Skip to content

Commit 6a39474

Browse files
SDAChessSDAChess
committed
ci: restore build and release workflows
Signed-off-by: Simon Scatton <sscatton@nvidia.com>
1 parent 83b4593 commit 6a39474

14 files changed

Lines changed: 4340 additions & 0 deletions

‎.github/workflows/branch-checks.yml‎

Lines changed: 192 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,192 @@
1+
name: Branch Checks
2+
3+
on:
4+
push:
5+
branches:
6+
- "pull-request/[0-9]+"
7+
workflow_dispatch:
8+
9+
env:
10+
CARGO_TERM_COLOR: always
11+
CARGO_INCREMENTAL: "0"
12+
MISE_GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
13+
14+
permissions:
15+
contents: read
16+
packages: read
17+
18+
concurrency:
19+
group: ${{ github.workflow }}-${{ github.ref }}
20+
cancel-in-progress: true
21+
22+
jobs:
23+
pr_metadata:
24+
name: Resolve PR metadata
25+
runs-on: ubuntu-latest
26+
permissions:
27+
contents: read
28+
pull-requests: read
29+
outputs:
30+
should_run: ${{ steps.gate.outputs.should_run }}
31+
steps:
32+
- uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
33+
34+
- id: gate
35+
uses: ./.github/actions/pr-gate
36+
37+
mise-lockfile:
38+
name: mise Lockfile
39+
needs: pr_metadata
40+
if: needs.pr_metadata.outputs.should_run == 'true'
41+
runs-on: linux-amd64-cpu8
42+
container:
43+
image: ghcr.io/nvidia/openshell/ci:latest
44+
credentials:
45+
username: ${{ github.actor }}
46+
password: ${{ secrets.GITHUB_TOKEN }}
47+
steps:
48+
- uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
49+
50+
- name: Mark workspace as safe for git
51+
run: git config --global --add safe.directory "$GITHUB_WORKSPACE"
52+
53+
- name: Verify mise.lock is in sync with mise.toml
54+
run: |
55+
mise lock
56+
if ! git diff --exit-code mise.lock; then
57+
echo "::error::mise.lock is out of sync with mise.toml. Run 'mise lock' locally and commit the result." >&2
58+
exit 1
59+
fi
60+
61+
license-headers:
62+
name: License Headers
63+
needs: pr_metadata
64+
if: needs.pr_metadata.outputs.should_run == 'true'
65+
runs-on: linux-amd64-cpu8
66+
container:
67+
image: ghcr.io/nvidia/openshell/ci:latest
68+
credentials:
69+
username: ${{ github.actor }}
70+
password: ${{ secrets.GITHUB_TOKEN }}
71+
steps:
72+
- uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
73+
74+
- name: Install tools
75+
run: mise install --locked
76+
77+
- name: Check license headers
78+
run: mise run license:check
79+
80+
rust:
81+
name: Rust (${{ matrix.runner }})
82+
needs: pr_metadata
83+
if: needs.pr_metadata.outputs.should_run == 'true'
84+
strategy:
85+
fail-fast: false
86+
matrix:
87+
runner: [linux-amd64-cpu8, linux-arm64-cpu8]
88+
runs-on: ${{ matrix.runner }}
89+
env:
90+
SCCACHE_GHA_ENABLED: "true"
91+
SCCACHE_GHA_VERSION: branch-checks-rust-${{ matrix.runner }}
92+
container:
93+
image: ghcr.io/nvidia/openshell/ci:latest
94+
credentials:
95+
username: ${{ github.actor }}
96+
password: ${{ secrets.GITHUB_TOKEN }}
97+
steps:
98+
- uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
99+
100+
- name: Configure GHA sccache backend
101+
uses: mozilla-actions/sccache-action@9e7fa8a12102821edf02ca5dbea1acd0f89a2696 # v0.0.10
102+
103+
- name: Install tools
104+
run: mise install --locked
105+
106+
- name: Cache Rust target and registry
107+
uses: Swatinem/rust-cache@c19371144df3bb44fab255c43d04cbc2ab54d1c4 # v2
108+
with:
109+
# Keep branch-check caches partitioned by runner architecture; lint
110+
# and test intentionally share the same job-local target directory.
111+
shared-key: rust-checks-${{ matrix.runner }}
112+
# Preserve compiled artifacts from failed lint/test runs so the next
113+
# push to the same PR branch does not start from a cold cache.
114+
cache-on-failure: "true"
115+
116+
- name: Format
117+
run: mise run rust:format:check
118+
119+
- name: Lint
120+
run: mise run rust:lint
121+
122+
- name: Test
123+
run: mise run test:rust
124+
125+
- name: Verify telemetry can be compiled out
126+
run: mise run rust:verify:telemetry-off
127+
128+
- name: sccache stats
129+
if: always()
130+
run: |
131+
set +e
132+
stats_bin="${SCCACHE_PATH:-sccache}"
133+
"$stats_bin" --show-stats
134+
status=$?
135+
if [ "$status" -ne 0 ]; then
136+
echo "::warning::sccache stats unavailable (exit $status)"
137+
fi
138+
exit 0
139+
140+
python:
141+
name: Python (${{ matrix.runner }})
142+
needs: pr_metadata
143+
if: needs.pr_metadata.outputs.should_run == 'true'
144+
strategy:
145+
fail-fast: false
146+
matrix:
147+
runner: [linux-amd64-cpu8, linux-arm64-cpu8]
148+
runs-on: ${{ matrix.runner }}
149+
container:
150+
image: ghcr.io/nvidia/openshell/ci:latest
151+
credentials:
152+
username: ${{ github.actor }}
153+
password: ${{ secrets.GITHUB_TOKEN }}
154+
steps:
155+
- uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
156+
157+
- name: Install tools
158+
run: mise install --locked
159+
160+
- name: Install dependencies
161+
run: uv sync --frozen
162+
163+
- name: Format
164+
run: mise run python:format:check
165+
166+
- name: Lint
167+
run: mise run python:lint
168+
169+
- name: Typecheck
170+
run: mise run python:typecheck
171+
172+
- name: Test
173+
run: mise run test:python
174+
175+
markdown:
176+
name: Markdown
177+
needs: pr_metadata
178+
if: needs.pr_metadata.outputs.should_run == 'true'
179+
runs-on: linux-amd64-cpu8
180+
container:
181+
image: ghcr.io/nvidia/openshell/ci:latest
182+
credentials:
183+
username: ${{ github.actor }}
184+
password: ${{ secrets.GITHUB_TOKEN }}
185+
steps:
186+
- uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
187+
188+
- name: Install tools
189+
run: mise install --locked
190+
191+
- name: Lint
192+
run: mise run markdown:lint

‎.github/workflows/ci-image.yml‎

Lines changed: 108 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,108 @@
1+
name: Build CI Image
2+
3+
on:
4+
push:
5+
branches: [main]
6+
paths:
7+
- 'deploy/docker/Dockerfile.ci'
8+
- 'mise.toml'
9+
- 'mise.lock'
10+
- 'tasks/**'
11+
- '.github/workflows/ci-image.yml'
12+
workflow_dispatch:
13+
14+
env:
15+
REGISTRY: ghcr.io
16+
CI_IMAGE: ghcr.io/nvidia/openshell/ci
17+
18+
permissions:
19+
contents: read
20+
packages: write
21+
22+
jobs:
23+
build-ci-image:
24+
name: Build (${{ matrix.arch }})
25+
strategy:
26+
fail-fast: false
27+
matrix:
28+
include:
29+
- arch: amd64
30+
platform: linux/amd64
31+
runner: linux-amd64-cpu8
32+
- arch: arm64
33+
platform: linux/arm64
34+
runner: linux-arm64-cpu8
35+
runs-on: ${{ matrix.runner }}
36+
timeout-minutes: 60
37+
steps:
38+
- uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
39+
40+
- name: Log in to GitHub Container Registry
41+
uses: docker/login-action@af1e73f918a031802d376d3c8bbc3fe56130a9b0 # v4
42+
with:
43+
registry: ${{ env.REGISTRY }}
44+
username: ${{ github.actor }}
45+
password: ${{ secrets.GITHUB_TOKEN }}
46+
47+
- name: Resolve BuildKit config
48+
id: buildkit
49+
run: |
50+
if [[ -r /etc/buildkit/buildkitd.toml ]]; then
51+
echo "config=/etc/buildkit/buildkitd.toml" >> "$GITHUB_OUTPUT"
52+
else
53+
echo "config=" >> "$GITHUB_OUTPUT"
54+
fi
55+
56+
- name: Set up Docker Buildx
57+
uses: ./.github/actions/setup-buildx
58+
with:
59+
buildkitd-config: ${{ steps.buildkit.outputs.config }}
60+
61+
- name: Build and push CI image
62+
env:
63+
MISE_GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
64+
ARCH_IMAGE: ${{ env.CI_IMAGE }}:${{ github.sha }}-${{ matrix.arch }}
65+
run: |
66+
set -euo pipefail
67+
docker buildx build \
68+
--builder openshell \
69+
--platform "${{ matrix.platform }}" \
70+
--secret id=MISE_GITHUB_TOKEN,env=MISE_GITHUB_TOKEN \
71+
--cache-from "type=gha,scope=ci-image-${{ matrix.arch }}" \
72+
--cache-to "type=gha,mode=max,scope=ci-image-${{ matrix.arch }}" \
73+
--push \
74+
-t "$ARCH_IMAGE" \
75+
-f deploy/docker/Dockerfile.ci \
76+
.
77+
78+
- name: Smoke check CI image
79+
env:
80+
ARCH_IMAGE: ${{ env.CI_IMAGE }}:${{ github.sha }}-${{ matrix.arch }}
81+
run: |
82+
set -euo pipefail
83+
docker run --rm --platform "${{ matrix.platform }}" "$ARCH_IMAGE" mise --version
84+
docker run --rm --platform "${{ matrix.platform }}" "$ARCH_IMAGE" gh --version
85+
docker run --rm --platform "${{ matrix.platform }}" "$ARCH_IMAGE" docker buildx version
86+
87+
merge-ci-image:
88+
name: Merge manifest
89+
needs: build-ci-image
90+
runs-on: linux-amd64-cpu8
91+
timeout-minutes: 10
92+
steps:
93+
- name: Log in to GitHub Container Registry
94+
uses: docker/login-action@af1e73f918a031802d376d3c8bbc3fe56130a9b0 # v4
95+
with:
96+
registry: ${{ env.REGISTRY }}
97+
username: ${{ github.actor }}
98+
password: ${{ secrets.GITHUB_TOKEN }}
99+
100+
- name: Create multi-arch manifests
101+
run: |
102+
set -euo pipefail
103+
docker buildx imagetools create \
104+
--prefer-index=false \
105+
-t "${CI_IMAGE}:${GITHUB_SHA}" \
106+
-t "${CI_IMAGE}:latest" \
107+
"${CI_IMAGE}:${GITHUB_SHA}-amd64" \
108+
"${CI_IMAGE}:${GITHUB_SHA}-arm64"

‎.github/workflows/deb-package.yml‎

Lines changed: 92 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,92 @@
1+
name: Debian Package
2+
3+
on:
4+
workflow_call:
5+
inputs:
6+
deb-version:
7+
required: true
8+
type: string
9+
checkout-ref:
10+
required: true
11+
type: string
12+
13+
permissions:
14+
contents: read
15+
packages: read
16+
17+
defaults:
18+
run:
19+
shell: bash
20+
21+
jobs:
22+
build-deb-linux:
23+
name: Build Debian Package (Linux ${{ matrix.arch }})
24+
strategy:
25+
matrix:
26+
include:
27+
- arch: amd64
28+
runner: linux-amd64-cpu8
29+
deb_arch: amd64
30+
cli_target: x86_64-unknown-linux-musl
31+
gnu_target: x86_64-unknown-linux-gnu
32+
- arch: arm64
33+
runner: linux-arm64-cpu8
34+
deb_arch: arm64
35+
cli_target: aarch64-unknown-linux-musl
36+
gnu_target: aarch64-unknown-linux-gnu
37+
runs-on: ${{ matrix.runner }}
38+
timeout-minutes: 20
39+
container:
40+
image: ghcr.io/nvidia/openshell/ci:latest
41+
credentials:
42+
username: ${{ github.actor }}
43+
password: ${{ secrets.GITHUB_TOKEN }}
44+
steps:
45+
- uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
46+
with:
47+
ref: ${{ inputs['checkout-ref'] }}
48+
49+
- name: Download CLI artifact
50+
uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
51+
with:
52+
name: cli-linux-${{ matrix.arch }}
53+
path: package-input/
54+
55+
- name: Download gateway artifact
56+
uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
57+
with:
58+
name: gateway-binary-linux-${{ matrix.arch }}
59+
path: package-input/
60+
61+
- name: Download VM driver artifact
62+
uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
63+
with:
64+
name: driver-vm-linux-${{ matrix.arch }}
65+
path: package-input/
66+
67+
- name: Extract package inputs
68+
run: |
69+
set -euo pipefail
70+
mkdir -p package-binaries
71+
tar -xzf "package-input/openshell-${{ matrix.cli_target }}.tar.gz" -C package-binaries
72+
tar -xzf "package-input/openshell-gateway-${{ matrix.gnu_target }}.tar.gz" -C package-binaries
73+
tar -xzf "package-input/openshell-driver-vm-${{ matrix.gnu_target }}.tar.gz" -C package-binaries
74+
ls -lah package-binaries
75+
76+
- name: Build Debian package
77+
run: |
78+
set -euo pipefail
79+
OPENSHELL_CLI_BINARY="${PWD}/package-binaries/openshell" \
80+
OPENSHELL_GATEWAY_BINARY="${PWD}/package-binaries/openshell-gateway" \
81+
OPENSHELL_DRIVER_VM_BINARY="${PWD}/package-binaries/openshell-driver-vm" \
82+
OPENSHELL_DEB_VERSION="${{ inputs['deb-version'] }}" \
83+
OPENSHELL_DEB_ARCH="${{ matrix.deb_arch }}" \
84+
OPENSHELL_OUTPUT_DIR=artifacts \
85+
tasks/scripts/package-deb.sh
86+
87+
- name: Upload Debian package artifact
88+
uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7
89+
with:
90+
name: deb-linux-${{ matrix.arch }}
91+
path: artifacts/*.deb
92+
retention-days: 5

0 commit comments

Comments
 (0)