OpenShell/.github/workflows/prepare-integration-inputs.yml

# SPDX-FileCopyrightText: Copyright (c) 2025-2026 NVIDIA CORPORATION & AFFILIATES. All rights reserved.
# SPDX-License-Identifier: Apache-2.0

name: Prepare Integration Inputs

on:
  workflow_call:
    inputs:
      artifact-run-id:
        description: Workflow run containing the candidate artifacts
        required: false
        type: string
        default: ""
      source-sha:
        description: Candidate source revision; defaults to the artifact run head SHA
        required: false
        type: string
        default: ""
      deb-artifact-name:
        description: Debian package artifact to include in the tmachine inputs
        required: false
        type: string
        default: ""
      rpm-artifact-name:
        description: RPM package artifact to include in the tmachine inputs
        required: false
        type: string
        default: ""
    outputs:
      source_sha:
        description: Source revision of the candidate artifacts
        value: ${{ jobs.prepare.outputs.source_sha }}
      integration_inputs_artifact_id:
        description: Immutable ID of the prepared integration inputs artifact
        value: ${{ jobs.prepare.outputs.integration_inputs_artifact_id }}

permissions:
  actions: read
  contents: read
  packages: read

jobs:
  prepare:
    name: Prepare tmachine inputs
    runs-on: ubuntu-24.04
    timeout-minutes: 30
    outputs:
      source_sha: ${{ steps.artifact-run.outputs.source_sha }}
      integration_inputs_artifact_id: ${{ steps.upload-integration-inputs.outputs.artifact-id }}
    steps:
      - name: Resolve artifact run
        id: artifact-run
        env:
          ARTIFACT_RUN_ID: ${{ inputs['artifact-run-id'] || github.run_id }}
          GH_TOKEN: ${{ github.token }}
          SOURCE_SHA: ${{ inputs['source-sha'] }}
        run: |
          if [ -z "${SOURCE_SHA}" ]; then
            SOURCE_SHA=$(gh api "repos/${GITHUB_REPOSITORY}/actions/runs/${ARTIFACT_RUN_ID}" --jq .head_sha)
          fi
          echo "source_sha=${SOURCE_SHA}" >> "$GITHUB_OUTPUT"

      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          ref: ${{ steps.artifact-run.outputs.source_sha }}
          persist-credentials: false

      - uses: ./.github/actions/setup-nix

      - name: Download CLI artifact
        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
        with:
          name: openshell-x86_64-unknown-linux-musl
          path: artifacts/binaries/x86_64-unknown-linux-musl
          github-token: ${{ github.token }}
          run-id: ${{ inputs['artifact-run-id'] || github.run_id }}

      - name: Download gateway artifact
        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
        with:
          name: openshell-gateway-x86_64-unknown-linux-gnu
          path: artifacts/binaries/x86_64-unknown-linux-gnu
          github-token: ${{ github.token }}
          run-id: ${{ inputs['artifact-run-id'] || github.run_id }}

      - name: Download Debian package artifact
        if: inputs['deb-artifact-name'] != ''
        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
        with:
          name: ${{ inputs['deb-artifact-name'] }}
          path: artifacts/packages/download
          github-token: ${{ github.token }}
          run-id: ${{ inputs['artifact-run-id'] || github.run_id }}

      - name: Stage Debian package input
        if: inputs['deb-artifact-name'] != ''
        run: |
          set -euo pipefail
          mv artifacts/packages/download/*.deb artifacts/packages/openshell.deb
          rmdir artifacts/packages/download

      - name: Download RPM package artifact
        if: inputs['rpm-artifact-name'] != ''
        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
        with:
          name: ${{ inputs['rpm-artifact-name'] }}
          path: artifacts/packages/rpm/download
          github-token: ${{ github.token }}
          run-id: ${{ inputs['artifact-run-id'] || github.run_id }}

      - name: Stage RPM package inputs
        if: inputs['rpm-artifact-name'] != ''
        run: |
          set -euo pipefail
          shopt -s nullglob
          download_dir=artifacts/packages/rpm/download
          cli_rpms=("$download_dir"/openshell-[0-9]*.rpm)
          gateway_rpms=("$download_dir"/openshell-gateway-[0-9]*.rpm)
          if [[ ${#cli_rpms[@]} -ne 1 || ${#gateway_rpms[@]} -ne 1 ]]; then
            echo "candidate artifact must contain exactly one CLI and one gateway RPM" >&2
            exit 1
          fi
          cli_identity=${cli_rpms[0]%.rpm}
          gateway_identity=${gateway_rpms[0]%.rpm}
          if [[ ${cli_identity##*.} != "${gateway_identity##*.}" ]]; then
            echo "candidate CLI and gateway RPM architectures must match" >&2
            exit 1
          fi
          mv "${cli_rpms[0]}" artifacts/packages/rpm/openshell.rpm
          mv "${gateway_rpms[0]}" artifacts/packages/rpm/openshell-gateway.rpm
          rm -rf "$download_dir"

      - name: Log in to GHCR
        run: echo "${{ github.token }}" | docker login ghcr.io -u "${GITHUB_ACTOR}" --password-stdin

      - name: Export OpenShell images
        env:
          IMAGE_TAG: ${{ steps.artifact-run.outputs.source_sha }}
        run: |
          mkdir -p artifacts/images

          docker pull "ghcr.io/nvidia/openshell/gateway:${IMAGE_TAG}"
          docker tag "ghcr.io/nvidia/openshell/gateway:${IMAGE_TAG}" openshell/gateway:tmachine
          docker save --output artifacts/images/openshell-gateway-tmachine.tar openshell/gateway:tmachine

          docker pull "ghcr.io/nvidia/openshell/sandbox:${IMAGE_TAG}"
          docker tag "ghcr.io/nvidia/openshell/sandbox:${IMAGE_TAG}" openshell/sandbox:tmachine
          docker save --output artifacts/images/openshell-sandbox-tmachine.tar openshell/sandbox:tmachine

          docker pull "ghcr.io/nvidia/openshell/supervisor:${IMAGE_TAG}"
          docker tag "ghcr.io/nvidia/openshell/supervisor:${IMAGE_TAG}" openshell/supervisor:tmachine
          docker save --output artifacts/images/openshell-supervisor-tmachine.tar openshell/supervisor:tmachine

      - name: Build test archives
        run: |
          # Retry dependency preparation, then generate artifacts once.
          nix build --no-link .#build-artifacts-test-archives || nix build --no-link .#build-artifacts-test-archives
          nix run .#build-artifacts-test-archives

      - name: Build test workload images
        run: |
          # Retry dependency preparation, then generate artifacts once.
          nix build --no-link .#build-artifacts-test-images || nix build --no-link .#build-artifacts-test-images
          nix run .#build-artifacts-test-images

      - name: Package Helm chart
        run: |
          # Retry dependency preparation, then generate artifacts once.
          nix build --no-link .#build-artifacts-helm || nix build --no-link .#build-artifacts-helm
          nix run .#build-artifacts-helm

      - name: Upload integration inputs
        id: upload-integration-inputs
        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
        with:
          name: openshell-tmachine-inputs
          path: artifacts
          compression-level: 0
          retention-days: 5
          if-no-files-found: error