release-build.yml

# SPDX-FileCopyrightText: Copyright (c) 2025-2026 NVIDIA CORPORATION & AFFILIATES. All rights reserved.
# SPDX-License-Identifier: Apache-2.0

name: Build Release

on:
  workflow_call:
    inputs:
      release-tag:
        description: Git tag to build and publish
        required: true
        type: string
      expected-source-sha:
        description: Qualified source commit that the release tag must resolve to
        required: false
        default: ""
        type: string
      is-prerelease:
        description: Whether the caller is publishing a pre-release
        required: true
        type: boolean
    outputs:
      python_version:
        description: Python package version
        value: ${{ jobs.compute-versions.outputs.python_version }}
      npm_version:
        description: TypeScript package version
        value: ${{ jobs.compute-versions.outputs.npm_version }}
      semver:
        description: Release version without the v prefix
        value: ${{ jobs.compute-versions.outputs.semver }}
      source_sha:
        description: Source commit resolved from the release tag
        value: ${{ jobs.compute-versions.outputs.source_sha }}
    secrets:
      CACHIX_AUTH_TOKEN:
        required: false

permissions:
  contents: read
  packages: read

env:
  RELEASE_TAG: ${{ inputs.release-tag }}

defaults:
  run:
    shell: bash

jobs:
  compute-versions:
    name: Compute Versions
    runs-on: linux-amd64-cpu8
    timeout-minutes: 5
    defaults:
      run:
        shell: nix develop -c bash -euo pipefail {0}
    outputs:
      python_version: ${{ steps.v.outputs.python }}
      cargo_version: ${{ steps.v.outputs.cargo }}
      npm_version: ${{ steps.v.outputs.npm }}
      deb_version: ${{ steps.v.outputs.deb }}
      rpm_version: ${{ steps.v.outputs.rpm_version }}
      rpm_release: ${{ steps.v.outputs.rpm_release }}
      # Semver without 'v' prefix (e.g. 0.6.0), used for image tags and release body
      semver: ${{ steps.v.outputs.semver }}
      # Commit resolved from RELEASE_TAG, used for image tags and downstream metadata
      source_sha: ${{ steps.v.outputs.source_sha }}
      is_prerelease: ${{ steps.v.outputs.is_prerelease }}
    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          fetch-depth: 0
          persist-credentials: false
          ref: ${{ inputs.release-tag }}

      - uses: ./.github/actions/setup-nix
        with:
          prepare-shell: "true"

      - name: Fetch tags
        run: git fetch --tags --force

      - name: Compute all versions
        id: v
        env:
          EXPECTED_PRERELEASE: ${{ inputs.is-prerelease }}
          EXPECTED_SOURCE_SHA: ${{ inputs.expected-source-sha }}
        run: |
          set -euo pipefail
          if [[ -n "${EXPECTED_SOURCE_SHA}" && "$(git rev-parse HEAD)" != "${EXPECTED_SOURCE_SHA}" ]]; then
            echo "Release tag ${RELEASE_TAG} does not match the qualified commit ${EXPECTED_SOURCE_SHA}." >&2
            exit 1
          fi
          if [[ "${RELEASE_TAG}" =~ ^v[0-9]+\.[0-9]+\.[0-9]+-pre\.[1-9][0-9]*$ ]]; then
            is_prerelease=true
          elif [[ "${RELEASE_TAG}" =~ ^v[0-9]+\.[0-9]+\.[0-9]+$ ]]; then
            is_prerelease=false
          else
            echo "Unsupported release tag: ${RELEASE_TAG}" >&2
            exit 1
          fi
          if [[ "${is_prerelease}" != "${EXPECTED_PRERELEASE}" ]]; then
            echo "Tag ${RELEASE_TAG} does not match this release workflow's prerelease mode." >&2
            exit 1
          fi
          {
            echo "is_prerelease=${is_prerelease}"
            echo "python=$(uv run --no-project python tasks/scripts/release.py get-version --python)"
            echo "cargo=$(uv run --no-project python tasks/scripts/release.py get-version --cargo)"
            echo "npm=$(uv run --no-project python tasks/scripts/release.py get-version --npm)"
            echo "deb=$(uv run --no-project python tasks/scripts/release.py get-version --deb)"
            echo "rpm_version=$(uv run --no-project python tasks/scripts/release.py get-version --rpm-version)"
            echo "rpm_release=$(uv run --no-project python tasks/scripts/release.py get-version --rpm-release)"
            echo "semver=${RELEASE_TAG#v}"
            echo "source_sha=$(git rev-parse HEAD)"
          } >> "$GITHUB_OUTPUT"

  build-binaries:
    needs: compute-versions
    permissions:
      contents: read
    uses: ./.github/workflows/build-binaries.yml
    with:
      cargo-version: ${{ needs.compute-versions.outputs.cargo_version }}
      supervisor-image-tag: ${{ needs.compute-versions.outputs.semver }}
      checkout-ref: ${{ needs.compute-versions.outputs.source_sha }}
    secrets:
      CACHIX_AUTH_TOKEN: ${{ secrets.CACHIX_AUTH_TOKEN }}

  build-vm-driver:
    needs: [compute-versions, build-binaries]
    permissions:
      contents: read
    uses: ./.github/workflows/build-vm-driver.yml
    with:
      cargo-version: ${{ needs.compute-versions.outputs.cargo_version }}
      supervisor-image-tag: ${{ needs.compute-versions.outputs.semver }}
      checkout-ref: ${{ needs.compute-versions.outputs.source_sha }}
    secrets:
      CACHIX_AUTH_TOKEN: ${{ secrets.CACHIX_AUTH_TOKEN }}

  package-binaries:
    needs: [compute-versions, build-binaries, build-vm-driver]
    permissions:
      actions: read
      contents: read
    uses: ./.github/workflows/package-release-binaries.yml
    with:
      checkout-ref: ${{ needs.compute-versions.outputs.source_sha }}

  build-images:
    needs: [compute-versions, build-binaries]
    permissions:
      contents: read
      packages: write
    uses: ./.github/workflows/build-images.yml
    with:
      image-tag: ${{ inputs.is-prerelease && needs.compute-versions.outputs.source_sha || needs.compute-versions.outputs.semver }}
      push-images: ${{ inputs.is-prerelease }}
      checkout-ref: ${{ needs.compute-versions.outputs.source_sha }}

  build-python-wheel:
    name: Build Python Wheel
    needs: [compute-versions]
    runs-on: linux-amd64-cpu8
    timeout-minutes: 20
    defaults:
      run:
        shell: nix develop -c bash -euo pipefail {0}
    env:
      SETUPTOOLS_SCM_PRETEND_VERSION_FOR_OPENSHELL: ${{ needs.compute-versions.outputs.python_version }}
    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          fetch-depth: 0
          persist-credentials: false
          ref: ${{ needs.compute-versions.outputs.source_sha }}

      - uses: ./.github/actions/setup-nix
        with:
          prepare-shell: "true"

      - name: Sync Python dependencies
        run: uv sync --frozen

      - name: Build Python wheel
        run: |
          set -euo pipefail
          uv run --frozen python tasks/scripts/generate_python_proto.py
          uv build --wheel --out-dir target/wheels
          uv run --no-project python tasks/scripts/verify-python-wheel.py target/wheels \
            --expected-version "${SETUPTOOLS_SCM_PRETEND_VERSION_FOR_OPENSHELL}"
          ls -la target/wheels/*.whl

      - name: Upload wheel artifact
        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7
        with:
          name: python-wheel
          path: target/wheels/*.whl
          retention-days: 5

  build-deb:
    name: Build Debian Packages
    needs: [compute-versions, build-binaries, build-vm-driver]
    uses: ./.github/workflows/deb-package.yml
    with:
      deb-version: ${{ needs.compute-versions.outputs.deb_version }}
      checkout-ref: ${{ needs.compute-versions.outputs.source_sha }}

  build-snap:
    name: Build Snap
    needs: [compute-versions, build-binaries]
    uses: ./.github/workflows/snap-package.yml
    with:
      checkout-ref: ${{ needs.compute-versions.outputs.source_sha }}

  build-rpm:
    name: Build RPM Packages
    needs: [compute-versions, build-binaries]
    uses: ./.github/workflows/rpm-package.yml
    with:
      checkout-ref: ${{ needs.compute-versions.outputs.source_sha }}
      rpm-version: ${{ needs.compute-versions.outputs.rpm_version }}
      rpm-release: ${{ needs.compute-versions.outputs.rpm_release }}
      cargo-version: ${{ needs.compute-versions.outputs.cargo_version }}