branch-checks.yml

name: Branch Checks

on:
  merge_group:
    types: [checks_requested]
  push:
    branches:
      - "pull-request/[0-9]+"
  workflow_dispatch:

env:
  CARGO_TERM_COLOR: always
  CARGO_INCREMENTAL: "0"
  MISE_GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}

permissions:
  contents: read
  packages: read

concurrency:
  group: ${{ github.workflow }}-${{ github.ref }}
  cancel-in-progress: true

jobs:
  pr_metadata:
    name: Resolve PR metadata
    runs-on: ubuntu-latest
    permissions:
      contents: read
      pull-requests: read
    outputs:
      should_run: ${{ steps.gate.outputs.should_run }}
      base_sha: ${{ steps.gate.outputs.base_sha }}
    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1

      - id: gate
        uses: ./.github/actions/pr-gate

  protobuf-compatibility:
    name: Protobuf Compatibility
    needs: pr_metadata
    if: needs.pr_metadata.outputs.should_run == 'true'
    runs-on: linux-amd64-cpu8
    timeout-minutes: 15
    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          fetch-depth: 0
          persist-credentials: false

      - uses: ./.github/actions/check-protobuf-compatibility
        with:
          ref: >-
            ${{ github.event_name == 'workflow_dispatch'
                && format('refs/remotes/origin/{0}', github.event.repository.default_branch)
                || github.event.merge_group.base_sha
                || needs.pr_metadata.outputs.base_sha }}

  mise-lockfile:
    name: mise Lockfile
    needs: pr_metadata
    if: needs.pr_metadata.outputs.should_run == 'true'
    runs-on: linux-amd64-cpu8
    timeout-minutes: 30
    container:
      image: ghcr.io/nvidia/openshell/ci:9cb72baa2e61a1b5f12407e6e82da7fdba0aa722@sha256:67a9a0c32cb99825e6d3e9d9eec45d67149ea1ff7c11a1b1e1b3480d2d3df684
      credentials:
        username: ${{ github.actor }}
        password: ${{ secrets.GITHUB_TOKEN }}
    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1

      - name: Mark workspace as safe for git
        run: git config --global --add safe.directory "$GITHUB_WORKSPACE"

      - name: Verify mise.lock is in sync with mise.toml
        run: |
          mise lock
          if ! git diff --exit-code mise.lock; then
            echo "::error::mise.lock is out of sync with mise.toml. Run 'mise lock' locally and commit the result." >&2
            exit 1
          fi

  license-headers:
    name: License Headers
    needs: pr_metadata
    if: needs.pr_metadata.outputs.should_run == 'true'
    runs-on: linux-amd64-cpu8
    timeout-minutes: 30
    container:
      image: ghcr.io/nvidia/openshell/ci:9cb72baa2e61a1b5f12407e6e82da7fdba0aa722@sha256:67a9a0c32cb99825e6d3e9d9eec45d67149ea1ff7c11a1b1e1b3480d2d3df684
      credentials:
        username: ${{ github.actor }}
        password: ${{ secrets.GITHUB_TOKEN }}
    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1

      - name: Install tools
        run: mise install --locked

      - name: Check license headers
        run: mise run license:check

  cargo-deny:
    name: Cargo Deny
    needs: pr_metadata
    if: needs.pr_metadata.outputs.should_run == 'true'
    runs-on: linux-amd64-cpu8
    timeout-minutes: 30
    defaults:
      run:
        shell: nix develop .#devShells.x86_64-linux.default -c bash -euo pipefail {0}
    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1

      - uses: ./.github/actions/setup-nix
        with:
          cachix-auth-token: ${{ secrets.CACHIX_AUTH_TOKEN }}
          prepare-shell: "true"
          shell-installable: .#devShells.x86_64-linux.default

      - name: Check dependencies
        run: cargo deny check licenses bans sources

  rust-format:
    name: Rust format
    needs: pr_metadata
    if: needs.pr_metadata.outputs.should_run == 'true'
    runs-on: linux-amd64-cpu8
    timeout-minutes: 15
    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1

      - uses: ./.github/actions/setup-nix
        with:
          prepare-shell: "true"
          cachix-auth-token: ${{ secrets.CACHIX_AUTH_TOKEN }}

      - name: Format
        shell: nix develop -c bash -euo pipefail {0}
        run: |
          cargo fmt --all -- --check
          cargo fmt --manifest-path e2e/rust/Cargo.toml --all -- --check
          cargo fmt --manifest-path examples/governance-interceptor/Cargo.toml --all -- --check
          cargo fmt --manifest-path examples/supervisor-middleware-content-guard/Cargo.toml --all -- --check

  cargo-lockfiles:
    name: Cargo lockfiles
    needs: pr_metadata
    if: needs.pr_metadata.outputs.should_run == 'true'
    runs-on: linux-amd64-cpu8
    timeout-minutes: 15
    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1

      - uses: ./.github/actions/setup-nix
        with:
          prepare-shell: "true"
          cachix-auth-token: ${{ secrets.CACHIX_AUTH_TOKEN }}

      - name: Verify Cargo lockfiles
        shell: nix develop -c bash -euo pipefail {0}
        run: tasks/scripts/check-cargo-lockfiles.sh

  rust-lint:
    name: Rust lint (${{ matrix.system }})
    needs: pr_metadata
    if: needs.pr_metadata.outputs.should_run == 'true'
    strategy:
      fail-fast: false
      matrix:
        include:
          - runner: linux-amd64-cpu8
            system: x86_64-linux
          - runner: linux-arm64-cpu8
            system: aarch64-linux
          - runner: macos-15-xlarge
            system: aarch64-darwin
    runs-on: ${{ matrix.runner }}
    timeout-minutes: 45
    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1

      - uses: ./.github/actions/setup-nix
        with:
          prepare-shell: "true"
          cachix-auth-token: ${{ secrets.CACHIX_AUTH_TOKEN }}

      - uses: ./.github/actions/setup-rust
        with:
          cache-key: rust-checks-v2
          save-cache: "false"

      - name: Lint
        shell: nix develop -c bash -euo pipefail {0}
        run: |
          cargo clippy --locked --workspace --all-targets -- -D warnings
          cargo clippy --locked --manifest-path e2e/rust/Cargo.toml --all-targets -- -D warnings
          cargo clippy --locked --manifest-path examples/governance-interceptor/Cargo.toml --all-targets -- -D warnings
          cargo clippy --locked --manifest-path examples/supervisor-middleware-content-guard/Cargo.toml --all-targets -- -D warnings

  rust-test:
    name: Rust test (${{ matrix.system }})
    needs: pr_metadata
    if: needs.pr_metadata.outputs.should_run == 'true'
    strategy:
      fail-fast: false
      matrix:
        include:
          - runner: linux-amd64-cpu8
            system: x86_64-linux
          - runner: linux-arm64-cpu8
            system: aarch64-linux
          - runner: macos-15-xlarge
            system: aarch64-darwin
    runs-on: ${{ matrix.runner }}
    timeout-minutes: 45
    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1

      - uses: ./.github/actions/setup-nix
        with:
          prepare-shell: "true"
          cachix-auth-token: ${{ secrets.CACHIX_AUTH_TOKEN }}

      - uses: ./.github/actions/setup-rust
        with:
          cache-key: rust-checks-v2
          save-cache: "true"

      - name: Test
        shell: nix develop -c bash -euo pipefail {0}
        env:
          OPENSHELL_TELEMETRY_ENABLED: "false"
        run: |
          cargo nextest run --locked --profile ci --workspace --features openshell-server/test-support
          cargo nextest run --locked --config-file .config/nextest.toml --profile ci --manifest-path examples/supervisor-middleware-content-guard/Cargo.toml

  rust-build-modes:
    name: Rust build modes (${{ matrix.system }})
    needs: pr_metadata
    if: needs.pr_metadata.outputs.should_run == 'true'
    strategy:
      fail-fast: false
      matrix:
        include:
          - runner: linux-amd64-cpu8
            system: x86_64-linux
          - runner: linux-arm64-cpu8
            system: aarch64-linux
          - runner: macos-15-xlarge
            system: aarch64-darwin
    runs-on: ${{ matrix.runner }}
    timeout-minutes: 45
    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1

      - uses: ./.github/actions/setup-nix
        with:
          prepare-shell: "true"
          cachix-auth-token: ${{ secrets.CACHIX_AUTH_TOKEN }}

      - uses: ./.github/actions/setup-rust
        with:
          cache-key: rust-checks-v2
          save-cache: "false"

      - name: Verify build modes
        shell: nix develop -c bash -euo pipefail {0}
        run: |
          cargo build --locked -p openshell-gateway --bin openshell-gateway
          tasks/scripts/verify-telemetry-compiled-out.sh present target/debug/openshell-gateway
          cargo build --locked -p openshell-gateway --bin openshell-gateway --no-default-features --features defaults-without-telemetry
          tasks/scripts/verify-telemetry-compiled-out.sh absent target/debug/openshell-gateway
          cargo build --locked -p openshell-supervisor --bin openshell-supervisor --no-default-features --features defaults-without-telemetry
          tasks/scripts/verify-telemetry-compiled-out.sh absent target/debug/openshell-supervisor
          cargo check --locked -p openshell-supervisor --all-targets --no-default-features --features system-ca-roots

      - name: Verify system CA roots dependency boundary
        shell: nix develop -c bash -euo pipefail {0}
        run: |
          cargo tree --locked -p openshell-supervisor --prefix none --no-default-features --features system-ca-roots > /tmp/openshell-supervisor-dependencies.txt
          if grep -Eq '^(webpki-roots|webpki-root-certs) v' /tmp/openshell-supervisor-dependencies.txt; then
            echo "ERROR: bundled Mozilla roots found in system CA roots build" >&2
            cat /tmp/openshell-supervisor-dependencies.txt >&2
            exit 1
          fi

      - name: Verify standalone prover dependency boundary
        shell: nix develop -c bash -euo pipefail {0}
        run: |
          cargo tree --locked -p openshell-prover-cli --edges normal --prefix none > /tmp/openshell-prover-dependencies.txt
          if grep -Eq '^(openshell-(cli|server|sdk|bootstrap|tui|providers|core|policy)) v' /tmp/openshell-prover-dependencies.txt; then
            echo "ERROR: standalone prover includes an OpenShell control-plane dependency" >&2
            cat /tmp/openshell-prover-dependencies.txt >&2
            exit 1
          fi

  rust-feature-alias:
    name: Rust feature alias
    needs: pr_metadata
    if: needs.pr_metadata.outputs.should_run == 'true'
    runs-on: linux-amd64-cpu8
    timeout-minutes: 30
    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1

      - uses: ./.github/actions/setup-nix
        with:
          prepare-shell: "true"
          cachix-auth-token: ${{ secrets.CACHIX_AUTH_TOKEN }}

      - uses: ./.github/actions/setup-rust
        with:
          cache-key: rust-checks-v2
          save-cache: "false"

      - name: Verify defaults-without-telemetry feature alias
        shell: nix develop -c bash -euo pipefail {0}
        run: |
          tasks/scripts/verify-defaults-without-telemetry.sh
          git diff --exit-code HEAD -- ':(glob)**/Cargo.lock'

  rust-gateway-core-features:
    name: Rust gateway core features
    needs: pr_metadata
    if: needs.pr_metadata.outputs.should_run == 'true'
    runs-on: linux-amd64-cpu8
    timeout-minutes: 30
    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1

      - uses: ./.github/actions/setup-nix
        with:
          prepare-shell: "true"
          cachix-auth-token: ${{ secrets.CACHIX_AUTH_TOKEN }}

      - uses: ./.github/actions/setup-rust
        with:
          cache-key: rust-checks-v2
          save-cache: "false"

      - name: Verify core gateway compute-driver feature sets
        shell: nix develop -c bash -euo pipefail {0}
        run: |
          cargo nextest run --locked --profile ci -p openshell-gateway --all-targets --no-default-features
          cargo nextest run --locked --profile ci -p openshell-gateway --all-targets --no-default-features --features compute-driver-docker
          cargo nextest run --locked --profile ci -p openshell-gateway --all-targets --no-default-features --features compute-driver-kubernetes
          cargo nextest run --locked --profile ci -p openshell-gateway --all-targets --no-default-features --features compute-driver-podman

  rust-gateway-extended-features:
    name: Rust gateway extended features
    needs: pr_metadata
    if: needs.pr_metadata.outputs.should_run == 'true'
    runs-on: linux-amd64-cpu8
    timeout-minutes: 30
    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1

      - uses: ./.github/actions/setup-nix
        with:
          prepare-shell: "true"
          cachix-auth-token: ${{ secrets.CACHIX_AUTH_TOKEN }}

      - uses: ./.github/actions/setup-rust
        with:
          cache-key: rust-checks-v2
          save-cache: "false"

      - name: Verify extended gateway compute-driver feature sets
        shell: nix develop -c bash -euo pipefail {0}
        run: |
          cargo nextest run --locked --profile ci -p openshell-gateway --all-targets --no-default-features --features compute-driver-vm
          cargo nextest run --locked --profile ci -p openshell-gateway --all-targets --no-default-features --features compute-driver-mxc
          cargo nextest run --locked --profile ci -p openshell-gateway --all-targets --no-default-features --features compute-driver-docker,compute-driver-vm

  python:
    name: Python (${{ matrix.runner }})
    needs: pr_metadata
    if: needs.pr_metadata.outputs.should_run == 'true'
    strategy:
      fail-fast: false
      matrix:
        runner: [linux-amd64-cpu8, linux-arm64-cpu8]
    runs-on: ${{ matrix.runner }}
    timeout-minutes: 30
    container:
      image: ghcr.io/nvidia/openshell/ci:9cb72baa2e61a1b5f12407e6e82da7fdba0aa722@sha256:67a9a0c32cb99825e6d3e9d9eec45d67149ea1ff7c11a1b1e1b3480d2d3df684
      credentials:
        username: ${{ github.actor }}
        password: ${{ secrets.GITHUB_TOKEN }}
    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1

      - name: Install tools
        run: mise install --locked

      - name: Install dependencies
        run: uv sync --frozen

      - name: Format
        run: mise run python:format:check

      - name: Lint
        run: mise run python:lint

      - name: Typecheck
        run: mise run python:typecheck

      - name: Test
        run: mise run test:python

      - name: Test local gateway configuration helpers
        run: |
          bash tasks/scripts/test-gateway-pull-policy.sh
          bash tasks/scripts/test-gateway-config.sh
  go:
    name: Go SDK
    needs: pr_metadata
    if: needs.pr_metadata.outputs.should_run == 'true'
    runs-on: linux-amd64-cpu8
    timeout-minutes: 30
    container:
      image: ghcr.io/nvidia/openshell/ci:9cb72baa2e61a1b5f12407e6e82da7fdba0aa722@sha256:67a9a0c32cb99825e6d3e9d9eec45d67149ea1ff7c11a1b1e1b3480d2d3df684
      credentials:
        username: ${{ github.actor }}
        password: ${{ secrets.GITHUB_TOKEN }}
    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1

      - name: Install tools
        run: mise install --locked

      - name: Lint, build, test, proto-check
        run: mise run go:ci

  markdown:
    name: Markdown
    needs: pr_metadata
    if: needs.pr_metadata.outputs.should_run == 'true'
    runs-on: linux-amd64-cpu8
    timeout-minutes: 30
    container:
      image: ghcr.io/nvidia/openshell/ci:9cb72baa2e61a1b5f12407e6e82da7fdba0aa722@sha256:67a9a0c32cb99825e6d3e9d9eec45d67149ea1ff7c11a1b1e1b3480d2d3df684
      credentials:
        username: ${{ github.actor }}
        password: ${{ secrets.GITHUB_TOKEN }}
    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1

      - name: Install tools
        run: mise install --locked

      - name: Lint
        run: mise run markdown:lint

  sdk-typescript:
    name: TypeScript SDK
    needs: pr_metadata
    if: needs.pr_metadata.outputs.should_run == 'true'
    runs-on: linux-amd64-cpu8
    timeout-minutes: 30
    container:
      image: ghcr.io/nvidia/openshell/ci:9cb72baa2e61a1b5f12407e6e82da7fdba0aa722@sha256:67a9a0c32cb99825e6d3e9d9eec45d67149ea1ff7c11a1b1e1b3480d2d3df684
      credentials:
        username: ${{ github.actor }}
        password: ${{ secrets.GITHUB_TOKEN }}
    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1

      - name: Install tools
        run: mise install --locked

      - name: Check TypeScript SDK
        run: mise run sdk:ts:ci

      # Exercise the full release publish path (version stamp, dist-tag,
      # prepublishOnly, tarball) without uploading. Uses the off-tag dev
      # version, which validates the prerelease dist-tag branch too.
      - name: Verify publishable artifact (dry-run)
        env:
          OPENSHELL_NPM_PUBLISH_ARGS: --dry-run
        run: |
          OPENSHELL_NPM_VERSION="$(uv run python tasks/scripts/release.py get-version --npm)" \
            mise run sdk:ts:publish