Skip to content

Commit 9751872

Browse files
drewdrew
authored
feat(release): add Debian package publishing (#1069)
1 parent b39af3d commit 9751872

21 files changed

Lines changed: 1189 additions & 33 deletions

File tree

‎.github/workflows/deb-package.yml‎

Lines changed: 92 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,92 @@
1+
name: Debian Package
2+
3+
on:
4+
workflow_call:
5+
inputs:
6+
deb-version:
7+
required: true
8+
type: string
9+
checkout-ref:
10+
required: true
11+
type: string
12+
13+
permissions:
14+
contents: read
15+
packages: read
16+
17+
defaults:
18+
run:
19+
shell: bash
20+
21+
jobs:
22+
build-deb-linux:
23+
name: Build Debian Package (Linux ${{ matrix.arch }})
24+
strategy:
25+
matrix:
26+
include:
27+
- arch: amd64
28+
runner: build-amd64
29+
deb_arch: amd64
30+
cli_target: x86_64-unknown-linux-musl
31+
gnu_target: x86_64-unknown-linux-gnu
32+
- arch: arm64
33+
runner: build-arm64
34+
deb_arch: arm64
35+
cli_target: aarch64-unknown-linux-musl
36+
gnu_target: aarch64-unknown-linux-gnu
37+
runs-on: ${{ matrix.runner }}
38+
timeout-minutes: 20
39+
container:
40+
image: ghcr.io/nvidia/openshell/ci:latest
41+
credentials:
42+
username: ${{ github.actor }}
43+
password: ${{ secrets.GITHUB_TOKEN }}
44+
steps:
45+
- uses: actions/checkout@v6
46+
with:
47+
ref: ${{ inputs['checkout-ref'] }}
48+
49+
- name: Download CLI artifact
50+
uses: actions/download-artifact@v4
51+
with:
52+
name: cli-linux-${{ matrix.arch }}
53+
path: package-input/
54+
55+
- name: Download gateway artifact
56+
uses: actions/download-artifact@v4
57+
with:
58+
name: gateway-binary-linux-${{ matrix.arch }}
59+
path: package-input/
60+
61+
- name: Download VM driver artifact
62+
uses: actions/download-artifact@v4
63+
with:
64+
name: driver-vm-linux-${{ matrix.arch }}
65+
path: package-input/
66+
67+
- name: Extract package inputs
68+
run: |
69+
set -euo pipefail
70+
mkdir -p package-binaries
71+
tar -xzf "package-input/openshell-${{ matrix.cli_target }}.tar.gz" -C package-binaries
72+
tar -xzf "package-input/openshell-gateway-${{ matrix.gnu_target }}.tar.gz" -C package-binaries
73+
tar -xzf "package-input/openshell-driver-vm-${{ matrix.gnu_target }}.tar.gz" -C package-binaries
74+
ls -lah package-binaries
75+
76+
- name: Build Debian package
77+
run: |
78+
set -euo pipefail
79+
OPENSHELL_CLI_BINARY="${PWD}/package-binaries/openshell" \
80+
OPENSHELL_GATEWAY_BINARY="${PWD}/package-binaries/openshell-gateway" \
81+
OPENSHELL_DRIVER_VM_BINARY="${PWD}/package-binaries/openshell-driver-vm" \
82+
OPENSHELL_DEB_VERSION="${{ inputs['deb-version'] }}" \
83+
OPENSHELL_DEB_ARCH="${{ matrix.deb_arch }}" \
84+
OPENSHELL_OUTPUT_DIR=artifacts \
85+
tasks/scripts/package-deb.sh
86+
87+
- name: Upload Debian package artifact
88+
uses: actions/upload-artifact@v4
89+
with:
90+
name: deb-linux-${{ matrix.arch }}
91+
path: artifacts/*.deb
92+
retention-days: 5

‎.github/workflows/driver-vm-linux.yml‎

Lines changed: 254 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,254 @@
1+
name: Driver VM Linux
2+
3+
on:
4+
workflow_call:
5+
inputs:
6+
cargo-version:
7+
required: true
8+
type: string
9+
image-tag:
10+
required: true
11+
type: string
12+
checkout-ref:
13+
required: true
14+
type: string
15+
16+
permissions:
17+
contents: read
18+
packages: read
19+
20+
defaults:
21+
run:
22+
shell: bash
23+
24+
jobs:
25+
download-kernel-runtime:
26+
name: Download Kernel Runtime
27+
runs-on: build-amd64
28+
timeout-minutes: 10
29+
container:
30+
image: ghcr.io/nvidia/openshell/ci:latest
31+
credentials:
32+
username: ${{ github.actor }}
33+
password: ${{ secrets.GITHUB_TOKEN }}
34+
steps:
35+
- uses: actions/checkout@v4
36+
with:
37+
ref: ${{ inputs['checkout-ref'] }}
38+
39+
- name: Download Linux runtime tarballs
40+
env:
41+
GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
42+
run: |
43+
set -euo pipefail
44+
mkdir -p runtime-artifacts
45+
46+
for platform in linux-aarch64 linux-x86_64; do
47+
asset="vm-runtime-${platform}.tar.zst"
48+
echo "Downloading ${asset}..."
49+
asset_url=$(curl -fsSL \
50+
-H "Accept: application/vnd.github+json" \
51+
-H "Authorization: Bearer ${GH_TOKEN}" \
52+
"https://api.github.com/repos/${GITHUB_REPOSITORY}/releases/tags/vm-dev" \
53+
| jq -r --arg asset "$asset" '.assets[] | select(.name == $asset) | .browser_download_url' \
54+
| head -n1)
55+
if [ -z "$asset_url" ]; then
56+
echo "::error::No ${asset} asset found on vm-dev release"
57+
exit 1
58+
fi
59+
curl -fL -o "runtime-artifacts/${asset}" "$asset_url"
60+
done
61+
62+
ls -lah runtime-artifacts/
63+
64+
- name: Verify downloads
65+
run: |
66+
set -euo pipefail
67+
for platform in linux-aarch64 linux-x86_64; do
68+
test -f "runtime-artifacts/vm-runtime-${platform}.tar.zst"
69+
done
70+
71+
- name: Upload runtime artifacts
72+
uses: actions/upload-artifact@v4
73+
with:
74+
name: driver-vm-kernel-runtime-tarballs
75+
path: runtime-artifacts/vm-runtime-*.tar.zst
76+
retention-days: 1
77+
78+
build-rootfs:
79+
name: Build Rootfs (${{ matrix.arch }})
80+
strategy:
81+
matrix:
82+
include:
83+
- arch: arm64
84+
runner: build-arm64
85+
guest_arch: aarch64
86+
- arch: amd64
87+
runner: build-amd64
88+
guest_arch: x86_64
89+
runs-on: ${{ matrix.runner }}
90+
timeout-minutes: 30
91+
container:
92+
image: ghcr.io/nvidia/openshell/ci:latest
93+
credentials:
94+
username: ${{ github.actor }}
95+
password: ${{ secrets.GITHUB_TOKEN }}
96+
options: --privileged
97+
volumes:
98+
- /var/run/docker.sock:/var/run/docker.sock
99+
env:
100+
MISE_GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
101+
OPENSHELL_IMAGE_TAG: ${{ inputs['image-tag'] }}
102+
steps:
103+
- uses: actions/checkout@v4
104+
with:
105+
ref: ${{ inputs['checkout-ref'] }}
106+
107+
- name: Mark workspace safe for git
108+
run: git config --global --add safe.directory "$GITHUB_WORKSPACE"
109+
110+
- name: Log in to GHCR
111+
run: echo "${{ secrets.GITHUB_TOKEN }}" | docker login ghcr.io -u "${{ github.actor }}" --password-stdin
112+
113+
- name: Install tools
114+
run: mise install --locked
115+
116+
- name: Install zstd
117+
run: apt-get update && apt-get install -y --no-install-recommends zstd && rm -rf /var/lib/apt/lists/*
118+
119+
- name: Build base rootfs tarball
120+
run: |
121+
set -euo pipefail
122+
crates/openshell-vm/scripts/build-rootfs.sh \
123+
--base \
124+
--arch ${{ matrix.guest_arch }} \
125+
target/rootfs-build
126+
127+
mkdir -p target/vm-runtime-compressed
128+
tar -C target/rootfs-build -cf - . \
129+
| zstd -19 -T0 -o target/vm-runtime-compressed/rootfs.tar.zst
130+
131+
- name: Upload rootfs artifact
132+
uses: actions/upload-artifact@v4
133+
with:
134+
name: driver-vm-rootfs-${{ matrix.arch }}
135+
path: target/vm-runtime-compressed/rootfs.tar.zst
136+
retention-days: 1
137+
138+
build-driver-vm-linux:
139+
name: Build Driver VM (Linux ${{ matrix.arch }})
140+
needs: [download-kernel-runtime, build-rootfs]
141+
strategy:
142+
matrix:
143+
include:
144+
- arch: arm64
145+
runner: build-arm64
146+
target: aarch64-unknown-linux-gnu
147+
platform: linux-aarch64
148+
- arch: amd64
149+
runner: build-amd64
150+
target: x86_64-unknown-linux-gnu
151+
platform: linux-x86_64
152+
runs-on: ${{ matrix.runner }}
153+
timeout-minutes: 30
154+
container:
155+
image: ghcr.io/nvidia/openshell/ci:latest
156+
credentials:
157+
username: ${{ github.actor }}
158+
password: ${{ secrets.GITHUB_TOKEN }}
159+
options: --privileged
160+
env:
161+
MISE_GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
162+
SCCACHE_MEMCACHED_ENDPOINT: ${{ vars.SCCACHE_MEMCACHED_ENDPOINT }}
163+
OPENSHELL_IMAGE_TAG: ${{ inputs['image-tag'] }}
164+
steps:
165+
- uses: actions/checkout@v4
166+
with:
167+
ref: ${{ inputs['checkout-ref'] }}
168+
fetch-depth: 0
169+
170+
- name: Mark workspace safe for git
171+
run: git config --global --add safe.directory "$GITHUB_WORKSPACE"
172+
173+
- name: Fetch tags
174+
run: git fetch --tags --force
175+
176+
- name: Install tools
177+
run: mise install --locked
178+
179+
- name: Cache Rust target and registry
180+
uses: Swatinem/rust-cache@779680da715d629ac1d338a641029a2f4372abb5 # v2
181+
with:
182+
shared-key: driver-vm-linux-${{ matrix.arch }}
183+
cache-directories: .cache/sccache
184+
cache-targets: "true"
185+
186+
- name: Install zstd
187+
run: apt-get update && apt-get install -y --no-install-recommends zstd && rm -rf /var/lib/apt/lists/*
188+
189+
- name: Download kernel runtime tarball
190+
uses: actions/download-artifact@v4
191+
with:
192+
name: driver-vm-kernel-runtime-tarballs
193+
path: runtime-download/
194+
195+
- name: Download rootfs tarball
196+
uses: actions/download-artifact@v4
197+
with:
198+
name: driver-vm-rootfs-${{ matrix.arch }}
199+
path: rootfs-download/
200+
201+
- name: Stage compressed runtime for embedding
202+
run: |
203+
set -euo pipefail
204+
COMPRESSED_DIR="${PWD}/target/vm-runtime-compressed"
205+
mkdir -p "$COMPRESSED_DIR"
206+
207+
EXTRACT_DIR=$(mktemp -d)
208+
zstd -d "runtime-download/vm-runtime-${{ matrix.platform }}.tar.zst" --stdout \
209+
| tar -xf - -C "$EXTRACT_DIR"
210+
211+
for file in "$EXTRACT_DIR"/*; do
212+
[ -f "$file" ] || continue
213+
name=$(basename "$file")
214+
[ "$name" = "provenance.json" ] && continue
215+
zstd -19 -f -q -T0 -o "${COMPRESSED_DIR}/${name}.zst" "$file"
216+
done
217+
218+
cp rootfs-download/rootfs.tar.zst "${COMPRESSED_DIR}/rootfs.tar.zst"
219+
ls -lah "$COMPRESSED_DIR"
220+
221+
- name: Scope workspace to driver-vm crates
222+
run: |
223+
set -euo pipefail
224+
sed -i 's|members = \["crates/\*"\]|members = ["crates/openshell-driver-vm", "crates/openshell-core"]|' Cargo.toml
225+
226+
- name: Patch workspace version
227+
if: ${{ inputs['cargo-version'] != '' }}
228+
run: |
229+
set -euo pipefail
230+
sed -i -E '/^\[workspace\.package\]/,/^\[/{s/^version[[:space:]]*=[[:space:]]*".*"/version = "'"${{ inputs['cargo-version'] }}"'"/}' Cargo.toml
231+
232+
- name: Build openshell-driver-vm
233+
run: |
234+
set -euo pipefail
235+
OPENSHELL_VM_RUNTIME_COMPRESSED_DIR="${PWD}/target/vm-runtime-compressed" \
236+
mise x -- cargo build --release -p openshell-driver-vm
237+
238+
- name: sccache stats
239+
if: always()
240+
run: mise x -- sccache --show-stats
241+
242+
- name: Package binary
243+
run: |
244+
set -euo pipefail
245+
mkdir -p artifacts
246+
tar -czf "artifacts/openshell-driver-vm-${{ matrix.target }}.tar.gz" \
247+
-C target/release openshell-driver-vm
248+
249+
- name: Upload artifact
250+
uses: actions/upload-artifact@v4
251+
with:
252+
name: driver-vm-linux-${{ matrix.arch }}
253+
path: artifacts/*.tar.gz
254+
retention-days: 5

0 commit comments

Comments
 (0)