mirror of
https://github.com/NVIDIA/OpenShell.git
synced 2026-10-19 05:50:41 +08:00
88 lines
3.3 KiB
YAML
88 lines
3.3 KiB
YAML
# SPDX-FileCopyrightText: Copyright (c) 2025-2026 NVIDIA CORPORATION & AFFILIATES. All rights reserved.
|
|
# SPDX-License-Identifier: Apache-2.0
|
|
|
|
name: Build Rust Binary
|
|
description: Build, verify, package, and upload an auditable Rust binary
|
|
|
|
inputs:
|
|
package:
|
|
description: Cargo package that owns the binary
|
|
required: true
|
|
binary:
|
|
description: Cargo binary name
|
|
required: true
|
|
triple:
|
|
description: Rust target triple
|
|
required: true
|
|
cargo-version:
|
|
description: Cargo package version embedded in the binary
|
|
required: true
|
|
supervisor-image-tag:
|
|
description: Default supervisor image tag embedded in the binary
|
|
required: false
|
|
default: ""
|
|
artifact-name:
|
|
description: GitHub artifact name
|
|
required: false
|
|
default: ""
|
|
extra-cargo-flags:
|
|
description: Additional flags passed to cargo build
|
|
required: false
|
|
default: ""
|
|
runs:
|
|
using: composite
|
|
steps:
|
|
- name: Hash development shell
|
|
id: dev-shell
|
|
shell: bash
|
|
run: |
|
|
shell_drv=$(nix eval --raw --impure .#devShells --apply 'shells: shells.${builtins.currentSystem}.default.drvPath')
|
|
echo "hash=$(nix hash file --type sha256 --base16 "$shell_drv")" >> "$GITHUB_OUTPUT"
|
|
|
|
- name: Cache Rust artifacts
|
|
uses: Swatinem/rust-cache@6323deb102c322ba6fcbdcafc7e3dddab59af2b6 # v2.9.2
|
|
with:
|
|
shared-key: binaries-${{ inputs.binary }}-${{ inputs.triple }}-${{ steps.dev-shell.outputs.hash }}
|
|
cache-on-failure: "true"
|
|
cache-workspace-crates: "true"
|
|
cache-bin: "false"
|
|
cmd-format: nix develop -c {0}
|
|
|
|
- name: Set version
|
|
shell: nix develop -c bash -euo pipefail {0}
|
|
env:
|
|
INPUTS_CARGO_VERSION: ${{ inputs.cargo-version }}
|
|
run: sed -i "s/^version = \"0\\.0\\.0\"$/version = \"${INPUTS_CARGO_VERSION}\"/" Cargo.toml
|
|
|
|
- name: Build ${{ inputs.binary }}
|
|
shell: nix develop -c bash -euo pipefail {0}
|
|
env:
|
|
GIT_DIR: /nonexistent
|
|
OPENSHELL_IMAGE_TAG: ${{ inputs.supervisor-image-tag }}
|
|
INPUTS_PACKAGE: ${{ inputs.package }}
|
|
INPUTS_BINARY: ${{ inputs.binary }}
|
|
INPUTS_TRIPLE: ${{ inputs.triple }}
|
|
INPUTS_EXTRA_CARGO_FLAGS: ${{ inputs.extra-cargo-flags }}
|
|
run: cargo auditable build --release --target "${INPUTS_TRIPLE}" --package "${INPUTS_PACKAGE}" --bin "${INPUTS_BINARY}" ${INPUTS_EXTRA_CARGO_FLAGS}
|
|
|
|
- name: Verify ${{ inputs.binary }}
|
|
shell: nix develop -c bash -euo pipefail {0}
|
|
env:
|
|
INPUTS_BINARY: ${{ inputs.binary }}
|
|
INPUTS_TRIPLE: ${{ inputs.triple }}
|
|
run: |
|
|
binary="target/${INPUTS_TRIPLE}/release/${INPUTS_BINARY}"
|
|
# Confirm the binary runs and reports the expected name.
|
|
"$binary" --version | grep -q "^${INPUTS_BINARY} "
|
|
# Confirm Syft can decode the embedded cargo-auditable metadata.
|
|
SYFT_CHECK_FOR_APP_UPDATE=false syft "file:${binary}" -o cyclonedx-json | grep 'pkg:cargo/' > /dev/null
|
|
|
|
- name: Upload ${{ inputs.binary }}
|
|
uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7
|
|
with:
|
|
name: ${{ inputs.artifact-name || format('{0}-{1}', inputs.binary, inputs.triple) }}
|
|
path: target/${{ inputs.triple }}/release/${{ inputs.binary }}
|
|
compression-level: 0
|
|
retention-days: 5
|
|
if-no-files-found: error
|