ci: build release binaries with Nix

.github/actions/build-docker-image/action.yml

@@ -0,0 +1,66 @@
+# SPDX-FileCopyrightText: Copyright (c) 2025-2026 NVIDIA CORPORATION & AFFILIATES. All rights reserved.
+# SPDX-License-Identifier: Apache-2.0
+
+name: Build Docker Image
+description: Build and push one architecture of an OpenShell image
+
+inputs:
+  component:
+    description: Docker image and Dockerfile name
+    required: true
+  binary:
+    description: Binary staged in the Docker build context
+    required: true
+  triple:
+    description: Binary artifact target triple
+    required: true
+  arch:
+    description: Docker architecture name
+    required: true
+  platform:
+    description: Docker platform
+    required: true
+  image-tag:
+    description: Docker image tag
+    required: true
+  github-token:
+    description: Token used to push the image
+    required: true
+
+runs:
+  using: composite
+  steps:
+    - uses: ./.github/actions/setup-buildx
+      with:
+        buildkitd-config: /etc/buildkit/buildkitd.toml
+
+    - name: Log in to GHCR
+      shell: bash
+      run: echo "${{ inputs.github-token }}" | docker login ghcr.io -u "${{ github.actor }}" --password-stdin
+
+    - name: Download ${{ inputs.binary }}
+      uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
+      with:
+        name: ${{ inputs.binary }}-${{ inputs.triple }}
+        path: artifact
+
+    - name: Stage ${{ inputs.binary }}
+      shell: bash
+      run: install -Dm0755 artifact/${{ inputs.binary }} deploy/docker/.build/prebuilt-binaries/${{ inputs.arch }}/${{ inputs.binary }}
+
+    - name: Build ${{ inputs.component }} image
+      shell: bash
+      env:
+        IMAGE_TAG: ${{ inputs.image-tag }}
+      run: |
+        docker buildx build \
+          --builder openshell \
+          --platform ${{ inputs.platform }} \
+          --file deploy/docker/Dockerfile.${{ inputs.component }} \
+          --target ${{ inputs.component }} \
+          --tag ghcr.io/nvidia/openshell/${{ inputs.component }}:${IMAGE_TAG}-${{ inputs.arch }} \
+          --cache-from type=gha,scope=${{ inputs.component }}-${{ inputs.arch }} \
+          --cache-to type=gha,mode=max,scope=${{ inputs.component }}-${{ inputs.arch }} \
+          --provenance=false \
+          --push \
+          .

.github/actions/build-rust-binary/action.yml

@@ -0,0 +1,98 @@
+# SPDX-FileCopyrightText: Copyright (c) 2025-2026 NVIDIA CORPORATION & AFFILIATES. All rights reserved.
+# SPDX-License-Identifier: Apache-2.0
+
+name: Build Rust Binary
+description: Build, verify, package, and upload an auditable Rust binary
+
+inputs:
+  binary:
+    description: Cargo binary name
+    required: true
+  triple:
+    description: Rust target triple
+    required: true
+  dev-shell:
+    description: Nix development shell used to build the binary
+    required: true
+  cargo-version:
+    description: Cargo package version embedded in the binary
+    required: true
+  image-tag:
+    description: Default supervisor image tag embedded in the binary
+    required: false
+    default: ""
+  artifact-name:
+    description: GitHub artifact name
+    required: false
+    default: ""
+  extra-cargo-flags:
+    description: Additional flags passed to cargo build
+    required: false
+    default: ""
+  interpreter:
+    description: ELF interpreter for a dynamically linked Linux binary
+    required: false
+    default: ""
+
+runs:
+  using: composite
+  steps:
+    - name: Hash development shell
+      id: dev-shell
+      shell: bash
+      env:
+        DEV_SHELL: ${{ inputs.dev-shell }}
+      run: echo "hash=$(nix hash file --type sha256 --base16 "$(nix eval --raw "${DEV_SHELL}.drvPath")")" >> "$GITHUB_OUTPUT"
+
+    - name: Cache Rust artifacts
+      uses: Swatinem/rust-cache@6323deb102c322ba6fcbdcafc7e3dddab59af2b6 # v2.9.2
+      with:
+        shared-key: binaries-${{ inputs.binary }}-${{ inputs.triple }}-${{ steps.dev-shell.outputs.hash }}
+        cache-on-failure: "true"
+        cache-workspace-crates: "true"
+        cache-bin: "false"
+        cmd-format: nix develop ${{ inputs.dev-shell }} -c {0}
+
+    - name: Set version
+      shell: nix develop ${{ inputs.dev-shell }} -c bash -euo pipefail {0}
+      run: sed -i 's/^version = "0\.0\.0"$/version = "${{ inputs.cargo-version }}"/' Cargo.toml
+
+    - name: Build ${{ inputs.binary }}
+      shell: nix develop ${{ inputs.dev-shell }} -c bash -euo pipefail {0}
+      env:
+        OPENSHELL_IMAGE_TAG: ${{ inputs.image-tag }}
+      run: GIT_DIR=/nonexistent cargo auditable build --release --bin "${{ inputs.binary }}" ${{ inputs.extra-cargo-flags }}
+
+    - name: Verify ${{ inputs.binary }}
+      shell: nix develop ${{ inputs.dev-shell }} -c bash -euo pipefail {0}
+      run: |
+        # Confirm the binary runs and reports the expected name.
+        target/release/${{ inputs.binary }} --version | grep -q '^${{ inputs.binary }} '
+        # Confirm Syft can decode the embedded cargo-auditable metadata.
+        SYFT_CHECK_FOR_APP_UPDATE=false syft file:target/release/${{ inputs.binary }} -o cyclonedx-json | grep 'pkg:cargo/' > /dev/null
+
+    - name: Verify static linkage
+      if: endsWith(inputs.triple, '-linux-musl')
+      shell: nix develop ${{ inputs.dev-shell }} -c bash -euo pipefail {0}
+      run: tasks/scripts/verify-static-binary.sh target/release/${{ inputs.binary }}
+
+    - name: Normalize Linux dynamic binary
+      if: endsWith(inputs.triple, '-linux-gnu')
+      shell: nix develop ${{ inputs.dev-shell }} -c bash -euo pipefail {0}
+      run: |
+        binary=target/release/${{ inputs.binary }}
+        # Remove Nix store paths so the binary can run on other distributions.
+        patchelf --set-interpreter "${{ inputs.interpreter }}" --remove-rpath "$binary"
+        # Z3 must be embedded instead of loaded from the target system.
+        test -z "$(patchelf --print-needed "$binary" | grep '^libz3')"
+        # Reject symbols introduced after glibc 2.28.
+        tasks/scripts/verify-glibc-symbols.sh 2.28 "$binary"
+
+    - name: Upload ${{ inputs.binary }}
+      uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7
+      with:
+        name: ${{ inputs.artifact-name || format('{0}-{1}', inputs.binary, inputs.triple) }}
+        path: target/release/${{ inputs.binary }}
+        compression-level: 0
+        retention-days: 5
+        if-no-files-found: error

.github/actions/check-job-results/action.yml

@@ -0,0 +1,33 @@
+# SPDX-FileCopyrightText: Copyright (c) 2025-2026 NVIDIA CORPORATION & AFFILIATES. All rights reserved.
+# SPDX-License-Identifier: Apache-2.0
+
+name: Check job results
+description: Fail when any required upstream job did not succeed
+
+inputs:
+  results:
+    description: JSON-encoded GitHub Actions needs context
+    required: true
+
+runs:
+  using: composite
+  steps:
+    - name: Check required jobs
+      shell: bash
+      env:
+        JOB_RESULTS: ${{ inputs.results }}
+      run: |
+        set -euo pipefail
+        failures="$(
+          jq -r '
+            to_entries[]
+            | select(.value.result != "success")
+            | "\(.key) concluded \(.value.result)"
+          ' <<< "$JOB_RESULTS"
+        )"
+        if [ -n "$failures" ]; then
+          while IFS= read -r failure; do
+            echo "::error::$failure"
+          done <<< "$failures"
+          exit 1
+        fi

.github/actions/setup-e2e-cli/action.yml

@@ -1,29 +1,19 @@
 name: Setup E2E CLI
 description: Download an architecture-matched prebuilt OpenShell CLI for E2E tests
 
-inputs:
-  artifact-prefix:
-    description: Artifact name prefix; linux-<arch> is appended automatically
-    required: true
-
 runs:
   using: composite
   steps:
     - name: Download prebuilt CLI
       uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
       with:
-        name: ${{ format('{0}-linux-{1}', inputs.artifact-prefix, runner.arch == 'X64' && 'amd64' || 'arm64') }}
+        name: ${{ runner.arch == 'X64' && 'openshell-x86_64-unknown-linux-musl' || 'openshell-aarch64-unknown-linux-musl' }}
         path: .e2e/prebuilt-cli
 
     - name: Configure prebuilt CLI
       shell: bash
       run: |
-        set -euo pipefail
         cli="$GITHUB_WORKSPACE/.e2e/prebuilt-cli/openshell"
-        if [[ ! -f "$cli" ]]; then
-          echo "downloaded artifact is missing $cli" >&2
-          exit 1
-        fi
         chmod +x "$cli"
         "$cli" --version
         echo "OPENSHELL_BIN=$cli" >> "$GITHUB_ENV"

.github/actions/setup-e2e-driver/action.yml

@@ -0,0 +1,27 @@
+# SPDX-FileCopyrightText: Copyright (c) 2025-2026 NVIDIA CORPORATION & AFFILIATES. All rights reserved.
+# SPDX-License-Identifier: Apache-2.0
+
+name: Setup E2E Driver
+description: Download an architecture-matched standalone compute driver for E2E tests
+
+inputs:
+  binary:
+    description: Compute driver binary name
+    required: true
+
+runs:
+  using: composite
+  steps:
+    - name: Download prebuilt ${{ inputs.binary }}
+      uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
+      with:
+        name: ${{ inputs.binary }}-${{ runner.arch == 'X64' && 'x86_64-unknown-linux-gnu' || 'aarch64-unknown-linux-gnu' }}
+        path: .e2e/prebuilt-driver
+
+    - name: Configure prebuilt ${{ inputs.binary }}
+      shell: bash
+      run: |
+        driver="$GITHUB_WORKSPACE/.e2e/prebuilt-driver/${{ inputs.binary }}"
+        chmod +x "$driver"
+        "$driver" --version
+        echo "OPENSHELL_EXTERNAL_DRIVER_BIN=$driver" >> "$GITHUB_ENV"

.github/actions/setup-e2e-gateway/action.yml

@@ -2,28 +2,24 @@ name: Setup E2E Gateway
 description: Download an architecture-matched prebuilt OpenShell gateway for E2E tests
 
 inputs:
-  artifact-prefix:
-    description: Artifact name prefix; linux-<arch> is appended automatically
-    required: true
+  artifact-name:
+    description: GitHub artifact name
+    required: false
+    default: ""
 
 runs:
   using: composite
   steps:
     - name: Download prebuilt gateway
       uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
       with:
-        name: ${{ format('{0}-linux-{1}', inputs.artifact-prefix, runner.arch == 'X64' && 'amd64' || 'arm64') }}
+        name: ${{ inputs.artifact-name || (runner.arch == 'X64' && 'openshell-gateway-x86_64-unknown-linux-gnu' || 'openshell-gateway-aarch64-unknown-linux-gnu') }}
         path: .e2e/prebuilt-gateway
 
     - name: Configure prebuilt gateway
       shell: bash
       run: |
-        set -euo pipefail
         gateway="$GITHUB_WORKSPACE/.e2e/prebuilt-gateway/openshell-gateway"
-        if [[ ! -f "$gateway" ]]; then
-          echo "downloaded artifact is missing $gateway" >&2
-          exit 1
-        fi
         chmod +x "$gateway"
         "$gateway" --version
         echo "OPENSHELL_GATEWAY_BIN=$gateway" >> "$GITHUB_ENV"

.github/actions/setup-e2e-kind/action.yml

@@ -0,0 +1,82 @@
+# SPDX-FileCopyrightText: Copyright (c) 2025-2026 NVIDIA CORPORATION & AFFILIATES. All rights reserved.
+# SPDX-License-Identifier: Apache-2.0
+
+name: Setup E2E kind
+description: Create a kind cluster and preload OpenShell images for E2E tests
+
+inputs:
+  cluster-name:
+    description: kind cluster name
+    required: true
+  image-tag:
+    description: OpenShell image tag to load
+    required: true
+  images:
+    description: Space-separated OpenShell image components to load
+    required: false
+    default: gateway supervisor
+  registry:
+    description: Container registry and namespace
+    required: false
+    default: ghcr.io/nvidia/openshell
+  registry-username:
+    description: Registry username
+    required: true
+  registry-password:
+    description: Registry password
+    required: true
+  mise-version:
+    description: mise release to install
+    required: false
+    default: v2026.4.25
+
+runs:
+  using: composite
+  steps:
+    - uses: ./.github/actions/setup-mise
+      with:
+        version: ${{ inputs.mise-version }}
+
+    - name: Log in to GHCR
+      shell: bash
+      env:
+        REGISTRY: ${{ inputs.registry }}
+        REGISTRY_USERNAME: ${{ inputs.registry-username }}
+        REGISTRY_PASSWORD: ${{ inputs.registry-password }}
+      run: echo "$REGISTRY_PASSWORD" | docker login "${REGISTRY%%/*}" -u "$REGISTRY_USERNAME" --password-stdin
+
+    - name: Create kind cluster
+      uses: helm/kind-action@ef37e7f390d99f746eb8b610417061a60e82a6cc # v1.14.0
+      with:
+        cluster_name: ${{ inputs.cluster-name }}
+        wait: 120s
+
+    - name: Export kind kubeconfig to mise path
+      shell: bash
+      env:
+        CLUSTER_NAME: ${{ inputs.cluster-name }}
+      run: |
+        set -euo pipefail
+        kind get kubeconfig --name "$CLUSTER_NAME" > "$GITHUB_WORKSPACE/kubeconfig"
+        chmod 600 "$GITHUB_WORKSPACE/kubeconfig"
+
+    - name: Load OpenShell images into kind
+      shell: bash
+      env:
+        CLUSTER_NAME: ${{ inputs.cluster-name }}
+        IMAGE_COMPONENTS: ${{ inputs.images }}
+        IMAGE_TAG: ${{ inputs.image-tag }}
+        REGISTRY: ${{ inputs.registry }}
+      run: |
+        set -euo pipefail
+        for component in $IMAGE_COMPONENTS; do
+          case "$component" in
+            gateway | supervisor) ;;
+            *) echo "ERROR: unsupported OpenShell image component: $component" >&2; exit 1 ;;
+          esac
+          image="${REGISTRY}/${component}:${IMAGE_TAG}"
+          archive="${RUNNER_TEMP:-/tmp}/openshell-${component}-linux-amd64.tar"
+          docker pull --platform linux/amd64 "$image"
+          docker image save --platform linux/amd64 --output "$archive" "$image"
+          kind load image-archive "$archive" --name "$CLUSTER_NAME"
+        done