add support for building artifacts with custom GOPROXY

Signed-off-by: Tariq Ibrahim <tibrahim@nvidia.com>

Author: tariq1890

.github/workflows/ci.yaml

@@ -35,6 +35,7 @@ jobs:
         run: echo "version=$(echo $GITHUB_SHA | cut -c1-8)" >> "$GITHUB_OUTPUT"
 
   golang:
+    secrets: inherit
     uses: ./.github/workflows/golang.yaml
 
   image:

.github/workflows/golang.yaml

@@ -16,13 +16,6 @@ name: Golang
 
 on:
   workflow_call: {}
-  pull_request:
-    types:
-      - opened
-      - synchronize
-    branches:
-      - main
-      - release-*
 
 jobs:
   check:
@@ -84,7 +77,10 @@ jobs:
 
   build:
     name: Build
-    runs-on: ubuntu-latest
+    runs-on: linux-amd64-cpu4
+    permissions:
+      contents: read
+      id-token: write
     steps:
       - name: Checkout code
         uses: actions/checkout@v5
@@ -100,4 +96,19 @@ jobs:
         with:
           go-version: ${{ env.GOLANG_VERSION }}
 
-      - run: make build
+      - name: Setup JFrog CLI
+        id: jfrog
+        uses: jfrog/setup-jfrog-cli@v4
+        env:
+          JF_URL: https://${{ secrets.OIDC_ARTIFACTORY_ENDPOINT }}/
+        with:
+          oidc-provider-name: nvgithub
+          oidc-audience: ${{ secrets.OIDC_ARTIFACTORY_ENDPOINT }}
+      - env:
+          OIDC_USER: ${{ steps.jfrog.outputs.oidc-user }}
+          OIDC_TOKEN: ${{ steps.jfrog.outputs.oidc-token }}
+          OIDC_ARTIFACTORY_ENDPOINT: ${{ secrets.OIDC_ARTIFACTORY_ENDPOINT }}
+        run: |
+          OIDC_USER_ENCODED=$(python3 -c 'import urllib.parse, os; print(urllib.parse.quote_plus(os.environ["OIDC_USER"]))')
+          export GOPROXY="https://${OIDC_USER_ENCODED}:${OIDC_TOKEN}@${OIDC_ARTIFACTORY_ENDPOINT}/artifactory/api/go/edge-go-remote-virtual"
+          make build

.github/workflows/image.yaml

@@ -76,7 +76,11 @@ jobs:
           path: ${{ github.workspace }}/dist/*
 
   image:
-    runs-on: ubuntu-latest
+    runs-on: linux-amd64-cpu4
+    permissions:
+      contents: read
+      id-token: write
+      packages: write
     strategy:
       matrix:
         target:
@@ -109,12 +113,26 @@ jobs:
           username: ${{ github.actor }}
           password: ${{ secrets.GITHUB_TOKEN }}
 
+      - name: Setup JFrog CLI
+        id: jfrog
+        uses: jfrog/setup-jfrog-cli@v4
+        env:
+          JF_URL: https://${{ secrets.OIDC_ARTIFACTORY_ENDPOINT }}/
+        with:
+          oidc-provider-name: nvgithub
+          oidc-audience: ${{ secrets.OIDC_ARTIFACTORY_ENDPOINT }}
+
       - name: Build image
         env:
           IMAGE_NAME: ghcr.io/nvidia/container-toolkit
           VERSION: ${{ inputs.version }}
           PUSH_ON_BUILD: "true"
           BUILD_MULTI_ARCH_IMAGES: ${{ inputs.build_multi_arch_images }}
+          OIDC_USER: ${{ steps.jfrog.outputs.oidc-user }}
+          OIDC_TOKEN: ${{ steps.jfrog.outputs.oidc-token }}
+          OIDC_ARTIFACTORY_ENDPOINT: ${{ secrets.OIDC_ARTIFACTORY_ENDPOINT }}
         run: |
+          OIDC_USER_ENCODED=$(python3 -c 'import urllib.parse, os; print(urllib.parse.quote_plus(os.environ["OIDC_USER"]))')
+          export GOPROXY="https://${OIDC_USER_ENCODED}:${OIDC_TOKEN}@${OIDC_ARTIFACTORY_ENDPOINT}/artifactory/api/go/edge-go-remote-virtual"
           echo "${VERSION}"
           make -f deployments/container/Makefile build-${{ matrix.target }}

deployments/container/Dockerfile

@@ -42,6 +42,9 @@ RUN set -eux; \
 ENV GOPATH=/go
 ENV PATH=$GOPATH/bin:/usr/local/go/bin:$PATH
 
+ARG GOPROXY=direct
+ENV GOPROXY=$GOPROXY
+
 WORKDIR /build
 COPY . .
 

deployments/container/Makefile

@@ -27,6 +27,8 @@ DIST_DIR ?= $(CURDIR)/dist
 ##### Global variables #####
 include $(CURDIR)/versions.mk
 
+GOPROXY ?= direct
+
 IMAGE_VERSION := $(VERSION)
 
 IMAGE_TAG ?= $(VERSION)
@@ -88,6 +90,7 @@ $(IMAGE_TARGETS): image-%: $(ARTIFACTS_ROOT)
 		--build-arg GIT_COMMIT_SHORT="$(GIT_COMMIT_SHORT)" \
 		--build-arg GIT_BRANCH="$(GIT_BRANCH)" \
 		--build-arg SOURCE_DATE_EPOCH="$(SOURCE_DATE_EPOCH)" \
+		--build-arg GOPROXY="$(GOPROXY)" \
 		-f $(DOCKERFILE) \
 		$(CURDIR)
 

internal/lookup/root/root.go

@@ -90,7 +90,7 @@ func (r *Driver) Version() (string, error) {
 	return r.version, nil
 }
 
-// GetLibcudaParentDir returns the cached libcuda.so path if possible.
+// GetLibcudasoPath returns the cached libcuda.so path if possible.
 // If this has not yet been initialized, the path is first detected and then returned.
 func (r *Driver) GetLibcudasoPath() (string, error) {
 	r.Lock()

pkg/nvcdi/driver-nvml.go

@@ -75,7 +75,7 @@ func (l *nvcdilib) newDriverVersionDiscoverer() (discover.Discover, error) {
 }
 
 // NewDriverLibraryDiscoverer creates a discoverer for the libraries associated with the specified driver version.
-func (l *nvcdilib) NewDriverLibraryDiscoverer(version string, libcudaSoParentDirPath string) (discover.Discover, error) {
+func (l *nvcdilib) NewDriverLibraryDiscoverer(version string, libCudaSoParentDirectoryPath string) (discover.Discover, error) {
 	versionSuffixLibraryMounts, err := l.getVersionSuffixDriverLibraryMounts(version)
 	if err != nil {
 		return nil, err
@@ -110,10 +110,6 @@ func (l *nvcdilib) NewDriverLibraryDiscoverer(version string, libcudaSoParentDir
 	disableDeviceNodeModification := l.hookCreator.Create(DisableDeviceNodeModificationHook)
 	discoverers = append(discoverers, disableDeviceNodeModification)
 
-	libCudaSoParentDirectoryPath, err := l.driver.GetLibcudaParentDir()
-	if err != nil {
-		return nil, fmt.Errorf("failed to get libcuda.so parent directory path: %w", err)
-	}
 	environmentVariable := &discover.EnvVar{
 		Name:  "NVIDIA_CTK_LIBCUDA_DIR",
 		Value: libCudaSoParentDirectoryPath,