OpenShell/.github/workflows/driver-vm-linux.yml

name: Driver VM Linux

on:
  workflow_call:
    inputs:
      cargo-version:
        required: false
        type: string
        default: ""
      image-tag:
        required: true
        type: string
      checkout-ref:
        required: true
        type: string
      runtime-platforms:
        description: "Comma-separated VM runtime platforms to download: linux-aarch64,linux-x86_64"
        required: false
        type: string
        default: "linux-aarch64,linux-x86_64"
      driver-targets:
        description: "JSON matrix entries for Linux VM driver targets"
        required: false
        type: string
        default: >-
          [{"arch":"arm64","runner":"linux-arm64-cpu8","target":"aarch64-unknown-linux-gnu","zig_target":"aarch64-unknown-linux-gnu.2.28","platform":"linux-aarch64","guest_arch":"aarch64"},{"arch":"amd64","runner":"linux-amd64-cpu8","target":"x86_64-unknown-linux-gnu","zig_target":"x86_64-unknown-linux-gnu.2.28","platform":"linux-x86_64","guest_arch":"x86_64"}]

permissions:
  contents: read
  packages: read

defaults:
  run:
    shell: bash

jobs:
  download-kernel-runtime:
    name: Download Kernel Runtime
    runs-on: linux-amd64-cpu8
    timeout-minutes: 10
    container:
      image: ghcr.io/nvidia/openshell/ci:latest
      credentials:
        username: ${{ github.actor }}
        password: ${{ secrets.GITHUB_TOKEN }}
    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          ref: ${{ inputs['checkout-ref'] }}

      - name: Download Linux runtime tarballs
        env:
          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
          RUNTIME_PLATFORMS: ${{ inputs['runtime-platforms'] }}
        run: |
          set -euo pipefail
          mkdir -p runtime-artifacts

          runtime_platforms="${RUNTIME_PLATFORMS//[[:space:]]/}"
          IFS=',' read -r -a platforms <<< "$runtime_platforms"
          if [ "${#platforms[@]}" -eq 0 ]; then
            echo "::error::No VM runtime platforms requested"
            exit 1
          fi
          for platform in "${platforms[@]}"; do
            case "$platform" in
              linux-aarch64 | linux-x86_64) ;;
              *)
                echo "::error::Unsupported VM runtime platform '$platform' in runtime-platforms"
                exit 1
                ;;
            esac
          done
          printf '%s\n' "${platforms[@]}" > runtime-artifacts/platforms.txt

          for platform in "${platforms[@]}"; do
            asset="vm-runtime-${platform}.tar.zst"
            echo "Downloading ${asset}..."
            if ! gh release download vm-runtime \
              --repo "${GITHUB_REPOSITORY}" \
              --pattern "${asset}" \
              --dir runtime-artifacts \
              --clobber; then
              echo "::error::No ${asset} asset found on vm-runtime release"
              exit 1
            fi
          done

          ls -lah runtime-artifacts/

      - name: Verify downloads
        run: |
          set -euo pipefail
          while IFS= read -r platform; do
            test -f "runtime-artifacts/vm-runtime-${platform}.tar.zst"
          done < runtime-artifacts/platforms.txt

      - name: Upload runtime artifacts
        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7
        with:
          name: vm-driver-kernel-runtime-tarballs
          path: runtime-artifacts/vm-runtime-*.tar.zst
          retention-days: 1

  build-driver-vm-linux:
    name: Build Driver VM (Linux ${{ matrix.arch }})
    needs: [download-kernel-runtime]
    strategy:
      matrix:
        include: ${{ fromJSON(inputs['driver-targets']) }}
    runs-on: ${{ matrix.runner }}
    timeout-minutes: 30
    container:
      image: ghcr.io/nvidia/openshell/ci:latest
      credentials:
        username: ${{ github.actor }}
        password: ${{ secrets.GITHUB_TOKEN }}
      options: --privileged
    env:
      MISE_GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
      OPENSHELL_IMAGE_TAG: ${{ inputs['image-tag'] }}
    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          ref: ${{ inputs['checkout-ref'] }}
          fetch-depth: 0

      - name: Mark workspace safe for git
        run: git config --global --add safe.directory "$GITHUB_WORKSPACE"

      - name: Fetch tags
        run: git fetch --tags --force

      - name: Install tools
        run: mise install --locked

      - name: Cache Rust target and registry
        uses: Swatinem/rust-cache@6323deb102c322ba6fcbdcafc7e3dddab59af2b6 # v2
        with:
          shared-key: driver-vm-linux-${{ matrix.arch }}
          cache-directories: .cache/sccache
          cache-targets: "true"

      - name: Install zstd
        run: apt-get update && apt-get install -y --no-install-recommends zstd && rm -rf /var/lib/apt/lists/*

      - name: Download kernel runtime tarball
        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
        with:
          name: vm-driver-kernel-runtime-tarballs
          path: runtime-download/

      - name: Stage compressed runtime for embedding
        run: |
          set -euo pipefail
          COMPRESSED_DIR="${PWD}/target/vm-runtime-compressed"
          VM_RUNTIME_TARBALL="${PWD}/runtime-download/vm-runtime-${{ matrix.platform }}.tar.zst" \
          VM_RUNTIME_PLATFORM="${{ matrix.platform }}" \
          OPENSHELL_VM_RUNTIME_COMPRESSED_DIR="$COMPRESSED_DIR" \
            tasks/scripts/vm/compress-vm-runtime.sh

      - name: Build bundled supervisor
        run: |
          set -euo pipefail
          OPENSHELL_VM_RUNTIME_COMPRESSED_DIR="${PWD}/target/vm-runtime-compressed" \
            tasks/scripts/vm/build-supervisor-bundle.sh --arch "${{ matrix.guest_arch }}"

      - name: Verify embedded driver inputs
        run: |
          set -euo pipefail
          for file in libkrun.so.zst libkrunfw.so.5.zst gvproxy.zst umoci.zst openshell-sandbox.zst; do
            test -s "target/vm-runtime-compressed/${file}"
          done

      - name: Scope workspace to driver-vm crates
        run: |
          set -euo pipefail
          sed -i 's|members = \["crates/\*"\]|members = ["crates/openshell-driver-vm", "crates/openshell-core"]|' Cargo.toml

      - name: Patch workspace version
        if: ${{ inputs['cargo-version'] != '' }}
        run: |
          set -euo pipefail
          sed -i -E '/^\[workspace\.package\]/,/^\[/{s/^version[[:space:]]*=[[:space:]]*".*"/version = "'"${{ inputs['cargo-version'] }}"'"/}' Cargo.toml

      - name: Build openshell-driver-vm with glibc 2.28 floor
        run: |
          set -euo pipefail
          mise x -- rustup target add ${{ matrix.target }}
          OPENSHELL_VM_RUNTIME_COMPRESSED_DIR="${PWD}/target/vm-runtime-compressed" \
            mise x -- cargo zigbuild --release --target ${{ matrix.zig_target }} -p openshell-driver-vm --bin openshell-driver-vm
          mkdir -p artifacts/bin
          install -m 0755 target/${{ matrix.target }}/release/openshell-driver-vm artifacts/bin/openshell-driver-vm

      - name: Verify packaged binary
        run: |
          set -euo pipefail
          OUTPUT="$(artifacts/bin/openshell-driver-vm --version)"
          echo "$OUTPUT"
          grep -q '^openshell-driver-vm ' <<<"$OUTPUT"

      - name: Verify glibc symbol floor
        run: tasks/scripts/verify-glibc-symbols.sh 2.28 artifacts/bin/openshell-driver-vm

      - name: sccache stats
        if: always()
        run: mise x -- sccache --show-stats

      - name: Package binary
        run: |
          set -euo pipefail
          mkdir -p artifacts
          tar -czf "artifacts/openshell-driver-vm-${{ matrix.target }}.tar.gz" \
            -C artifacts/bin openshell-driver-vm

      - name: Upload artifact
        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7
        with:
          name: driver-vm-linux-${{ matrix.arch }}
          path: artifacts/*.tar.gz
          retention-days: 5