OpenShell/.github/workflows/package-release-binaries.yml

# SPDX-FileCopyrightText: Copyright (c) 2025-2026 NVIDIA CORPORATION & AFFILIATES. All rights reserved.
# SPDX-License-Identifier: Apache-2.0

name: Package Release Binaries

on:
  workflow_call:
    inputs:
      checkout-ref:
        required: false
        type: string
        default: ""

permissions:
  actions: read
  contents: read

jobs:
  package:
    name: Package ${{ matrix.artifact }}
    runs-on: ubuntu-latest
    timeout-minutes: 10
    strategy:
      fail-fast: false
      matrix:
        include:
          - artifact: openshell-x86_64-unknown-linux-musl
            binary: openshell
            package: cli-linux-amd64
          - artifact: openshell-aarch64-unknown-linux-musl
            binary: openshell
            package: cli-linux-arm64
          - artifact: openshell-aarch64-apple-darwin
            binary: openshell
            package: cli-macos
          - artifact: openshell-gateway-x86_64-unknown-linux-gnu
            binary: openshell-gateway
            package: gateway-binary-linux-amd64
          - artifact: openshell-gateway-aarch64-unknown-linux-gnu
            binary: openshell-gateway
            package: gateway-binary-linux-arm64
          - artifact: openshell-gateway-aarch64-apple-darwin
            binary: openshell-gateway
            package: gateway-binary-macos
          - artifact: openshell-sandbox-x86_64-unknown-linux-musl
            binary: openshell-sandbox
            package: sandbox-binary-linux-amd64
          - artifact: openshell-sandbox-aarch64-unknown-linux-musl
            binary: openshell-sandbox
            package: sandbox-binary-linux-arm64
          - artifact: openshell-supervisor-x86_64-unknown-linux-gnu
            binary: openshell-supervisor
            package: supervisor-binary-linux-amd64
          - artifact: openshell-supervisor-aarch64-unknown-linux-gnu
            binary: openshell-supervisor
            package: supervisor-binary-linux-arm64
          - artifact: openshell-driver-vm-x86_64-unknown-linux-gnu
            binary: openshell-driver-vm
            package: driver-vm-linux-amd64
          - artifact: openshell-driver-vm-aarch64-unknown-linux-gnu
            binary: openshell-driver-vm
            package: driver-vm-linux-arm64
          - artifact: openshell-driver-vm-aarch64-apple-darwin
            binary: openshell-driver-vm
            package: driver-vm-macos
          - artifact: openshell-prover-x86_64-unknown-linux-musl
            binary: openshell-prover
            package: prover-binary-linux-amd64
          - artifact: openshell-prover-aarch64-unknown-linux-musl
            binary: openshell-prover
            package: prover-binary-linux-arm64
          - artifact: openshell-prover-aarch64-apple-darwin
            binary: openshell-prover
            package: prover-binary-macos
    steps:
      - name: Download ${{ matrix.artifact }}
        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
        with:
          name: ${{ matrix.artifact }}
          path: raw

      - name: Create archive
        env:
          ARTIFACT: ${{ matrix.artifact }}
          BINARY: ${{ matrix.binary }}
        run: |
          set -euo pipefail
          chmod +x "raw/${BINARY}"
          tar -czf "${ARTIFACT}.tar.gz" -C raw "${BINARY}"

      - name: Upload ${{ matrix.package }}
        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7
        with:
          name: ${{ matrix.package }}
          path: ${{ matrix.artifact }}.tar.gz
          retention-days: 5
          if-no-files-found: error

  smoke-prover:
    name: Smoke packaged prover (${{ matrix.triple }})
    needs: package
    runs-on: ${{ matrix.runner }}
    timeout-minutes: 10
    strategy:
      fail-fast: false
      matrix:
        include:
          - triple: x86_64-unknown-linux-musl
            runner: linux-amd64-cpu8
            package: prover-binary-linux-amd64
          - triple: aarch64-unknown-linux-musl
            runner: linux-arm64-cpu8
            package: prover-binary-linux-arm64
          - triple: aarch64-apple-darwin
            runner: macos-15-xlarge
            package: prover-binary-macos
    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          ref: ${{ inputs['checkout-ref'] || github.sha }}

      - name: Download packaged prover
        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
        with:
          name: ${{ matrix.package }}
          path: package

      - name: Extract and run containment check
        env:
          TRIPLE: ${{ matrix.triple }}
        run: |
          set -euo pipefail
          mkdir extracted
          tar -xzf "package/openshell-prover-${TRIPLE}.tar.gz" -C extracted
          test "$(find extracted -type f | wc -l | tr -d ' ')" = 1
          test -x extracted/openshell-prover
          if [ "${RUNNER_OS}" = "Linux" ]; then
            tasks/scripts/verify-static-binary.sh extracted/openshell-prover
          else
            otool -L extracted/openshell-prover | tee linkage.txt
            if grep -Eiq 'libz3|/nix/store' linkage.txt; then
              echo "ERROR: packaged prover has a non-portable native dependency" >&2
              exit 1
            fi
          fi
          extracted/openshell-prover check \
            crates/openshell-prover-cli/tests/fixtures/candidate-contained.yaml \
            --boundary crates/openshell-prover-cli/tests/fixtures/boundary.yaml \
            --output json > result.json
          grep -q '"result"[[:space:]]*:[[:space:]]*"within_boundary"' result.json

          if extracted/openshell-prover check \
            crates/openshell-prover-cli/tests/fixtures/candidate-underscore-host.yaml \
            --boundary crates/openshell-prover-cli/tests/fixtures/boundary-empty.yaml \
            --output json > underscore.json; then
            echo "ERROR: underscore host unexpectedly stayed within an empty boundary" >&2
            exit 1
          else
            test "$?" = 1
          fi
          grep -q '"result"[[:space:]]*:[[:space:]]*"exceeds_boundary"' underscore.json
          grep -q '"host"[[:space:]]*:[[:space:]]*"api_internal.example.com"' underscore.json

          if extracted/openshell-prover check \
            crates/openshell-prover-cli/tests/fixtures/candidate-unicode-network-selector.yaml \
            --boundary crates/openshell-prover-cli/tests/fixtures/boundary-empty.yaml \
            --output json > unicode.json; then
            echo "ERROR: non-ASCII network selector unexpectedly produced a definitive result" >&2
            exit 1
          else
            test "$?" = 3
          fi
          grep -q '"result"[[:space:]]*:[[:space:]]*"unsupported"' unicode.json
          grep -q '"reason_code"[[:space:]]*:[[:space:]]*"unsupported_policy_shape"' unicode.json

  prover-checksums:
    name: Package prover checksums
    needs: smoke-prover
    runs-on: ubuntu-latest
    timeout-minutes: 10
    steps:
      - name: Download packaged prover archives
        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
        with:
          pattern: prover-binary-*
          path: release
          merge-multiple: true

      - name: Generate prover checksums
        run: |
          set -euo pipefail
          cd release
          sha256sum openshell-prover-*.tar.gz > openshell-prover-checksums-sha256.txt
          test "$(awk 'END { print NR }' openshell-prover-checksums-sha256.txt)" = 3
          sha256sum --check openshell-prover-checksums-sha256.txt

      - name: Upload prover checksums
        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7
        with:
          name: prover-checksums
          path: release/openshell-prover-checksums-sha256.txt
          retention-days: 5
          if-no-files-found: error