mirror of
https://github.com/NVIDIA/OpenShell.git
synced 2026-10-20 06:00:06 +08:00
Florent BENOIT
8e9136bbc3
The release tarball ships an unsigned binary that fails at runtime when Hypervisor.framework rejects the caller. Sign with the existing entitlements plist during the build, before artifact upload. Closes #3506 Signed-off-by: Florent Benoit <fbenoit@redhat.com>
114 lines
3.9 KiB
YAML
114 lines
3.9 KiB
YAML
# SPDX-FileCopyrightText: Copyright (c) 2025-2026 NVIDIA CORPORATION & AFFILIATES. All rights reserved.
|
|
# SPDX-License-Identifier: Apache-2.0
|
|
|
|
name: Build VM Driver
|
|
|
|
on:
|
|
workflow_call:
|
|
inputs:
|
|
cargo-version:
|
|
required: true
|
|
type: string
|
|
supervisor-image-tag:
|
|
required: false
|
|
type: string
|
|
default: ""
|
|
checkout-ref:
|
|
required: false
|
|
type: string
|
|
default: ""
|
|
secrets:
|
|
CACHIX_AUTH_TOKEN:
|
|
required: true
|
|
|
|
permissions:
|
|
contents: read
|
|
|
|
jobs:
|
|
build:
|
|
name: openshell-driver-vm (${{ matrix.triple }})
|
|
strategy:
|
|
matrix:
|
|
include:
|
|
- arch: x86_64
|
|
triple: x86_64-unknown-linux-gnu
|
|
runner: linux-amd64-cpu8
|
|
- arch: aarch64
|
|
triple: aarch64-unknown-linux-gnu
|
|
runner: linux-arm64-cpu8
|
|
- arch: aarch64
|
|
triple: aarch64-apple-darwin
|
|
runner: macos-15-xlarge
|
|
entitlements-file: crates/openshell-driver-vm/entitlements.plist
|
|
runs-on: ${{ matrix.runner }}
|
|
timeout-minutes: 60
|
|
defaults:
|
|
run:
|
|
shell: nix develop -c bash -euo pipefail {0}
|
|
steps:
|
|
- uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
|
|
with:
|
|
persist-credentials: false
|
|
ref: ${{ inputs['checkout-ref'] || github.sha }}
|
|
|
|
- uses: ./.github/actions/setup-nix
|
|
with:
|
|
prepare-shell: "true"
|
|
cachix-auth-token: ${{ secrets.CACHIX_AUTH_TOKEN }}
|
|
|
|
- name: Download openshell-sandbox
|
|
uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
|
|
with:
|
|
name: openshell-sandbox-${{ matrix.arch }}-unknown-linux-musl
|
|
path: sandbox
|
|
|
|
- name: Download openshell-supervisor
|
|
if: endsWith(matrix.triple, '-unknown-linux-gnu')
|
|
uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
|
|
with:
|
|
name: openshell-supervisor-${{ matrix.arch }}-unknown-linux-gnu
|
|
path: supervisor
|
|
|
|
- name: Download native macOS host supervisor
|
|
if: endsWith(matrix.triple, '-apple-darwin')
|
|
uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
|
|
with:
|
|
name: openshell-supervisor-aarch64-apple-darwin
|
|
path: host-supervisor
|
|
|
|
- name: Download VM guest init
|
|
uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
|
|
with:
|
|
name: openshell-vm-init-${{ matrix.arch }}-unknown-linux-musl
|
|
path: vm-init
|
|
|
|
- name: Build VM runtime
|
|
run: |
|
|
# HTTP 416 is not retried by Nix; restart the build once on failure.
|
|
nix build .#vm-runtime || nix build .#vm-runtime
|
|
|
|
- name: Assemble compressed VM runtime
|
|
run: |
|
|
compressed_dir="${RUNNER_TEMP}/vm-runtime-compressed"
|
|
host_supervisor="supervisor/openshell-supervisor"
|
|
if [[ "${{ matrix.triple }}" == *-apple-darwin ]]; then
|
|
host_supervisor="host-supervisor/openshell-supervisor"
|
|
fi
|
|
install -d "$compressed_dir"
|
|
cp result/compressed/*.zst "$compressed_dir/"
|
|
zstd -19 -T1 sandbox/openshell-sandbox -o "$compressed_dir/openshell-sandbox.zst"
|
|
zstd -19 -T1 "$host_supervisor" -o "$compressed_dir/openshell-supervisor.zst"
|
|
zstd -19 -T1 vm-init/openshell-vm-init -o "$compressed_dir/openshell-vm-init.zst"
|
|
|
|
- name: Build openshell-driver-vm
|
|
uses: ./.github/actions/build-rust-binary
|
|
env:
|
|
OPENSHELL_VM_RUNTIME_COMPRESSED_DIR: ${{ runner.temp }}/vm-runtime-compressed
|
|
with:
|
|
package: openshell-driver-vm
|
|
binary: openshell-driver-vm
|
|
triple: ${{ matrix.triple }}
|
|
cargo-version: ${{ inputs['cargo-version'] }}
|
|
supervisor-image-tag: ${{ inputs['supervisor-image-tag'] }}
|
|
entitlements-file: ${{ matrix.entitlements-file }}
|