diff --git a/.github/workflows/deb-package.yml b/.github/workflows/deb-package.yml index 75c206defe..2877487582 100644 --- a/.github/workflows/deb-package.yml +++ b/.github/workflows/deb-package.yml @@ -25,12 +25,12 @@ jobs: matrix: include: - arch: amd64 - runner: build-amd64 + runner: linux-amd64-cpu8 deb_arch: amd64 cli_target: x86_64-unknown-linux-musl gnu_target: x86_64-unknown-linux-gnu - arch: arm64 - runner: build-arm64 + runner: linux-arm64-cpu8 deb_arch: arm64 cli_target: aarch64-unknown-linux-musl gnu_target: aarch64-unknown-linux-gnu diff --git a/.github/workflows/driver-vm-linux.yml b/.github/workflows/driver-vm-linux.yml index 9829916ff3..7359994617 100644 --- a/.github/workflows/driver-vm-linux.yml +++ b/.github/workflows/driver-vm-linux.yml @@ -24,7 +24,7 @@ defaults: jobs: download-kernel-runtime: name: Download Kernel Runtime - runs-on: build-amd64 + runs-on: linux-amd64-cpu8 timeout-minutes: 10 container: image: ghcr.io/nvidia/openshell/ci:latest @@ -82,12 +82,12 @@ jobs: matrix: include: - arch: arm64 - runner: build-arm64 + runner: linux-arm64-cpu8 target: aarch64-unknown-linux-gnu platform: linux-aarch64 guest_arch: aarch64 - arch: amd64 - runner: build-amd64 + runner: linux-amd64-cpu8 target: x86_64-unknown-linux-gnu platform: linux-x86_64 guest_arch: x86_64 diff --git a/.github/workflows/release-canary.yml b/.github/workflows/release-canary.yml index 9f262a7262..d4a9dcc6fd 100644 --- a/.github/workflows/release-canary.yml +++ b/.github/workflows/release-canary.yml @@ -33,9 +33,9 @@ jobs: matrix: include: - arch: amd64 - runner: build-amd64 + runner: linux-amd64-cpu8 - arch: arm64 - runner: build-arm64 + runner: linux-arm64-cpu8 runs-on: ${{ matrix.runner }} timeout-minutes: 10 container: @@ -81,10 +81,10 @@ jobs: - two-step include: - arch: amd64 - runner: build-amd64 + runner: linux-amd64-cpu8 target: x86_64-unknown-linux-musl - arch: arm64 - runner: build-arm64 + runner: linux-arm64-cpu8 target: aarch64-unknown-linux-musl runs-on: ${{ matrix.runner }} timeout-minutes: 30 diff --git a/.github/workflows/release-dev.yml b/.github/workflows/release-dev.yml index 5563a67ebf..40fcdceefa 100644 --- a/.github/workflows/release-dev.yml +++ b/.github/workflows/release-dev.yml @@ -19,7 +19,7 @@ jobs: # --------------------------------------------------------------------------- compute-versions: name: Compute Versions - runs-on: build-amd64 + runs-on: linux-amd64-cpu8 timeout-minutes: 5 container: image: ghcr.io/nvidia/openshell/ci:latest @@ -75,12 +75,12 @@ jobs: uses: ./.github/workflows/e2e-test.yml with: image-tag: ${{ github.sha }} - runner: build-arm64 + runner: linux-arm64-cpu8 tag-ghcr-dev: name: Tag GHCR Images as Dev needs: [build-gateway, build-supervisor, build-cluster] - runs-on: build-amd64 + runs-on: linux-amd64-cpu8 timeout-minutes: 10 steps: - name: Log in to GHCR @@ -105,12 +105,12 @@ jobs: matrix: include: - arch: amd64 - runner: build-amd64 + runner: linux-amd64-cpu8 artifact: linux-amd64 task: python:build:linux:amd64 output_path: target/wheels/linux-amd64/*.whl - arch: arm64 - runner: build-arm64 + runner: linux-arm64-cpu8 artifact: linux-arm64 task: python:build:linux:arm64 output_path: target/wheels/linux-arm64/*.whl @@ -160,7 +160,7 @@ jobs: build-python-wheel-macos: name: Build Python Wheel (macOS) needs: [compute-versions] - runs-on: build-amd64 + runs-on: linux-amd64-cpu8 timeout-minutes: 120 container: image: ghcr.io/nvidia/openshell/ci:latest @@ -217,11 +217,11 @@ jobs: matrix: include: - arch: amd64 - runner: build-amd64 + runner: linux-amd64-cpu8 target: x86_64-unknown-linux-musl zig_target: x86_64-linux-musl - arch: arm64 - runner: build-arm64 + runner: linux-arm64-cpu8 target: aarch64-unknown-linux-musl zig_target: aarch64-linux-musl runs-on: ${{ matrix.runner }} @@ -325,7 +325,7 @@ jobs: build-cli-macos: name: Build CLI (macOS) needs: [compute-versions] - runs-on: build-amd64 + runs-on: linux-amd64-cpu8 timeout-minutes: 60 container: image: ghcr.io/nvidia/openshell/ci:latest @@ -392,10 +392,10 @@ jobs: matrix: include: - arch: amd64 - runner: build-amd64 + runner: linux-amd64-cpu8 target: x86_64-unknown-linux-gnu - arch: arm64 - runner: build-arm64 + runner: linux-arm64-cpu8 target: aarch64-unknown-linux-gnu runs-on: ${{ matrix.runner }} timeout-minutes: 60 @@ -472,7 +472,7 @@ jobs: build-gateway-binary-macos: name: Build Gateway Binary (macOS) needs: [compute-versions] - runs-on: build-amd64 + runs-on: linux-amd64-cpu8 timeout-minutes: 60 container: image: ghcr.io/nvidia/openshell/ci:latest @@ -543,10 +543,10 @@ jobs: matrix: include: - arch: amd64 - runner: build-amd64 + runner: linux-amd64-cpu8 target: x86_64-unknown-linux-gnu - arch: arm64 - runner: build-arm64 + runner: linux-arm64-cpu8 target: aarch64-unknown-linux-gnu runs-on: ${{ matrix.runner }} timeout-minutes: 60 @@ -642,7 +642,7 @@ jobs: release-dev: name: Release Dev needs: [compute-versions, build-cli-linux, build-cli-macos, build-gateway-binary-linux, build-gateway-binary-macos, build-supervisor-binary-linux, build-python-wheels-linux, build-python-wheel-macos, build-deb] - runs-on: build-amd64 + runs-on: linux-amd64-cpu8 timeout-minutes: 10 outputs: wheel_filenames: ${{ steps.wheel_filenames.outputs.wheel_filenames }} diff --git a/.github/workflows/release-tag.yml b/.github/workflows/release-tag.yml index 7df792cba2..6ccc055ae0 100644 --- a/.github/workflows/release-tag.yml +++ b/.github/workflows/release-tag.yml @@ -30,7 +30,7 @@ jobs: # --------------------------------------------------------------------------- compute-versions: name: Compute Versions - runs-on: build-amd64 + runs-on: linux-amd64-cpu8 timeout-minutes: 5 container: image: ghcr.io/nvidia/openshell/ci:latest @@ -90,12 +90,12 @@ jobs: uses: ./.github/workflows/e2e-test.yml with: image-tag: ${{ github.sha }} - runner: build-arm64 + runner: linux-arm64-cpu8 tag-ghcr-release: name: Tag GHCR Images for Release needs: [compute-versions, build-gateway, build-supervisor, build-cluster, e2e] - runs-on: build-amd64 + runs-on: linux-amd64-cpu8 timeout-minutes: 10 steps: - name: Log in to GHCR @@ -125,12 +125,12 @@ jobs: matrix: include: - arch: amd64 - runner: build-amd64 + runner: linux-amd64-cpu8 artifact: linux-amd64 task: python:build:linux:amd64 output_path: target/wheels/linux-amd64/*.whl - arch: arm64 - runner: build-arm64 + runner: linux-arm64-cpu8 artifact: linux-arm64 task: python:build:linux:arm64 output_path: target/wheels/linux-arm64/*.whl @@ -181,7 +181,7 @@ jobs: build-python-wheel-macos: name: Build Python Wheel (macOS) needs: [compute-versions] - runs-on: build-amd64 + runs-on: linux-amd64-cpu8 timeout-minutes: 120 container: image: ghcr.io/nvidia/openshell/ci:latest @@ -239,11 +239,11 @@ jobs: matrix: include: - arch: amd64 - runner: build-amd64 + runner: linux-amd64-cpu8 target: x86_64-unknown-linux-musl zig_target: x86_64-linux-musl - arch: arm64 - runner: build-arm64 + runner: linux-arm64-cpu8 target: aarch64-unknown-linux-musl zig_target: aarch64-linux-musl runs-on: ${{ matrix.runner }} @@ -348,7 +348,7 @@ jobs: build-cli-macos: name: Build CLI (macOS) needs: [compute-versions] - runs-on: build-amd64 + runs-on: linux-amd64-cpu8 timeout-minutes: 60 container: image: ghcr.io/nvidia/openshell/ci:latest @@ -416,10 +416,10 @@ jobs: matrix: include: - arch: amd64 - runner: build-amd64 + runner: linux-amd64-cpu8 target: x86_64-unknown-linux-gnu - arch: arm64 - runner: build-arm64 + runner: linux-arm64-cpu8 target: aarch64-unknown-linux-gnu runs-on: ${{ matrix.runner }} timeout-minutes: 60 @@ -501,10 +501,10 @@ jobs: matrix: include: - arch: amd64 - runner: build-amd64 + runner: linux-amd64-cpu8 target: x86_64-unknown-linux-gnu - arch: arm64 - runner: build-arm64 + runner: linux-arm64-cpu8 target: aarch64-unknown-linux-gnu runs-on: ${{ matrix.runner }} timeout-minutes: 60 @@ -582,7 +582,7 @@ jobs: build-gateway-binary-macos: name: Build Gateway Binary (macOS) needs: [compute-versions] - runs-on: build-amd64 + runs-on: linux-amd64-cpu8 timeout-minutes: 60 container: image: ghcr.io/nvidia/openshell/ci:latest @@ -669,7 +669,7 @@ jobs: release: name: Release needs: [compute-versions, build-cli-linux, build-cli-macos, build-gateway-binary-linux, build-gateway-binary-macos, build-supervisor-binary-linux, build-python-wheels-linux, build-python-wheel-macos, tag-ghcr-release, build-deb] - runs-on: build-amd64 + runs-on: linux-amd64-cpu8 timeout-minutes: 10 outputs: wheel_filenames: ${{ steps.wheel_filenames.outputs.wheel_filenames }} diff --git a/architecture/build-containers.md b/architecture/build-containers.md index a76c997323..fddbd45dd3 100644 --- a/architecture/build-containers.md +++ b/architecture/build-containers.md @@ -47,6 +47,7 @@ OpenShell also publishes Python wheels for `linux/amd64`, `linux/arm64`, and mac - There is no local Linux multiarch wheel build task. Release workflows own the per-arch Linux wheel production. - The macOS ARM64 wheel is cross-compiled with `deploy/docker/Dockerfile.python-wheels-macos` via `build:python:wheel:macos`. - Release workflows mirror the CLI layout: a Linux matrix job for amd64/arm64, a separate macOS job, and release jobs that download the per-platform wheel artifacts directly before publishing. +- Release CPU jobs run on `linux-amd64-cpu8` and `linux-arm64-cpu8`; the macOS wheel is still cross-compiled in Docker from the amd64 Linux runner. ## Sandbox Images diff --git a/architecture/ci-e2e.md b/architecture/ci-e2e.md index 2a43bfb9c9..6b86c5043c 100644 --- a/architecture/ci-e2e.md +++ b/architecture/ci-e2e.md @@ -32,6 +32,8 @@ OS-49 Phase 5 added non-required shadow workflows for the non-release workflows `branch-checks.yml` uses `pr-gate` without a required label. That still verifies the mirror SHA matches the source PR head SHA, but does not require a new GitHub label for ordinary required checks. `branch-e2e.yml` keeps the existing `test:e2e` gate because it publishes temporary images and runs the expensive E2E suite. `ci-image.yml` now builds amd64 and arm64 CI images natively on shared CPU runners and merges the multi-arch manifest after both per-arch images are pushed. +OS-49 Phase 7 moves the release-facing CPU jobs in `release-canary.yml`, `release-dev.yml`, and `release-tag.yml` to the same shared CPU labels. The release workflows also call `driver-vm-linux.yml` and `deb-package.yml`, so those reusable workers use the same labels to avoid retaining a hidden ARC dependency in the release path. `release-vm-dev.yml` and `release-vm-kernel.yml` remain on the old labels until the VM runtime decision is recorded for OS-131. + ## Trigger taxonomy Five GitHub Actions trigger types appear in this flow. Each one was chosen for a specific reason - they are not interchangeable. @@ -170,6 +172,8 @@ Only one workflow holds an "interesting" token: `rerun-on-completion` in `e2e-ga `release-tag.yml` and `release-dev.yml` call `e2e-test.yml` directly on `main` / tag pushes. Tags and `main` are inherently trusted refs, so they bypass copy-pr-bot. E2E still blocks the release jobs (`tag-ghcr-release: needs: [..., e2e]`). +The release CPU jobs run on `linux-amd64-cpu8` and `linux-arm64-cpu8`. GitHub-hosted docs publishing and the external wheel-publish bridge keep their existing runners. VM development release workflows are tracked separately because the managed platform capability decision is still open. + Permissions on the release workflows are not yet scoped per-job. Tracked separately. ## Edge cases