Supervisor Static Linkage Validation #188
Workflow file for this run
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| # SPDX-FileCopyrightText: Copyright (c) 2025-2026 NVIDIA CORPORATION & AFFILIATES. All rights reserved. | |
| # SPDX-License-Identifier: Apache-2.0 | |
| name: Supervisor Static Linkage Validation | |
| # The glibc-static supervisor variant (SUPERVISOR_LIBC=glibc-static) has no | |
| # other CI caller: docker-build.yml builds the default musl variant, so the | |
| # GNU + crt-static build branch and its native-only, per-arch requirements are | |
| # never exercised by image or release CI. Build the variant here on both | |
| # architectures so it cannot regress unnoticed. rust-native-build.yml runs | |
| # verify-static-binary.sh for the sandbox component, which fails the job on any | |
| # dynamic linkage. | |
| # | |
| # Linkage can change from a new/updated dependency or a source change, not just | |
| # from the build scripts, so the push path filters cover the workspace manifests | |
| # and crate sources in addition to the build tooling. A nightly schedule is the | |
| # unfiltered backstop for anything the filters miss. | |
| # | |
| # rust-native-build.yml runs on NVIDIA self-hosted runners, which reject jobs | |
| # triggered by `pull_request`. This workflow therefore follows the repo's | |
| # self-hosted convention (see branch-checks.yml / branch-e2e.yml): validate in | |
| # the merge queue (pre-merge), on push to main (post-merge), nightly, and on | |
| # demand — never on `pull_request`. | |
| on: | |
| merge_group: | |
| types: [checks_requested] | |
| push: | |
| branches: [main] | |
| paths: | |
| - "Cargo.toml" | |
| - "Cargo.lock" | |
| - "crates/**" | |
| - "rust-toolchain.toml" | |
| - "mise.toml" | |
| - "mise.lock" | |
| - ".cargo/config.toml" | |
| - "tasks/scripts/stage-prebuilt-binaries.sh" | |
| - "tasks/scripts/verify-static-binary.sh" | |
| - ".github/workflows/rust-native-build.yml" | |
| - ".github/workflows/supervisor-static-validate.yml" | |
| schedule: | |
| # Nightly (04:17 UTC) unfiltered run so a linkage regression cannot slip | |
| # through the path filters unnoticed. Schedules run only on the default branch. | |
| - cron: "17 4 * * *" | |
| workflow_dispatch: | |
| concurrency: | |
| group: ${{ github.workflow }}-${{ github.ref }} | |
| cancel-in-progress: false | |
| permissions: | |
| contents: read | |
| packages: read | |
| jobs: | |
| glibc-static: | |
| name: glibc-static supervisor (${{ matrix.arch }}) | |
| strategy: | |
| fail-fast: false | |
| matrix: | |
| arch: [amd64, arm64] | |
| uses: ./.github/workflows/rust-native-build.yml | |
| with: | |
| component: sandbox | |
| arch: ${{ matrix.arch }} | |
| supervisor-libc: glibc-static | |
| artifact-name: supervisor-glibc-static-${{ matrix.arch }} | |
| retention-days: 1 | |
| secrets: inherit |