* chore(nix): unify native and cross-compilation toolchains
Replace the separate GNU and musl development shells with one shell that
provides explicit toolchains for x86_64 and aarch64 Linux, plus native
Darwin on macOS. Cargo selects the compiler, assembler, archiver, and
linker through target-specific environment variables.
Build GNU targets against a glibc 2.28 sysroot with static GCC runtimes
and use the musl toolchains for static Linux executables. Build Z3 and
AWS-LC with each target's stdenv and expose AWS-LC libraries and Rust
bindings through its target-specific system directory.
Keep Darwin system libraries on the unprocessed Apple SDK and prevent
the Rust toolchain from propagating replacement libraries into the shell.
Include the compiler and libc fixes needed for Darwin-to-Linux builds.
Share dependency and environment wiring through mkToolchain, keep compiler
wrappers in the Linux and Darwin modules, and group the pinned GNU build
environment under glibc-2.28. Document the toolchain boundaries in the build
architecture overview.
Validation: actionlint and nix fmt pass. The toolchain refactor preserves
the shell derivations for x86_64 Linux, aarch64 Linux, and aarch64 Darwin.
Signed-off-by: Simon Scatton <sscatton@nvidia.com>
* ci(nix): use the default shell for binary builds
Remove the dev-shell input and its matrix and workflow plumbing.
Use the host default shell for builds and cache hashing.
Signed-off-by: Simon Scatton <sscatton@nvidia.com>
* ci(nix): build release binaries with explicit Cargo targets
Use target-specific artifact paths and rely on the Nix toolchains for
linkage. Remove post-link rewriting, platform linkage checks, and the
unused interpreter input. Update the build architecture documentation.
Signed-off-by: Simon Scatton <sscatton@nvidia.com>
* refactor(nix): reuse glibc and GCC build recipes
Use a pinned historical Nixpkgs recipe for glibc 2.28 and rebuild GCC 15
against it instead of maintaining separate runtime builds. Keep only
compatibility adjustments needed by the current build tools.
Assemble the sysroot from glibc outputs and static native libraries. Use
standard ELF interpreters and resolve Rust's explicit gcc_s dependency
through the static GCC archives.
Allow 90 minutes for Rust branch checks to accommodate cold toolchain
builds. Validate the Linux release matrix locally; Darwin remains for CI.
Signed-off-by: Simon Scatton <sscatton@nvidia.com>
* fix(nix): disable obsolete RPC tools in glibc
Avoid building rpcgen against the Darwin SDK, which does not expose stat64.
Signed-off-by: Simon Scatton <sscatton@nvidia.com>
---------
Signed-off-by: Simon Scatton <sscatton@nvidia.com>
* feat(docs): add version availability labels
Signed-off-by: Piotr Mlocek <pmlocek@nvidia.com>
* fix(docs): use supported Python for sync
Signed-off-by: Piotr Mlocek <pmlocek@nvidia.com>
* feat(docs): publish versioned docs from releases
Signed-off-by: Piotr Mlocek <pmlocek@nvidia.com>
* fix(docs): format dev version label
Signed-off-by: Piotr Mlocek <pmlocek@nvidia.com>
* chore(docs): upgrade Fern CLI to 5.112.0
Signed-off-by: Piotr Mlocek <pmlocek@nvidia.com>
* fix(docs): make release publishing monotonic
Signed-off-by: Piotr Mlocek <pmlocek@nvidia.com>
* fix(docs): preserve snapshot release identity
Signed-off-by: Piotr Mlocek <pmlocek@nvidia.com>
* docs(fern): document versioned publishing
Signed-off-by: Piotr Mlocek <pmlocek@nvidia.com>
* test(docs): cover explicit snapshot rollback
Signed-off-by: Piotr Mlocek <pmlocek@nvidia.com>
* refactor(docs): use Fern refs for versions
Signed-off-by: Piotr Mlocek <pmlocek@nvidia.com>
* fix(docs): bundle components for ref versions
Signed-off-by: Piotr Mlocek <pmlocek@nvidia.com>
* revert(docs): keep complete version copies
Signed-off-by: Piotr Mlocek <pmlocek@nvidia.com>
* fix(docs): publish latest and dev channels
Signed-off-by: Piotr Mlocek <pmlocek@nvidia.com>
---------
Signed-off-by: Piotr Mlocek <pmlocek@nvidia.com>
The Maturin-based wheel packaging was a historical remnant from when the local gateway launch path and OpenShell CLI were coupled in one binary. The gateway and CLI now ship as standalone artifacts, so the Python distribution should contain only the SDK.
Build a single platform-independent setuptools wheel, verify that it cannot contain native code or an openshell entry point, and simplify the release jobs and documentation for SDK-only PyPI installs.
Signed-off-by: Simon Scatton <sscatton@nvidia.com>
The generated protobuf/gRPC modules under python/openshell/_proto/ are
gitignored. maturin honors .gitignore when collecting python-source files
from a git checkout, so native builds (Linux release CI, local
pip install .) dropped these modules and shipped an unimportable wheel.
The macOS wheel only included them by accident: it builds in a Docker
context whose COPY omits .git, so maturin had no gitignore to apply.
Pin the stubs back in with explicit, package-relative
[tool.maturin].include globs so inclusion no longer depends on whether
.git is present in the build context.
Add a wheel smoke check to the release-tag and release-dev workflows that
installs each Linux wheel in a clean python:3.12-slim image and imports
openshell.sandbox, and document the invariant in architecture/build.md.
Closes#1705
Signed-off-by: Max Dubrinsky <mdubrinsky@nvidia.com>
Switch the snapcraft build from 'source: .' (which copies the full
20 GB repo including 18 GB of target/ and build artifacts into LXD)
to 'source: ./snap/prebuilt' (~130 MB of only the binaries and
metadata that snapcraft needs).
The snap-package workflow now downloads the same cli, gateway, and
supervisor binaries that other packaging jobs (deb, rpm, tarballs)
use. A new 'Prepare snap build directory' step assembles snap/prebuilt/
with the 3 binaries, gateway wrapper script, LICENSE, README.md, and
a precomputed version string — everything snapcraft needs without
any source tree access.
This addresses CI/CD Improvements (issue #1361) by reducing data
transferred into the LXD sandbox by ~150x and eliminating the need
for snapcraft to traverse the entire repository tree.
Signed-off-by: Zygmunt Krynicki <zygmunt.krynicki@canonical.com>
release-helm and tag-ghcr-release now depend on the release job.
This is to prevent a GHCR image or helm chart from being published when some
other aspect of the release fails.
Signed-off-by: Kris Hicks <khicks@nvidia.com>
* ci(helm): add OCI chart release workflow
Publishes the Helm chart to ghcr.io/nvidia/openshell/helm-chart via helm push on every tag (versioned + :latest) and main push (:0.0.0-dev overwrite + :0.0.0-dev.<sha> per-commit pin). Renames Chart.yaml name to helm-chart to match the target OCI path.
* ci(helm): use full sha in dev pinned chart version
The container images pushed by docker-build.yml are tagged with the
full $GITHUB_SHA, not a 7-char prefix. Match the chart's pinned
version (0.0.0-dev.<full-sha>) so the chart tag and the image tag
the chart resolves to are identical.
* docs(readme): add helm chart install instructions
Document the OCI chart at ghcr.io/nvidia/openshell/helm-chart with
examples for tagged, floating dev, and SHA-pinned dev installs, and
flag the Kubernetes deployment path as experimental.
* docs(helm): split chart details into chart README
Move the dev tag conventions and configuration pointers into a new
README under deploy/helm/openshell/ and shorten the top-level README
section to the install command (no --version, defaults to latest
tagged semver) plus a link to the chart README.
Simon Scatton