# SPDX-FileCopyrightText: Copyright (c) 2025-2026 NVIDIA CORPORATION & AFFILIATES. All rights reserved.
# SPDX-License-Identifier: Apache-2.0

name: Supervisor Static Linkage Validation

# The glibc-static supervisor variant (SUPERVISOR_LIBC=glibc-static) has no
# other CI caller: docker-build.yml builds the default musl variant, so the
# GNU + crt-static build branch and its native-only, per-arch requirements are
# never exercised by image or release CI. Build the variant here on both
# architectures so it cannot regress unnoticed. rust-native-build.yml runs
# verify-static-binary.sh for the sandbox component, which fails the job on any
# dynamic linkage.
#
# Linkage can change from a new/updated dependency or a source change, not just
# from the build scripts, so the push path filters cover the workspace manifests
# and crate sources in addition to the build tooling. A nightly schedule is the
# unfiltered backstop for anything the filters miss.
#
# rust-native-build.yml runs on NVIDIA self-hosted runners, which reject jobs
# triggered by `pull_request`. This workflow therefore follows the repo's
# self-hosted convention (see branch-checks.yml / branch-e2e.yml): validate in
# the merge queue (pre-merge), on push to main (post-merge), nightly, and on
# demand — never on `pull_request`.

on:
  merge_group:
    types: [checks_requested]
  push:
    branches: [main]
    paths:
      - "Cargo.toml"
      - "Cargo.lock"
      - "crates/**"
      - "rust-toolchain.toml"
      - "mise.toml"
      - "mise.lock"
      - ".cargo/config.toml"
      - "tasks/scripts/stage-prebuilt-binaries.sh"
      - "tasks/scripts/verify-static-binary.sh"
      - ".github/workflows/rust-native-build.yml"
      - ".github/workflows/supervisor-static-validate.yml"
  schedule:
    # Nightly (04:17 UTC) unfiltered run so a linkage regression cannot slip
    # through the path filters unnoticed. Schedules run only on the default branch.
    - cron: "17 4 * * *"
  workflow_dispatch:

concurrency:
  group: ${{ github.workflow }}-${{ github.ref }}
  cancel-in-progress: false

permissions:
  contents: read
  packages: read

jobs:
  glibc-static:
    name: glibc-static supervisor (${{ matrix.arch }})
    strategy:
      fail-fast: false
      matrix:
        arch: [amd64, arm64]
    uses: ./.github/workflows/rust-native-build.yml
    with:
      component: sandbox
      arch: ${{ matrix.arch }}
      supervisor-libc: glibc-static
      artifact-name: supervisor-glibc-static-${{ matrix.arch }}
      retention-days: 1
    secrets: inherit