fix warning as error

.github/workflows/linux-build.yml

@@ -48,7 +48,7 @@ jobs:
         run: make containerization
 
       - name: Build vminitd (glibc)
-        run: make -C vminitd SWIFT_CONFIGURATION="--disable-automatic-resolution -Xswiftc -warnings-as-errors"
+        run: make -C vminitd SWIFT_CONFIGURATION="--disable-automatic-resolution"
 
       - name: Install Static Linux SDK
         run: make -C vminitd linux-sdk
@@ -57,4 +57,4 @@ jobs:
         run: make -C vminitd
 
       - name: Run unit tests
-        run: swift test --disable-automatic-resolution -Xswiftc -warnings-as-errors
+        run: swift test --disable-automatic-resolution

CLAUDE.md

@@ -24,7 +24,7 @@ The project is built via `make`, not directly with `swift build`. Two Swift pack
 - `make protos` — regenerates `Sources/Containerization/SandboxContext/SandboxContext.{pb,grpc}.swift` from the `.proto`. Touch this whenever the proto changes; never hand-edit the generated files.
 - `make init` / `make init-image` — `init` compiles the guest and builds `bin/initfs.ext4` (+ a rootfs tar) inside the dev container via `scripts/build-initfs.sh` (mkfs + loop mount, with a `mke2fs -d` fallback), then `init-image` creates the `vminit:latest` OCI image from the tar with the native `cctl` (`cctl rootfs create --rootfs <tar> --image vminit:latest`). CI splits these: a Linux container job builds the initfs artifact, the macOS job runs `init-image`. Building the guest on macOS requires the apple/`container` CLI — there is no host Swiftly / Static Linux SDK setup step anymore.
 
-`WARNINGS_AS_ERRORS=true` is the default for both packages. Don't disable it casually — CI builds with it on.
+`WARNINGS_AS_ERRORS=true` is the default for both packages. Don't disable it casually — CI builds with it on. It is enforced *per target* via `.treatAllWarnings(as: .error)` in both `Package.swift` files, not by a global `-Xswiftc -warnings-as-errors`: a global flag also reaches package dependencies, which SwiftPM's swiftbuild build system (the default since Swift 6.5) compiles with `-suppress-warnings`, and `swiftc` rejects that pair — the build then fails inside third-party modules before any of our code compiles. `WARNINGS_AS_ERRORS=false` relaxes it by passing `-Xswiftc -no-warnings-as-errors`.
 
 ## Architecture
 

Makefile

@@ -22,7 +22,15 @@ WARNINGS_AS_ERRORS ?= true
 SCRATCH_ROOT ?=
 SCRATCH_PATH ?= $(if $(SCRATCH_ROOT),$(SCRATCH_ROOT)/build-containerization)
 SWIFT_SCRATCH_FLAGS := $(if $(SCRATCH_PATH),--scratch-path $(SCRATCH_PATH))
-SWIFT_CONFIGURATION := $(if $(filter-out false,$(WARNINGS_AS_ERRORS)),-Xswiftc -warnings-as-errors) --disable-automatic-resolution $(SWIFT_SCRATCH_FLAGS)
+# Warnings-as-errors lives in Package.swift (`.treatAllWarnings(as: .error)`,
+# applied per target) rather than here. A global `-Xswiftc -warnings-as-errors`
+# also reaches package dependencies, which SwiftPM's swiftbuild build system
+# (the default since Swift 6.5) compiles with `-suppress-warnings` — swiftc
+# rejects that pair and the build dies inside third-party modules. Setting
+# WARNINGS_AS_ERRORS=false relaxes the per-target setting with an explicit
+# `-no-warnings-as-errors`, which has no such conflict.
+SWIFT_CONFIGURATION := $(if $(filter-out false,$(WARNINGS_AS_ERRORS)),,-Xswiftc -no-warnings-as-errors) --disable-automatic-resolution $(SWIFT_SCRATCH_FLAGS)
+
 
 # Commonly used locations
 UNAME_S := $(shell uname -s)

Package.swift

@@ -339,3 +339,22 @@ package.targets.append(
         path: "Sources/Integration"
     )
 )
+
+// Warnings are errors in this package's own targets.
+//
+// This is expressed per target rather than as a global `-Xswiftc
+// -warnings-as-errors`, which is what the Makefile used to pass. SwiftPM's
+// swiftbuild build system — the default since Swift 6.5 — compiles package
+// *dependencies* with `-suppress-warnings`, and swiftc rejects that alongside
+// `-warnings-as-errors` ("conflicting options"). A global flag therefore fails
+// the build inside third-party modules before any of our code is compiled,
+// while a per-target setting leaves dependencies alone.
+//
+// Applied in a loop so a target added later is covered without anyone
+// remembering to opt in. `make ... WARNINGS_AS_ERRORS=false` still relaxes it,
+// by passing `-Xswiftc -no-warnings-as-errors` — which does not conflict with
+// `-suppress-warnings`.
+let cOnlyTargets: Set<String> = ["CShim", "CArchive", "LCShim"]
+for target in package.targets where !cOnlyTargets.contains(target.name) {
+    target.swiftSettings = (target.swiftSettings ?? []) + [.treatAllWarnings(as: .error)]
+}

vminitd/Makefile

@@ -17,7 +17,12 @@ WARNINGS_AS_ERRORS ?= true
 export GIT_COMMIT := $(shell git rev-parse HEAD)
 export GIT_TAG := $(shell git describe --tags --exact-match 2>/dev/null || echo "")
 export BUILD_TIME := $(shell date -u +%Y-%m-%dT%H:%M:%SZ)
-SWIFT_WARNING_CONFIG := $(if $(filter-out false,$(WARNINGS_AS_ERRORS)),-Xswiftc -warnings-as-errors)
+# Warnings-as-errors is set per target in Package.swift; see the comment there.
+# Passing it globally would also apply it to package dependencies, which the
+# swiftbuild build system compiles with `-suppress-warnings` — a combination
+# swiftc rejects outright.
+SWIFT_WARNING_CONFIG := $(if $(filter-out false,$(WARNINGS_AS_ERRORS)),,-Xswiftc -no-warnings-as-errors)
+
 # MUSL_ARCH selects which Static Linux SDK triple to build against
 # ($(MUSL_ARCH)-swift-linux-musl). Defaults to the host architecture
 # so the in-tree aarch64 flow works unchanged, but callers can override

vminitd/Package.swift

@@ -69,3 +69,12 @@ let package = Package(
         ),
     ]
 )
+
+// Warnings are errors in this package's own targets. Same reasoning as the root
+// package: a global `-Xswiftc -warnings-as-errors` also lands on package
+// dependencies, which SwiftPM's swiftbuild build system compiles with
+// `-suppress-warnings`, and swiftc refuses that combination. `CVersion` is
+// C-only, so there is nothing for a Swift setting to apply to.
+for target in package.targets where target.name != "CVersion" {
+    target.swiftSettings = (target.swiftSettings ?? []) + [.treatAllWarnings(as: .error)]
+}