Skip to content

ci: build release binaries with Nix - #2977

Merged
SDAChess merged 20 commits into
mainfrom
feat/build-artifacts-with-nix
Aug 27, 2026
Merged

ci: build release binaries with Nix#2977
SDAChess merged 20 commits into
mainfrom
feat/build-artifacts-with-nix

Conversation

@SDAChess

@SDAChess SDAChess commented Aug 27, 2026

Copy link
Copy Markdown
Collaborator

Summary

Replace the separate release binary build paths with one Nix-based artifact workflow. Build each platform binary once, then reuse those artifacts across packaging, smoke tests, and release publication.

Related Issue

Closes #1683

Changes

  • Add a shared workflow that computes the release version once and passes it to all build jobs
  • Build Linux CLI and sandbox binaries statically with musl
  • Build Linux gateway and VM-driver binaries against glibc 2.28
  • Normalize dynamic Linux binaries with standard interpreters and no Nix RPATH
  • Build Apple Silicon CLI, gateway, and VM-driver binaries natively on macOS
  • Build release binaries with cargo auditable and verify their embedded metadata with Syft
  • Link Z3 statically into portable gateway and VM-driver artifacts
  • Package binaries into target-specific tarballs
  • Build the VM driver from the matching sandbox artifact and rolling VM runtime
  • Reuse built artifacts in downstream packages, smoke tests, and release jobs
  • Remove superseded Zig, Docker, and native binary build paths after migrating their callers

Testing

  • mise run pre-commit passes
  • actionlint passes for the binary workflow
  • x86_64 Linux CLI builds as a static PIE with auditable metadata
  • x86_64 Linux gateway builds with static Z3 and auditable metadata
  • Gateway normalization removes its Nix RPATH and sets the standard Linux interpreter
  • Gateway references no symbols newer than GLIBC 2.28
  • ARM64 Linux build matrix passes in GitHub Actions
  • Apple Silicon build matrix passes in GitHub Actions
  • Sandbox-to-VM-driver artifact chain passes in GitHub Actions
  • Downstream package and release smoke tests pass
  • Unit tests added/updated (not applicable; workflow-only change)
  • E2E tests added/updated (if applicable)

Checklist

  • Follows Conventional Commits
  • Commits are signed off (DCO)
  • Architecture docs updated (not applicable; CI-only change)

elezar
elezar reviewed Aug 27, 2026
View reviewed changes
Comment thread .github/workflows/build-binaries.yml Outdated
elezar
elezar reviewed Aug 27, 2026
View reviewed changes

@elezar elezar left a comment

Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Thanks @SDAChess.

One minor question. I assume a follow-up will be to start consuming these from other pipeline stages? Would it make sense to do that already to validate that the workflow works as expected?

@SDAChess

SDAChess commented Aug 27, 2026

Copy link
Copy Markdown
Collaborator Author

Thanks @SDAChess.

One minor question. I assume a follow-up will be to start consuming these from other pipeline stages? Would it make sense to do that already to validate that the workflow works as expected?

I plan to add this in this pull request. It's not ready for review yet. I'll put it as draft...

@SDAChess
SDAChess marked this pull request as draft August 27, 2026 08:19
@copy-pr-bot

copy-pr-bot Bot commented Aug 27, 2026

Copy link
Copy Markdown

Auto-sync is disabled for draft pull requests in this repository. Workflows must be run manually.

Contributors can view more details about this message here.

@SDAChess SDAChess added test:e2e Requires end-to-end coverage test:e2e-gpu Requires GPU end-to-end coverage test:e2e-kubernetes Requires Kubernetes end-to-end coverage labels Aug 27, 2026
@github-actions

github-actions Bot commented Aug 27, 2026

Copy link
Copy Markdown

Label test:e2e-gpu applied, but pull-request/2977 is at 7385eda while the PR head is 96a795a. A maintainer needs to comment /ok to test 96a795a189ee5345704db6f78ca2bb0298760010 to refresh the mirror. Once the mirror catches up, re-run Branch E2E Checks from the Actions tab.

@github-actions

github-actions Bot commented Aug 27, 2026

Copy link
Copy Markdown

Label test:e2e applied, but pull-request/2977 is at 7385eda while the PR head is 96a795a. A maintainer needs to comment /ok to test 96a795a189ee5345704db6f78ca2bb0298760010 to refresh the mirror. Once the mirror catches up, re-run Branch E2E Checks from the Actions tab.

@github-actions

github-actions Bot commented Aug 27, 2026

Copy link
Copy Markdown

Label test:e2e-kubernetes applied, but pull-request/2977 is at 7385eda while the PR head is 96a795a. A maintainer needs to comment /ok to test 96a795a189ee5345704db6f78ca2bb0298760010 to refresh the mirror. Once the mirror catches up, re-run Branch E2E Checks from the Actions tab.

@SDAChess

SDAChess commented Aug 27, 2026

Copy link
Copy Markdown
Collaborator Author

/ok-to-test 96a795a

@SDAChess

SDAChess commented Aug 27, 2026

Copy link
Copy Markdown
Collaborator Author

/ok-to-test b053940

@SDAChess

SDAChess commented Aug 27, 2026

Copy link
Copy Markdown
Collaborator Author

/ok-to-test d430e53

@SDAChess

SDAChess commented Aug 27, 2026

Copy link
Copy Markdown
Collaborator Author

/ok-to-test eafcef0

@SDAChess
SDAChess marked this pull request as ready for review August 27, 2026 13:44
@SDAChess
SDAChess force-pushed the feat/build-artifacts-with-nix branch from 28b3242 to ccdb07a Compare August 27, 2026 13:56
@github-actions

github-actions Bot commented Aug 27, 2026

Copy link
Copy Markdown

🌿 Preview your docs: https://nvidia-preview-pr-2977.docs.buildwithfern.com/openshell

github-advanced-security[bot]
github-advanced-security Bot found potential problems Aug 27, 2026
View reviewed changes

@github-advanced-security github-advanced-security AI left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

zizmor found more than 20 potential problems in the proposed changes. Check the Files changed tab for more details.

@SDAChess SDAChess self-assigned this Aug 27, 2026
@copy-pr-bot

copy-pr-bot Bot commented Aug 27, 2026

Copy link
Copy Markdown

This pull request requires additional validation before any workflows can run on NVIDIA's runners.

Pull request vetters can view their responsibilities here.

Contributors can view more details about this message here.

@SDAChess
ci: build release binaries with Nix
516adcd 
Refs #1683

Signed-off-by: Simon Scatton <sscatton@nvidia.com>
@SDAChess
ci: build VM artifacts with Nix
3d2bbae 
Refs #1683

Signed-off-by: Simon Scatton <sscatton@nvidia.com>
@SDAChess
ci: build images from Nix artifacts
7894e09 
Refs #1683

Signed-off-by: Simon Scatton <sscatton@nvidia.com>
@SDAChess
fix(nix): prevent host header leakage
ec073a1 
Signed-off-by: Simon Scatton <sscatton@nvidia.com>
@SDAChess
ci: parallelize artifact builds
3b01c8d 
Refs #1683

Signed-off-by: Simon Scatton <sscatton@nvidia.com>
SDAChess added 11 commits August 27, 2026 18:26
@SDAChess
fix(nix): disable mold in musl shells
7abab27 
Signed-off-by: Simon Scatton <sscatton@nvidia.com>
@SDAChess
ci: key Rust cache by Nix shell derivation
29cbd80 
Signed-off-by: Simon Scatton <sscatton@nvidia.com>
@SDAChess
ci: refactor end-to-end workflows
d7d1c6b 
Signed-off-by: Simon Scatton <sscatton@nvidia.com>
@SDAChess
ci: split platform binary workflows
c3876ce 
Signed-off-by: Simon Scatton <sscatton@nvidia.com>
@SDAChess
ci: remove obsolete native build workflows
f383e6f 
Signed-off-by: Simon Scatton <sscatton@nvidia.com>
@SDAChess
ci: replace disallowed mise action
9d8931d 
Signed-off-by: Simon Scatton <sscatton@nvidia.com>
@SDAChess
ci: fix refactored e2e lanes
fef9105 
Signed-off-by: Simon Scatton <sscatton@nvidia.com>
@SDAChess
ci: check out local result action
d175fda 
Signed-off-by: Simon Scatton <sscatton@nvidia.com>
@SDAChess
ci: cache mise installations
dcc9400 
Signed-off-by: Simon Scatton <sscatton@nvidia.com>
@SDAChess
ci: run docker builds on host runners
6834739 
Signed-off-by: Simon Scatton <sscatton@nvidia.com>
@SDAChess
ci: disable unstable kubernetes e2e lanes
312c797 
Signed-off-by: Simon Scatton <sscatton@nvidia.com>
@SDAChess
SDAChess force-pushed the feat/build-artifacts-with-nix branch from ee3b738 to 312c797 Compare August 27, 2026 16:30
@SDAChess

SDAChess commented Aug 27, 2026

Copy link
Copy Markdown
Collaborator Author

/ok-to-test 312c797

krishicks
krishicks previously approved these changes Aug 27, 2026
View reviewed changes
@SDAChess
fix(ci): scope binary builds to cargo packages
cdb223c 
Signed-off-by: Simon Scatton <sscatton@nvidia.com>
@SDAChess

SDAChess commented Aug 27, 2026

Copy link
Copy Markdown
Collaborator Author

/ok-to-test cdb223c

@SDAChess
fix(ci): address zizmor template injection findings
17dbe71 
Signed-off-by: Simon Scatton <sscatton@nvidia.com>
@SDAChess

SDAChess commented Aug 27, 2026

Copy link
Copy Markdown
Collaborator Author

/ok-to-test 17dbe71

github-advanced-security[bot]
github-advanced-security Bot found potential problems Aug 27, 2026
View reviewed changes
Comment thread .github/actions/setup-e2e-driver/action.yml Fixed
Comment thread .github/actions/setup-e2e-podman/action.yml Fixed
Comment thread .github/actions/setup-e2e-podman/action.yml Fixed
Comment thread .github/actions/setup-mise/action.yml Fixed
Comment thread .github/actions/setup-mise/action.yml Fixed
Comment thread .github/workflows/e2e-docker-test.yml Fixed
@SDAChess
fix(ci): resolve remaining zizmor annotations
c5ac6fa 
Signed-off-by: Simon Scatton <sscatton@nvidia.com>
@SDAChess

SDAChess commented Aug 27, 2026

Copy link
Copy Markdown
Collaborator Author

/ok-to-test c5ac6fa

@SDAChess
SDAChess enabled auto-merge August 27, 2026 17:23
@SDAChess
SDAChess added this pull request to the merge queue Aug 27, 2026
Merged via the queue into main with commit 981606d Aug 27, 2026
77 of 79 checks passed
@SDAChess
SDAChess deleted the feat/build-artifacts-with-nix branch August 27, 2026 17:35
@waynesun09 waynesun09 mentioned this pull request Aug 27, 2026
Open
@fullsend-ai-coder fullsend-ai-coder Bot mentioned this pull request Aug 27, 2026
Open
8 tasks
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@elezar elezar elezar left review comments
@krishicks krishicks krishicks approved these changes
@mrunalp mrunalp Awaiting requested review from mrunalp mrunalp is a code owner
@sjenning sjenning Awaiting requested review from sjenning sjenning is a code owner
@derekwaynecarr derekwaynecarr Awaiting requested review from derekwaynecarr derekwaynecarr is a code owner
+1 more reviewer
@github-advanced-security github-advanced-security[bot] github-advanced-security[bot] left review comments
Reviewers whose approvals may not affect merge requirements

Assignees

@SDAChess SDAChess

Labels

test:e2e Requires end-to-end coverage test:e2e-gpu Requires GPU end-to-end coverage test:e2e-kubernetes Requires Kubernetes end-to-end coverage

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

chore(ci): clean up release pipeline

4 participants

@SDAChess @krishicks @elezar @github-advanced-security