feat(k8s): add operator namespace label watcher #3422
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: Branch Checks | |
| on: | |
| merge_group: | |
| types: [checks_requested] | |
| push: | |
| branches: | |
| - "pull-request/[0-9]+" | |
| workflow_dispatch: | |
| env: | |
| CARGO_TERM_COLOR: always | |
| CARGO_INCREMENTAL: "0" | |
| MISE_GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} | |
| permissions: | |
| contents: read | |
| packages: read | |
| concurrency: | |
| group: ${{ github.workflow }}-${{ github.ref }} | |
| cancel-in-progress: true | |
| jobs: | |
| pr_metadata: | |
| name: Resolve PR metadata | |
| runs-on: ubuntu-latest | |
| permissions: | |
| contents: read | |
| pull-requests: read | |
| outputs: | |
| should_run: ${{ steps.gate.outputs.should_run }} | |
| steps: | |
| - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 | |
| - id: gate | |
| uses: ./.github/actions/pr-gate | |
| mise-lockfile: | |
| name: mise Lockfile | |
| needs: pr_metadata | |
| if: needs.pr_metadata.outputs.should_run == 'true' | |
| runs-on: linux-amd64-cpu8 | |
| container: | |
| image: ghcr.io/nvidia/openshell/ci:latest | |
| credentials: | |
| username: ${{ github.actor }} | |
| password: ${{ secrets.GITHUB_TOKEN }} | |
| steps: | |
| - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 | |
| - name: Mark workspace as safe for git | |
| run: git config --global --add safe.directory "$GITHUB_WORKSPACE" | |
| - name: Verify mise.lock is in sync with mise.toml | |
| run: | | |
| mise lock | |
| if ! git diff --exit-code mise.lock; then | |
| echo "::error::mise.lock is out of sync with mise.toml. Run 'mise lock' locally and commit the result." >&2 | |
| exit 1 | |
| fi | |
| license-headers: | |
| name: License Headers | |
| needs: pr_metadata | |
| if: needs.pr_metadata.outputs.should_run == 'true' | |
| runs-on: linux-amd64-cpu8 | |
| container: | |
| image: ghcr.io/nvidia/openshell/ci:latest | |
| credentials: | |
| username: ${{ github.actor }} | |
| password: ${{ secrets.GITHUB_TOKEN }} | |
| steps: | |
| - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 | |
| - name: Install tools | |
| run: mise install --locked | |
| - name: Check license headers | |
| run: mise run license:check | |
| rust: | |
| name: Rust (${{ matrix.runner }}) | |
| needs: pr_metadata | |
| if: needs.pr_metadata.outputs.should_run == 'true' | |
| strategy: | |
| fail-fast: false | |
| matrix: | |
| runner: [linux-amd64-cpu8, linux-arm64-cpu8] | |
| runs-on: ${{ matrix.runner }} | |
| env: | |
| SCCACHE_GHA_ENABLED: "true" | |
| SCCACHE_GHA_VERSION: branch-checks-rust-${{ matrix.runner }} | |
| container: | |
| image: ghcr.io/nvidia/openshell/ci:latest | |
| credentials: | |
| username: ${{ github.actor }} | |
| password: ${{ secrets.GITHUB_TOKEN }} | |
| steps: | |
| - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 | |
| - name: Configure GHA sccache backend | |
| uses: mozilla-actions/sccache-action@9e7fa8a12102821edf02ca5dbea1acd0f89a2696 # v0.0.10 | |
| - name: Install tools | |
| run: mise install --locked | |
| - name: Cache Rust target and registry | |
| uses: Swatinem/rust-cache@c19371144df3bb44fab255c43d04cbc2ab54d1c4 # v2.9.1 | |
| with: | |
| # Keep branch-check caches partitioned by runner architecture; lint | |
| # and test intentionally share the same job-local target directory. | |
| shared-key: rust-checks-${{ matrix.runner }} | |
| # Preserve compiled artifacts from failed lint/test runs so the next | |
| # push to the same PR branch does not start from a cold cache. | |
| cache-on-failure: "true" | |
| - name: Format | |
| run: mise run rust:format:check | |
| - name: Lint | |
| run: mise run rust:lint | |
| - name: Test | |
| run: mise run test:rust | |
| - name: Verify telemetry can be compiled out | |
| run: mise run rust:verify:telemetry-off | |
| - name: Verify system CA roots build mode compiles and excludes bundled Mozilla roots | |
| run: mise run rust:verify:system-ca-roots | |
| - name: sccache stats | |
| if: always() | |
| run: | | |
| set +e | |
| stats_bin="${SCCACHE_PATH:-sccache}" | |
| "$stats_bin" --show-stats | |
| status=$? | |
| if [ "$status" -ne 0 ]; then | |
| echo "::warning::sccache stats unavailable (exit $status)" | |
| fi | |
| exit 0 | |
| rust-macos: | |
| name: Rust lint (macOS) | |
| needs: pr_metadata | |
| if: needs.pr_metadata.outputs.should_run == 'true' | |
| runs-on: macos-latest | |
| timeout-minutes: 20 | |
| steps: | |
| - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 | |
| - name: Install mise | |
| run: | | |
| curl --proto '=https' --tlsv1.2 -sSf https://mise.run | MISE_VERSION=v2026.4.25 sh | |
| echo "$HOME/.local/bin" >> "$GITHUB_PATH" | |
| echo "$HOME/.local/share/mise/shims" >> "$GITHUB_PATH" | |
| - name: Configure GHA sccache backend | |
| uses: mozilla-actions/sccache-action@9e7fa8a12102821edf02ca5dbea1acd0f89a2696 # v0.0.10 | |
| - name: Install Rust and Clippy | |
| run: | | |
| mise install --locked rust | |
| rustup component add clippy | |
| - name: Cache Rust target and registry | |
| uses: Swatinem/rust-cache@c19371144df3bb44fab255c43d04cbc2ab54d1c4 # v2.9.1 | |
| with: | |
| shared-key: rust-clippy-macos | |
| cache-on-failure: "true" | |
| - name: Lint macOS-sensitive crates | |
| # Formatting is target-independent and already checked by the Linux jobs. | |
| # The full mise lint covers every workspace/E2E target and requires extra | |
| # native dependencies such as Z3; keep this guard focused on macOS cfgs. | |
| run: | | |
| cargo clippy \ | |
| -p openshell-sandbox \ | |
| -p openshell-core \ | |
| -p openshell-cli \ | |
| --all-targets \ | |
| -- -D warnings | |
| python: | |
| name: Python (${{ matrix.runner }}) | |
| needs: pr_metadata | |
| if: needs.pr_metadata.outputs.should_run == 'true' | |
| strategy: | |
| fail-fast: false | |
| matrix: | |
| runner: [linux-amd64-cpu8, linux-arm64-cpu8] | |
| runs-on: ${{ matrix.runner }} | |
| container: | |
| image: ghcr.io/nvidia/openshell/ci:latest | |
| credentials: | |
| username: ${{ github.actor }} | |
| password: ${{ secrets.GITHUB_TOKEN }} | |
| steps: | |
| - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 | |
| - name: Install tools | |
| run: mise install --locked | |
| - name: Install dependencies | |
| run: uv sync --frozen | |
| - name: Format | |
| run: mise run python:format:check | |
| - name: Lint | |
| run: mise run python:lint | |
| - name: Typecheck | |
| run: mise run python:typecheck | |
| - name: Test | |
| run: mise run test:python | |
| go: | |
| name: Go SDK | |
| needs: pr_metadata | |
| if: needs.pr_metadata.outputs.should_run == 'true' | |
| runs-on: linux-amd64-cpu8 | |
| container: | |
| image: ghcr.io/nvidia/openshell/ci:latest | |
| credentials: | |
| username: ${{ github.actor }} | |
| password: ${{ secrets.GITHUB_TOKEN }} | |
| steps: | |
| - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 | |
| - name: Install tools | |
| run: mise install --locked | |
| - name: Lint, build, test, proto-check | |
| run: mise run go:ci | |
| markdown: | |
| name: Markdown | |
| needs: pr_metadata | |
| if: needs.pr_metadata.outputs.should_run == 'true' | |
| runs-on: linux-amd64-cpu8 | |
| container: | |
| image: ghcr.io/nvidia/openshell/ci:latest | |
| credentials: | |
| username: ${{ github.actor }} | |
| password: ${{ secrets.GITHUB_TOKEN }} | |
| steps: | |
| - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 | |
| - name: Install tools | |
| run: mise install --locked | |
| - name: Lint | |
| run: mise run markdown:lint |