mirror of
https://github.com/NVIDIA/OpenShell.git
synced 2026-10-21 06:11:31 +08:00
Johnny Greco
58b5f8f976
* feat(prover): add standalone policy maximum checker Signed-off-by: Johnny Greco <jogreco@nvidia.com> * refactor(prover): simplify check scope schema Signed-off-by: Johnny Greco <jogreco@nvidia.com> * fix(prover): align containment and cancellation with runtime Signed-off-by: Johnny Greco <jogreco@nvidia.com> * fix(prover): stabilize containment checks in CI Signed-off-by: Johnny Greco <jogreco@nvidia.com> * test(prover): avoid solver in fast-path guard test Signed-off-by: Johnny Greco <jogreco@nvidia.com> * fix(prover): align string containment with runtime Signed-off-by: Johnny Greco <jogreco@nvidia.com> * fix(prover): reject ambiguous z3 string escapes Signed-off-by: Johnny Greco <jogreco@nvidia.com> * fix(prover): align containment with runtime boundaries Signed-off-by: Johnny Greco <jogreco@nvidia.com> * fix(prover-cli): harden cancellation and invalid input Signed-off-by: Johnny Greco <jogreco@nvidia.com> * feat(packaging): install policy prover with OpenShell Signed-off-by: Johnny Greco <jogreco@nvidia.com> * docs(prover): clarify installation and check results Signed-off-by: Johnny Greco <jogreco@nvidia.com> * docs(build): describe prover distribution directly Signed-off-by: Johnny Greco <jogreco@nvidia.com> * refactor(prover): rename maximum policy to boundary Signed-off-by: Johnny Greco <jogreco@nvidia.com> * refactor(prover): localize fail-closed validation Signed-off-by: Johnny Greco <jogreco@nvidia.com> * test(prover): cover fail-closed CLI surfaces Signed-off-by: Johnny Greco <jogreco@nvidia.com> * test(prover): allow CI load for REST solver proof Signed-off-by: Johnny Greco <jogreco@nvidia.com> * fix(prover): use canonical policy schema for containment Signed-off-by: Johnny Greco <jogreco@nvidia.com> * fix(prover): preserve uncertainty for runtime binary globs Signed-off-by: Johnny Greco <jogreco@nvidia.com> * fix(prover): bound policy validation work Signed-off-by: Johnny Greco <jogreco@nvidia.com> * docs(prover): document validation resource limits Signed-off-by: Johnny Greco <jogreco@nvidia.com> * fix(prover): make containment API extensible Signed-off-by: Johnny Greco <jogreco@nvidia.com> * docs(prover): define containment API contract Signed-off-by: Johnny Greco <jogreco@nvidia.com> * fix(ci): integrate prover with consolidated builds Signed-off-by: Johnny Greco <jogreco@nvidia.com> * fix(ci): declare release packaging dependency Signed-off-by: Johnny Greco <jogreco@nvidia.com> --------- Signed-off-by: Johnny Greco <jogreco@nvidia.com>
164 lines
4.6 KiB
YAML
164 lines
4.6 KiB
YAML
# SPDX-FileCopyrightText: Copyright (c) 2025-2026 NVIDIA CORPORATION & AFFILIATES. All rights reserved.
|
|
# SPDX-License-Identifier: Apache-2.0
|
|
|
|
name: Build Binaries
|
|
|
|
on:
|
|
workflow_call:
|
|
inputs:
|
|
cargo-version:
|
|
required: true
|
|
type: string
|
|
supervisor-image-tag:
|
|
required: false
|
|
type: string
|
|
default: ""
|
|
checkout-ref:
|
|
required: false
|
|
type: string
|
|
default: ""
|
|
secrets:
|
|
CACHIX_AUTH_TOKEN:
|
|
required: true
|
|
|
|
permissions:
|
|
contents: read
|
|
|
|
env:
|
|
EXTRA_CARGO_FLAGS: ""
|
|
|
|
jobs:
|
|
cli:
|
|
name: openshell (${{ matrix.triple }})
|
|
env:
|
|
PACKAGE: openshell-cli
|
|
BINARY: openshell
|
|
strategy:
|
|
matrix:
|
|
include:
|
|
- triple: x86_64-unknown-linux-musl
|
|
runner: linux-amd64-cpu8
|
|
- triple: aarch64-unknown-linux-musl
|
|
runner: linux-arm64-cpu8
|
|
- triple: aarch64-apple-darwin
|
|
runner: macos-15-xlarge
|
|
runs-on: ${{ matrix.runner }}
|
|
timeout-minutes: 60
|
|
steps: &build_steps
|
|
- uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
|
|
with:
|
|
persist-credentials: false
|
|
ref: ${{ inputs.checkout-ref || github.sha }}
|
|
- uses: ./.github/actions/setup-nix
|
|
with:
|
|
cachix-auth-token: ${{ secrets.CACHIX_AUTH_TOKEN }}
|
|
- uses: ./.github/actions/build-rust-binary
|
|
with:
|
|
package: ${{ env.PACKAGE }}
|
|
binary: ${{ env.BINARY }}
|
|
triple: ${{ matrix.triple }}
|
|
cargo-version: ${{ inputs.cargo-version }}
|
|
supervisor-image-tag: ${{ inputs.supervisor-image-tag }}
|
|
extra-cargo-flags: ${{ env.EXTRA_CARGO_FLAGS }}
|
|
|
|
conformance:
|
|
name: openshell-conformance (${{ matrix.triple }})
|
|
env:
|
|
PACKAGE: openshell-conformance-cli
|
|
BINARY: openshell-conformance
|
|
strategy:
|
|
matrix:
|
|
include:
|
|
- triple: x86_64-unknown-linux-musl
|
|
runner: linux-amd64-cpu8
|
|
- triple: aarch64-unknown-linux-musl
|
|
runner: linux-arm64-cpu8
|
|
runs-on: ${{ matrix.runner }}
|
|
timeout-minutes: 60
|
|
steps: *build_steps
|
|
|
|
prover:
|
|
name: openshell-prover (${{ matrix.triple }})
|
|
env:
|
|
PACKAGE: openshell-prover-cli
|
|
BINARY: openshell-prover
|
|
strategy:
|
|
matrix:
|
|
include:
|
|
- triple: x86_64-unknown-linux-musl
|
|
runner: linux-amd64-cpu8
|
|
- triple: aarch64-unknown-linux-musl
|
|
runner: linux-arm64-cpu8
|
|
- triple: aarch64-apple-darwin
|
|
runner: macos-15-xlarge
|
|
runs-on: ${{ matrix.runner }}
|
|
timeout-minutes: 60
|
|
steps: *build_steps
|
|
|
|
gateway:
|
|
name: openshell-gateway (${{ matrix.triple }})
|
|
env:
|
|
PACKAGE: openshell-gateway
|
|
BINARY: openshell-gateway
|
|
strategy:
|
|
matrix:
|
|
include:
|
|
- triple: x86_64-unknown-linux-gnu
|
|
runner: linux-amd64-cpu8
|
|
- triple: aarch64-unknown-linux-gnu
|
|
runner: linux-arm64-cpu8
|
|
- triple: aarch64-apple-darwin
|
|
runner: macos-15-xlarge
|
|
runs-on: ${{ matrix.runner }}
|
|
timeout-minutes: 60
|
|
steps: *build_steps
|
|
|
|
runtimes:
|
|
name: ${{ matrix.binary }} (${{ matrix.triple }})
|
|
env:
|
|
PACKAGE: ${{ matrix.package }}
|
|
BINARY: ${{ matrix.binary }}
|
|
strategy:
|
|
matrix:
|
|
include:
|
|
- package: openshell-sandbox
|
|
binary: openshell-sandbox
|
|
triple: x86_64-unknown-linux-musl
|
|
runner: linux-amd64-cpu8
|
|
- package: openshell-sandbox
|
|
binary: openshell-sandbox
|
|
triple: aarch64-unknown-linux-musl
|
|
runner: linux-arm64-cpu8
|
|
- package: openshell-supervisor
|
|
binary: openshell-supervisor
|
|
triple: x86_64-unknown-linux-gnu
|
|
runner: linux-amd64-cpu8
|
|
- package: openshell-supervisor
|
|
binary: openshell-supervisor
|
|
triple: aarch64-unknown-linux-gnu
|
|
runner: linux-arm64-cpu8
|
|
- package: openshell-supervisor
|
|
binary: openshell-supervisor
|
|
triple: aarch64-apple-darwin
|
|
runner: macos-15-xlarge
|
|
runs-on: ${{ matrix.runner }}
|
|
timeout-minutes: 60
|
|
steps: *build_steps
|
|
|
|
vm-init:
|
|
name: openshell-vm-init (${{ matrix.triple }})
|
|
env:
|
|
PACKAGE: openshell-driver-vm
|
|
BINARY: openshell-vm-init
|
|
EXTRA_CARGO_FLAGS: --no-default-features
|
|
strategy:
|
|
matrix:
|
|
include:
|
|
- triple: x86_64-unknown-linux-musl
|
|
runner: linux-amd64-cpu8
|
|
- triple: aarch64-unknown-linux-musl
|
|
runner: linux-arm64-cpu8
|
|
runs-on: ${{ matrix.runner }}
|
|
timeout-minutes: 60
|
|
steps: *build_steps
|