name: Driver VM macOS on: workflow_call: inputs: cargo-version: required: true type: string image-tag: required: true type: string checkout-ref: required: true type: string permissions: contents: read packages: read defaults: run: shell: bash jobs: download-kernel-runtime: name: Download Kernel Runtime runs-on: linux-amd64-cpu8 timeout-minutes: 10 container: image: ghcr.io/nvidia/openshell/ci:latest credentials: username: ${{ github.actor }} password: ${{ secrets.GITHUB_TOKEN }} steps: - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: ref: ${{ inputs['checkout-ref'] }} - name: Download macOS runtime tarball env: GH_TOKEN: ${{ secrets.GITHUB_TOKEN }} run: | set -euo pipefail mkdir -p runtime-artifacts asset="vm-runtime-darwin-aarch64.tar.zst" echo "Downloading ${asset}..." if ! gh release download vm-runtime \ --repo "${GITHUB_REPOSITORY}" \ --pattern "${asset}" \ --dir runtime-artifacts \ --clobber; then echo "::error::No ${asset} asset found on vm-runtime release" exit 1 fi ls -lah runtime-artifacts/ - name: Verify download run: test -f runtime-artifacts/vm-runtime-darwin-aarch64.tar.zst - name: Upload runtime artifact uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7 with: name: vm-driver-macos-kernel-runtime-tarball path: runtime-artifacts/vm-runtime-darwin-aarch64.tar.zst retention-days: 1 build-supervisor-arm64: name: Build Supervisor Bundle (arm64) runs-on: linux-arm64-cpu8 timeout-minutes: 30 container: image: ghcr.io/nvidia/openshell/ci:latest credentials: username: ${{ github.actor }} password: ${{ secrets.GITHUB_TOKEN }} env: MISE_GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} OPENSHELL_IMAGE_TAG: ${{ inputs['image-tag'] }} steps: - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: ref: ${{ inputs['checkout-ref'] }} fetch-depth: 0 - name: Mark workspace safe for git run: git config --global --add safe.directory "$GITHUB_WORKSPACE" - name: Fetch tags run: git fetch --tags --force - name: Install tools run: mise install --locked - name: Cache Rust target and registry uses: Swatinem/rust-cache@c19371144df3bb44fab255c43d04cbc2ab54d1c4 # v2 with: shared-key: driver-vm-supervisor-arm64 cache-directories: .cache/sccache cache-targets: "true" - name: Install zstd run: apt-get update && apt-get install -y --no-install-recommends zstd && rm -rf /var/lib/apt/lists/* - name: Build bundled supervisor run: | set -euo pipefail tasks/scripts/vm/build-supervisor-bundle.sh --arch aarch64 - name: sccache stats if: always() run: mise x -- sccache --show-stats - name: Upload supervisor bundle uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7 with: name: driver-vm-supervisor-arm64 path: target/vm-runtime-compressed/openshell-sandbox.zst retention-days: 1 build-driver-vm-macos: name: Build Driver VM (macOS) needs: [download-kernel-runtime, build-supervisor-arm64] runs-on: linux-amd64-cpu8 timeout-minutes: 60 container: image: ghcr.io/nvidia/openshell/ci:latest credentials: username: ${{ github.actor }} password: ${{ secrets.GITHUB_TOKEN }} options: --privileged volumes: - /var/run/docker.sock:/var/run/docker.sock env: MISE_GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} steps: - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: ref: ${{ inputs['checkout-ref'] }} fetch-depth: 0 - name: Mark workspace safe for git run: git config --global --add safe.directory "$GITHUB_WORKSPACE" - name: Fetch tags run: git fetch --tags --force - name: Log in to GHCR run: echo "${{ secrets.GITHUB_TOKEN }}" | docker login ghcr.io -u "${{ github.actor }}" --password-stdin - name: Set up Docker Buildx uses: ./.github/actions/setup-buildx - name: Install zstd run: apt-get update && apt-get install -y --no-install-recommends zstd && rm -rf /var/lib/apt/lists/* - name: Download kernel runtime tarball uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1 with: name: vm-driver-macos-kernel-runtime-tarball path: runtime-download/ - name: Prepare compressed runtime directory run: | set -euo pipefail COMPRESSED_DIR="${PWD}/target/vm-runtime-compressed-macos" VM_RUNTIME_TARBALL="${PWD}/runtime-download/vm-runtime-darwin-aarch64.tar.zst" \ VM_RUNTIME_PLATFORM="darwin-aarch64" \ OPENSHELL_VM_RUNTIME_COMPRESSED_DIR="$COMPRESSED_DIR" \ tasks/scripts/vm/compress-vm-runtime.sh - name: Download bundled supervisor uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1 with: name: driver-vm-supervisor-arm64 path: target/vm-runtime-compressed-macos/ - name: Verify bundled supervisor run: | set -euo pipefail test -f target/vm-runtime-compressed-macos/openshell-sandbox.zst ls -lh target/vm-runtime-compressed-macos/openshell-sandbox.zst - name: Verify embedded driver inputs run: | set -euo pipefail for file in libkrun.dylib.zst libkrunfw.5.dylib.zst gvproxy.zst umoci.zst openshell-sandbox.zst; do test -s "target/vm-runtime-compressed-macos/${file}" done - name: Build macOS binary via Docker run: | set -euo pipefail docker buildx build \ --file deploy/docker/Dockerfile.driver-vm-macos \ --build-arg OPENSHELL_CARGO_VERSION="${{ inputs['cargo-version'] }}" \ --build-arg OPENSHELL_IMAGE_TAG="${{ inputs['image-tag'] }}" \ --build-arg CARGO_TARGET_CACHE_SCOPE="${{ github.sha }}" \ --build-context vm-runtime-compressed="${PWD}/target/vm-runtime-compressed-macos" \ --target binary \ --output type=local,dest=out/ \ . - name: Verify packaged binary shape run: test -x out/openshell-driver-vm - name: Package binary run: | set -euo pipefail mkdir -p artifacts tar -czf artifacts/openshell-driver-vm-aarch64-apple-darwin.tar.gz \ -C out openshell-driver-vm ls -lh artifacts/ - name: Upload artifact uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7 with: name: driver-vm-macos path: artifacts/*.tar.gz retention-days: 5