OpenShell/.github/workflows/release-vm-kernel.yml

name: Release VM Kernel

# Build custom libkrunfw (kernel firmware) + libkrun (VMM) + gvproxy for all
# supported openshell-vm platforms.  Artifacts are uploaded to the rolling
# "vm-dev" GitHub Release and consumed by release-vm-dev.yml when building the
# openshell-vm binary.
#
# The Linux kernel is compiled once on aarch64 Linux.  The resulting kernel.c
# (a C source file containing the kernel as a byte array) is shared with the
# macOS job, which only needs to compile it into a .dylib — no krunvm, no
# Fedora VM, no kernel rebuild.  This cuts macOS CI from ~45 min to ~5 min.
#
# This workflow runs on-demand (or when kernel config / pins change).  It is
# intentionally decoupled from the per-commit VM binary build because the
# kernel rarely changes and takes 15-45 minutes to compile.

on:
  workflow_dispatch:

permissions:
  contents: write
  packages: read

# Serialize with release-vm-dev.yml — both update the vm-dev release.
concurrency:
  group: vm-dev-release
  cancel-in-progress: false

defaults:
  run:
    shell: bash

jobs:
  # ---------------------------------------------------------------------------
  # Linux ARM64 — native kernel + libkrun build (also exports kernel.c)
  # ---------------------------------------------------------------------------
  build-runtime-linux-arm64:
    name: Build Runtime (Linux ARM64)
    runs-on: build-arm64
    timeout-minutes: 60
    container:
      image: ghcr.io/nvidia/openshell/ci:latest
      credentials:
        username: ${{ github.actor }}
        password: ${{ secrets.GITHUB_TOKEN }}
      options: --privileged
    env:
      MISE_GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
    steps:
      - uses: actions/checkout@v6

      - name: Mark workspace safe for git
        run: git config --global --add safe.directory "$GITHUB_WORKSPACE"

      - name: Build libkrunfw + libkrun from source
        run: tasks/scripts/vm/build-libkrun.sh

      - name: Package runtime tarball
        run: |
          tasks/scripts/vm/package-vm-runtime.sh \
            --platform linux-aarch64 \
            --build-dir target/libkrun-build \
            --output artifacts/vm-runtime-linux-aarch64.tar.zst

      - name: Upload runtime artifact
        uses: actions/upload-artifact@v4
        with:
          name: vm-runtime-linux-arm64
          path: artifacts/vm-runtime-linux-aarch64.tar.zst
          retention-days: 5

      # Export kernel.c + ABI_VERSION for the macOS job.  kernel.c contains
      # the aarch64 Linux kernel as a byte array — it is OS-agnostic and can
      # be compiled into a .dylib by Apple's cc without rebuilding the kernel.
      - name: Upload kernel.c for macOS build
        uses: actions/upload-artifact@v4
        with:
          name: kernel-c-arm64
          path: |
            target/libkrun-build/kernel.c
            target/libkrun-build/ABI_VERSION
          retention-days: 1

  # ---------------------------------------------------------------------------
  # Linux AMD64 — native kernel + libkrun build
  # ---------------------------------------------------------------------------
  build-runtime-linux-amd64:
    name: Build Runtime (Linux AMD64)
    runs-on: build-amd64
    timeout-minutes: 60
    container:
      image: ghcr.io/nvidia/openshell/ci:latest
      credentials:
        username: ${{ github.actor }}
        password: ${{ secrets.GITHUB_TOKEN }}
      options: --privileged
    env:
      MISE_GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
    steps:
      - uses: actions/checkout@v6

      - name: Mark workspace safe for git
        run: git config --global --add safe.directory "$GITHUB_WORKSPACE"

      - name: Build libkrunfw + libkrun from source
        run: tasks/scripts/vm/build-libkrun.sh

      - name: Package runtime tarball
        run: |
          tasks/scripts/vm/package-vm-runtime.sh \
            --platform linux-x86_64 \
            --build-dir target/libkrun-build \
            --output artifacts/vm-runtime-linux-x86_64.tar.zst

      - name: Upload artifact
        uses: actions/upload-artifact@v4
        with:
          name: vm-runtime-linux-amd64
          path: artifacts/vm-runtime-linux-x86_64.tar.zst
          retention-days: 5

  # ---------------------------------------------------------------------------
  # macOS ARM64 — uses pre-built kernel.c from Linux ARM64 job
  # ---------------------------------------------------------------------------
  build-runtime-macos-arm64:
    name: Build Runtime (macOS ARM64)
    needs: [build-runtime-linux-arm64]
    runs-on: macos-latest-xlarge
    timeout-minutes: 30
    env:
      RUSTC_WRAPPER: ""
    steps:
      - uses: actions/checkout@v6

      - name: Install dependencies
        run: |
          set -euo pipefail
          curl --proto '=https' --tlsv1.2 -sSf https://sh.rustup.rs | sh -s -- -y --default-toolchain 1.95.0
          echo "$HOME/.cargo/bin" >> "$GITHUB_PATH"
          brew install lld dtc xz

      - name: Download pre-built kernel.c
        uses: actions/download-artifact@v4
        with:
          name: kernel-c-arm64
          path: target/kernel-artifact

      - name: Build libkrunfw + libkrun from pre-built kernel
        run: tasks/scripts/vm/build-libkrun-macos.sh --kernel-dir target/kernel-artifact

      - name: Package runtime tarball
        run: |
          tasks/scripts/vm/package-vm-runtime.sh \
            --platform darwin-aarch64 \
            --build-dir target/libkrun-build \
            --output artifacts/vm-runtime-darwin-aarch64.tar.zst

      - name: Upload artifact
        uses: actions/upload-artifact@v4
        with:
          name: vm-runtime-macos-arm64
          path: artifacts/vm-runtime-darwin-aarch64.tar.zst
          retention-days: 5

  # ---------------------------------------------------------------------------
  # Upload all runtime tarballs to the vm-dev rolling release
  # ---------------------------------------------------------------------------
  release-kernel:
    name: Release Kernel Runtime
    needs: [build-runtime-linux-arm64, build-runtime-linux-amd64, build-runtime-macos-arm64]
    runs-on: build-amd64
    timeout-minutes: 10
    steps:
      - uses: actions/checkout@v6

      - name: Download all runtime artifacts
        uses: actions/download-artifact@v4
        with:
          pattern: vm-runtime-*
          path: release/
          merge-multiple: true

      - name: Generate checksums
        run: |
          set -euo pipefail
          cd release
          sha256sum vm-runtime-*.tar.zst > vm-runtime-checksums-sha256.txt
          cat vm-runtime-checksums-sha256.txt

      - name: Ensure vm-dev tag exists
        run: |
          git config user.name "github-actions[bot]"
          git config user.email "github-actions[bot]@users.noreply.github.com"
          git tag -fa vm-dev -m "VM Development Build" "${GITHUB_SHA}"
          git push --force origin vm-dev

      - name: Prune stale runtime assets from vm-dev release
        uses: actions/github-script@v7
        with:
          script: |
            const [owner, repo] = process.env.GITHUB_REPOSITORY.split('/');
            let release;
            try {
              release = await github.rest.repos.getReleaseByTag({ owner, repo, tag: 'vm-dev' });
            } catch (err) {
              if (err.status === 404) {
                core.info('No existing vm-dev release; will create fresh.');
                return;
              }
              throw err;
            }
            // Delete old runtime tarballs and checksums (keep vm binary assets)
            for (const asset of release.data.assets) {
              if (asset.name.startsWith('vm-runtime-')) {
                core.info(`Deleting stale asset: ${asset.name}`);
                await github.rest.repos.deleteReleaseAsset({ owner, repo, asset_id: asset.id });
              }
            }

      - name: Create / update vm-dev GitHub Release
        uses: softprops/action-gh-release@v2
        with:
          name: OpenShell VM Development Build
          prerelease: true
          tag_name: vm-dev
          target_commitish: ${{ github.sha }}
          body: |
            Rolling development build of **openshell-vm** — the MicroVM runtime for OpenShell.

            > **NOTE**: This is a development build, not a tagged release, and may be unstable.
            > The VM implementation itself is also experimental and may change or break without
            > notice.

            ### Kernel Runtime Artifacts

            Pre-built kernel runtime (libkrunfw + libkrun + gvproxy) for embedding into
            the openshell-vm binary. These are rebuilt when the kernel config or pinned
            dependency versions change.

            | Platform | Artifact |
            |----------|----------|
            | Linux ARM64 | `vm-runtime-linux-aarch64.tar.zst` |
            | Linux x86_64 | `vm-runtime-linux-x86_64.tar.zst` |
            | macOS ARM64 | `vm-runtime-darwin-aarch64.tar.zst` |

            ### VM Binaries

            Self-extracting openshell-vm binaries with embedded kernel runtime and base
            rootfs. These are rebuilt on every push to main.

            | Platform | Artifact |
            |----------|----------|
            | Linux ARM64 | `openshell-vm-aarch64-unknown-linux-gnu.tar.gz` |
            | Linux x86_64 | `openshell-vm-x86_64-unknown-linux-gnu.tar.gz` |
            | macOS ARM64 | `openshell-vm-aarch64-apple-darwin.tar.gz` |

            ### Quick install

            ```
            curl -fsSL https://raw.githubusercontent.com/NVIDIA/OpenShell/main/install-vm.sh | sh
            ```

            Auto-detects your platform, verifies checksums, and codesigns on macOS.

          files: |
            release/vm-runtime-linux-aarch64.tar.zst
            release/vm-runtime-linux-x86_64.tar.zst
            release/vm-runtime-darwin-aarch64.tar.zst
            release/vm-runtime-checksums-sha256.txt