From 8d800d51d34a674d4c17c4075575269217dd8f03 Mon Sep 17 00:00:00 2001 From: Simon Scatton Date: Fri, 21 Aug 2026 15:38:36 +0200 Subject: [PATCH 1/8] feat(nix): add glibc 2.28 development shell --- Cargo.lock | 9 +- flake.lock | 12 +-- flake.nix | 40 +++++---- nix/devShells/glibc-2-28.nix | 40 +++++++++ nix/pkgs/aws-lc-static.nix | 10 +++ nix/pkgs/z3-static.nix | 12 +++ nix/toolchains/linux-gnu-2.28/default.nix | 103 ++++++++++++++++++++++ nix/toolchains/linux-gnu-2.28/libc.nix | 64 ++++++++++++++ 8 files changed, 263 insertions(+), 27 deletions(-) create mode 100644 nix/devShells/glibc-2-28.nix create mode 100644 nix/pkgs/aws-lc-static.nix create mode 100644 nix/pkgs/z3-static.nix create mode 100644 nix/toolchains/linux-gnu-2.28/default.nix create mode 100644 nix/toolchains/linux-gnu-2.28/libc.nix diff --git a/Cargo.lock b/Cargo.lock index a9eee33af9..4a513f2ff9 100644 --- a/Cargo.lock +++ b/Cargo.lock @@ -299,9 +299,9 @@ dependencies = [ [[package]] name = "aws-lc-rs" -version = "1.16.3" +version = "1.18.0" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "0ec6fb3fe69024a75fa7e1bfb48aa6cf59706a101658ea01bfd33b2b248a038f" +checksum = "ce2b2dcc879c3bae0d371e77c99f2238400ef24ec001394befa67b6e543add9e" dependencies = [ "aws-lc-sys", "untrusted 0.7.1", @@ -310,14 +310,15 @@ dependencies = [ [[package]] name = "aws-lc-sys" -version = "0.40.0" +version = "0.44.0" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "f50037ee5e1e41e7b8f9d161680a725bd1626cb6f8c7e901f91f942850852fe7" +checksum = "f09fae7be8bb3174e05c6afdb34199e6dc0c7c04ba9fa237b1967adfbde27483" dependencies = [ "cc", "cmake", "dunce", "fs_extra", + "pkg-config", ] [[package]] diff --git a/flake.lock b/flake.lock index 48aa4dfd8b..746d9b48a4 100644 --- a/flake.lock +++ b/flake.lock @@ -20,11 +20,11 @@ }, "nixpkgs": { "locked": { - "lastModified": 1785318670, - "narHash": "sha256-dN6Ou5x/+23FZLEpYP3IffO+NyJFzUlGumt1uu3MMaY=", + "lastModified": 1787135253, + "narHash": "sha256-RD2kNWCG+Bjo6h+JVjWVNntZs2GtRoeY2xHjts/FNkA=", "owner": "NixOS", "repo": "nixpkgs", - "rev": "0954f7ee2f6bb3dc7d4e3d0d8bcb8fd4bde4cfc5", + "rev": "ffb3c9b700e759be2ef13237c9d8f953b32a1e46", "type": "github" }, "original": { @@ -49,11 +49,11 @@ ] }, "locked": { - "lastModified": 1785476452, - "narHash": "sha256-/CXwCFPS41rb/JI2VitKCgVK6V5E6/sfw5ke3B9zyVQ=", + "lastModified": 1787281715, + "narHash": "sha256-5yIL5XL31hCZBPWDdUOvUy4cYAl27XZrke7JELhHlnI=", "owner": "oxalica", "repo": "rust-overlay", - "rev": "6ef009bf4c4873cdc1a621826722bdea7c03e62c", + "rev": "89abdfd661ea493cde2f73d7b1332cb34150aa43", "type": "github" }, "original": { diff --git a/flake.nix b/flake.nix index a95a3472fa..c420ff0e1f 100644 --- a/flake.nix +++ b/flake.nix @@ -33,34 +33,40 @@ inherit system; overlays = [ (import rust-overlay) ]; }; + commonDevShellPackages = with pkgs; [ + # Assemble Debian artifacts on macOS and Linux. + dpkg + # Required to find packages. + pkg-config + # Coverage. + lcov + ]; treefmtEval = treefmt-nix.lib.evalModule pkgs { projectRootFile = "flake.nix"; programs.nixfmt.enable = true; }; rustToolchain = pkgs.rust-bin.fromRustupToolchainFile ./rust-toolchain.toml; + z3-static = pkgs.callPackage ./nix/pkgs/z3-static.nix { }; + aws-lc-static = pkgs.callPackage ./nix/pkgs/aws-lc-static.nix { }; testGuest = import ./nix/test-guest { inherit pkgs; }; in { apps.test-guest = testGuest.app; apps.test-guest-cache = testGuest.cacheApp; - devShells.default = pkgs.mkShell { - packages = with pkgs; [ - rustToolchain - # Assemble Debian artifacts on macOS and Linux. - dpkg - # Required to find packages - pkg-config - # Required for bindgen generation. - llvmPackages.libclang - # system dependency for openshell-prover - z3 - # Coverage - lcov - ]; - - env = { - LIBCLANG_PATH = "${pkgs.llvmPackages.libclang.lib}/lib"; + devShells = { + default = pkgs.mkShell { + packages = [ + rustToolchain + z3-static + aws-lc-static + ] + ++ commonDevShellPackages; + }; + } + // pkgs.lib.optionalAttrs pkgs.stdenv.hostPlatform.isLinux { + glibc-2-28 = import ./nix/devShells/glibc-2-28.nix { + inherit pkgs rust-overlay commonDevShellPackages; }; }; diff --git a/nix/devShells/glibc-2-28.nix b/nix/devShells/glibc-2-28.nix new file mode 100644 index 0000000000..1bba2ef637 --- /dev/null +++ b/nix/devShells/glibc-2-28.nix @@ -0,0 +1,40 @@ +# SPDX-FileCopyrightText: Copyright (c) 2025-2026 NVIDIA CORPORATION & AFFILIATES. All rights reserved. +# SPDX-License-Identifier: Apache-2.0 + +{ + pkgs, + rust-overlay, + commonDevShellPackages, +}: + +let + toolchain = import ../toolchains/linux-gnu-2.28 { inherit pkgs; }; + z3-static = pkgs.callPackage ../pkgs/z3-static.nix { + stdenv = toolchain.stdenv; + }; + aws-lc-static = pkgs.callPackage ../pkgs/aws-lc-static.nix { + stdenv = toolchain.stdenv; + }; + rustScope = { + stdenv = toolchain.stdenv; + gccForLibs.lib = toolchain.sharedRuntime; + pkgsTargetTarget = pkgs.pkgsTargetTarget // { + stdenv = toolchain.stdenv; + }; + }; + rust-bin = rust-overlay.lib.mkRustBin { } ( + pkgs + // rustScope + // { + callPackage = pkgs.newScope rustScope; + } + ); +in +(pkgs.mkShell.override { stdenv = toolchain.stdenv; }) { + packages = [ + (rust-bin.fromRustupToolchainFile ../../rust-toolchain.toml) + z3-static + aws-lc-static + ] + ++ commonDevShellPackages; +} diff --git a/nix/pkgs/aws-lc-static.nix b/nix/pkgs/aws-lc-static.nix new file mode 100644 index 0000000000..e128ea26ec --- /dev/null +++ b/nix/pkgs/aws-lc-static.nix @@ -0,0 +1,10 @@ +# SPDX-FileCopyrightText: Copyright (c) 2025-2026 NVIDIA CORPORATION & AFFILIATES. All rights reserved. +# SPDX-License-Identifier: Apache-2.0 + +{ aws-lc, stdenv }: + +aws-lc.override { + inherit stdenv; + useSharedLibraries = false; + withRustBindings = true; +} diff --git a/nix/pkgs/z3-static.nix b/nix/pkgs/z3-static.nix new file mode 100644 index 0000000000..f58c36920c --- /dev/null +++ b/nix/pkgs/z3-static.nix @@ -0,0 +1,12 @@ +# SPDX-FileCopyrightText: Copyright (c) 2025-2026 NVIDIA CORPORATION & AFFILIATES. All rights reserved. +# SPDX-License-Identifier: Apache-2.0 + +{ z3, stdenv }: + +(z3.override { + inherit stdenv; + pythonBindings = false; +}).overrideAttrs + (old: { + cmakeFlags = old.cmakeFlags ++ [ "-DZ3_BUILD_LIBZ3_SHARED=OFF" ]; + }) diff --git a/nix/toolchains/linux-gnu-2.28/default.nix b/nix/toolchains/linux-gnu-2.28/default.nix new file mode 100644 index 0000000000..3e911f1ced --- /dev/null +++ b/nix/toolchains/linux-gnu-2.28/default.nix @@ -0,0 +1,103 @@ +# SPDX-FileCopyrightText: Copyright (c) 2025-2026 NVIDIA CORPORATION & AFFILIATES. All rights reserved. +# SPDX-License-Identifier: Apache-2.0 + +{ pkgs }: + +let + glibc = pkgs.callPackage ./libc.nix { }; + mkStdenv = + { + libraryPaths ? [ ], + ldflags ? null, + }: + let + runtime = pkgs.buildEnv { + name = "gcc-static-runtime"; + paths = libraryPaths ++ map pkgs.lib.getDev libraryPaths; + pathsToLink = [ + "/include" + "/include-cxx" + "/lib" + ]; + postBuild = '' + mkdir -p $out/lib + find $out/lib -type l ! \( -name '*.a' -o -name 'crt*.o' \) -delete + printf 'GROUP ( libgcc.a libgcc_eh.a )\n' > $out/lib/libgcc_s.a + ''; + passthru.isGNU = true; + }; + in + pkgs.stdenvAdapters.useMoldLinker ( + pkgs.overrideCC pkgs.stdenv ( + pkgs.wrapCCWith { + cc = pkgs.gccNGPackages.gcc-unwrapped.overrideAttrs (old: { + configureFlags = old.configureFlags ++ [ "--disable-fixincludes" ]; + }); + bintools = pkgs.wrapBintoolsWith { + bintools = pkgs.binutils-unwrapped; + libc = glibc; + }; + extraPackages = [ runtime ]; + libcxx = runtime; + nixSupport = { + cc-cflags = [ + "-isystem${pkgs.linuxHeaders}/include" + "-static-libgcc" + "-B${runtime}/lib" + ]; + } + // pkgs.lib.optionalAttrs (ldflags != null) { cc-ldflags = ldflags; }; + } + ) + ); + libgcc = + (pkgs.gccNGPackages.libgcc.override { + stdenv = mkStdenv { }; + }).overrideAttrs + (old: { + makeFlags = old.makeFlags ++ [ "SHLIB_LC=-lc" ]; + }); + libssp = + (pkgs.gccNGPackages.libssp.override { + stdenv = mkStdenv { libraryPaths = [ libgcc ]; }; + }).overrideAttrs + { + dontDisableStatic = true; + }; + libstdcxxStdenv = mkStdenv { + libraryPaths = [ + libgcc + libssp + ]; + }; + libstdcxx = + (pkgs.gccNGPackages.libstdcxx.override { + stdenv = libstdcxxStdenv; + inherit libgcc; + libbacktrace = pkgs.libbacktrace.override { + stdenv = libstdcxxStdenv; + }; + }).overrideAttrs + { + dontDisableStatic = true; + }; + sharedRuntime = pkgs.buildEnv { + name = "gcc-shared-runtime"; + paths = [ + libgcc + libstdcxx + ]; + pathsToLink = [ "/lib" ]; + }; + stdenv = mkStdenv { + libraryPaths = [ + libgcc + libssp + libstdcxx + ]; + ldflags = [ "-lssp" ]; + }; +in +{ + inherit sharedRuntime stdenv; +} diff --git a/nix/toolchains/linux-gnu-2.28/libc.nix b/nix/toolchains/linux-gnu-2.28/libc.nix new file mode 100644 index 0000000000..8f1c9864bd --- /dev/null +++ b/nix/toolchains/linux-gnu-2.28/libc.nix @@ -0,0 +1,64 @@ +# SPDX-FileCopyrightText: Copyright (c) 2025-2026 NVIDIA CORPORATION & AFFILIATES. All rights reserved. +# SPDX-License-Identifier: Apache-2.0 + +{ + stdenv, + fetchurl, + linuxHeaders, + bison, + gawk, + python3, +}: + +stdenv.mkDerivation { + pname = "glibc"; + version = "2.28"; + enableParallelBuilding = true; + hardeningDisable = [ + "fortify" + "pic" + ]; + + src = fetchurl { + url = "https://ftp.gnu.org/gnu/glibc/glibc-2.28.tar.gz"; + hash = "sha256-8xjW4/H07Qt00oMqxPSR0PuSjkUcntpZTL8cO+569Hw="; + }; + + postPatch = '' + substituteInPlace sysdeps/gnu/Makefile \ + --replace-fail \ + '$(object-suffixes) $(object-suffixes:=.d)' \ + '$(object-suffixes)' + ''; + + nativeBuildInputs = [ + bison + gawk + python3 + ]; + + configureFlags = [ + "--with-headers=${linuxHeaders}/include" + "--disable-werror" + ]; + + preConfigure = '' + mkdir build + cd build + configureScript=../configure + ''; + + postConfigure = '' + export NIX_DONT_SET_RPATH=1 + ''; + + postFixup = '' + if grep -q "$out/lib64/" "$out/bin/ldd"; then + substituteInPlace "$out/bin/ldd" \ + --replace-fail "$out/lib64/" "$out/lib/" + fi + ''; + + env.NIX_NO_SELF_RPATH = true; + passthru.threadModel = "posix"; +} From 7f4c0d66d1f454fedfbd4516a01f710f1b9dc446 Mon Sep 17 00:00:00 2001 From: Simon Scatton Date: Fri, 21 Aug 2026 16:51:27 +0200 Subject: [PATCH 2/8] feat(nix): add musl development shell --- flake.nix | 3 +++ nix/devShells/musl.nix | 26 ++++++++++++++++++++++++++ nix/pkgs/aws-lc-static.nix | 8 ++++++-- 3 files changed, 35 insertions(+), 2 deletions(-) create mode 100644 nix/devShells/musl.nix diff --git a/flake.nix b/flake.nix index c420ff0e1f..732826cc61 100644 --- a/flake.nix +++ b/flake.nix @@ -68,6 +68,9 @@ glibc-2-28 = import ./nix/devShells/glibc-2-28.nix { inherit pkgs rust-overlay commonDevShellPackages; }; + musl = import ./nix/devShells/musl.nix { + inherit pkgs rust-overlay commonDevShellPackages; + }; }; formatter = treefmtEval.config.build.wrapper; diff --git a/nix/devShells/musl.nix b/nix/devShells/musl.nix new file mode 100644 index 0000000000..b5c57aaf56 --- /dev/null +++ b/nix/devShells/musl.nix @@ -0,0 +1,26 @@ +# SPDX-FileCopyrightText: Copyright (c) 2025-2026 NVIDIA CORPORATION & AFFILIATES. All rights reserved. +# SPDX-License-Identifier: Apache-2.0 + +{ + pkgs, + rust-overlay, + commonDevShellPackages, +}: + +let + muslPkgs = pkgs.pkgsMusl; + rust-bin = rust-overlay.lib.mkRustBin { } muslPkgs; + rustToolchain = (rust-bin.fromRustupToolchainFile ../../rust-toolchain.toml).override { + enableLibsecret = false; + }; +in +muslPkgs.mkShell { + packages = [ + rustToolchain + (muslPkgs.callPackage ../pkgs/z3-static.nix { }) + (muslPkgs.callPackage ../pkgs/aws-lc-static.nix { + rust-bindgen = pkgs.rust-bindgen; + }) + ] + ++ commonDevShellPackages; +} diff --git a/nix/pkgs/aws-lc-static.nix b/nix/pkgs/aws-lc-static.nix index e128ea26ec..45fd5ad174 100644 --- a/nix/pkgs/aws-lc-static.nix +++ b/nix/pkgs/aws-lc-static.nix @@ -1,10 +1,14 @@ # SPDX-FileCopyrightText: Copyright (c) 2025-2026 NVIDIA CORPORATION & AFFILIATES. All rights reserved. # SPDX-License-Identifier: Apache-2.0 -{ aws-lc, stdenv }: +{ + aws-lc, + rust-bindgen, + stdenv, +}: aws-lc.override { - inherit stdenv; + inherit stdenv rust-bindgen; useSharedLibraries = false; withRustBindings = true; } From aa0473cb803c396caffc782928b9eec495c4042e Mon Sep 17 00:00:00 2001 From: Simon Scatton Date: Fri, 21 Aug 2026 17:05:22 +0200 Subject: [PATCH 3/8] feat(build): use mold in musl development shell --- nix/devShells/musl.nix | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/nix/devShells/musl.nix b/nix/devShells/musl.nix index b5c57aaf56..ba7c06bf22 100644 --- a/nix/devShells/musl.nix +++ b/nix/devShells/musl.nix @@ -9,12 +9,13 @@ let muslPkgs = pkgs.pkgsMusl; + stdenv = pkgs.stdenvAdapters.useMoldLinker muslPkgs.stdenv; rust-bin = rust-overlay.lib.mkRustBin { } muslPkgs; rustToolchain = (rust-bin.fromRustupToolchainFile ../../rust-toolchain.toml).override { enableLibsecret = false; }; in -muslPkgs.mkShell { +(muslPkgs.mkShell.override { inherit stdenv; }) { packages = [ rustToolchain (muslPkgs.callPackage ../pkgs/z3-static.nix { }) From fb596bfc2bf2c529848b9fa44632318ca691752f Mon Sep 17 00:00:00 2001 From: Simon Scatton Date: Fri, 21 Aug 2026 17:25:02 +0200 Subject: [PATCH 4/8] feat(flake): add nix remote cache --- flake.nix | 7 +++++++ 1 file changed, 7 insertions(+) diff --git a/flake.nix b/flake.nix index 732826cc61..2d72e74941 100644 --- a/flake.nix +++ b/flake.nix @@ -4,6 +4,13 @@ { description = "OpenShell development environment"; + nixConfig = { + extra-substituters = [ "https://openshell.cachix.org" ]; + extra-trusted-public-keys = [ + "openshell.cachix.org-1:OAr5MunsfH5PZvUsfD08OtGx5RtcwdNZGJdU5FqLm5w=" + ]; + }; + inputs = { flake-utils.url = "github:numtide/flake-utils"; nixpkgs.url = "github:NixOS/nixpkgs/nixos-unstable"; From ab36c09a5d2b167ffe90d9fc00fc8ae56fac5ee1 Mon Sep 17 00:00:00 2001 From: Simon Scatton Date: Fri, 21 Aug 2026 17:50:50 +0200 Subject: [PATCH 5/8] feat(build): use mold in default development shell --- flake.nix | 24 ++++++++++++++++-------- 1 file changed, 16 insertions(+), 8 deletions(-) diff --git a/flake.nix b/flake.nix index 2d72e74941..ec21dd3b8b 100644 --- a/flake.nix +++ b/flake.nix @@ -62,14 +62,22 @@ apps.test-guest-cache = testGuest.cacheApp; devShells = { - default = pkgs.mkShell { - packages = [ - rustToolchain - z3-static - aws-lc-static - ] - ++ commonDevShellPackages; - }; + default = + (pkgs.mkShell.override { + stdenv = + if pkgs.stdenv.hostPlatform.isLinux then + pkgs.stdenvAdapters.useMoldLinker pkgs.stdenv + else + pkgs.stdenv; + }) + { + packages = [ + rustToolchain + z3-static + aws-lc-static + ] + ++ commonDevShellPackages; + }; } // pkgs.lib.optionalAttrs pkgs.stdenv.hostPlatform.isLinux { glibc-2-28 = import ./nix/devShells/glibc-2-28.nix { From 4ba4318153b9917aa1fc3676ecdea7df531616c4 Mon Sep 17 00:00:00 2001 From: Simon Scatton Date: Fri, 21 Aug 2026 17:38:53 +0200 Subject: [PATCH 6/8] ci(branch-checks): run Rust checks in Nix shells --- .github/workflows/branch-checks.yml | 121 +++++++++------------------- 1 file changed, 38 insertions(+), 83 deletions(-) diff --git a/.github/workflows/branch-checks.yml b/.github/workflows/branch-checks.yml index bece5c8825..a3e2aa45bb 100644 --- a/.github/workflows/branch-checks.yml +++ b/.github/workflows/branch-checks.yml @@ -99,114 +99,69 @@ jobs: run: mise run rust:deny:policy rust: - name: Rust (${{ matrix.runner }}) + name: Rust (${{ matrix.system }}) needs: pr_metadata if: needs.pr_metadata.outputs.should_run == 'true' strategy: fail-fast: false matrix: - runner: [linux-amd64-cpu8, linux-arm64-cpu8] + include: + - runner: linux-amd64-cpu8 + system: x86_64-linux + - runner: linux-arm64-cpu8 + system: aarch64-linux + - runner: macos-latest + system: aarch64-darwin runs-on: ${{ matrix.runner }} - env: - SCCACHE_GHA_ENABLED: "true" - SCCACHE_GHA_VERSION: branch-checks-rust-${{ matrix.runner }} - container: - image: ghcr.io/nvidia/openshell/ci:latest - credentials: - username: ${{ github.actor }} - password: ${{ secrets.GITHUB_TOKEN }} + defaults: + run: + shell: nix develop .#devShells.${{ matrix.system }}.default -c bash -euo pipefail {0} steps: - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 - - name: Configure GHA sccache backend - uses: mozilla-actions/sccache-action@9e7fa8a12102821edf02ca5dbea1acd0f89a2696 # v0.0.10 + - uses: cachix/install-nix-action@13d8dd58da0234aa297dedd986986ccb8e7f3e24 # v31.11.1 + with: + github_access_token: ${{ secrets.GITHUB_TOKEN }} - - name: Install tools - run: mise install --locked + - uses: cachix/cachix-action@5f2d7c5294214f71b873db4b969586b980625e71 # v17 + with: + name: openshell + authToken: ${{ secrets.CACHIX_AUTH_TOKEN }} + + - name: Realize Nix development shell + shell: bash + run: nix build --no-link ".#devShells.${{ matrix.system }}.default" - name: Cache Rust target and registry uses: Swatinem/rust-cache@6323deb102c322ba6fcbdcafc7e3dddab59af2b6 # v2.9.2 with: - # Keep branch-check caches partitioned by runner architecture; lint + # Keep branch-check caches partitioned by target system; lint # and test intentionally share the same job-local target directory. - shared-key: rust-checks-${{ matrix.runner }} + shared-key: rust-checks-${{ matrix.system }} # Preserve compiled artifacts from failed lint/test runs so the next # push to the same PR branch does not start from a cold cache. cache-on-failure: "true" + cache-bin: "false" + cmd-format: nix develop .#devShells.${{ matrix.system }}.default -c {0} - name: Format - run: mise run rust:format:check - - - name: Lint - run: mise run rust:lint - - - name: Test - run: mise run test:rust - - - name: Verify telemetry can be compiled out - run: mise run rust:verify:telemetry-off - - - name: Verify system CA roots build mode compiles and excludes bundled Mozilla roots - run: mise run rust:verify:system-ca-roots - - - name: sccache stats - if: always() run: | - set +e - stats_bin="${SCCACHE_PATH:-sccache}" - "$stats_bin" --show-stats - status=$? - if [ "$status" -ne 0 ]; then - echo "::warning::sccache stats unavailable (exit $status)" - fi - exit 0 - - rust-macos: - name: Rust lint (macOS) - needs: pr_metadata - if: needs.pr_metadata.outputs.should_run == 'true' - runs-on: macos-latest - timeout-minutes: 20 - steps: - - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 - - - name: Install mise - run: | - curl --proto '=https' --tlsv1.2 -sSf https://mise.run | MISE_VERSION=v2026.4.25 sh - echo "$HOME/.local/bin" >> "$GITHUB_PATH" - echo "$HOME/.local/share/mise/shims" >> "$GITHUB_PATH" - - - name: Configure GHA sccache backend - uses: mozilla-actions/sccache-action@9e7fa8a12102821edf02ca5dbea1acd0f89a2696 # v0.0.10 + cargo fmt --all -- --check + cargo fmt --manifest-path e2e/rust/Cargo.toml --all -- --check + cargo fmt --manifest-path examples/governance-interceptor/Cargo.toml --all -- --check - - name: Install Rust and Clippy + - name: Lint run: | - mise install --locked rust - rustup component add clippy - - - name: Cache Rust target and registry - uses: Swatinem/rust-cache@6323deb102c322ba6fcbdcafc7e3dddab59af2b6 # v2.9.2 - with: - shared-key: rust-clippy-macos - cache-on-failure: "true" + cargo clippy --workspace --all-targets -- -D warnings + cargo clippy --manifest-path e2e/rust/Cargo.toml --all-targets -- -D warnings + cargo check --manifest-path examples/governance-interceptor/Cargo.toml --all-targets - - name: Lint macOS-sensitive crates - # Formatting is target-independent and already checked by the Linux jobs. - # The full mise lint covers every workspace/E2E target and requires extra - # native dependencies such as Z3; keep this guard focused on macOS cfgs. + - name: Test + env: + OPENSHELL_TELEMETRY_ENABLED: "false" run: | - cargo clippy \ - -p openshell-sandbox \ - -p openshell-core \ - -p openshell-cli \ - -p openshell-driver-db-credstore \ - -p openshell-driver-docker \ - -p openshell-driver-kubernetes \ - -p openshell-driver-kubernetes-secrets \ - -p openshell-driver-podman \ - -p openshell-driver-vault \ - --all-targets \ - -- -D warnings + cargo test --workspace --exclude openshell-server + cargo test -p openshell-server --features test-support python: name: Python (${{ matrix.runner }}) From 1bad4286120e7e75365573f9bec9b925d1a8c0c6 Mon Sep 17 00:00:00 2001 From: Simon Scatton Date: Fri, 21 Aug 2026 18:09:25 +0200 Subject: [PATCH 7/8] ci(branch-checks): run Rust tests with nextest --- .config/nextest.toml | 5 +++++ .github/workflows/branch-checks.yml | 8 +++++--- flake.nix | 1 + 3 files changed, 11 insertions(+), 3 deletions(-) create mode 100644 .config/nextest.toml diff --git a/.config/nextest.toml b/.config/nextest.toml new file mode 100644 index 0000000000..ba2efb0b15 --- /dev/null +++ b/.config/nextest.toml @@ -0,0 +1,5 @@ +[profile.ci] +fail-fast = false +status-level = "fail" +final-status-level = "fail" +failure-output = "immediate-final" diff --git a/.github/workflows/branch-checks.yml b/.github/workflows/branch-checks.yml index a3e2aa45bb..8f781a7f39 100644 --- a/.github/workflows/branch-checks.yml +++ b/.github/workflows/branch-checks.yml @@ -110,7 +110,7 @@ jobs: system: x86_64-linux - runner: linux-arm64-cpu8 system: aarch64-linux - - runner: macos-latest + - runner: macos-15-xlarge system: aarch64-darwin runs-on: ${{ matrix.runner }} defaults: @@ -160,8 +160,10 @@ jobs: env: OPENSHELL_TELEMETRY_ENABLED: "false" run: | - cargo test --workspace --exclude openshell-server - cargo test -p openshell-server --features test-support + cargo nextest run --profile ci --workspace --exclude openshell-server + cargo test --doc --workspace --exclude openshell-server + cargo nextest run --profile ci -p openshell-server --features test-support + cargo test --doc -p openshell-server --features test-support python: name: Python (${{ matrix.runner }}) diff --git a/flake.nix b/flake.nix index ec21dd3b8b..cb1a0a5d7d 100644 --- a/flake.nix +++ b/flake.nix @@ -41,6 +41,7 @@ overlays = [ (import rust-overlay) ]; }; commonDevShellPackages = with pkgs; [ + cargo-nextest # Assemble Debian artifacts on macOS and Linux. dpkg # Required to find packages. From acd5382534a8ae8d7d521bd74706bad3f1d42f5f Mon Sep 17 00:00:00 2001 From: Simon Scatton Date: Fri, 21 Aug 2026 18:23:11 +0200 Subject: [PATCH 8/8] ci(branch-checks): cache Rust workspace artifacts --- .config/nextest.toml | 3 +++ .github/workflows/branch-checks.yml | 1 + 2 files changed, 4 insertions(+) diff --git a/.config/nextest.toml b/.config/nextest.toml index ba2efb0b15..43783c18e9 100644 --- a/.config/nextest.toml +++ b/.config/nextest.toml @@ -1,3 +1,6 @@ +# SPDX-FileCopyrightText: Copyright (c) 2025-2026 NVIDIA CORPORATION & AFFILIATES. All rights reserved. +# SPDX-License-Identifier: Apache-2.0 + [profile.ci] fail-fast = false status-level = "fail" diff --git a/.github/workflows/branch-checks.yml b/.github/workflows/branch-checks.yml index 8f781a7f39..011be8b1c9 100644 --- a/.github/workflows/branch-checks.yml +++ b/.github/workflows/branch-checks.yml @@ -141,6 +141,7 @@ jobs: # Preserve compiled artifacts from failed lint/test runs so the next # push to the same PR branch does not start from a cold cache. cache-on-failure: "true" + cache-workspace-crates: "true" cache-bin: "false" cmd-format: nix develop .#devShells.${{ matrix.system }}.default -c {0}