Repository navigation
fix(tests): pin the k3s installer to a release (#5223) #8806
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: Branch Checks | |
| on: | |
| merge_group: | |
| types: [checks_requested] | |
| push: | |
| branches: | |
| - "pull-request/[0-9]+" | |
| workflow_dispatch: | |
| env: | |
| CARGO_TERM_COLOR: always | |
| CARGO_INCREMENTAL: "0" | |
| MISE_GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} | |
| permissions: | |
| contents: read | |
| packages: read | |
| concurrency: | |
| group: ${{ github.workflow }}-${{ github.ref }} | |
| cancel-in-progress: true | |
| jobs: | |
| pr_metadata: | |
| name: Resolve PR metadata | |
| runs-on: ubuntu-latest | |
| permissions: | |
| contents: read | |
| pull-requests: read | |
| outputs: | |
| should_run: ${{ steps.gate.outputs.should_run }} | |
| base_sha: ${{ steps.gate.outputs.base_sha }} | |
| pr_number: ${{ steps.pr-number.outputs.number }} | |
| steps: | |
| - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 | |
| - id: gate | |
| uses: ./.github/actions/pr-gate | |
| - id: pr-number | |
| shell: bash | |
| env: | |
| PR_REF: ${{ github.ref_name }} | |
| EVENT_NAME: ${{ github.event_name }} | |
| run: | | |
| if [ "$EVENT_NAME" = push ] && [[ "$PR_REF" =~ ^pull-request/([0-9]+)$ ]]; then | |
| echo "number=${BASH_REMATCH[1]}" >> "$GITHUB_OUTPUT" | |
| else | |
| echo "number=0" >> "$GITHUB_OUTPUT" | |
| fi | |
| compatibility-review: | |
| name: Compatibility Review (advisory) | |
| needs: pr_metadata | |
| if: needs.pr_metadata.outputs.should_run == 'true' | |
| permissions: | |
| contents: read | |
| pull-requests: read | |
| uses: ./.github/workflows/codex-compatibility.yml | |
| with: | |
| candidate_ref: ${{ github.sha }} | |
| source_sha: ${{ github.sha }} | |
| base_ref: >- | |
| ${{ github.event.merge_group.base_sha | |
| || needs.pr_metadata.outputs.base_sha | |
| || format('refs/remotes/origin/{0}', github.event.repository.default_branch) }} | |
| pr_number: ${{ fromJSON(needs.pr_metadata.outputs.pr_number) }} | |
| secrets: | |
| CODEX_SECURITY_API_KEY: ${{ secrets.CODEX_SECURITY_API_KEY }} | |
| compatibility-comment: | |
| name: Comment on detected breaking changes | |
| needs: [pr_metadata, compatibility-review] | |
| if: >- | |
| ${{ !cancelled() && needs.pr_metadata.outputs.pr_number != '0' | |
| && needs.compatibility-review.outputs.has_findings == 'true' | |
| && needs.compatibility-review.outputs.report_artifact != '' }} | |
| runs-on: ubuntu-latest | |
| timeout-minutes: 5 | |
| continue-on-error: true | |
| permissions: | |
| actions: read | |
| pull-requests: write | |
| steps: | |
| - name: Download compatibility report | |
| uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1 | |
| with: | |
| artifact-ids: ${{ needs.compatibility-review.outputs.report_artifact }} | |
| path: compatibility-report | |
| - name: Post new or materially updated findings | |
| uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9 | |
| env: | |
| PR_NUMBER: ${{ needs.pr_metadata.outputs.pr_number }} | |
| SOURCE_SHA: ${{ github.sha }} | |
| with: | |
| script: | | |
| const fs = require('node:fs'); | |
| const report = JSON.parse(fs.readFileSync('compatibility-report/report.json', 'utf8')); | |
| if (!report.review?.findings?.some(finding => !finding.previous_report_url)) return; | |
| const number = Number(process.env.PR_NUMBER); | |
| const { data: pr } = await github.rest.pulls.get({ ...context.repo, pull_number: number }); | |
| if (pr.state !== 'open' || pr.head.sha !== process.env.SOURCE_SHA) { | |
| core.notice('Skipping a comment for a closed PR or an outdated head.'); | |
| return; | |
| } | |
| const markdown = fs.readFileSync('compatibility-report/comment.md', 'utf8'); | |
| const runUrl = `${context.serverUrl}/${context.repo.owner}/${context.repo.repo}/actions/runs/${context.runId}/attempts/${process.env.GITHUB_RUN_ATTEMPT}`; | |
| await github.rest.issues.createComment({ | |
| ...context.repo, | |
| issue_number: number, | |
| body: `${markdown}\n[Branch check run](${runUrl})`, | |
| }); | |
| protobuf-compatibility: | |
| name: Protobuf Compatibility | |
| needs: pr_metadata | |
| if: needs.pr_metadata.outputs.should_run == 'true' | |
| runs-on: linux-amd64-cpu8 | |
| timeout-minutes: 15 | |
| steps: | |
| - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 | |
| with: | |
| fetch-depth: 0 | |
| persist-credentials: false | |
| - uses: ./.github/actions/check-protobuf-compatibility | |
| with: | |
| ref: >- | |
| ${{ github.event_name == 'workflow_dispatch' | |
| && format('refs/remotes/origin/{0}', github.event.repository.default_branch) | |
| || github.event.merge_group.base_sha | |
| || needs.pr_metadata.outputs.base_sha }} | |
| mise-lockfile: | |
| name: mise Lockfile | |
| needs: pr_metadata | |
| if: needs.pr_metadata.outputs.should_run == 'true' | |
| runs-on: linux-amd64-cpu8 | |
| timeout-minutes: 30 | |
| container: | |
| image: ghcr.io/nvidia/openshell/ci:9cb72baa2e61a1b5f12407e6e82da7fdba0aa722@sha256:67a9a0c32cb99825e6d3e9d9eec45d67149ea1ff7c11a1b1e1b3480d2d3df684 | |
| credentials: | |
| username: ${{ github.actor }} | |
| password: ${{ secrets.GITHUB_TOKEN }} | |
| steps: | |
| - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 | |
| - name: Mark workspace as safe for git | |
| run: git config --global --add safe.directory "$GITHUB_WORKSPACE" | |
| - name: Verify mise.lock is in sync with mise.toml | |
| run: | | |
| mise lock | |
| if ! git diff --exit-code mise.lock; then | |
| echo "::error::mise.lock is out of sync with mise.toml. Run 'mise lock' locally and commit the result." >&2 | |
| exit 1 | |
| fi | |
| license-headers: | |
| name: License Headers | |
| needs: pr_metadata | |
| if: needs.pr_metadata.outputs.should_run == 'true' | |
| runs-on: linux-amd64-cpu8 | |
| timeout-minutes: 30 | |
| container: | |
| image: ghcr.io/nvidia/openshell/ci:9cb72baa2e61a1b5f12407e6e82da7fdba0aa722@sha256:67a9a0c32cb99825e6d3e9d9eec45d67149ea1ff7c11a1b1e1b3480d2d3df684 | |
| credentials: | |
| username: ${{ github.actor }} | |
| password: ${{ secrets.GITHUB_TOKEN }} | |
| steps: | |
| - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 | |
| - name: Install tools | |
| run: mise install --locked | |
| - name: Check license headers | |
| run: mise run license:check | |
| cargo-deny: | |
| name: Cargo Deny | |
| needs: pr_metadata | |
| if: needs.pr_metadata.outputs.should_run == 'true' | |
| runs-on: linux-amd64-cpu8 | |
| timeout-minutes: 30 | |
| defaults: | |
| run: | |
| shell: nix develop .#devShells.x86_64-linux.default -c bash -euo pipefail {0} | |
| steps: | |
| - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 | |
| - uses: ./.github/actions/setup-nix | |
| with: | |
| cachix-auth-token: ${{ secrets.CACHIX_AUTH_TOKEN }} | |
| prepare-shell: "true" | |
| shell-installable: .#devShells.x86_64-linux.default | |
| - name: Install pinned cargo-deny | |
| run: mise install --locked github:EmbarkStudios/cargo-deny | |
| # Enter mise inside the Nix shell so Nix's cargo-deny cannot shadow the pin. | |
| # mise sets RUSTC_WRAPPER=sccache, but this metadata-only job does not | |
| # install sccache. Clear wrappers after mise applies its environment. | |
| - name: Verify crypto dependency guardrail | |
| run: mise exec github:EmbarkStudios/cargo-deny -- env RUSTC_WRAPPER= RUSTC_WORKSPACE_WRAPPER= uv run --no-project python tasks/scripts/test-crypto-dependency-policy.py | |
| - name: Check dependencies | |
| run: mise exec github:EmbarkStudios/cargo-deny -- env RUSTC_WRAPPER= RUSTC_WORKSPACE_WRAPPER= cargo deny check licenses bans sources | |
| rust-format: | |
| name: Rust format | |
| needs: pr_metadata | |
| if: needs.pr_metadata.outputs.should_run == 'true' | |
| runs-on: linux-amd64-cpu8 | |
| timeout-minutes: 15 | |
| steps: | |
| - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 | |
| - uses: ./.github/actions/setup-nix | |
| with: | |
| prepare-shell: "true" | |
| cachix-auth-token: ${{ secrets.CACHIX_AUTH_TOKEN }} | |
| - name: Format | |
| shell: nix develop -c bash -euo pipefail {0} | |
| run: | | |
| cargo fmt --all -- --check | |
| cargo fmt --manifest-path e2e/rust/Cargo.toml --all -- --check | |
| cargo fmt --manifest-path examples/governance-interceptor/Cargo.toml --all -- --check | |
| cargo fmt --manifest-path examples/supervisor-middleware-content-guard/Cargo.toml --all -- --check | |
| cargo fmt --manifest-path examples/isolation-backend-v8/Cargo.toml --all -- --check | |
| cargo fmt --manifest-path tests/testkit/Cargo.toml --all -- --check | |
| cargo fmt --manifest-path tests/tmachine/Cargo.toml --all -- --check | |
| cargo fmt --manifest-path tests/runner/Cargo.toml --all -- --check | |
| cargo fmt --manifest-path tests/suites/conformance/Cargo.toml -p conformance -- --check | |
| cargo fmt --manifest-path tests/suites/features/Cargo.toml -p keycloak-provider-refresh -- --check | |
| cargo fmt --manifest-path tests/support/Cargo.toml --all -- --check | |
| cargo-lockfiles: | |
| name: Cargo lockfiles | |
| needs: pr_metadata | |
| if: needs.pr_metadata.outputs.should_run == 'true' | |
| runs-on: linux-amd64-cpu8 | |
| timeout-minutes: 15 | |
| steps: | |
| - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 | |
| - uses: ./.github/actions/setup-nix | |
| with: | |
| prepare-shell: "true" | |
| cachix-auth-token: ${{ secrets.CACHIX_AUTH_TOKEN }} | |
| - name: Verify Cargo lockfiles | |
| shell: nix develop -c bash -euo pipefail {0} | |
| run: | | |
| tasks/scripts/check-cargo-lockfiles.sh | |
| uv run tasks/scripts/check_cargo_lockfile_alignment.py | |
| rust-lint: | |
| name: Rust lint (${{ matrix.system }}) | |
| needs: pr_metadata | |
| if: needs.pr_metadata.outputs.should_run == 'true' | |
| strategy: | |
| fail-fast: false | |
| matrix: | |
| include: | |
| - runner: linux-amd64-cpu8 | |
| system: x86_64-linux | |
| - runner: linux-arm64-cpu8 | |
| system: aarch64-linux | |
| - runner: macos-15-xlarge | |
| system: aarch64-darwin | |
| runs-on: ${{ matrix.runner }} | |
| timeout-minutes: 45 | |
| steps: | |
| - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 | |
| - uses: ./.github/actions/setup-nix | |
| with: | |
| prepare-shell: "true" | |
| cachix-auth-token: ${{ secrets.CACHIX_AUTH_TOKEN }} | |
| - uses: ./.github/actions/setup-rust | |
| with: | |
| cache-key: rust-checks-v2 | |
| save-cache: "false" | |
| - name: Lint | |
| shell: nix develop -c bash -euo pipefail {0} | |
| run: | | |
| cargo clippy --locked --workspace --all-targets -- -D warnings | |
| cargo clippy --locked --manifest-path e2e/rust/Cargo.toml --all-targets -- -D warnings | |
| cargo clippy --locked --manifest-path examples/governance-interceptor/Cargo.toml --all-targets -- -D warnings | |
| cargo clippy --locked --manifest-path examples/supervisor-middleware-content-guard/Cargo.toml --all-targets -- -D warnings | |
| cargo clippy --locked --manifest-path examples/isolation-backend-v8/Cargo.toml --all-targets -- -D warnings | |
| cargo clippy --locked --manifest-path tests/testkit/Cargo.toml --all-targets -- -D warnings | |
| cargo clippy --locked --manifest-path tests/tmachine/Cargo.toml --all-targets -- -D warnings | |
| cargo clippy --locked --manifest-path tests/runner/Cargo.toml --all-targets -- -D warnings | |
| cargo clippy --locked --manifest-path tests/suites/conformance/Cargo.toml -p conformance --all-targets -- -D warnings | |
| cargo clippy --locked --manifest-path tests/suites/features/Cargo.toml -p keycloak-provider-refresh --all-targets -- -D warnings | |
| cargo clippy --locked --manifest-path tests/support/Cargo.toml --all-targets -- -D warnings | |
| rust-test: | |
| name: Rust test (${{ matrix.system }}) | |
| needs: pr_metadata | |
| if: needs.pr_metadata.outputs.should_run == 'true' | |
| strategy: | |
| fail-fast: false | |
| matrix: | |
| include: | |
| - runner: linux-amd64-cpu8 | |
| system: x86_64-linux | |
| - runner: linux-arm64-cpu8 | |
| system: aarch64-linux | |
| - runner: macos-15-xlarge | |
| system: aarch64-darwin | |
| runs-on: ${{ matrix.runner }} | |
| timeout-minutes: 45 | |
| steps: | |
| - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 | |
| - uses: ./.github/actions/setup-nix | |
| with: | |
| prepare-shell: "true" | |
| cachix-auth-token: ${{ secrets.CACHIX_AUTH_TOKEN }} | |
| - uses: ./.github/actions/setup-rust | |
| with: | |
| cache-key: rust-checks-v2 | |
| save-cache: "true" | |
| - name: Verify crypto backend independence | |
| shell: nix develop -c bash -euo pipefail {0} | |
| run: | | |
| cargo tree --locked -p openshell-crypto --no-default-features --edges normal,build,dev --target all --prefix none > /tmp/openshell-crypto-dependencies.txt | |
| if grep -Eq '^(ring|aws-lc-rs|aws-lc-sys|aws-lc-fips-sys) v' /tmp/openshell-crypto-dependencies.txt; then | |
| echo "ERROR: backend-free crypto build includes Ring or AWS-LC" >&2 | |
| cat /tmp/openshell-crypto-dependencies.txt >&2 | |
| exit 1 | |
| fi | |
| cargo test --locked -p openshell-crypto --no-default-features --test independent_backend | |
| - name: Verify OpenSSL backend | |
| shell: nix develop .#crypto -c bash -euo pipefail {0} | |
| env: | |
| OPENSSL_NO_VENDOR: "1" | |
| OPENSSL_STATIC: "0" | |
| run: | | |
| cargo tree --locked -p openshell-crypto --no-default-features --features openssl --edges normal,build,dev --target all --prefix none > /tmp/openshell-openssl-dependencies.txt | |
| if grep -Eq '^(ring|aws-lc-rs|aws-lc-sys|aws-lc-fips-sys|openssl-src) v' /tmp/openshell-openssl-dependencies.txt; then | |
| echo "ERROR: OpenSSL-only crypto build includes another backend or vendored OpenSSL" >&2 | |
| cat /tmp/openshell-openssl-dependencies.txt >&2 | |
| exit 1 | |
| fi | |
| cargo clippy --locked -p openshell-crypto --no-default-features --features openssl --all-targets -- -D warnings | |
| cargo test --locked -p openshell-crypto --no-default-features --features openssl | |
| for feature in tls-tonic tls-kube tls-sqlx; do | |
| cargo check --locked -p openshell-crypto --no-default-features --features "openssl,$feature" | |
| done | |
| cargo clippy --locked -p openshell-crypto --features openssl --all-targets -- -D warnings | |
| cargo test --locked -p openshell-crypto --features openssl | |
| - name: Verify dynamic OpenSSL linkage on Linux | |
| if: runner.os == 'Linux' | |
| shell: nix develop .#crypto -c bash -euo pipefail {0} | |
| env: | |
| OPENSSL_NO_VENDOR: "1" | |
| OPENSSL_STATIC: "0" | |
| run: | | |
| cargo test --locked -p openshell-crypto --no-default-features --features openssl --test openssl_tls --no-run --message-format=json > "$RUNNER_TEMP/openssl-artifacts.jsonl" | |
| executable=$(uv run --no-project python -c 'import json, sys; artifacts = [json.loads(line) for line in sys.stdin]; paths = [a["executable"] for a in artifacts if a.get("reason") == "compiler-artifact" and a.get("target", {}).get("name") == "openssl_tls" and a.get("executable")]; assert len(paths) == 1, paths; print(paths[0])' < "$RUNNER_TEMP/openssl-artifacts.jsonl") | |
| ldd "$executable" > "$RUNNER_TEMP/openssl-linkage.txt" | |
| cat "$RUNNER_TEMP/openssl-linkage.txt" | |
| for library in libssl libcrypto; do | |
| if ! grep -Eq "^[[:space:]]*$library\\.so[^[:space:]]* => /" "$RUNNER_TEMP/openssl-linkage.txt"; then | |
| echo "ERROR: $library did not resolve to a dynamic library" >&2 | |
| exit 1 | |
| fi | |
| done | |
| - name: Test | |
| shell: nix develop -c bash -euo pipefail {0} | |
| env: | |
| OPENSHELL_TELEMETRY_ENABLED: "false" | |
| run: | | |
| cargo nextest run --locked --profile ci --workspace --features openshell-server/test-support | |
| cargo nextest run --locked --config-file .config/nextest.toml --profile ci --manifest-path examples/supervisor-middleware-content-guard/Cargo.toml | |
| cargo nextest run --locked --config-file .config/nextest.toml --profile ci --manifest-path tests/testkit/Cargo.toml | |
| cargo nextest run --locked --config-file .config/nextest.toml --profile ci --manifest-path tests/tmachine/Cargo.toml | |
| cargo nextest run --locked --config-file .config/nextest.toml --profile ci --manifest-path tests/runner/Cargo.toml | |
| rust-postgres-test: | |
| name: Rust PostgreSQL tests | |
| needs: pr_metadata | |
| if: needs.pr_metadata.outputs.should_run == 'true' | |
| # Bare runner: the test script starts a disposable PostgreSQL container | |
| # with the host's Docker. | |
| runs-on: linux-amd64-cpu8 | |
| timeout-minutes: 30 | |
| steps: | |
| - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 | |
| with: | |
| persist-credentials: false | |
| - uses: ./.github/actions/setup-nix | |
| with: | |
| prepare-shell: "true" | |
| cachix-auth-token: ${{ secrets.CACHIX_AUTH_TOKEN }} | |
| - uses: ./.github/actions/setup-rust | |
| with: | |
| cache-key: rust-checks-v2 | |
| save-cache: "false" | |
| - name: Test | |
| shell: nix develop -c bash -euo pipefail {0} | |
| env: | |
| CONTAINER_ENGINE: docker | |
| OPENSHELL_TELEMETRY_ENABLED: "false" | |
| run: tasks/scripts/run-postgres-tests.sh --locked --profile ci | |
| rust-build-modes: | |
| name: Rust build modes (${{ matrix.system }}) | |
| needs: pr_metadata | |
| if: needs.pr_metadata.outputs.should_run == 'true' | |
| strategy: | |
| fail-fast: false | |
| matrix: | |
| include: | |
| - runner: linux-amd64-cpu8 | |
| system: x86_64-linux | |
| - runner: linux-arm64-cpu8 | |
| system: aarch64-linux | |
| - runner: macos-15-xlarge | |
| system: aarch64-darwin | |
| runs-on: ${{ matrix.runner }} | |
| timeout-minutes: 45 | |
| steps: | |
| - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 | |
| - uses: ./.github/actions/setup-nix | |
| with: | |
| prepare-shell: "true" | |
| cachix-auth-token: ${{ secrets.CACHIX_AUTH_TOKEN }} | |
| - uses: ./.github/actions/setup-rust | |
| with: | |
| cache-key: rust-checks-v2 | |
| save-cache: "false" | |
| - name: Verify build modes | |
| shell: nix develop -c bash -euo pipefail {0} | |
| run: | | |
| cargo build --locked -p openshell-gateway --bin openshell-gateway | |
| tasks/scripts/verify-telemetry-compiled-out.sh present target/debug/openshell-gateway | |
| cargo build --locked -p openshell-gateway --bin openshell-gateway --no-default-features --features defaults-without-telemetry | |
| tasks/scripts/verify-telemetry-compiled-out.sh absent target/debug/openshell-gateway | |
| cargo build --locked -p openshell-supervisor --bin openshell-supervisor --no-default-features --features defaults-without-telemetry | |
| tasks/scripts/verify-telemetry-compiled-out.sh absent target/debug/openshell-supervisor | |
| cargo check --locked -p openshell-supervisor --all-targets --no-default-features --features system-ca-roots | |
| - name: Verify system CA roots dependency boundary | |
| shell: nix develop -c bash -euo pipefail {0} | |
| run: | | |
| cargo tree --locked -p openshell-supervisor --prefix none --no-default-features --features system-ca-roots > /tmp/openshell-supervisor-dependencies.txt | |
| if grep -Eq '^(webpki-roots|webpki-root-certs) v' /tmp/openshell-supervisor-dependencies.txt; then | |
| echo "ERROR: bundled Mozilla roots found in system CA roots build" >&2 | |
| cat /tmp/openshell-supervisor-dependencies.txt >&2 | |
| exit 1 | |
| fi | |
| - name: Verify standalone prover dependency boundary | |
| shell: nix develop -c bash -euo pipefail {0} | |
| run: | | |
| cargo tree --locked -p openshell-prover-cli --edges normal --prefix none > /tmp/openshell-prover-dependencies.txt | |
| if grep -Eq '^(openshell-(cli|server|sdk|bootstrap|tui|providers|core|policy)) v' /tmp/openshell-prover-dependencies.txt; then | |
| echo "ERROR: standalone prover includes an OpenShell control-plane dependency" >&2 | |
| cat /tmp/openshell-prover-dependencies.txt >&2 | |
| exit 1 | |
| fi | |
| rust-feature-alias: | |
| name: Rust feature alias | |
| needs: pr_metadata | |
| if: needs.pr_metadata.outputs.should_run == 'true' | |
| runs-on: linux-amd64-cpu8 | |
| timeout-minutes: 30 | |
| steps: | |
| - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 | |
| - uses: ./.github/actions/setup-nix | |
| with: | |
| prepare-shell: "true" | |
| cachix-auth-token: ${{ secrets.CACHIX_AUTH_TOKEN }} | |
| - uses: ./.github/actions/setup-rust | |
| with: | |
| cache-key: rust-checks-v2 | |
| save-cache: "false" | |
| - name: Verify defaults-without-telemetry feature alias | |
| shell: nix develop -c bash -euo pipefail {0} | |
| run: | | |
| tasks/scripts/verify-defaults-without-telemetry.sh | |
| git diff --exit-code HEAD -- ':(glob)**/Cargo.lock' | |
| rust-gateway-core-features: | |
| name: Rust gateway core features | |
| needs: pr_metadata | |
| if: needs.pr_metadata.outputs.should_run == 'true' | |
| runs-on: linux-amd64-cpu8 | |
| timeout-minutes: 30 | |
| steps: | |
| - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 | |
| - uses: ./.github/actions/setup-nix | |
| with: | |
| prepare-shell: "true" | |
| cachix-auth-token: ${{ secrets.CACHIX_AUTH_TOKEN }} | |
| - uses: ./.github/actions/setup-rust | |
| with: | |
| cache-key: rust-checks-v2 | |
| save-cache: "false" | |
| - name: Verify core gateway compute-driver feature sets | |
| shell: nix develop -c bash -euo pipefail {0} | |
| run: | | |
| cargo nextest run --locked --profile ci -p openshell-gateway --all-targets --no-default-features | |
| cargo nextest run --locked --profile ci -p openshell-gateway --all-targets --no-default-features --features compute-driver-docker | |
| cargo nextest run --locked --profile ci -p openshell-gateway --all-targets --no-default-features --features compute-driver-kubernetes | |
| cargo nextest run --locked --profile ci -p openshell-gateway --all-targets --no-default-features --features compute-driver-podman | |
| rust-gateway-extended-features: | |
| name: Rust gateway extended features | |
| needs: pr_metadata | |
| if: needs.pr_metadata.outputs.should_run == 'true' | |
| runs-on: linux-amd64-cpu8 | |
| timeout-minutes: 30 | |
| steps: | |
| - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 | |
| - uses: ./.github/actions/setup-nix | |
| with: | |
| prepare-shell: "true" | |
| cachix-auth-token: ${{ secrets.CACHIX_AUTH_TOKEN }} | |
| - uses: ./.github/actions/setup-rust | |
| with: | |
| cache-key: rust-checks-v2 | |
| save-cache: "false" | |
| - name: Verify extended gateway compute-driver feature sets | |
| shell: nix develop -c bash -euo pipefail {0} | |
| run: | | |
| cargo nextest run --locked --profile ci -p openshell-gateway --all-targets --no-default-features --features compute-driver-vm | |
| cargo nextest run --locked --profile ci -p openshell-gateway --all-targets --no-default-features --features compute-driver-mxc | |
| cargo nextest run --locked --profile ci -p openshell-gateway --all-targets --no-default-features --features compute-driver-docker,compute-driver-vm | |
| python: | |
| name: Python (${{ matrix.runner }}) | |
| needs: pr_metadata | |
| if: needs.pr_metadata.outputs.should_run == 'true' | |
| strategy: | |
| fail-fast: false | |
| matrix: | |
| runner: [linux-amd64-cpu8, linux-arm64-cpu8] | |
| runs-on: ${{ matrix.runner }} | |
| timeout-minutes: 30 | |
| container: | |
| image: ghcr.io/nvidia/openshell/ci:9cb72baa2e61a1b5f12407e6e82da7fdba0aa722@sha256:67a9a0c32cb99825e6d3e9d9eec45d67149ea1ff7c11a1b1e1b3480d2d3df684 | |
| credentials: | |
| username: ${{ github.actor }} | |
| password: ${{ secrets.GITHUB_TOKEN }} | |
| steps: | |
| - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 | |
| - name: Install tools | |
| run: mise install --locked | |
| - name: Install dependencies | |
| run: uv sync --frozen | |
| - name: Format | |
| run: mise run python:format:check | |
| - name: Lint | |
| run: mise run python:lint | |
| - name: Typecheck | |
| run: mise run python:typecheck | |
| - name: Test | |
| run: mise run test:python | |
| - name: Test local gateway configuration helpers | |
| run: | | |
| bash tasks/scripts/test-gateway-pull-policy.sh | |
| bash tasks/scripts/test-gateway-config.sh | |
| - name: Test release qualification summary | |
| run: mise run test:qualification-summary | |
| go: | |
| name: Go SDK | |
| needs: pr_metadata | |
| if: needs.pr_metadata.outputs.should_run == 'true' | |
| runs-on: linux-amd64-cpu8 | |
| timeout-minutes: 30 | |
| container: | |
| image: ghcr.io/nvidia/openshell/ci:9cb72baa2e61a1b5f12407e6e82da7fdba0aa722@sha256:67a9a0c32cb99825e6d3e9d9eec45d67149ea1ff7c11a1b1e1b3480d2d3df684 | |
| credentials: | |
| username: ${{ github.actor }} | |
| password: ${{ secrets.GITHUB_TOKEN }} | |
| steps: | |
| - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 | |
| - name: Install tools | |
| run: mise install --locked | |
| - name: Lint, build, test, proto-check | |
| run: mise run go:ci | |
| markdown: | |
| name: Markdown | |
| needs: pr_metadata | |
| if: needs.pr_metadata.outputs.should_run == 'true' | |
| runs-on: linux-amd64-cpu8 | |
| timeout-minutes: 30 | |
| container: | |
| image: ghcr.io/nvidia/openshell/ci:9cb72baa2e61a1b5f12407e6e82da7fdba0aa722@sha256:67a9a0c32cb99825e6d3e9d9eec45d67149ea1ff7c11a1b1e1b3480d2d3df684 | |
| credentials: | |
| username: ${{ github.actor }} | |
| password: ${{ secrets.GITHUB_TOKEN }} | |
| steps: | |
| - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 | |
| - name: Install tools | |
| run: mise install --locked | |
| - name: Lint | |
| run: mise run markdown:lint | |
| sdk-typescript: | |
| name: TypeScript SDK | |
| needs: pr_metadata | |
| if: needs.pr_metadata.outputs.should_run == 'true' | |
| runs-on: linux-amd64-cpu8 | |
| timeout-minutes: 30 | |
| container: | |
| image: ghcr.io/nvidia/openshell/ci:9cb72baa2e61a1b5f12407e6e82da7fdba0aa722@sha256:67a9a0c32cb99825e6d3e9d9eec45d67149ea1ff7c11a1b1e1b3480d2d3df684 | |
| credentials: | |
| username: ${{ github.actor }} | |
| password: ${{ secrets.GITHUB_TOKEN }} | |
| steps: | |
| - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 | |
| - name: Install tools | |
| run: mise install --locked | |
| - name: Check TypeScript SDK | |
| run: mise run sdk:ts:ci | |
| # Exercise the full release publish path (version stamp, dist-tag, | |
| # prepublishOnly, tarball) without uploading. Uses the off-tag dev | |
| # version, which validates the prerelease dist-tag branch too. | |
| - name: Verify publishable artifact (dry-run) | |
| env: | |
| OPENSHELL_NPM_PUBLISH_ARGS: --dry-run | |
| run: | | |
| OPENSHELL_NPM_VERSION="$(uv run python tasks/scripts/release.py get-version --npm)" \ | |
| mise run sdk:ts:publish |