diff --git a/.agents/skills/release-captain/SKILL.md b/.agents/skills/release-captain/SKILL.md index 6ad534404f..ed73ef19cb 100644 --- a/.agents/skills/release-captain/SKILL.md +++ b/.agents/skills/release-captain/SKILL.md @@ -41,6 +41,9 @@ tag, or start a second `Pre-release` run for a tag; it has no concurrency guard. - `Release` (`release.yml`) is dispatched by hand with the stable version. It picks the highest `-pre.N` on `main` whose whole `Pre-release` run passed, creates the stable tag on that commit, and publishes without requalifying. +- Pre-release and stable builds leave the `experimental` feature disabled. Release + Dev enables it through `dev-build: true`. Normal workspace builds, lint, + and tests enable `experimental` without separate CI lanes for development features. ## Setup diff --git a/.github/workflows/branch-checks.yml b/.github/workflows/branch-checks.yml index 218d3d2657..60e4d04432 100644 --- a/.github/workflows/branch-checks.yml +++ b/.github/workflows/branch-checks.yml @@ -273,7 +273,7 @@ jobs: - name: Lint shell: nix develop -c bash -euo pipefail {0} run: | - cargo clippy --locked --workspace --all-targets -- -D warnings + cargo clippy --locked --workspace --all-targets --features experimental -- -D warnings cargo clippy --locked --manifest-path e2e/rust/Cargo.toml --all-targets -- -D warnings cargo clippy --locked --manifest-path examples/governance-interceptor/Cargo.toml --all-targets -- -D warnings cargo clippy --locked --manifest-path examples/supervisor-middleware-content-guard/Cargo.toml --all-targets -- -D warnings @@ -325,7 +325,7 @@ jobs: env: OPENSHELL_TELEMETRY_ENABLED: "false" run: | - cargo nextest run --locked --profile ci --workspace --features openshell-server/test-support + cargo nextest run --locked --profile ci --workspace --features openshell-server/test-support,experimental cargo nextest run --locked --config-file .config/nextest.toml --profile ci --manifest-path examples/supervisor-middleware-content-guard/Cargo.toml cargo nextest run --locked --config-file .config/nextest.toml --profile ci --manifest-path tests/testkit/Cargo.toml diff --git a/.github/workflows/branch-e2e.yml b/.github/workflows/branch-e2e.yml index db4c96b936..649146f86a 100644 --- a/.github/workflows/branch-e2e.yml +++ b/.github/workflows/branch-e2e.yml @@ -108,6 +108,7 @@ jobs: uses: ./.github/workflows/build-binaries.yml with: cargo-version: ${{ needs.version.outputs.cargo }} + dev-build: true secrets: CACHIX_AUTH_TOKEN: ${{ secrets.CACHIX_AUTH_TOKEN }} diff --git a/.github/workflows/build-binaries.yml b/.github/workflows/build-binaries.yml index 1289968d14..cbecea1168 100644 --- a/.github/workflows/build-binaries.yml +++ b/.github/workflows/build-binaries.yml @@ -17,6 +17,11 @@ on: required: false type: string default: "" + dev-build: + description: Enable the gateway and supervisor experimental feature bundle + required: false + type: boolean + default: false secrets: CACHIX_AUTH_TOKEN: required: true @@ -85,6 +90,7 @@ jobs: env: PACKAGE: openshell-gateway BINARY: openshell-gateway + EXTRA_CARGO_FLAGS: ${{ inputs.dev-build && '--features experimental' || '' }} strategy: matrix: include: @@ -103,6 +109,8 @@ jobs: env: PACKAGE: ${{ matrix.package }} BINARY: ${{ matrix.binary }} + # Only supervisor entries define the experimental feature bundle. + EXTRA_CARGO_FLAGS: ${{ matrix.package == 'openshell-supervisor' && inputs.dev-build && '--features experimental' || '' }} strategy: matrix: include: diff --git a/.github/workflows/release-dev.yml b/.github/workflows/release-dev.yml index aec77972ee..200ec0449e 100644 --- a/.github/workflows/release-dev.yml +++ b/.github/workflows/release-dev.yml @@ -68,6 +68,7 @@ jobs: cargo-version: ${{ needs.compute-versions.outputs.cargo_version }} supervisor-image-tag: dev checkout-ref: ${{ github.sha }} + dev-build: true secrets: CACHIX_AUTH_TOKEN: ${{ secrets.CACHIX_AUTH_TOKEN }} diff --git a/.github/workflows/rust-cache.yml b/.github/workflows/rust-cache.yml index d9ec30c631..1434b051ae 100644 --- a/.github/workflows/rust-cache.yml +++ b/.github/workflows/rust-cache.yml @@ -62,6 +62,6 @@ jobs: shell: nix develop -c bash -euo pipefail {0} run: | cargo test --locked -p openshell-crypto --no-default-features --test independent_backend --no-run - cargo nextest run --locked --profile ci --workspace --features openshell-server/test-support --no-run + cargo nextest run --locked --profile ci --workspace --features openshell-server/test-support,experimental --no-run cargo nextest run --locked --config-file .config/nextest.toml --profile ci --manifest-path examples/supervisor-middleware-content-guard/Cargo.toml --no-run cargo nextest run --locked --config-file .config/nextest.toml --profile ci --manifest-path tests/testkit/Cargo.toml --no-run diff --git a/CI.md b/CI.md index df66dc0ad3..d5ce66ae82 100644 --- a/CI.md +++ b/CI.md @@ -655,9 +655,9 @@ The bot's full administrator documentation is internal to NVIDIA. The only comma | File | Role | |---|---| -| `.github/workflows/branch-checks.yml` | Required non-E2E checks. Triggers on `push: pull-request/[0-9]+` for PR mirrors and `merge_group` for queued merges. | +| `.github/workflows/branch-checks.yml` | Required non-E2E checks. Triggers on `push: pull-request/[0-9]+` for PR mirrors and `merge_group` for queued merges. Rust lint and tests run once with the development configuration (`--features experimental`). | | `.github/workflows/branch-e2e.yml` | Standard, GPU, Kubernetes HA, and Kubernetes credential-driver E2E. PR mirror pushes use `test:e2e`, `test:e2e-gpu`, and `test:e2e-kubernetes` labels; merge groups do not run E2E. | -| `.github/workflows/build-binaries.yml`, `build-vm-driver.yml` | Shared binary matrices used by branch and release workflows. The VM driver remains separate because its build consumes the runtime binaries. | +| `.github/workflows/build-binaries.yml`, `build-vm-driver.yml` | Shared binary matrices used by branch and release workflows. The VM driver remains separate because its build consumes the runtime binaries. `dev-build: true` selects `--features experimental` for the gateway and supervisor. Release Dev and branch E2E enable it; prerelease and stable builds use the default of `false`. | | `.github/workflows/build-images.yml` | Builds and pushes multi-platform images, then uploads the same OCI images as workflow artifacts. | | `.github/workflows/package-release-binaries.yml` | Packages raw build artifacts into release tarballs without rebuilding them. | | `.github/workflows/e2e-docker-test.yml`, `e2e-podman-test.yml`, `e2e-vm-test.yml`, `e2e-kubernetes-test.yml` | Reusable runtime lanes called directly by branch and release workflows. Callers select suites and declare only the artifacts each runtime consumes. | diff --git a/CONTRIBUTING.md b/CONTRIBUTING.md index b1034dd23f..8cee75c1b9 100644 --- a/CONTRIBUTING.md +++ b/CONTRIBUTING.md @@ -306,6 +306,11 @@ mise trust mise run gateway ``` +The normal Rust workspace build, check, lint, and test tasks enable the +`experimental` feature bundle. CI uses the same development configuration. Use +`--features experimental` to select it in direct Cargo builds; Cargo's `dev` profile +does not enable it automatically. Prerelease and stable builds leave it off. + ## Building the `openshell` CLI Inside this repository, `openshell` is a local shortcut script at `scripts/bin/openshell`. The script will diff --git a/crates/openshell-gateway/Cargo.toml b/crates/openshell-gateway/Cargo.toml index fa977a2c2a..c7925038ed 100644 --- a/crates/openshell-gateway/Cargo.toml +++ b/crates/openshell-gateway/Cargo.toml @@ -41,6 +41,8 @@ openshell-driver-mxc = { path = "../openshell-driver-mxc", optional = true } [features] default = ["telemetry", "in-tree-compute-drivers"] +# Opt-in bundle for experimental features; stable builds leave it off. +experimental = ["openshell-server/experimental"] in-tree-compute-drivers = [ "compute-driver-docker", "compute-driver-kubernetes", diff --git a/crates/openshell-server/Cargo.toml b/crates/openshell-server/Cargo.toml index 9160719bf9..a6e91420df 100644 --- a/crates/openshell-server/Cargo.toml +++ b/crates/openshell-server/Cargo.toml @@ -120,6 +120,8 @@ notify = "8" [features] default = ["telemetry"] +# Opt-in bundle for experimental features; stable builds leave it off. +experimental = [] ## Compile in anonymous telemetry emission (forwards to openshell-core/telemetry). ## On by default; build with `--no-default-features` for a telemetry-free gateway ## that contains no telemetry endpoint, HTTP client, or emission code. diff --git a/crates/openshell-supervisor/Cargo.toml b/crates/openshell-supervisor/Cargo.toml index e6e7fcd6ba..9b5af080ec 100644 --- a/crates/openshell-supervisor/Cargo.toml +++ b/crates/openshell-supervisor/Cargo.toml @@ -54,6 +54,8 @@ uuid = { workspace = true } [features] default = ["telemetry", "bundled-ca-roots"] +# Opt-in bundle for experimental features; stable builds leave it off. +experimental = [] system-ca-roots = ["telemetry"] defaults-without-telemetry = ["bundled-ca-roots"] telemetry = ["openshell-core/telemetry"] diff --git a/tasks/ci.toml b/tasks/ci.toml index 7f896c570d..0e738035e6 100644 --- a/tasks/ci.toml +++ b/tasks/ci.toml @@ -14,7 +14,7 @@ hide = true ["build:rust:workspace"] description = "Build all Rust crates" -run = "cargo build --workspace" +run = "cargo build --workspace --features experimental" hide = true ["build:release"] diff --git a/tasks/rust.toml b/tasks/rust.toml index 682e478fca..c3eb899238 100644 --- a/tasks/rust.toml +++ b/tasks/rust.toml @@ -11,7 +11,7 @@ run = "cargo run --release -p openshell-sandbox --features perf-harness --bin op description = "Check all Rust crates for errors" depends = ["rust:lockfiles:check"] run = [ - "cargo check --workspace", + "cargo check --workspace --features experimental", "cargo check -p openshell-sandbox --all-targets --features perf-harness", ] run_windows = "powershell -NoProfile -ExecutionPolicy Bypass -File tasks/scripts/windows-msvc.ps1 check native" @@ -27,7 +27,7 @@ hide = true description = "Lint Rust code with Clippy (deny warnings)" depends = ["rust:lockfiles:check"] run = [ - "cargo clippy --workspace --all-targets -- -D warnings", + "cargo clippy --workspace --all-targets --features experimental -- -D warnings", "cargo clippy -p openshell-sandbox --all-targets --features perf-harness -- -D warnings", "cargo clippy --manifest-path e2e/rust/Cargo.toml --all-targets -- -D warnings", "cargo clippy --manifest-path examples/governance-interceptor/Cargo.toml --all-targets -- -D warnings", diff --git a/tasks/test.toml b/tasks/test.toml index 30e8982599..2f6646ceb9 100644 --- a/tasks/test.toml +++ b/tasks/test.toml @@ -116,8 +116,8 @@ run = [ "cargo test -p openshell-crypto --no-default-features --test independent_backend", # Run the workspace once without openshell-server so we can run that crate # with test-only helpers enabled. - "cargo test --workspace --exclude openshell-server", - "cargo test -p openshell-server --features test-support", + "cargo test --workspace --exclude openshell-server --features experimental", + "cargo test -p openshell-server --features test-support,experimental", "cargo nextest run --config-file .config/nextest.toml --manifest-path examples/supervisor-middleware-content-guard/Cargo.toml", "cargo nextest run --config-file .config/nextest.toml --manifest-path tests/testkit/Cargo.toml", ]