# SPDX-FileCopyrightText: Copyright (c) 2025-2026 NVIDIA CORPORATION & AFFILIATES. All rights reserved.
# SPDX-License-Identifier: Apache-2.0

name: Build VM Driver

on:
  workflow_call:
    inputs:
      cargo-version:
        required: true
        type: string
      supervisor-image-tag:
        required: false
        type: string
        default: ""
      checkout-ref:
        required: false
        type: string
        default: ""
    secrets:
      CACHIX_AUTH_TOKEN:
        required: true

permissions:
  contents: read

jobs:
  build:
    name: openshell-driver-vm (${{ matrix.triple }})
    strategy:
      matrix:
        include:
          - arch: x86_64
            triple: x86_64-unknown-linux-gnu
            runner: linux-amd64-cpu8
          - arch: aarch64
            triple: aarch64-unknown-linux-gnu
            runner: linux-arm64-cpu8
          - arch: aarch64
            triple: aarch64-apple-darwin
            runner: macos-15-xlarge
    runs-on: ${{ matrix.runner }}
    timeout-minutes: 60
    defaults:
      run:
        shell: nix develop -c bash -euo pipefail {0}
    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          persist-credentials: false
          ref: ${{ inputs['checkout-ref'] || github.sha }}

      - uses: ./.github/actions/setup-nix
        with:
          cachix-auth-token: ${{ secrets.CACHIX_AUTH_TOKEN }}

      - name: Download openshell-sandbox
        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
        with:
          name: openshell-sandbox-${{ matrix.arch }}-unknown-linux-musl
          path: sandbox

      - name: Download openshell-supervisor
        if: endsWith(matrix.triple, '-unknown-linux-gnu')
        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
        with:
          name: openshell-supervisor-${{ matrix.arch }}-unknown-linux-gnu
          path: supervisor

      - name: Download native macOS host supervisor
        if: endsWith(matrix.triple, '-apple-darwin')
        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
        with:
          name: openshell-supervisor-aarch64-apple-darwin
          path: host-supervisor

      - name: Download VM guest init
        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
        with:
          name: openshell-vm-init-${{ matrix.arch }}-unknown-linux-musl
          path: vm-init

      - name: Build VM runtime
        run: nix build .#vm-runtime

      - name: Assemble compressed VM runtime
        run: |
          compressed_dir="${RUNNER_TEMP}/vm-runtime-compressed"
          host_supervisor="supervisor/openshell-supervisor"
          if [[ "${{ matrix.triple }}" == *-apple-darwin ]]; then
            host_supervisor="host-supervisor/openshell-supervisor"
          fi
          install -d "$compressed_dir"
          cp result/compressed/*.zst "$compressed_dir/"
          zstd -19 -T1 sandbox/openshell-sandbox -o "$compressed_dir/openshell-sandbox.zst"
          zstd -19 -T1 "$host_supervisor" -o "$compressed_dir/openshell-supervisor.zst"
          zstd -19 -T1 vm-init/openshell-vm-init -o "$compressed_dir/openshell-vm-init.zst"

      - name: Build openshell-driver-vm
        uses: ./.github/actions/build-rust-binary
        env:
          OPENSHELL_VM_RUNTIME_COMPRESSED_DIR: ${{ runner.temp }}/vm-runtime-compressed
        with:
          package: openshell-driver-vm
          binary: openshell-driver-vm
          triple: ${{ matrix.triple }}
          cargo-version: ${{ inputs['cargo-version'] }}
          supervisor-image-tag: ${{ inputs['supervisor-image-tag'] }}