Skip to content

ci: build release binaries with Nix - #2977

Merged
SDAChess merged 20 commits into
mainfrom
feat/build-artifacts-with-nix
Aug 27, 2026
Merged

ci: build release binaries with Nix#2977
SDAChess merged 20 commits into
mainfrom
feat/build-artifacts-with-nix

Conversation

@SDAChess

@SDAChessSDAChess commented Aug 27, 2026

Copy link
Copy Markdown
Collaborator

Summary

Replace the separate release binary build paths with one Nix-based artifact workflow. Build each platform binary once, then reuse those artifacts across packaging, smoke tests, and release publication.

Related Issue

Closes#1683

Changes

  • Add a shared workflow that computes the release version once and passes it to all build jobs
  • Build Linux CLI and sandbox binaries statically with musl
  • Build Linux gateway and VM-driver binaries against glibc 2.28
  • Normalize dynamic Linux binaries with standard interpreters and no Nix RPATH
  • Build Apple Silicon CLI, gateway, and VM-driver binaries natively on macOS
  • Build release binaries with cargo auditable and verify their embedded metadata with Syft
  • Link Z3 statically into portable gateway and VM-driver artifacts
  • Package binaries into target-specific tarballs
  • Build the VM driver from the matching sandbox artifact and rolling VM runtime
  • Reuse built artifacts in downstream packages, smoke tests, and release jobs
  • Remove superseded Zig, Docker, and native binary build paths after migrating their callers

Testing

  • mise run pre-commit passes
  • actionlint passes for the binary workflow
  • x86_64 Linux CLI builds as a static PIE with auditable metadata
  • x86_64 Linux gateway builds with static Z3 and auditable metadata
  • Gateway normalization removes its Nix RPATH and sets the standard Linux interpreter
  • Gateway references no symbols newer than GLIBC 2.28
  • ARM64 Linux build matrix passes in GitHub Actions
  • Apple Silicon build matrix passes in GitHub Actions
  • Sandbox-to-VM-driver artifact chain passes in GitHub Actions
  • Downstream package and release smoke tests pass
  • Unit tests added/updated (not applicable; workflow-only change)
  • E2E tests added/updated (if applicable)

Checklist

  • Follows Conventional Commits
  • Commits are signed off (DCO)
  • Architecture docs updated (not applicable; CI-only change)

elezar
elezar reviewed Aug 27, 2026
View reviewed changes
Comment thread.github/workflows/build-binaries.yml Outdated
elezar
elezar reviewed Aug 27, 2026
View reviewed changes

@elezarelezar left a comment

Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Thanks @SDAChess.

One minor question. I assume a follow-up will be to start consuming these from other pipeline stages? Would it make sense to do that already to validate that the workflow works as expected?

@SDAChess

SDAChess commented Aug 27, 2026

Copy link
Copy Markdown
CollaboratorAuthor

Thanks @SDAChess.

One minor question. I assume a follow-up will be to start consuming these from other pipeline stages? Would it make sense to do that already to validate that the workflow works as expected?

I plan to add this in this pull request. It's not ready for review yet. I'll put it as draft...

@SDAChess
SDAChess marked this pull request as draft August 27, 2026 08:19
@copy-pr-bot

copy-pr-botBot commented Aug 27, 2026

Copy link
Copy Markdown

Auto-sync is disabled for draft pull requests in this repository. Workflows must be run manually.

Contributors can view more details about this message here.

@SDAChessSDAChess added test:e2e Requires end-to-end coverage test:e2e-gpu Requires GPU end-to-end coverage test:e2e-kubernetes Requires Kubernetes end-to-end coverage labels Aug 27, 2026
@github-actions

github-actionsBot commented Aug 27, 2026

Copy link
Copy Markdown

Label test:e2e-gpu applied, but pull-request/2977 is at 7385eda while the PR head is 96a795a. A maintainer needs to comment /ok to test 96a795a189ee5345704db6f78ca2bb0298760010 to refresh the mirror. Once the mirror catches up, re-run Branch E2E Checks from the Actions tab.

@github-actions

github-actionsBot commented Aug 27, 2026

Copy link
Copy Markdown

Label test:e2e applied, but pull-request/2977 is at 7385eda while the PR head is 96a795a. A maintainer needs to comment /ok to test 96a795a189ee5345704db6f78ca2bb0298760010 to refresh the mirror. Once the mirror catches up, re-run Branch E2E Checks from the Actions tab.

@github-actions

github-actionsBot commented Aug 27, 2026

Copy link
Copy Markdown

Label test:e2e-kubernetes applied, but pull-request/2977 is at 7385eda while the PR head is 96a795a. A maintainer needs to comment /ok to test 96a795a189ee5345704db6f78ca2bb0298760010 to refresh the mirror. Once the mirror catches up, re-run Branch E2E Checks from the Actions tab.

@SDAChess

SDAChess commented Aug 27, 2026

Copy link
Copy Markdown
CollaboratorAuthor

/ok-to-test 96a795a

@SDAChess

SDAChess commented Aug 27, 2026

Copy link
Copy Markdown
CollaboratorAuthor

/ok-to-test b053940

@SDAChess

SDAChess commented Aug 27, 2026

Copy link
Copy Markdown
CollaboratorAuthor

/ok-to-test d430e53

@SDAChess

SDAChess commented Aug 27, 2026

Copy link
Copy Markdown
CollaboratorAuthor

/ok-to-test eafcef0

@SDAChess
SDAChess marked this pull request as ready for review August 27, 2026 13:44
@SDAChess
SDAChessforce-pushed the feat/build-artifacts-with-nix branch from 28b3242 to ccdb07aCompareAugust 27, 2026 13:56
@github-actions

github-actionsBot commented Aug 27, 2026

Copy link
Copy Markdown

🌿 Preview your docs:https://nvidia-preview-pr-2977.docs.buildwithfern.com/openshell

github-advanced-security[bot]
github-advanced-securityBot found potential problems Aug 27, 2026
View reviewed changes

@github-advanced-securitygithub-advanced-securityAI left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

zizmor found more than 20 potential problems in the proposed changes. Check the Files changed tab for more details.

@SDAChessSDAChess self-assigned this Aug 27, 2026
@copy-pr-bot

copy-pr-botBot commented Aug 27, 2026

Copy link
Copy Markdown

This pull request requires additional validation before any workflows can run on NVIDIA's runners.

Pull request vetters can view their responsibilities here.

Contributors can view more details about this message here.

@SDAChess
ci: build release binaries with Nix
516adcd
Refs #1683
Signed-off-by: Simon Scatton <sscatton@nvidia.com>
@SDAChess
ci: build VM artifacts with Nix
3d2bbae
Refs #1683
Signed-off-by: Simon Scatton <sscatton@nvidia.com>
@SDAChess
ci: build images from Nix artifacts
7894e09
Refs #1683
Signed-off-by: Simon Scatton <sscatton@nvidia.com>
@SDAChess
fix(nix): prevent host header leakage
ec073a1
Signed-off-by: Simon Scatton <sscatton@nvidia.com>
@SDAChess
ci: parallelize artifact builds
3b01c8d
Refs #1683
Signed-off-by: Simon Scatton <sscatton@nvidia.com>
@SDAChess
ci: build external driver test artifacts
8e5adb1
Refs #1683
Signed-off-by: Simon Scatton <sscatton@nvidia.com>
@SDAChess
fix(nix): disable mold in musl shells
7abab27
Signed-off-by: Simon Scatton <sscatton@nvidia.com>
@SDAChess
ci: key Rust cache by Nix shell derivation
29cbd80
Signed-off-by: Simon Scatton <sscatton@nvidia.com>
@SDAChess
ci: refactor end-to-end workflows
d7d1c6b
Signed-off-by: Simon Scatton <sscatton@nvidia.com>
@SDAChess
ci: split platform binary workflows
c3876ce
Signed-off-by: Simon Scatton <sscatton@nvidia.com>
@SDAChess
ci: remove obsolete native build workflows
f383e6f
Signed-off-by: Simon Scatton <sscatton@nvidia.com>
@SDAChess
ci: replace disallowed mise action
9d8931d
Signed-off-by: Simon Scatton <sscatton@nvidia.com>
@SDAChess
ci: fix refactored e2e lanes
fef9105
Signed-off-by: Simon Scatton <sscatton@nvidia.com>
@SDAChess
ci: check out local result action
d175fda
Signed-off-by: Simon Scatton <sscatton@nvidia.com>
@SDAChess
ci: cache mise installations
dcc9400
Signed-off-by: Simon Scatton <sscatton@nvidia.com>
@SDAChess
ci: run docker builds on host runners
6834739
Signed-off-by: Simon Scatton <sscatton@nvidia.com>
@SDAChess
ci: disable unstable kubernetes e2e lanes
312c797
Signed-off-by: Simon Scatton <sscatton@nvidia.com>
@SDAChess
SDAChessforce-pushed the feat/build-artifacts-with-nix branch from ee3b738 to 312c797CompareAugust 27, 2026 16:30
@SDAChess

SDAChess commented Aug 27, 2026

Copy link
Copy Markdown
CollaboratorAuthor

/ok-to-test 312c797

krishicks
krishicks previously approved these changes Aug 27, 2026
View reviewed changes
@SDAChess
fix(ci): scope binary builds to cargo packages
cdb223c
Signed-off-by: Simon Scatton <sscatton@nvidia.com>
@SDAChess

SDAChess commented Aug 27, 2026

Copy link
Copy Markdown
CollaboratorAuthor

/ok-to-test cdb223c

@SDAChess
fix(ci): address zizmor template injection findings
17dbe71
Signed-off-by: Simon Scatton <sscatton@nvidia.com>
@SDAChess

SDAChess commented Aug 27, 2026

Copy link
Copy Markdown
CollaboratorAuthor

/ok-to-test 17dbe71

github-advanced-security[bot]
github-advanced-securityBot found potential problems Aug 27, 2026
View reviewed changes
Comment thread.github/actions/setup-e2e-driver/action.yml Fixed
Comment thread.github/actions/setup-e2e-podman/action.yml Fixed
Comment thread.github/actions/setup-e2e-podman/action.yml Fixed
Comment thread.github/actions/setup-mise/action.yml Fixed
Comment thread.github/actions/setup-mise/action.yml Fixed
Comment thread.github/workflows/e2e-docker-test.yml Fixed
@SDAChess
fix(ci): resolve remaining zizmor annotations
c5ac6fa
Signed-off-by: Simon Scatton <sscatton@nvidia.com>
@SDAChess

SDAChess commented Aug 27, 2026

Copy link
Copy Markdown
CollaboratorAuthor

/ok-to-test c5ac6fa

@SDAChess
SDAChess enabled auto-merge August 27, 2026 17:23
@SDAChess
SDAChess added this pull request to the merge queueAug 27, 2026
Merged via the queue into main with commit 981606dAug 27, 2026
77 of 79 checks passed
@SDAChess
SDAChess deleted the feat/build-artifacts-with-nix branch August 27, 2026 17:35
Sign up for freeto join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@elezarelezarelezar left review comments
@krishickskrishickskrishicks approved these changes
@mrunalpmrunalpAwaiting requested review from mrunalpmrunalp is a code owner
@sjenningsjenningAwaiting requested review from sjenningsjenning is a code owner
@derekwaynecarrderekwaynecarrAwaiting requested review from derekwaynecarrderekwaynecarr is a code owner
+1 more reviewer
@github-advanced-securitygithub-advanced-security[bot]github-advanced-security[bot] left review comments
Reviewers whose approvals may not affect merge requirements

Assignees

@SDAChessSDAChess

Labels

test:e2eRequires end-to-end coveragetest:e2e-gpuRequires GPU end-to-end coveragetest:e2e-kubernetesRequires Kubernetes end-to-end coverage

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

chore(ci): clean up release pipeline

4 participants

@SDAChess@krishicks@elezar@github-advanced-security