-units v0.5.0 h1:69rxXcBk27SvSaaxTtLh/8llcHD8vYHT7WSdRZ/jvr4=
 github.com/docker/go-units v0.5.0/go.mod h1:fgPhTUdO+D/Jk86RDLlptpiXQzgHJF7gydDDbaIK4Dk=
 github.com/docker/libtrust v0.0.0-20160708172513-aabc10ec26b7/go.mod h1:cyGadeNEkKy96OOhEzfZl+yxihPEzKnqJwvfuSUqbZE=

client/version.go

@@ -1,7 +1,7 @@
 package client
 
 const (
-	version = "0.1.0-alpha010"
+	version = "0.1.0-alpha011"
 )
 
 // Version returns the version of the client package.