Release Tag #121
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: Release Tag | |
| on: | |
| push: | |
| tags: | |
| - "v*.*.*" | |
| workflow_dispatch: | |
| inputs: | |
| tag: | |
| description: "Git tag to release (e.g. v0.0.4)" | |
| required: true | |
| type: string | |
| permissions: | |
| contents: write | |
| packages: write | |
| # Resolve the tag once: prefer the workflow_dispatch input, fall back to the | |
| # push-event ref. Every job references this via env.RELEASE_TAG. | |
| env: | |
| RELEASE_TAG: ${{ inputs.tag || github.ref_name }} | |
| defaults: | |
| run: | |
| shell: bash | |
| jobs: | |
| # --------------------------------------------------------------------------- | |
| # Compute all versions once at the start to avoid git-describe race conditions | |
| # --------------------------------------------------------------------------- | |
| compute-versions: | |
| name: Compute Versions | |
| runs-on: linux-amd64-cpu8 | |
| timeout-minutes: 5 | |
| container: | |
| image: ghcr.io/nvidia/openshell/ci:latest | |
| credentials: | |
| username: ${{ github.actor }} | |
| password: ${{ secrets.GITHUB_TOKEN }} | |
| outputs: | |
| python_version: ${{ steps.v.outputs.python }} | |
| cargo_version: ${{ steps.v.outputs.cargo }} | |
| npm_version: ${{ steps.v.outputs.npm }} | |
| deb_version: ${{ steps.v.outputs.deb }} | |
| rpm_version: ${{ steps.v.outputs.rpm_version }} | |
| rpm_release: ${{ steps.v.outputs.rpm_release }} | |
| # Semver without 'v' prefix (e.g. 0.6.0), used for image tags and release body | |
| semver: ${{ steps.v.outputs.semver }} | |
| # Commit resolved from RELEASE_TAG, used for image tags and downstream metadata | |
| source_sha: ${{ steps.v.outputs.source_sha }} | |
| steps: | |
| - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 | |
| with: | |
| ref: ${{ inputs.tag || github.ref }} | |
| fetch-depth: 0 | |
| - name: Mark workspace safe for git | |
| run: git config --global --add safe.directory "$GITHUB_WORKSPACE" | |
| - name: Fetch tags | |
| run: git fetch --tags --force | |
| - name: Compute all versions | |
| id: v | |
| run: | | |
| set -euo pipefail | |
| echo "python=$(uv run python tasks/scripts/release.py get-version --python)" >> "$GITHUB_OUTPUT" | |
| echo "cargo=$(uv run python tasks/scripts/release.py get-version --cargo)" >> "$GITHUB_OUTPUT" | |
| echo "npm=$(uv run python tasks/scripts/release.py get-version --npm)" >> "$GITHUB_OUTPUT" | |
| echo "deb=$(uv run python tasks/scripts/release.py get-version --deb)" >> "$GITHUB_OUTPUT" | |
| echo "rpm_version=$(uv run python tasks/scripts/release.py get-version --rpm-version)" >> "$GITHUB_OUTPUT" | |
| echo "rpm_release=$(uv run python tasks/scripts/release.py get-version --rpm-release)" >> "$GITHUB_OUTPUT" | |
| echo "semver=${RELEASE_TAG#v}" >> "$GITHUB_OUTPUT" | |
| echo "source_sha=$(git rev-parse HEAD)" >> "$GITHUB_OUTPUT" | |
| build-cli: | |
| needs: compute-versions | |
| permissions: | |
| contents: read | |
| uses: ./.github/workflows/build-cli-binaries.yml | |
| with: | |
| cargo-version: ${{ needs.compute-versions.outputs.cargo_version }} | |
| image-tag: ${{ needs.compute-versions.outputs.semver }} | |
| checkout-ref: ${{ inputs.tag || github.ref }} | |
| secrets: inherit | |
| build-gateway: | |
| needs: compute-versions | |
| permissions: | |
| contents: read | |
| uses: ./.github/workflows/build-gateway-binaries.yml | |
| with: | |
| cargo-version: ${{ needs.compute-versions.outputs.cargo_version }} | |
| image-tag: ${{ needs.compute-versions.outputs.semver }} | |
| checkout-ref: ${{ inputs.tag || github.ref }} | |
| secrets: inherit | |
| build-sandbox: | |
| needs: compute-versions | |
| permissions: | |
| contents: read | |
| uses: ./.github/workflows/build-sandbox-binaries.yml | |
| with: | |
| cargo-version: ${{ needs.compute-versions.outputs.cargo_version }} | |
| image-tag: ${{ needs.compute-versions.outputs.semver }} | |
| checkout-ref: ${{ inputs.tag || github.ref }} | |
| secrets: inherit | |
| build-vm-driver: | |
| needs: [compute-versions, build-sandbox] | |
| permissions: | |
| contents: read | |
| uses: ./.github/workflows/build-vm-driver.yml | |
| with: | |
| cargo-version: ${{ needs.compute-versions.outputs.cargo_version }} | |
| image-tag: ${{ needs.compute-versions.outputs.semver }} | |
| checkout-ref: ${{ inputs.tag || github.ref }} | |
| secrets: inherit | |
| package-binaries: | |
| needs: [build-cli, build-gateway, build-sandbox, build-vm-driver] | |
| permissions: | |
| actions: read | |
| contents: read | |
| uses: ./.github/workflows/package-release-binaries.yml | |
| build-gateway-image: | |
| needs: [compute-versions, build-gateway] | |
| permissions: | |
| contents: read | |
| packages: write | |
| uses: ./.github/workflows/docker-build.yml | |
| with: | |
| component: gateway | |
| binary: openshell-gateway | |
| target-suffix: unknown-linux-gnu | |
| image-tag: ${{ needs.compute-versions.outputs.source_sha }} | |
| checkout-ref: ${{ inputs.tag || github.ref }} | |
| secrets: inherit | |
| build-supervisor-image: | |
| needs: [compute-versions, build-sandbox] | |
| permissions: | |
| contents: read | |
| packages: write | |
| uses: ./.github/workflows/docker-build.yml | |
| with: | |
| component: supervisor | |
| binary: openshell-sandbox | |
| target-suffix: unknown-linux-musl | |
| image-tag: ${{ needs.compute-versions.outputs.source_sha }} | |
| checkout-ref: ${{ inputs.tag || github.ref }} | |
| secrets: inherit | |
| docker-e2e: | |
| needs: [compute-versions, build-cli, build-gateway, build-supervisor-image] | |
| permissions: | |
| actions: read | |
| contents: read | |
| packages: read | |
| uses: ./.github/workflows/e2e-docker-test.yml | |
| with: | |
| image-tag: ${{ needs.compute-versions.outputs.source_sha }} | |
| checkout-ref: ${{ inputs.tag || github.ref }} | |
| runner: linux-arm64-cpu8 | |
| podman-e2e: | |
| needs: [compute-versions, build-cli, build-gateway, build-supervisor-image] | |
| permissions: | |
| actions: read | |
| contents: read | |
| packages: read | |
| uses: ./.github/workflows/e2e-podman-test.yml | |
| with: | |
| image-tag: ${{ needs.compute-versions.outputs.source_sha }} | |
| checkout-ref: ${{ inputs.tag || github.ref }} | |
| vm-e2e: | |
| needs: [compute-versions, build-cli, build-gateway, build-vm-driver] | |
| permissions: | |
| actions: read | |
| contents: read | |
| packages: read | |
| uses: ./.github/workflows/e2e-vm-test.yml | |
| with: | |
| checkout-ref: ${{ inputs.tag || github.ref }} | |
| tag-ghcr-release: | |
| name: Tag GHCR Images for Release | |
| needs: [compute-versions, build-gateway-image, build-supervisor-image, release] | |
| runs-on: linux-amd64-cpu8 | |
| timeout-minutes: 10 | |
| steps: | |
| - name: Log in to GHCR | |
| run: echo "${{ secrets.GITHUB_TOKEN }}" | docker login ghcr.io -u "${GITHUB_ACTOR}" --password-stdin | |
| - name: Tag images with version and latest | |
| run: | | |
| set -euo pipefail | |
| REGISTRY="ghcr.io/nvidia/openshell" | |
| VERSION="${{ needs.compute-versions.outputs.semver }}" | |
| SOURCE_TAG="${{ needs.compute-versions.outputs.source_sha }}" | |
| for component in gateway supervisor; do | |
| echo "Tagging ${REGISTRY}/${component}:${SOURCE_TAG} as ${VERSION} and latest..." | |
| docker buildx imagetools create \ | |
| --prefer-index=false \ | |
| -t "${REGISTRY}/${component}:${VERSION}" \ | |
| "${REGISTRY}/${component}:${SOURCE_TAG}" | |
| docker buildx imagetools create \ | |
| --prefer-index=false \ | |
| -t "${REGISTRY}/${component}:latest" \ | |
| "${REGISTRY}/${component}:${SOURCE_TAG}" | |
| done | |
| build-python-wheel: | |
| name: Build Python Wheel | |
| needs: [compute-versions] | |
| runs-on: linux-amd64-cpu8 | |
| timeout-minutes: 20 | |
| container: | |
| image: ghcr.io/nvidia/openshell/ci:latest | |
| credentials: | |
| username: ${{ github.actor }} | |
| password: ${{ secrets.GITHUB_TOKEN }} | |
| env: | |
| MISE_GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} | |
| SETUPTOOLS_SCM_PRETEND_VERSION_FOR_OPENSHELL: ${{ needs.compute-versions.outputs.python_version }} | |
| steps: | |
| - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 | |
| with: | |
| ref: ${{ inputs.tag || github.ref }} | |
| fetch-depth: 0 | |
| - name: Mark workspace safe for git | |
| run: git config --global --add safe.directory "$GITHUB_WORKSPACE" | |
| - name: Sync Python dependencies | |
| run: uv sync | |
| - name: Build Python wheel | |
| run: | | |
| set -euo pipefail | |
| mise run python:build | |
| ls -la target/wheels/*.whl | |
| - name: Upload wheel artifact | |
| uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7 | |
| with: | |
| name: python-wheel | |
| path: target/wheels/*.whl | |
| retention-days: 5 | |
| build-deb: | |
| name: Build Debian Packages | |
| needs: [compute-versions, build-cli, build-gateway, build-vm-driver] | |
| uses: ./.github/workflows/deb-package.yml | |
| with: | |
| deb-version: ${{ needs.compute-versions.outputs.deb_version }} | |
| checkout-ref: ${{ inputs.tag || github.ref }} | |
| secrets: inherit | |
| build-snap: | |
| name: Build Snap | |
| needs: [compute-versions, build-cli, build-gateway, build-sandbox] | |
| uses: ./.github/workflows/snap-package.yml | |
| with: | |
| checkout-ref: ${{ inputs.tag || github.ref }} | |
| upload-channel: latest/stable | |
| github-environment: latest/stable | |
| secrets: | |
| publish-credentials: ${{ secrets.SNAPCRAFT_STORE_CREDENTIALS }} | |
| build-rpm: | |
| name: Build RPM Packages | |
| needs: [compute-versions, build-cli, build-gateway] | |
| uses: ./.github/workflows/rpm-package.yml | |
| with: | |
| checkout-ref: ${{ inputs.tag || github.ref }} | |
| rpm-version: ${{ needs.compute-versions.outputs.rpm_version }} | |
| rpm-release: ${{ needs.compute-versions.outputs.rpm_release }} | |
| cargo-version: ${{ needs.compute-versions.outputs.cargo_version }} | |
| secrets: inherit | |
| smoke-linux-release-artifacts: | |
| name: Smoke Linux Release Artifacts (${{ matrix.name }}) | |
| needs: [package-binaries, build-deb, build-rpm, build-python-wheel] | |
| timeout-minutes: 20 | |
| strategy: | |
| fail-fast: false | |
| matrix: | |
| include: | |
| - name: ubuntu-20.04-binaries | |
| runner: linux-amd64-cpu8 | |
| image: ubuntu:20.04 | |
| kind: binary | |
| artifact_arch: amd64 | |
| rpm_arch: x86_64 | |
| target: x86_64-unknown-linux-gnu | |
| - name: ubuntu-20.04-binaries-arm64 | |
| runner: linux-arm64-cpu8 | |
| image: ubuntu:20.04 | |
| kind: binary | |
| artifact_arch: arm64 | |
| rpm_arch: aarch64 | |
| target: aarch64-unknown-linux-gnu | |
| - name: ubuntu-22.04-deb | |
| runner: linux-amd64-cpu8 | |
| image: ubuntu:22.04 | |
| kind: deb | |
| artifact_arch: amd64 | |
| rpm_arch: x86_64 | |
| target: x86_64-unknown-linux-gnu | |
| - name: ubuntu-22.04-deb-arm64 | |
| runner: linux-arm64-cpu8 | |
| image: ubuntu:22.04 | |
| kind: deb | |
| artifact_arch: arm64 | |
| rpm_arch: aarch64 | |
| target: aarch64-unknown-linux-gnu | |
| - name: fedora-rpm | |
| runner: linux-amd64-cpu8 | |
| image: fedora:latest | |
| kind: rpm | |
| artifact_arch: amd64 | |
| rpm_arch: x86_64 | |
| target: x86_64-unknown-linux-gnu | |
| - name: fedora-rpm-aarch64 | |
| runner: linux-arm64-cpu8 | |
| image: fedora:latest | |
| kind: rpm | |
| artifact_arch: arm64 | |
| rpm_arch: aarch64 | |
| target: aarch64-unknown-linux-gnu | |
| - name: python-wheel | |
| runner: linux-amd64-cpu8 | |
| image: python:3.12-slim | |
| kind: wheel | |
| runs-on: ${{ matrix.runner }} | |
| container: | |
| image: ${{ matrix.image }} | |
| steps: | |
| - name: Download gateway binary artifact | |
| if: matrix.kind == 'binary' | |
| uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1 | |
| with: | |
| name: gateway-binary-linux-${{ matrix.artifact_arch }} | |
| path: smoke-input/ | |
| - name: Download VM driver binary artifact | |
| if: matrix.kind == 'binary' | |
| uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1 | |
| with: | |
| name: driver-vm-linux-${{ matrix.artifact_arch }} | |
| path: smoke-input/ | |
| - name: Smoke binary artifacts | |
| if: matrix.kind == 'binary' | |
| run: | | |
| set -euo pipefail | |
| apt-get update | |
| mkdir -p smoke-bin | |
| tar -xzf smoke-input/openshell-gateway-${{ matrix.target }}.tar.gz -C smoke-bin | |
| tar -xzf smoke-input/openshell-driver-vm-${{ matrix.target }}.tar.gz -C smoke-bin | |
| LD_BIND_NOW=1 smoke-bin/openshell-gateway --version | |
| smoke-bin/openshell-driver-vm --version | |
| - name: Download Debian package artifact | |
| if: matrix.kind == 'deb' | |
| uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1 | |
| with: | |
| name: deb-linux-${{ matrix.artifact_arch }} | |
| path: package-input/ | |
| - name: Smoke Debian package | |
| if: matrix.kind == 'deb' | |
| run: | | |
| set -euo pipefail | |
| apt-get update | |
| apt-get install -y --no-install-recommends ./package-input/*.deb | |
| LD_BIND_NOW=1 openshell-gateway --version | |
| /usr/libexec/openshell/openshell-driver-vm --version | |
| - name: Download RPM package artifacts | |
| if: matrix.kind == 'rpm' | |
| uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1 | |
| with: | |
| name: rpm-linux-${{ matrix.rpm_arch }} | |
| path: package-input/ | |
| - name: Smoke RPM packages | |
| if: matrix.kind == 'rpm' | |
| run: | | |
| set -euo pipefail | |
| dnf install -y ./package-input/openshell-[0-9]*.rpm ./package-input/openshell-gateway-*.rpm | |
| LD_BIND_NOW=1 openshell-gateway --version | |
| - name: Download Python wheel artifact | |
| if: matrix.kind == 'wheel' | |
| uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1 | |
| with: | |
| name: python-wheel | |
| path: wheel-input/ | |
| - name: Smoke Python wheel | |
| if: matrix.kind == 'wheel' | |
| run: | | |
| set -euo pipefail | |
| python -m venv /tmp/openshell-wheel-smoke | |
| /tmp/openshell-wheel-smoke/bin/pip install --no-cache-dir wheel-input/*.whl | |
| /tmp/openshell-wheel-smoke/bin/python - <<'PY' | |
| import importlib | |
| for name in ("openshell", "openshell._proto", "openshell.sandbox"): | |
| importlib.import_module(name) | |
| print(name, "OK") | |
| PY | |
| test ! -e /tmp/openshell-wheel-smoke/bin/openshell | |
| # --------------------------------------------------------------------------- | |
| # Create a tagged GitHub Release with CLI, gateway, driver, and wheels | |
| # --------------------------------------------------------------------------- | |
| release: | |
| name: Release | |
| needs: [compute-versions, package-binaries, build-python-wheel, docker-e2e, podman-e2e, vm-e2e, build-deb, build-rpm, build-snap, smoke-linux-release-artifacts] | |
| runs-on: linux-amd64-cpu8 | |
| timeout-minutes: 10 | |
| permissions: | |
| contents: write | |
| id-token: write | |
| attestations: write | |
| artifact-metadata: write | |
| outputs: | |
| wheel_filenames: ${{ steps.wheel_filenames.outputs.wheel_filenames }} | |
| steps: | |
| - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 | |
| with: | |
| ref: ${{ inputs.tag || github.ref }} | |
| - name: Download all CLI artifacts | |
| uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1 | |
| with: | |
| pattern: cli-* | |
| path: release/ | |
| merge-multiple: true | |
| - name: Download gateway binary artifacts | |
| uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1 | |
| with: | |
| pattern: gateway-binary-* | |
| path: release/ | |
| merge-multiple: true | |
| - name: Download supervisor binary artifacts | |
| uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1 | |
| with: | |
| pattern: supervisor-binary-* | |
| path: release/ | |
| merge-multiple: true | |
| - name: Download VM driver artifacts | |
| uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1 | |
| with: | |
| pattern: driver-vm-* | |
| path: release/ | |
| merge-multiple: true | |
| - name: Download wheel artifact | |
| uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1 | |
| with: | |
| name: python-wheel | |
| path: release/ | |
| - name: Download Debian package artifacts | |
| uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1 | |
| with: | |
| pattern: deb-linux-* | |
| path: release/ | |
| merge-multiple: true | |
| - name: Download RPM package artifacts | |
| uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1 | |
| with: | |
| pattern: rpm-linux-* | |
| path: release/ | |
| merge-multiple: true | |
| - name: Download snap artifacts | |
| uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1 | |
| with: | |
| pattern: snap-linux-* | |
| path: release/ | |
| merge-multiple: true | |
| - name: Capture wheel filenames | |
| id: wheel_filenames | |
| run: | | |
| set -euo pipefail | |
| shopt -s nullglob | |
| wheels=(release/*.whl) | |
| if [ "${#wheels[@]}" -ne 1 ]; then | |
| echo "expected exactly one Python wheel, found ${#wheels[@]}" >&2 | |
| exit 1 | |
| fi | |
| wheel_filename=$(basename "${wheels[0]}") | |
| echo "wheel_filenames=${wheel_filename}" >> "$GITHUB_OUTPUT" | |
| - name: Generate checksums | |
| run: | | |
| set -euo pipefail | |
| cd release | |
| sha256sum \ | |
| openshell-x86_64-unknown-linux-musl.tar.gz \ | |
| openshell-aarch64-unknown-linux-musl.tar.gz \ | |
| openshell-aarch64-apple-darwin.tar.gz \ | |
| openshell-driver-vm-x86_64-unknown-linux-gnu.tar.gz \ | |
| openshell-driver-vm-aarch64-unknown-linux-gnu.tar.gz \ | |
| openshell-driver-vm-aarch64-apple-darwin.tar.gz \ | |
| openshell_*.deb \ | |
| openshell-*.rpm \ | |
| *.whl > openshell-checksums-sha256.txt | |
| cat openshell-checksums-sha256.txt | |
| sha256sum \ | |
| openshell-gateway-x86_64-unknown-linux-gnu.tar.gz \ | |
| openshell-gateway-aarch64-unknown-linux-gnu.tar.gz \ | |
| openshell-gateway-aarch64-apple-darwin.tar.gz > openshell-gateway-checksums-sha256.txt | |
| cat openshell-gateway-checksums-sha256.txt | |
| sha256sum \ | |
| openshell-sandbox-x86_64-unknown-linux-musl.tar.gz \ | |
| openshell-sandbox-aarch64-unknown-linux-musl.tar.gz > openshell-sandbox-checksums-sha256.txt | |
| cat openshell-sandbox-checksums-sha256.txt | |
| - name: Generate Homebrew formula | |
| run: | | |
| set -euo pipefail | |
| python3 tasks/scripts/release.py generate-homebrew-formula \ | |
| --release-tag "${RELEASE_TAG}" \ | |
| --release-dir release \ | |
| --output release/openshell.rb | |
| cat release/openshell.rb | |
| - name: Attest VM driver artifacts | |
| uses: actions/attest@508db95dd578ae2727ebd6217d5ba78e4fbda05d # v4.2.1 | |
| with: | |
| subject-path: | | |
| release/*.tar.gz | |
| release/*.deb | |
| release/*.rpm | |
| release/*.whl | |
| - name: Prune removed VM checksum asset | |
| uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9 | |
| with: | |
| script: | | |
| const [owner, repo] = process.env.GITHUB_REPOSITORY.split('/'); | |
| let release; | |
| try { | |
| release = await github.rest.repos.getReleaseByTag({ owner, repo, tag: process.env.RELEASE_TAG }); | |
| } catch (err) { | |
| if (err.status === 404) { | |
| core.info(`No existing ${process.env.RELEASE_TAG} release; skipping VM checksum pruning.`); | |
| return; | |
| } | |
| throw err; | |
| } | |
| for (const asset of release.data.assets) { | |
| if (asset.name === 'openshell-driver-vm-checksums-sha256.txt') { | |
| core.info(`Deleting removed VM checksum asset: ${asset.name}`); | |
| await github.rest.repos.deleteReleaseAsset({ owner, repo, asset_id: asset.id }); | |
| } | |
| } | |
| - name: Create GitHub Release | |
| uses: softprops/action-gh-release@3d0d9888cb7fd7b750713d6e236d1fcb99157228 # v3.0.2 | |
| with: | |
| name: OpenShell ${{ env.RELEASE_TAG }} | |
| prerelease: false | |
| tag_name: ${{ env.RELEASE_TAG }} | |
| generate_release_notes: true | |
| body: | | |
| ## OpenShell ${{ env.RELEASE_TAG }} | |
| ### Quick install | |
| ```bash | |
| curl -LsSf https://raw.githubusercontent.com/NVIDIA/OpenShell/main/install.sh | OPENSHELL_VERSION=${{ env.RELEASE_TAG }} sh | |
| ``` | |
| files: | | |
| release/openshell-x86_64-unknown-linux-musl.tar.gz | |
| release/openshell-aarch64-unknown-linux-musl.tar.gz | |
| release/openshell-aarch64-apple-darwin.tar.gz | |
| release/openshell_*.deb | |
| release/openshell-*.rpm | |
| release/*.snap | |
| release/openshell-gateway-x86_64-unknown-linux-gnu.tar.gz | |
| release/openshell-gateway-aarch64-unknown-linux-gnu.tar.gz | |
| release/openshell-gateway-aarch64-apple-darwin.tar.gz | |
| release/openshell-sandbox-x86_64-unknown-linux-musl.tar.gz | |
| release/openshell-sandbox-aarch64-unknown-linux-musl.tar.gz | |
| release/openshell-driver-vm-x86_64-unknown-linux-gnu.tar.gz | |
| release/openshell-driver-vm-aarch64-unknown-linux-gnu.tar.gz | |
| release/openshell-driver-vm-aarch64-apple-darwin.tar.gz | |
| release/*.whl | |
| release/openshell.rb | |
| release/openshell-checksums-sha256.txt | |
| release/openshell-gateway-checksums-sha256.txt | |
| release/openshell-sandbox-checksums-sha256.txt | |
| publish-fern-docs: | |
| name: Publish Fern Docs | |
| needs: [release] | |
| runs-on: ubuntu-latest | |
| timeout-minutes: 15 | |
| steps: | |
| - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 | |
| with: | |
| ref: ${{ inputs.tag || github.ref }} | |
| - name: Setup Node.js | |
| uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0 | |
| with: | |
| node-version: "24" | |
| - name: Install Fern CLI | |
| run: | | |
| FERN_VERSION=$(node -p "require('./fern/fern.config.json').version") | |
| npm install -g "fern-api@${FERN_VERSION}" | |
| - name: Publish Fern docs | |
| env: | |
| FERN_TOKEN: ${{ secrets.FERN_TOKEN }} | |
| working-directory: ./fern | |
| run: fern generate --docs | |
| publish-sdk-typescript: | |
| name: Publish TypeScript SDK | |
| needs: [compute-versions, release] | |
| runs-on: linux-amd64-cpu8 | |
| timeout-minutes: 15 | |
| permissions: | |
| contents: read | |
| packages: write | |
| container: | |
| image: ghcr.io/nvidia/openshell/ci:latest | |
| credentials: | |
| username: ${{ github.actor }} | |
| password: ${{ secrets.GITHUB_TOKEN }} | |
| steps: | |
| - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 | |
| with: | |
| ref: ${{ inputs.tag || github.ref }} | |
| - name: Mark workspace safe for git | |
| run: git config --global --add safe.directory "$GITHUB_WORKSPACE" | |
| - name: Install tools | |
| run: mise install --locked | |
| - name: Configure npm auth for GitHub Packages | |
| working-directory: ./sdk/typescript | |
| run: | | |
| { | |
| echo "@nvidia:registry=https://npm.pkg.github.com" | |
| echo '//npm.pkg.github.com/:_authToken=${NODE_AUTH_TOKEN}' | |
| } > .npmrc | |
| - name: Publish | |
| env: | |
| OPENSHELL_NPM_VERSION: ${{ needs.compute-versions.outputs.npm_version }} | |
| NODE_AUTH_TOKEN: ${{ secrets.GITHUB_TOKEN }} | |
| run: mise run sdk:ts:publish | |
| release-helm: | |
| name: Release Helm Chart (OCI) | |
| needs: [compute-versions, release, tag-ghcr-release] | |
| runs-on: ubuntu-latest | |
| timeout-minutes: 10 | |
| permissions: | |
| packages: write | |
| steps: | |
| - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 | |
| with: | |
| ref: ${{ inputs.tag || github.ref }} | |
| - uses: ./.github/actions/release-helm-oci | |
| with: | |
| chart-version: ${{ needs.compute-versions.outputs.semver }} | |
| app-version: ${{ needs.compute-versions.outputs.semver }} | |
| release-kind: public | |
| trigger-wheel-publish: | |
| name: Trigger Wheel Publish | |
| needs: [compute-versions, release] | |
| runs-on: [self-hosted, nv] | |
| timeout-minutes: 10 | |
| steps: | |
| - name: Trigger GitLab CI | |
| env: | |
| GITLAB_CI_TRIGGER_TOKEN: ${{ secrets.GITLAB_CI_TRIGGER_TOKEN }} | |
| GITLAB_CI_TRIGGER_URL: ${{ secrets.GITLAB_CI_TRIGGER_URL }} | |
| COMMIT_SHA: ${{ needs.compute-versions.outputs.source_sha }} | |
| RELEASE_VERSION: ${{ needs.compute-versions.outputs.python_version }} | |
| RELEASE_TAG: ${{ env.RELEASE_TAG }} | |
| WHEEL_FILENAMES: ${{ needs.release.outputs.wheel_filenames }} | |
| run: | | |
| set -euo pipefail | |
| if [ -z "${WHEEL_FILENAMES}" ]; then | |
| echo "No wheel filenames provided by build job" >&2 | |
| exit 1 | |
| fi | |
| response=$(curl -X POST \ | |
| --fail \ | |
| --silent \ | |
| --show-error \ | |
| -F "token=${GITLAB_CI_TRIGGER_TOKEN}" \ | |
| -F "ref=main" \ | |
| -F "variables[PIPELINE_ACTION]=publish_wheels" \ | |
| -F "variables[GITHUB_REPOSITORY]=${GITHUB_REPOSITORY}" \ | |
| -F "variables[COMMIT_SHA]=${COMMIT_SHA}" \ | |
| -F "variables[RELEASE_TAG]=${RELEASE_TAG}" \ | |
| -F "variables[RELEASE_VERSION]=${RELEASE_VERSION}" \ | |
| -F "variables[RELEASE_KIND]=stable" \ | |
| -F "variables[WHEEL_FILENAMES]=${WHEEL_FILENAMES}" \ | |
| "${GITLAB_CI_TRIGGER_URL}") | |
| pipeline_id=$(printf '%s' "$response" | sed -n 's/.*"id":\([0-9][0-9]*\).*/\1/p') | |
| pipeline_status=$(printf '%s' "$response" | sed -n 's/.*"status":"\([^"]*\)".*/\1/p') | |
| echo "Triggered GitLab pipeline ${pipeline_id:-unknown} with status=${pipeline_status:-unknown}" |