Skip to content

Commit 9e53811

Browse files
committed
ci: add snap build and publish pipeline
- Add snap-package.yml workflow (workflow_call) that builds on linux-{amd64,arm64}-cpu8 runners, installs snapd/LXD/core24/snapcraft natively, packs the snap, and uploads to the Snap Store. - Integrate into release-dev.yml (latest/edge via latest/edge GitHub environment) and release-tag.yml (latest/stable via latest/stable GitHub environment with approval gates). - Add ubuntu-snap smoke test to release-canary.yml: install snap with --dangerous, connect all interfaces (docker, log-observe, system-observe, ssh-keys), and run openshell status. - Set grade: stable in snapcraft.yaml.
1 parent cd70249 commit 9e53811

5 files changed

Lines changed: 204 additions & 4 deletions

File tree

.github/workflows/release-canary.yml

Lines changed: 41 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -72,6 +72,47 @@ jobs:
7272
curl -LsSf https://raw.githubusercontent.com/NVIDIA/OpenShell/${{ github.event.workflow_run.head_sha || github.sha }}/install.sh | sh
7373
openshell status
7474
75+
ubuntu-snap:
76+
name: Ubuntu Snap
77+
if: ${{ github.event_name == 'workflow_dispatch' || github.event.workflow_run.conclusion == 'success' }}
78+
runs-on: ubuntu-24.04
79+
timeout-minutes: 20
80+
steps:
81+
- name: Install snapd
82+
run: |
83+
sudo apt-get update
84+
sudo apt-get install -y snapd
85+
sudo systemctl start snapd
86+
87+
- name: Install Docker snap
88+
run: |
89+
sudo snap install docker
90+
91+
- name: Download snap from release
92+
run: |
93+
set -euo pipefail
94+
SNAP_NAME=$(curl -sL "https://api.github.com/repos/NVIDIA/OpenShell/releases/tags/dev" | jq -r '.assets[].name' | grep -E 'openshell_.*amd64\.snap$' | head -1)
95+
if [ -z "$SNAP_NAME" ]; then
96+
echo "Could not find snap asset in dev release"
97+
exit 1
98+
fi
99+
curl -LsSf "https://github.com/NVIDIA/OpenShell/releases/download/dev/$SNAP_NAME" -o openshell.snap
100+
101+
- name: Install snap (dangerous — from release, not store)
102+
run: |
103+
sudo snap install ./openshell.snap --dangerous
104+
105+
- name: Connect interfaces
106+
run: |
107+
sudo snap connect openshell:docker docker:docker-daemon
108+
sudo snap connect openshell:log-observe
109+
sudo snap connect openshell:system-observe
110+
sudo snap connect openshell:ssh-keys
111+
112+
- name: Check status
113+
run: |
114+
openshell status
115+
75116
kubernetes:
76117
name: Kubernetes Helm (kind)
77118
if: ${{ github.event_name == 'workflow_dispatch' || github.event.workflow_run.conclusion == 'success' }}

.github/workflows/release-dev.yml

Lines changed: 20 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -647,6 +647,17 @@ jobs:
647647
checkout-ref: ${{ github.sha }}
648648
secrets: inherit
649649

650+
build-snap:
651+
name: Build Snap
652+
needs: [compute-versions]
653+
uses: ./.github/workflows/snap-package.yml
654+
with:
655+
checkout-ref: ${{ github.sha }}
656+
upload-channel: latest/edge
657+
github-environment: latest/edge
658+
secrets:
659+
publish-credentials: ${{ secrets.SNAPCRAFT_STORE_CREDENTIALS }}
660+
650661
build-rpm:
651662
name: Build RPM Packages
652663
needs: [compute-versions, build-cli-linux, build-gateway-binary-linux]
@@ -697,7 +708,7 @@ jobs:
697708
# ---------------------------------------------------------------------------
698709
release-dev:
699710
name: Release Dev
700-
needs: [compute-versions, build-cli-linux, build-cli-macos, build-gateway-binary-linux, build-gateway-binary-macos, build-supervisor-binary-linux, build-python-wheels-linux, build-python-wheel-macos, build-driver-vm-linux, build-driver-vm-macos, build-deb, build-rpm, smoke-linux-dev-artifacts]
711+
needs: [compute-versions, build-cli-linux, build-cli-macos, build-gateway-binary-linux, build-gateway-binary-macos, build-supervisor-binary-linux, build-python-wheels-linux, build-python-wheel-macos, build-driver-vm-linux, build-driver-vm-macos, build-deb, build-rpm, build-snap, smoke-linux-dev-artifacts]
701712
runs-on: linux-amd64-cpu8
702713
timeout-minutes: 10
703714
permissions:
@@ -759,6 +770,13 @@ jobs:
759770
path: release/
760771
merge-multiple: true
761772

773+
- name: Download snap artifacts
774+
uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
775+
with:
776+
pattern: snap-linux-*
777+
path: release/
778+
merge-multiple: true
779+
762780
- name: Normalize dev package filenames
763781
run: |
764782
set -euo pipefail
@@ -914,6 +932,7 @@ jobs:
914932
release/openshell-dev-amd64.deb
915933
release/openshell-dev-arm64.deb
916934
release/openshell-*.rpm
935+
release/*.snap
917936
release/openshell-gateway-x86_64-unknown-linux-gnu.tar.gz
918937
release/openshell-gateway-aarch64-unknown-linux-gnu.tar.gz
919938
release/openshell-gateway-aarch64-apple-darwin.tar.gz

.github/workflows/release-tag.yml

Lines changed: 20 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -683,6 +683,17 @@ jobs:
683683
checkout-ref: ${{ inputs.tag || github.ref }}
684684
secrets: inherit
685685

686+
build-snap:
687+
name: Build Snap
688+
needs: [compute-versions]
689+
uses: ./.github/workflows/snap-package.yml
690+
with:
691+
checkout-ref: ${{ inputs.tag || github.ref }}
692+
upload-channel: latest/stable
693+
github-environment: latest/stable
694+
secrets:
695+
publish-credentials: ${{ secrets.SNAPCRAFT_STORE_CREDENTIALS }}
696+
686697
build-rpm:
687698
name: Build RPM Packages
688699
needs: [compute-versions, build-cli-linux, build-gateway-binary-linux]
@@ -807,7 +818,7 @@ jobs:
807818
# ---------------------------------------------------------------------------
808819
release:
809820
name: Release
810-
needs: [compute-versions, build-cli-linux, build-cli-macos, build-gateway-binary-linux, build-gateway-binary-macos, build-supervisor-binary-linux, build-python-wheels-linux, build-python-wheel-macos, tag-ghcr-release, build-driver-vm-linux, build-driver-vm-macos, build-deb, build-rpm, smoke-linux-release-artifacts]
821+
needs: [compute-versions, build-cli-linux, build-cli-macos, build-gateway-binary-linux, build-gateway-binary-macos, build-supervisor-binary-linux, build-python-wheels-linux, build-python-wheel-macos, tag-ghcr-release, build-driver-vm-linux, build-driver-vm-macos, build-deb, build-rpm, build-snap, smoke-linux-release-artifacts]
811822
runs-on: linux-amd64-cpu8
812823
timeout-minutes: 10
813824
permissions:
@@ -871,6 +882,13 @@ jobs:
871882
path: release/
872883
merge-multiple: true
873884

885+
- name: Download snap artifacts
886+
uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
887+
with:
888+
pattern: snap-linux-*
889+
path: release/
890+
merge-multiple: true
891+
874892
- name: Capture wheel filenames
875893
id: wheel_filenames
876894
run: |
@@ -966,6 +984,7 @@ jobs:
966984
release/openshell-aarch64-apple-darwin.tar.gz
967985
release/openshell_*.deb
968986
release/openshell-*.rpm
987+
release/*.snap
969988
release/openshell-gateway-x86_64-unknown-linux-gnu.tar.gz
970989
release/openshell-gateway-aarch64-unknown-linux-gnu.tar.gz
971990
release/openshell-gateway-aarch64-apple-darwin.tar.gz

.github/workflows/snap-package.yml

Lines changed: 122 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,122 @@
1+
# SPDX-FileCopyrightText: Copyright (c) 2025-2026 NVIDIA CORPORATION & AFFILIATES. All rights reserved.
2+
# SPDX-License-Identifier: Apache-2.0
3+
4+
name: Snap Package
5+
6+
on:
7+
workflow_call:
8+
inputs:
9+
checkout-ref:
10+
required: true
11+
type: string
12+
upload-channel:
13+
required: true
14+
type: string
15+
description: "Snap Store channel to upload to (e.g., latest/edge, latest/candidate, latest/stable)"
16+
github-environment:
17+
required: true
18+
type: string
19+
description: "GitHub deployment environment for approval gates (e.g., latest/edge, latest/stable)"
20+
21+
permissions:
22+
contents: read
23+
24+
defaults:
25+
run:
26+
shell: bash
27+
28+
jobs:
29+
build-snap:
30+
name: Build Snap (Linux ${{ matrix.arch }})
31+
strategy:
32+
matrix:
33+
include:
34+
- arch: amd64
35+
runner: linux-amd64-cpu8
36+
- arch: arm64
37+
runner: linux-arm64-cpu8
38+
runs-on: ${{ matrix.runner }}
39+
timeout-minutes: 60
40+
steps:
41+
- uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
42+
with:
43+
ref: ${{ inputs.checkout-ref }}
44+
fetch-depth: 0
45+
46+
- name: Install snapd
47+
run: |
48+
set -euo pipefail
49+
if ! command -v snapd >/dev/null 2>&1; then
50+
sudo apt-get update
51+
sudo apt-get install -y snapd
52+
fi
53+
sudo systemctl start snapd
54+
sudo systemctl enable snapd
55+
56+
- name: Install LXD
57+
run: |
58+
set -euo pipefail
59+
sudo snap install lxd
60+
sudo usermod -aG lxd $USER
61+
sudo lxd init --auto
62+
63+
- name: Install core24
64+
run: |
65+
set -euo pipefail
66+
sudo snap install core24
67+
68+
- name: Install snapcraft
69+
run: |
70+
set -euo pipefail
71+
sudo snap install snapcraft --classic
72+
73+
- name: Build snap
74+
run: |
75+
set -euo pipefail
76+
snapcraft pack -v
77+
78+
- name: Capture snap filename
79+
id: capture
80+
run: |
81+
set -euo pipefail
82+
SNAP_FILE=$(ls -1 *.snap 2>/dev/null | head -1)
83+
if [ -z "$SNAP_FILE" ]; then
84+
echo "ERROR: No .snap file found after snapcraft pack"
85+
exit 1
86+
fi
87+
echo "snap-file=${SNAP_FILE}" >> $GITHUB_OUTPUT
88+
echo "Built snap: ${SNAP_FILE}"
89+
90+
- name: Upload snap artifact (${{ matrix.arch }})
91+
uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7
92+
with:
93+
name: snap-linux-${{ matrix.arch }}
94+
path: |
95+
${{ steps.capture.outputs.snap-file }}
96+
*.comp
97+
retention-days: 5
98+
99+
- name: Upload snap to Snap Store
100+
environment:
101+
name: ${{ inputs.github-environment }}
102+
env:
103+
SNAPCRAFT_STORE_CREDENTIALS: ${{ secrets.SNAPCRAFT_STORE_CREDENTIALS }}
104+
run: |
105+
set -euo pipefail
106+
SNAP_FILE="${{ steps.capture.outputs.snap-file }}"
107+
SNAP_NAME="${SNAP_FILE%.snap}"
108+
SNAP_NAME="${SNAP_NAME%%_*}"
109+
110+
COMPONENT_ARGS=()
111+
shopt -s nullglob
112+
for comp in "${SNAP_NAME}"+*.comp; do
113+
echo "Adding component: $comp"
114+
COMPONENT_ARGS+=(--component "$comp")
115+
done
116+
117+
echo "Uploading $SNAP_FILE to ${{ inputs.upload-channel }}"
118+
if [ ${#COMPONENT_ARGS[@]} -gt 0 ]; then
119+
snapcraft upload --release "${{ inputs.upload-channel }}" "$SNAP_FILE" "${COMPONENT_ARGS[@]}"
120+
else
121+
snapcraft upload --release "${{ inputs.upload-channel }}" "$SNAP_FILE"
122+
fi

snapcraft.yaml

Lines changed: 1 addition & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -12,8 +12,7 @@ description: |
1212
LLM inference routing.
1313
1414
base: core24
15-
# TODO: this prevents publishing a snap to latest/stable.
16-
grade: devel
15+
grade: stable
1716
confinement: strict
1817
license: Apache-2.0
1918
website: https://docs.nvidia.com/openshell/latest/index.html

0 commit comments

Comments
 (0)