From 0851db779d498fd5e0297e439748b79c078c9048 Mon Sep 17 00:00:00 2001 From: Piotr Mlocek Date: Mon, 1 Jun 2026 11:12:51 -0700 Subject: [PATCH 1/2] ci(release): validate macos gateway z3 bundle --- .../workflows/tmp-gateway-macos-binary.yml | 55 +++++++++++++++++++ deploy/docker/Dockerfile.gateway-macos | 10 +++- 2 files changed, 62 insertions(+), 3 deletions(-) create mode 100644 .github/workflows/tmp-gateway-macos-binary.yml diff --git a/.github/workflows/tmp-gateway-macos-binary.yml b/.github/workflows/tmp-gateway-macos-binary.yml new file mode 100644 index 0000000000..e34b4e13bc --- /dev/null +++ b/.github/workflows/tmp-gateway-macos-binary.yml @@ -0,0 +1,55 @@ +# SPDX-FileCopyrightText: Copyright (c) 2025-2026 NVIDIA CORPORATION & AFFILIATES. All rights reserved. +# SPDX-License-Identifier: Apache-2.0 + +name: Temporary Gateway macOS Binary + +on: + push: + branches: + - fix/gateway-macos-bundled-z3 + workflow_dispatch: + +permissions: + contents: read + packages: read + +defaults: + run: + shell: bash + +jobs: + gateway-macos-binary: + name: Gateway Binary (macOS) + runs-on: linux-amd64-cpu8 + timeout-minutes: 60 + container: + image: ghcr.io/nvidia/openshell/ci:latest + credentials: + username: ${{ github.actor }} + password: ${{ secrets.GITHUB_TOKEN }} + options: --privileged + volumes: + - /var/run/docker.sock:/var/run/docker.sock + steps: + - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6 + with: + fetch-depth: 0 + + - name: Mark workspace safe for git + run: git config --global --add safe.directory "$GITHUB_WORKSPACE" + + - name: Set up Docker Buildx + uses: ./.github/actions/setup-buildx + + - name: Build macOS gateway binary + run: | + set -euo pipefail + docker buildx build \ + --file deploy/docker/Dockerfile.gateway-macos \ + --build-arg CARGO_TARGET_CACHE_SCOPE="${{ github.sha }}" \ + --target binary \ + --output type=local,dest=out/ \ + . + + - name: Verify binary + run: test -x out/openshell-gateway diff --git a/deploy/docker/Dockerfile.gateway-macos b/deploy/docker/Dockerfile.gateway-macos index 27d2ffbbaf..122f16eba8 100644 --- a/deploy/docker/Dockerfile.gateway-macos +++ b/deploy/docker/Dockerfile.gateway-macos @@ -55,22 +55,25 @@ COPY Cargo.toml Cargo.lock ./ COPY crates/openshell-core/Cargo.toml crates/openshell-core/Cargo.toml COPY crates/openshell-driver-kubernetes/Cargo.toml crates/openshell-driver-kubernetes/Cargo.toml COPY crates/openshell-policy/Cargo.toml crates/openshell-policy/Cargo.toml +COPY crates/openshell-prover/Cargo.toml crates/openshell-prover/Cargo.toml COPY crates/openshell-router/Cargo.toml crates/openshell-router/Cargo.toml COPY crates/openshell-server/Cargo.toml crates/openshell-server/Cargo.toml COPY crates/openshell-core/build.rs crates/openshell-core/build.rs COPY proto/ proto/ -RUN sed -i 's|members = \["crates/\*"\]|members = ["crates/openshell-server", "crates/openshell-core", "crates/openshell-driver-kubernetes", "crates/openshell-policy", "crates/openshell-router"]|' Cargo.toml +RUN sed -i 's|members = \["crates/\*"\]|members = ["crates/openshell-server", "crates/openshell-core", "crates/openshell-driver-kubernetes", "crates/openshell-policy", "crates/openshell-prover", "crates/openshell-router"]|' Cargo.toml RUN mkdir -p crates/openshell-core/src \ crates/openshell-driver-kubernetes/src \ crates/openshell-policy/src \ + crates/openshell-prover/src \ crates/openshell-router/src \ crates/openshell-server/src && \ touch crates/openshell-core/src/lib.rs && \ touch crates/openshell-driver-kubernetes/src/lib.rs && \ printf 'fn main() {}\n' > crates/openshell-driver-kubernetes/src/main.rs && \ touch crates/openshell-policy/src/lib.rs && \ + touch crates/openshell-prover/src/lib.rs && \ touch crates/openshell-router/src/lib.rs && \ touch crates/openshell-server/src/lib.rs && \ printf 'fn main() {}\n' > crates/openshell-server/src/main.rs @@ -78,7 +81,7 @@ RUN mkdir -p crates/openshell-core/src \ RUN --mount=type=cache,id=cargo-registry-gateway-macos,sharing=locked,target=/root/.cargo/registry \ --mount=type=cache,id=cargo-git-gateway-macos,sharing=locked,target=/root/.cargo/git \ --mount=type=cache,id=cargo-target-gateway-macos-${CARGO_TARGET_CACHE_SCOPE},sharing=locked,target=/build/target \ - cargo build --release --target aarch64-apple-darwin -p openshell-server 2>/dev/null || true + cargo build --release --target aarch64-apple-darwin -p openshell-server --features bundled-z3 2>/dev/null || true COPY crates/ crates/ COPY providers/ providers/ @@ -87,6 +90,7 @@ RUN touch crates/openshell-core/src/lib.rs \ crates/openshell-driver-kubernetes/src/lib.rs \ crates/openshell-driver-kubernetes/src/main.rs \ crates/openshell-policy/src/lib.rs \ + crates/openshell-prover/src/lib.rs \ crates/openshell-router/src/lib.rs \ crates/openshell-server/src/lib.rs \ crates/openshell-server/src/main.rs \ @@ -101,7 +105,7 @@ RUN --mount=type=cache,id=cargo-registry-gateway-macos,sharing=locked,target=/ro if [ -n "${OPENSHELL_CARGO_VERSION:-}" ]; then \ sed -i -E '/^\[workspace\.package\]/,/^\[/{s/^version[[:space:]]*=[[:space:]]*".*"/version = "'"${OPENSHELL_CARGO_VERSION}"'"/}' Cargo.toml; \ fi && \ - cargo build --release --target aarch64-apple-darwin -p openshell-server && \ + cargo build --release --target aarch64-apple-darwin -p openshell-server --features bundled-z3 && \ cp target/aarch64-apple-darwin/release/openshell-gateway /openshell-gateway FROM scratch AS binary From e4c662f3e0971ec3271d258feb866a9bf983701b Mon Sep 17 00:00:00 2001 From: Piotr Mlocek Date: Mon, 1 Jun 2026 11:30:19 -0700 Subject: [PATCH 2/2] ci(release): remove temporary macos gateway validation --- .../workflows/tmp-gateway-macos-binary.yml | 55 ------------------- 1 file changed, 55 deletions(-) delete mode 100644 .github/workflows/tmp-gateway-macos-binary.yml diff --git a/.github/workflows/tmp-gateway-macos-binary.yml b/.github/workflows/tmp-gateway-macos-binary.yml deleted file mode 100644 index e34b4e13bc..0000000000 --- a/.github/workflows/tmp-gateway-macos-binary.yml +++ /dev/null @@ -1,55 +0,0 @@ -# SPDX-FileCopyrightText: Copyright (c) 2025-2026 NVIDIA CORPORATION & AFFILIATES. All rights reserved. -# SPDX-License-Identifier: Apache-2.0 - -name: Temporary Gateway macOS Binary - -on: - push: - branches: - - fix/gateway-macos-bundled-z3 - workflow_dispatch: - -permissions: - contents: read - packages: read - -defaults: - run: - shell: bash - -jobs: - gateway-macos-binary: - name: Gateway Binary (macOS) - runs-on: linux-amd64-cpu8 - timeout-minutes: 60 - container: - image: ghcr.io/nvidia/openshell/ci:latest - credentials: - username: ${{ github.actor }} - password: ${{ secrets.GITHUB_TOKEN }} - options: --privileged - volumes: - - /var/run/docker.sock:/var/run/docker.sock - steps: - - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6 - with: - fetch-depth: 0 - - - name: Mark workspace safe for git - run: git config --global --add safe.directory "$GITHUB_WORKSPACE" - - - name: Set up Docker Buildx - uses: ./.github/actions/setup-buildx - - - name: Build macOS gateway binary - run: | - set -euo pipefail - docker buildx build \ - --file deploy/docker/Dockerfile.gateway-macos \ - --build-arg CARGO_TARGET_CACHE_SCOPE="${{ github.sha }}" \ - --target binary \ - --output type=local,dest=out/ \ - . - - - name: Verify binary - run: test -x out/openshell-gateway