OpenShell/.github/workflows/driver-vm-linux.yml

name: Driver VM Linux

on:
  workflow_call:
    inputs:
      cargo-version:
        required: true
        type: string
      image-tag:
        required: true
        type: string
      checkout-ref:
        required: true
        type: string

permissions:
  contents: read
  packages: read

defaults:
  run:
    shell: bash

jobs:
  download-kernel-runtime:
    name: Download Kernel Runtime
    runs-on: linux-amd64-cpu8
    timeout-minutes: 10
    container:
      image: ghcr.io/nvidia/openshell/ci:latest
      credentials:
        username: ${{ github.actor }}
        password: ${{ secrets.GITHUB_TOKEN }}
    steps:
      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
        with:
          ref: ${{ inputs['checkout-ref'] }}

      - name: Download Linux runtime tarballs
        env:
          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
        run: |
          set -euo pipefail
          mkdir -p runtime-artifacts

          for platform in linux-aarch64 linux-x86_64; do
            asset="vm-runtime-${platform}.tar.zst"
            echo "Downloading ${asset}..."
            if ! gh release download vm-runtime \
              --repo "${GITHUB_REPOSITORY}" \
              --pattern "${asset}" \
              --dir runtime-artifacts \
              --clobber; then
              echo "::error::No ${asset} asset found on vm-runtime release"
              exit 1
            fi
          done

          ls -lah runtime-artifacts/

      - name: Verify downloads
        run: |
          set -euo pipefail
          for platform in linux-aarch64 linux-x86_64; do
            test -f "runtime-artifacts/vm-runtime-${platform}.tar.zst"
          done

      - name: Upload runtime artifacts
        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7
        with:
          name: vm-driver-kernel-runtime-tarballs
          path: runtime-artifacts/vm-runtime-*.tar.zst
          retention-days: 1

  build-driver-vm-linux:
    name: Build Driver VM (Linux ${{ matrix.arch }})
    needs: [download-kernel-runtime]
    strategy:
      matrix:
        include:
          - arch: arm64
            runner: linux-arm64-cpu8
            target: aarch64-unknown-linux-gnu
            zig_target: aarch64-unknown-linux-gnu.2.31
            platform: linux-aarch64
            guest_arch: aarch64
          - arch: amd64
            runner: linux-amd64-cpu8
            target: x86_64-unknown-linux-gnu
            zig_target: x86_64-unknown-linux-gnu.2.31
            platform: linux-x86_64
            guest_arch: x86_64
    runs-on: ${{ matrix.runner }}
    timeout-minutes: 30
    container:
      image: ghcr.io/nvidia/openshell/ci:latest
      credentials:
        username: ${{ github.actor }}
        password: ${{ secrets.GITHUB_TOKEN }}
      options: --privileged
    env:
      MISE_GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
      OPENSHELL_IMAGE_TAG: ${{ inputs['image-tag'] }}
    steps:
      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
        with:
          ref: ${{ inputs['checkout-ref'] }}
          fetch-depth: 0

      - name: Mark workspace safe for git
        run: git config --global --add safe.directory "$GITHUB_WORKSPACE"

      - name: Fetch tags
        run: git fetch --tags --force

      - name: Install tools
        run: mise install --locked

      - name: Cache Rust target and registry
        uses: Swatinem/rust-cache@c19371144df3bb44fab255c43d04cbc2ab54d1c4 # v2
        with:
          shared-key: driver-vm-linux-${{ matrix.arch }}
          cache-directories: .cache/sccache
          cache-targets: "true"

      - name: Install zstd
        run: apt-get update && apt-get install -y --no-install-recommends zstd && rm -rf /var/lib/apt/lists/*

      - name: Download kernel runtime tarball
        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
        with:
          name: vm-driver-kernel-runtime-tarballs
          path: runtime-download/

      - name: Stage compressed runtime for embedding
        run: |
          set -euo pipefail
          COMPRESSED_DIR="${PWD}/target/vm-runtime-compressed"
          VM_RUNTIME_TARBALL="${PWD}/runtime-download/vm-runtime-${{ matrix.platform }}.tar.zst" \
          VM_RUNTIME_PLATFORM="${{ matrix.platform }}" \
          OPENSHELL_VM_RUNTIME_COMPRESSED_DIR="$COMPRESSED_DIR" \
            tasks/scripts/vm/compress-vm-runtime.sh

      - name: Build bundled supervisor
        run: |
          set -euo pipefail
          OPENSHELL_VM_RUNTIME_COMPRESSED_DIR="${PWD}/target/vm-runtime-compressed" \
            tasks/scripts/vm/build-supervisor-bundle.sh --arch "${{ matrix.guest_arch }}"

      - name: Verify embedded driver inputs
        run: |
          set -euo pipefail
          for file in libkrun.so.zst libkrunfw.so.5.zst gvproxy.zst umoci.zst openshell-sandbox.zst; do
            test -s "target/vm-runtime-compressed/${file}"
          done

      - name: Scope workspace to driver-vm crates
        run: |
          set -euo pipefail
          sed -i 's|members = \["crates/\*"\]|members = ["crates/openshell-driver-vm", "crates/openshell-core"]|' Cargo.toml

      - name: Patch workspace version
        if: ${{ inputs['cargo-version'] != '' }}
        run: |
          set -euo pipefail
          sed -i -E '/^\[workspace\.package\]/,/^\[/{s/^version[[:space:]]*=[[:space:]]*".*"/version = "'"${{ inputs['cargo-version'] }}"'"/}' Cargo.toml

      - name: Build openshell-driver-vm with glibc 2.31 floor
        run: |
          set -euo pipefail
          mise x -- rustup target add ${{ matrix.target }}
          OPENSHELL_VM_RUNTIME_COMPRESSED_DIR="${PWD}/target/vm-runtime-compressed" \
            mise x -- cargo zigbuild --release --target ${{ matrix.zig_target }} -p openshell-driver-vm --bin openshell-driver-vm
          mkdir -p artifacts/bin
          install -m 0755 target/${{ matrix.target }}/release/openshell-driver-vm artifacts/bin/openshell-driver-vm

      - name: Verify packaged binary
        run: |
          set -euo pipefail
          OUTPUT="$(artifacts/bin/openshell-driver-vm --version)"
          echo "$OUTPUT"
          grep -q '^openshell-driver-vm ' <<<"$OUTPUT"

      - name: Verify glibc symbol floor
        run: tasks/scripts/verify-glibc-symbols.sh 2.31 artifacts/bin/openshell-driver-vm

      - name: sccache stats
        if: always()
        run: mise x -- sccache --show-stats

      - name: Package binary
        run: |
          set -euo pipefail
          mkdir -p artifacts
          tar -czf "artifacts/openshell-driver-vm-${{ matrix.target }}.tar.gz" \
            -C artifacts/bin openshell-driver-vm

      - name: Upload artifact
        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7
        with:
          name: driver-vm-linux-${{ matrix.arch }}
          path: artifacts/*.tar.gz
          retention-days: 5