docs: commit hero image. #340
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: CI | |
| on: | |
| push: | |
| branches: [main, "release/**"] | |
| pull_request: | |
| types: [opened, synchronize, reopened, ready_for_review, labeled, unlabeled] | |
| concurrency: | |
| group: ci-${{ github.workflow }}-${{ github.event.pull_request.number || github.ref }} | |
| cancel-in-progress: true | |
| permissions: | |
| contents: read | |
| env: | |
| REGISTRY: ghcr.io | |
| IMAGE_NAME: ${{ github.repository }} | |
| CI_MAIN_PUSH: ${{ github.event_name == 'push' && github.ref == 'refs/heads/main' }} | |
| jobs: | |
| preflight: | |
| name: preflight | |
| runs-on: ubuntu-latest | |
| steps: | |
| - uses: actions/checkout@v6 | |
| with: | |
| fetch-depth: 0 | |
| - uses: ./.github/actions/omnifs-just | |
| - uses: dtolnay/rust-toolchain@stable | |
| - name: Run preflight checks | |
| run: | | |
| set -euo pipefail | |
| just ci-preflight-fast | |
| just ci-preflight-policy | |
| - name: Check release metadata | |
| if: github.event_name == 'pull_request' && startsWith(github.head_ref, 'release/') | |
| run: | | |
| set -euo pipefail | |
| just release-check | |
| components: | |
| name: components | |
| runs-on: blacksmith-4vcpu-ubuntu-2404 | |
| permissions: | |
| contents: read | |
| id-token: write | |
| attestations: write | |
| steps: | |
| - uses: actions/checkout@v6 | |
| - uses: ./.github/actions/omnifs-just | |
| - uses: dtolnay/rust-toolchain@stable | |
| with: | |
| targets: wasm32-wasip2 | |
| - uses: Swatinem/rust-cache@v2 | |
| with: | |
| shared-key: components | |
| cache-on-failure: true | |
| - uses: taiki-e/install-action@v2 | |
| with: | |
| tool: wasm-tools@1.246.2 | |
| - name: Check, build, and validate WASM components | |
| run: just ci-wasm | |
| - name: Stage WASM components | |
| run: | | |
| set -euo pipefail | |
| mkdir -p dist-wasm | |
| cp target/wasm32-wasip2/release/*.wasm dist-wasm/ | |
| test -n "$(find dist-wasm -maxdepth 1 -name 'omnifs_provider_*.wasm' -print -quit)" | |
| test -f dist-wasm/omnifs_tool_archive.wasm | |
| test -f dist-wasm/test_provider.wasm | |
| - name: Attest WASM components | |
| if: env.CI_MAIN_PUSH == 'true' | |
| uses: actions/attest-build-provenance@v4 | |
| with: | |
| subject-path: dist-wasm/*.wasm | |
| - name: Upload WASM components | |
| uses: actions/upload-artifact@v7 | |
| with: | |
| name: omnifs-wasm | |
| path: dist-wasm/*.wasm | |
| retention-days: 90 | |
| if-no-files-found: error | |
| host-build: | |
| name: host build | |
| runs-on: blacksmith-4vcpu-ubuntu-2404 | |
| env: | |
| CARGO_INCREMENTAL: "0" | |
| CARGO_TARGET_DIR: ${{ github.workspace }}/target/host-build | |
| steps: | |
| - uses: actions/checkout@v6 | |
| - uses: ./.github/actions/omnifs-just | |
| - uses: dtolnay/rust-toolchain@stable | |
| - uses: Swatinem/rust-cache@v2 | |
| with: | |
| shared-key: host-build | |
| cache-on-failure: true | |
| - uses: taiki-e/install-action@v2 | |
| with: | |
| tool: nextest@0.9.132 | |
| - name: Lint and archive host tests | |
| run: just ci-host-build | |
| - name: Upload host test archive | |
| uses: actions/upload-artifact@v7 | |
| with: | |
| name: host-tests | |
| path: dist/host-tests/* | |
| retention-days: 1 | |
| if-no-files-found: error | |
| host-test: | |
| name: host test | |
| runs-on: blacksmith-4vcpu-ubuntu-2404 | |
| needs: [components, host-build] | |
| steps: | |
| - uses: actions/checkout@v6 | |
| - uses: ./.github/actions/omnifs-just | |
| - uses: dtolnay/rust-toolchain@stable | |
| - uses: taiki-e/install-action@v2 | |
| with: | |
| tool: nextest@0.9.132 | |
| - name: Download host test archive | |
| uses: actions/download-artifact@v8 | |
| with: | |
| name: host-tests | |
| path: dist/host-tests | |
| - name: Prepare WASM sidecar directory | |
| run: rm -rf target/wasm32-wasip2/release | |
| - name: Download WASM sidecar inputs | |
| uses: actions/download-artifact@v8 | |
| with: | |
| name: omnifs-wasm | |
| path: target/wasm32-wasip2/release | |
| - name: Cache wasmtime component compilations | |
| # Wasmtime's on-disk cache is internally content-addressed (WASM hash + | |
| # wasmtime version), so stale entries are harmless and won't be served | |
| # to mismatched callers. GitHub caches are immutable, so use a unique | |
| # write key but restore through a stable OS/arch namespace shared by | |
| # push and pull_request runs. | |
| uses: actions/cache@v5 | |
| with: | |
| path: ~/.cache/wasmtime | |
| key: wasmtime-cache-${{ runner.os }}-${{ runner.arch }}-${{ github.run_id }}-${{ github.run_attempt }} | |
| restore-keys: | | |
| wasmtime-cache-${{ runner.os }}-${{ runner.arch }}- | |
| wasmtime-cache-${{ runner.os }}- | |
| - name: Run host tests | |
| run: just ci-host-test | |
| cli-linux-x64: | |
| name: cli linux x64 | |
| if: >- | |
| github.event_name == 'push' || | |
| (github.event_name == 'pull_request' && | |
| (github.event.pull_request.user.login == 'raulk' || | |
| contains(github.event.pull_request.labels.*.name, 'ci-full'))) | |
| runs-on: blacksmith-4vcpu-ubuntu-2404 | |
| env: | |
| CARGO_INCREMENTAL: "0" | |
| CARGO_TARGET_DIR: ${{ github.workspace }}/target/cli-linux-x64 | |
| permissions: | |
| contents: read | |
| packages: read | |
| id-token: write | |
| attestations: write | |
| steps: | |
| - uses: actions/checkout@v6 | |
| - uses: ./.github/actions/omnifs-just | |
| - uses: ./.github/actions/omnifs-docker | |
| - uses: dtolnay/rust-toolchain@stable | |
| - uses: Swatinem/rust-cache@v2 | |
| with: | |
| shared-key: cli-linux-x64 | |
| cache-on-failure: true | |
| - uses: goto-bus-stop/setup-zig@v2 | |
| with: | |
| version: 0.15.2 | |
| - name: Build Linux x64 CLI | |
| id: build | |
| run: just ci-build-linux x86_64-unknown-linux-gnu.2.17 | |
| - name: Package Linux x64 CLI | |
| run: just ci-package-cli linux-x64 "${{ steps.build.outputs.artifact }}" | |
| - name: Attest Linux x64 CLI archive | |
| if: env.CI_MAIN_PUSH == 'true' | |
| uses: actions/attest-build-provenance@v4 | |
| with: | |
| subject-path: dist/cli/linux-x64/omnifs-cli-linux-x64.tar.xz | |
| - name: Upload Linux x64 CLI archive | |
| uses: actions/upload-artifact@v7 | |
| with: | |
| name: omnifs-cli-linux-x64 | |
| path: dist/cli/linux-x64/omnifs-cli-linux-x64.tar.xz* | |
| retention-days: 90 | |
| if-no-files-found: error | |
| cli-linux-arm64: | |
| name: cli linux arm64 | |
| if: >- | |
| github.event_name == 'push' || | |
| (github.event_name == 'pull_request' && | |
| (github.event.pull_request.user.login == 'raulk' || | |
| contains(github.event.pull_request.labels.*.name, 'ci-full'))) | |
| runs-on: blacksmith-4vcpu-ubuntu-2404-arm | |
| env: | |
| CARGO_INCREMENTAL: "0" | |
| CARGO_TARGET_DIR: ${{ github.workspace }}/target/cli-linux-arm64 | |
| permissions: | |
| contents: read | |
| id-token: write | |
| attestations: write | |
| steps: | |
| - uses: actions/checkout@v6 | |
| - uses: ./.github/actions/omnifs-just | |
| - uses: dtolnay/rust-toolchain@stable | |
| - uses: Swatinem/rust-cache@v2 | |
| with: | |
| shared-key: cli-linux-arm64 | |
| cache-on-failure: true | |
| - uses: goto-bus-stop/setup-zig@v2 | |
| with: | |
| version: 0.15.2 | |
| - name: Build Linux arm64 CLI | |
| id: build | |
| run: just ci-build-linux aarch64-unknown-linux-gnu.2.17 | |
| - name: Package Linux arm64 CLI | |
| run: just ci-package-cli linux-arm64 "${{ steps.build.outputs.artifact }}" | |
| - name: Attest Linux arm64 CLI archive | |
| if: env.CI_MAIN_PUSH == 'true' | |
| uses: actions/attest-build-provenance@v4 | |
| with: | |
| subject-path: dist/cli/linux-arm64/omnifs-cli-linux-arm64.tar.xz | |
| - name: Upload Linux arm64 CLI archive | |
| uses: actions/upload-artifact@v7 | |
| with: | |
| name: omnifs-cli-linux-arm64 | |
| path: dist/cli/linux-arm64/omnifs-cli-linux-arm64.tar.xz* | |
| retention-days: 90 | |
| if-no-files-found: error | |
| cli-darwin: | |
| name: cli darwin | |
| if: >- | |
| github.event_name == 'push' || | |
| (github.event_name == 'pull_request' && | |
| (github.event.pull_request.user.login == 'raulk' || | |
| contains(github.event.pull_request.labels.*.name, 'ci-full'))) | |
| runs-on: blacksmith-4vcpu-ubuntu-2404 | |
| env: | |
| CARGO_INCREMENTAL: "0" | |
| CARGO_TARGET_DIR: ${{ github.workspace }}/target/cli-darwin | |
| permissions: | |
| contents: read | |
| packages: read | |
| id-token: write | |
| attestations: write | |
| steps: | |
| - uses: actions/checkout@v6 | |
| - uses: ./.github/actions/omnifs-just | |
| - uses: ./.github/actions/omnifs-docker | |
| - uses: dtolnay/rust-toolchain@stable | |
| - uses: Swatinem/rust-cache@v2 | |
| with: | |
| shared-key: cli-darwin | |
| cache-on-failure: true | |
| cache-directories: .cache/darwin-rustup | |
| - name: Build Darwin CLI binaries | |
| id: build | |
| env: | |
| DARWIN_RUSTUP_HOME: ${{ github.workspace }}/.cache/darwin-rustup | |
| run: just ci-build-darwin | |
| - name: Package Darwin CLI archives | |
| run: | | |
| set -euo pipefail | |
| just ci-package-cli darwin-x64 "${{ steps.build.outputs.x64_artifact }}" | |
| just ci-package-cli darwin-arm64 "${{ steps.build.outputs.arm64_artifact }}" | |
| - name: Attest Darwin CLI archives | |
| if: env.CI_MAIN_PUSH == 'true' | |
| uses: actions/attest-build-provenance@v4 | |
| with: | |
| subject-path: dist/cli/*/omnifs-cli-*.tar.xz | |
| - name: Upload Darwin x64 CLI archive | |
| uses: actions/upload-artifact@v7 | |
| with: | |
| name: omnifs-cli-darwin-x64 | |
| path: dist/cli/darwin-x64/omnifs-cli-darwin-x64.tar.xz* | |
| retention-days: 90 | |
| if-no-files-found: error | |
| - name: Upload Darwin arm64 CLI archive | |
| uses: actions/upload-artifact@v7 | |
| with: | |
| name: omnifs-cli-darwin-arm64 | |
| path: dist/cli/darwin-arm64/omnifs-cli-darwin-arm64.tar.xz* | |
| retention-days: 90 | |
| if-no-files-found: error | |
| docker-amd64: | |
| name: docker amd64 | |
| if: >- | |
| github.event_name == 'push' || | |
| (github.event_name == 'pull_request' && | |
| (github.event.pull_request.user.login == 'raulk' || | |
| contains(github.event.pull_request.labels.*.name, 'ci-full'))) | |
| runs-on: ubuntu-latest | |
| needs: [components, cli-linux-x64] | |
| permissions: | |
| contents: read | |
| packages: write | |
| steps: | |
| - uses: actions/checkout@v6 | |
| - uses: ./.github/actions/omnifs-just | |
| - uses: ./.github/actions/omnifs-docker | |
| - name: Download WASM components | |
| uses: actions/download-artifact@v8 | |
| with: | |
| name: omnifs-wasm | |
| path: dist-wasm | |
| - name: Download Linux x64 CLI archive | |
| uses: actions/download-artifact@v8 | |
| with: | |
| name: omnifs-cli-linux-x64 | |
| path: dist-cli | |
| - name: Extract Linux x64 CLI binary | |
| run: | | |
| set -euo pipefail | |
| mkdir -p dist-cli/bin | |
| tar -C dist-cli/bin -xJf dist-cli/omnifs-cli-linux-x64.tar.xz | |
| test -x dist-cli/bin/omnifs | |
| - name: Build and push amd64 Docker image | |
| id: docker | |
| env: | |
| IMAGE: ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}:docker-amd64-${{ github.sha }} | |
| PLATFORM: linux/amd64 | |
| PUSH: "true" | |
| OMNIFS_BINARY: ${{ github.workspace }}/dist-cli/bin/omnifs | |
| OMNIFS_WASM_DIR: ${{ github.workspace }}/dist-wasm | |
| run: just ci-build-runtime | |
| - name: Export amd64 image digest | |
| run: | | |
| set -euo pipefail | |
| digest="${{ steps.docker.outputs.digest }}" | |
| test -n "$digest" | |
| mkdir -p /tmp/digests | |
| touch "/tmp/digests/${digest#sha256:}" | |
| - name: Upload amd64 image digest | |
| uses: actions/upload-artifact@v7 | |
| with: | |
| name: docker-digest-amd64 | |
| path: /tmp/digests/* | |
| if-no-files-found: error | |
| retention-days: 1 | |
| # The arm64 Docker build and smoke run on an arm64 runner so the image is | |
| # assembled and smoked natively. amd64 uses ubuntu-latest for lower queue time. | |
| docker-arm64: | |
| name: docker arm64 | |
| if: >- | |
| github.event_name == 'push' || | |
| (github.event_name == 'pull_request' && | |
| (github.event.pull_request.user.login == 'raulk' || | |
| contains(github.event.pull_request.labels.*.name, 'ci-full'))) | |
| runs-on: blacksmith-4vcpu-ubuntu-2404-arm | |
| needs: [components, cli-linux-arm64] | |
| permissions: | |
| contents: read | |
| packages: write | |
| steps: | |
| - uses: actions/checkout@v6 | |
| - uses: ./.github/actions/omnifs-just | |
| - uses: ./.github/actions/omnifs-docker | |
| - name: Download WASM components | |
| uses: actions/download-artifact@v8 | |
| with: | |
| name: omnifs-wasm | |
| path: dist-wasm | |
| - name: Download Linux arm64 CLI archive | |
| uses: actions/download-artifact@v8 | |
| with: | |
| name: omnifs-cli-linux-arm64 | |
| path: dist-cli | |
| - name: Extract Linux arm64 CLI binary | |
| run: | | |
| set -euo pipefail | |
| mkdir -p dist-cli/bin | |
| tar -C dist-cli/bin -xJf dist-cli/omnifs-cli-linux-arm64.tar.xz | |
| test -x dist-cli/bin/omnifs | |
| - name: Build and push arm64 Docker image | |
| id: docker | |
| env: | |
| IMAGE: ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}:docker-arm64-${{ github.sha }} | |
| PLATFORM: linux/arm64 | |
| PUSH: "true" | |
| OMNIFS_BINARY: ${{ github.workspace }}/dist-cli/bin/omnifs | |
| OMNIFS_WASM_DIR: ${{ github.workspace }}/dist-wasm | |
| run: just ci-build-runtime | |
| - name: Export arm64 image digest | |
| run: | | |
| set -euo pipefail | |
| digest="${{ steps.docker.outputs.digest }}" | |
| test -n "$digest" | |
| mkdir -p /tmp/digests | |
| touch "/tmp/digests/${digest#sha256:}" | |
| - name: Upload arm64 image digest | |
| uses: actions/upload-artifact@v7 | |
| with: | |
| name: docker-digest-arm64 | |
| path: /tmp/digests/* | |
| if-no-files-found: error | |
| retention-days: 1 | |
| smoke-amd64: | |
| name: smoke amd64 | |
| if: >- | |
| github.event_name == 'push' || | |
| (github.event_name == 'pull_request' && | |
| (github.event.pull_request.user.login == 'raulk' || | |
| contains(github.event.pull_request.labels.*.name, 'ci-full'))) | |
| runs-on: ubuntu-latest | |
| needs: docker-amd64 | |
| timeout-minutes: 30 | |
| permissions: | |
| contents: read | |
| packages: read | |
| env: | |
| CONTAINER: omnifs | |
| IMAGE: ghcr.io/${{ github.repository }}:smoke | |
| steps: | |
| - uses: actions/checkout@v6 | |
| - uses: ./.github/actions/omnifs-just | |
| - uses: ./.github/actions/omnifs-docker | |
| - name: Download amd64 image digest | |
| uses: actions/download-artifact@v8 | |
| with: | |
| name: docker-digest-amd64 | |
| path: /tmp/digests | |
| - name: Pull the amd64 image and tag it for smoke | |
| run: | | |
| set -euo pipefail | |
| digest_path=$(find /tmp/digests -mindepth 1 -maxdepth 1 -type f | head -n 1) | |
| test -n "$digest_path" | |
| digest_file="${digest_path##*/}" | |
| ref="${REGISTRY}/${IMAGE_NAME}@sha256:${digest_file}" | |
| docker pull "$ref" | |
| docker tag "$ref" "$IMAGE" | |
| - name: Run container smoke test | |
| env: | |
| GITHUB_TOKEN: ${{ github.token }} | |
| run: just ci-smoke-container | |
| smoke-arm64: | |
| name: smoke arm64 | |
| if: >- | |
| github.event_name == 'push' || | |
| (github.event_name == 'pull_request' && | |
| (github.event.pull_request.user.login == 'raulk' || | |
| contains(github.event.pull_request.labels.*.name, 'ci-full'))) | |
| runs-on: blacksmith-4vcpu-ubuntu-2404-arm | |
| needs: docker-arm64 | |
| timeout-minutes: 30 | |
| permissions: | |
| contents: read | |
| packages: read | |
| env: | |
| CONTAINER: omnifs | |
| IMAGE: ghcr.io/${{ github.repository }}:smoke | |
| steps: | |
| - uses: actions/checkout@v6 | |
| - uses: ./.github/actions/omnifs-just | |
| - uses: ./.github/actions/omnifs-docker | |
| - name: Download arm64 image digest | |
| uses: actions/download-artifact@v8 | |
| with: | |
| name: docker-digest-arm64 | |
| path: /tmp/digests | |
| - name: Pull the arm64 image and tag it for smoke | |
| run: | | |
| set -euo pipefail | |
| digest_path=$(find /tmp/digests -mindepth 1 -maxdepth 1 -type f | head -n 1) | |
| test -n "$digest_path" | |
| digest_file="${digest_path##*/}" | |
| ref="${REGISTRY}/${IMAGE_NAME}@sha256:${digest_file}" | |
| docker pull "$ref" | |
| docker tag "$ref" "$IMAGE" | |
| - name: Run container smoke test | |
| env: | |
| GITHUB_TOKEN: ${{ github.token }} | |
| run: just ci-smoke-container | |
| publish: | |
| name: publish | |
| if: github.event_name == 'push' && github.ref == 'refs/heads/main' | |
| runs-on: ubuntu-latest | |
| needs: | |
| - preflight | |
| - components | |
| - host-build | |
| - host-test | |
| - cli-linux-x64 | |
| - cli-linux-arm64 | |
| - cli-darwin | |
| - docker-amd64 | |
| - docker-arm64 | |
| - smoke-amd64 | |
| - smoke-arm64 | |
| permissions: | |
| contents: read | |
| packages: write | |
| steps: | |
| - uses: actions/checkout@v6 | |
| - uses: ./.github/actions/omnifs-docker | |
| - name: Download image digests | |
| uses: actions/download-artifact@v8 | |
| with: | |
| pattern: docker-digest-* | |
| path: /tmp/digests | |
| merge-multiple: true | |
| - name: Publish multi-platform manifest | |
| run: | | |
| set -euo pipefail | |
| refs=() | |
| for digest_file in /tmp/digests/*; do | |
| digest="${digest_file##*/}" | |
| refs+=("${REGISTRY}/${IMAGE_NAME}@sha256:${digest}") | |
| done | |
| test "${#refs[@]}" -ge 2 | |
| tag="${REGISTRY}/${IMAGE_NAME}:sha-${GITHUB_SHA}" | |
| docker buildx imagetools create -t "$tag" "${refs[@]}" | |
| docker buildx imagetools inspect "$tag" > manifest.txt | |
| grep -q 'Platform:.*linux/amd64' manifest.txt | |
| grep -q 'Platform:.*linux/arm64' manifest.txt | |
| awk '/^Digest:/ { print $2; exit }' manifest.txt > manifest-digest.txt | |
| - name: Upload manifest digest | |
| uses: actions/upload-artifact@v7 | |
| with: | |
| name: docker-manifest-digest | |
| path: | | |
| manifest.txt | |
| manifest-digest.txt | |
| retention-days: 90 | |
| if-no-files-found: error |