mirror of
https://github.com/NVIDIA/OpenShell.git
synced 2026-10-16 05:20:22 +08:00
Johnny Greco
58b5f8f976
* feat(prover): add standalone policy maximum checker Signed-off-by: Johnny Greco <jogreco@nvidia.com> * refactor(prover): simplify check scope schema Signed-off-by: Johnny Greco <jogreco@nvidia.com> * fix(prover): align containment and cancellation with runtime Signed-off-by: Johnny Greco <jogreco@nvidia.com> * fix(prover): stabilize containment checks in CI Signed-off-by: Johnny Greco <jogreco@nvidia.com> * test(prover): avoid solver in fast-path guard test Signed-off-by: Johnny Greco <jogreco@nvidia.com> * fix(prover): align string containment with runtime Signed-off-by: Johnny Greco <jogreco@nvidia.com> * fix(prover): reject ambiguous z3 string escapes Signed-off-by: Johnny Greco <jogreco@nvidia.com> * fix(prover): align containment with runtime boundaries Signed-off-by: Johnny Greco <jogreco@nvidia.com> * fix(prover-cli): harden cancellation and invalid input Signed-off-by: Johnny Greco <jogreco@nvidia.com> * feat(packaging): install policy prover with OpenShell Signed-off-by: Johnny Greco <jogreco@nvidia.com> * docs(prover): clarify installation and check results Signed-off-by: Johnny Greco <jogreco@nvidia.com> * docs(build): describe prover distribution directly Signed-off-by: Johnny Greco <jogreco@nvidia.com> * refactor(prover): rename maximum policy to boundary Signed-off-by: Johnny Greco <jogreco@nvidia.com> * refactor(prover): localize fail-closed validation Signed-off-by: Johnny Greco <jogreco@nvidia.com> * test(prover): cover fail-closed CLI surfaces Signed-off-by: Johnny Greco <jogreco@nvidia.com> * test(prover): allow CI load for REST solver proof Signed-off-by: Johnny Greco <jogreco@nvidia.com> * fix(prover): use canonical policy schema for containment Signed-off-by: Johnny Greco <jogreco@nvidia.com> * fix(prover): preserve uncertainty for runtime binary globs Signed-off-by: Johnny Greco <jogreco@nvidia.com> * fix(prover): bound policy validation work Signed-off-by: Johnny Greco <jogreco@nvidia.com> * docs(prover): document validation resource limits Signed-off-by: Johnny Greco <jogreco@nvidia.com> * fix(prover): make containment API extensible Signed-off-by: Johnny Greco <jogreco@nvidia.com> * docs(prover): define containment API contract Signed-off-by: Johnny Greco <jogreco@nvidia.com> * fix(ci): integrate prover with consolidated builds Signed-off-by: Johnny Greco <jogreco@nvidia.com> * fix(ci): declare release packaging dependency Signed-off-by: Johnny Greco <jogreco@nvidia.com> --------- Signed-off-by: Johnny Greco <jogreco@nvidia.com>
99 lines
3.1 KiB
YAML
99 lines
3.1 KiB
YAML
name: Debian Package
|
|
|
|
on:
|
|
workflow_call:
|
|
inputs:
|
|
deb-version:
|
|
required: true
|
|
type: string
|
|
checkout-ref:
|
|
required: true
|
|
type: string
|
|
|
|
permissions:
|
|
contents: read
|
|
packages: read
|
|
|
|
defaults:
|
|
run:
|
|
shell: bash
|
|
|
|
jobs:
|
|
build-deb-linux:
|
|
name: Build Debian Package (Linux ${{ matrix.arch }})
|
|
strategy:
|
|
matrix:
|
|
include:
|
|
- arch: amd64
|
|
runner: linux-amd64-cpu8
|
|
deb_arch: amd64
|
|
cli_target: x86_64-unknown-linux-musl
|
|
gnu_target: x86_64-unknown-linux-gnu
|
|
- arch: arm64
|
|
runner: linux-arm64-cpu8
|
|
deb_arch: arm64
|
|
cli_target: aarch64-unknown-linux-musl
|
|
gnu_target: aarch64-unknown-linux-gnu
|
|
runs-on: ${{ matrix.runner }}
|
|
timeout-minutes: 20
|
|
container:
|
|
image: ghcr.io/nvidia/openshell/ci:latest
|
|
credentials:
|
|
username: ${{ github.actor }}
|
|
password: ${{ secrets.GITHUB_TOKEN }}
|
|
steps:
|
|
- uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
|
|
with:
|
|
ref: ${{ inputs['checkout-ref'] }}
|
|
|
|
- name: Download CLI artifact
|
|
uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
|
|
with:
|
|
name: openshell-${{ matrix.cli_target }}
|
|
path: package-binaries/
|
|
|
|
- name: Download gateway artifact
|
|
uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
|
|
with:
|
|
name: openshell-gateway-${{ matrix.gnu_target }}
|
|
path: package-binaries/
|
|
|
|
- name: Download prover artifact
|
|
uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
|
|
with:
|
|
name: openshell-prover-${{ matrix.cli_target }}
|
|
path: package-binaries/
|
|
|
|
- name: Download VM driver artifact
|
|
uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
|
|
with:
|
|
name: openshell-driver-vm-${{ matrix.gnu_target }}
|
|
path: package-binaries/
|
|
|
|
- name: Configure package inputs
|
|
run: |
|
|
set -euo pipefail
|
|
chmod +x package-binaries/openshell{,-gateway,-prover,-driver-vm}
|
|
ls -lah package-binaries
|
|
|
|
- name: Build Debian package
|
|
run: |
|
|
set -euo pipefail
|
|
OPENSHELL_CLI_BINARY="${PWD}/package-binaries/openshell" \
|
|
OPENSHELL_GATEWAY_BINARY="${PWD}/package-binaries/openshell-gateway" \
|
|
OPENSHELL_PROVER_BINARY="${PWD}/package-binaries/openshell-prover" \
|
|
OPENSHELL_DRIVER_VM_BINARY="${PWD}/package-binaries/openshell-driver-vm" \
|
|
OPENSHELL_DEB_VERSION="${INPUTS_DEB_VERSION}" \
|
|
OPENSHELL_DEB_ARCH="${{ matrix.deb_arch }}" \
|
|
OPENSHELL_OUTPUT_DIR=artifacts \
|
|
tasks/scripts/package-deb.sh
|
|
env:
|
|
INPUTS_DEB_VERSION: ${{ inputs['deb-version'] }}
|
|
|
|
- name: Upload Debian package artifact
|
|
uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7
|
|
with:
|
|
name: deb-linux-${{ matrix.arch }}
|
|
path: artifacts/*.deb
|
|
retention-days: 5
|