mirror of
https://github.com/NVIDIA/OpenShell.git
synced 2026-10-31 07:44:57 +08:00
Johnny Greco
58b5f8f976
* feat(prover): add standalone policy maximum checker Signed-off-by: Johnny Greco <jogreco@nvidia.com> * refactor(prover): simplify check scope schema Signed-off-by: Johnny Greco <jogreco@nvidia.com> * fix(prover): align containment and cancellation with runtime Signed-off-by: Johnny Greco <jogreco@nvidia.com> * fix(prover): stabilize containment checks in CI Signed-off-by: Johnny Greco <jogreco@nvidia.com> * test(prover): avoid solver in fast-path guard test Signed-off-by: Johnny Greco <jogreco@nvidia.com> * fix(prover): align string containment with runtime Signed-off-by: Johnny Greco <jogreco@nvidia.com> * fix(prover): reject ambiguous z3 string escapes Signed-off-by: Johnny Greco <jogreco@nvidia.com> * fix(prover): align containment with runtime boundaries Signed-off-by: Johnny Greco <jogreco@nvidia.com> * fix(prover-cli): harden cancellation and invalid input Signed-off-by: Johnny Greco <jogreco@nvidia.com> * feat(packaging): install policy prover with OpenShell Signed-off-by: Johnny Greco <jogreco@nvidia.com> * docs(prover): clarify installation and check results Signed-off-by: Johnny Greco <jogreco@nvidia.com> * docs(build): describe prover distribution directly Signed-off-by: Johnny Greco <jogreco@nvidia.com> * refactor(prover): rename maximum policy to boundary Signed-off-by: Johnny Greco <jogreco@nvidia.com> * refactor(prover): localize fail-closed validation Signed-off-by: Johnny Greco <jogreco@nvidia.com> * test(prover): cover fail-closed CLI surfaces Signed-off-by: Johnny Greco <jogreco@nvidia.com> * test(prover): allow CI load for REST solver proof Signed-off-by: Johnny Greco <jogreco@nvidia.com> * fix(prover): use canonical policy schema for containment Signed-off-by: Johnny Greco <jogreco@nvidia.com> * fix(prover): preserve uncertainty for runtime binary globs Signed-off-by: Johnny Greco <jogreco@nvidia.com> * fix(prover): bound policy validation work Signed-off-by: Johnny Greco <jogreco@nvidia.com> * docs(prover): document validation resource limits Signed-off-by: Johnny Greco <jogreco@nvidia.com> * fix(prover): make containment API extensible Signed-off-by: Johnny Greco <jogreco@nvidia.com> * docs(prover): define containment API contract Signed-off-by: Johnny Greco <jogreco@nvidia.com> * fix(ci): integrate prover with consolidated builds Signed-off-by: Johnny Greco <jogreco@nvidia.com> * fix(ci): declare release packaging dependency Signed-off-by: Johnny Greco <jogreco@nvidia.com> --------- Signed-off-by: Johnny Greco <jogreco@nvidia.com>
60 lines
1.6 KiB
YAML
60 lines
1.6 KiB
YAML
# SPDX-FileCopyrightText: Copyright (c) 2025-2026 NVIDIA CORPORATION & AFFILIATES. All rights reserved.
|
|
# SPDX-License-Identifier: Apache-2.0
|
|
|
|
name: RPM Package
|
|
|
|
on:
|
|
workflow_call:
|
|
inputs:
|
|
checkout-ref:
|
|
required: true
|
|
type: string
|
|
rpm-version:
|
|
required: false
|
|
type: string
|
|
default: ""
|
|
rpm-release:
|
|
required: false
|
|
type: string
|
|
default: ""
|
|
cargo-version:
|
|
required: false
|
|
type: string
|
|
default: ""
|
|
|
|
permissions:
|
|
contents: read
|
|
|
|
defaults:
|
|
run:
|
|
shell: bash
|
|
|
|
jobs:
|
|
build-rpm-linux:
|
|
name: Build RPM Package (Linux ${{ matrix.arch }})
|
|
strategy:
|
|
fail-fast: false
|
|
matrix:
|
|
include:
|
|
- arch: x86_64
|
|
runner: linux-amd64-cpu8
|
|
cli_target: x86_64-unknown-linux-musl
|
|
gateway_target: x86_64-unknown-linux-gnu
|
|
prover_target: x86_64-unknown-linux-musl
|
|
- arch: aarch64
|
|
runner: linux-arm64-cpu8
|
|
cli_target: aarch64-unknown-linux-musl
|
|
gateway_target: aarch64-unknown-linux-gnu
|
|
prover_target: aarch64-unknown-linux-musl
|
|
uses: ./.github/workflows/build-rpm.yml
|
|
with:
|
|
checkout-ref: ${{ inputs.checkout-ref }}
|
|
arch: ${{ matrix.arch }}
|
|
runner: ${{ matrix.runner }}
|
|
cli-target: ${{ matrix.cli_target }}
|
|
gateway-target: ${{ matrix.gateway_target }}
|
|
prover-target: ${{ matrix.prover_target }}
|
|
rpm-version: ${{ inputs.rpm-version }}
|
|
rpm-release: ${{ inputs.rpm-release }}
|
|
cargo-version: ${{ inputs.cargo-version }}
|