From 262d469df27624a301f56cdd7a173f37d2292015 Mon Sep 17 00:00:00 2001 From: Fedor Korotkov Date: Fri, 5 Jun 2026 10:12:53 -0700 Subject: [PATCH 01/20] Migrate CI to GitHub Actions --- .cirrus.star | 4 -- .cirrus.yml | 68 ----------------------- .github/workflows/ci.yml | 75 ++++++++++++++++++++++++++ .github/workflows/main.yml | 24 --------- .github/workflows/release.yml | 81 ++++++++++++++++++++++++++++ .golangci.yml | 34 +++++++----- .goreleaser.yml | 27 ++-------- Dockerfile | 25 +++++---- packaging/orchard-controller.service | 12 ----- packaging/postinstall.sh | 17 ------ packaging/postremove.sh | 20 ------- packaging/preremove.sh | 14 ----- 12 files changed, 195 insertions(+), 206 deletions(-) delete mode 100644 .cirrus.star delete mode 100644 .cirrus.yml create mode 100644 .github/workflows/ci.yml delete mode 100644 .github/workflows/main.yml create mode 100644 .github/workflows/release.yml delete mode 100644 packaging/orchard-controller.service delete mode 100644 packaging/postinstall.sh delete mode 100644 packaging/postremove.sh delete mode 100644 packaging/preremove.sh diff --git a/.cirrus.star b/.cirrus.star deleted file mode 100644 index 0a131539..00000000 --- a/.cirrus.star +++ /dev/null @@ -1,4 +0,0 @@ -load("github.com/cirrus-modules/golang@main", "lint_task") - -def main(ctx): - return [lint_task()] diff --git a/.cirrus.yml b/.cirrus.yml deleted file mode 100644 index ab467cf9..00000000 --- a/.cirrus.yml +++ /dev/null @@ -1,68 +0,0 @@ -task: - name: Test (macOS) - persistent_worker: - labels: - name: dev-mini - resources: - tart-vms: 2 - pre_pull_script: - - tart pull ghcr.io/cirruslabs/macos-tahoe-base:latest - test_script: - - go test -timeout=20m -ldflags="-B gobuildid" -v -count=1 ./... - always: - cleanup_script: - - tart list - - rm -rf ~/.tart/vms/orchard-* - -task: - depends_on: - - Lint - - Test (macOS) - env: - MACOS_SIGN_P12: ENCRYPTED[!183482723ca1a95f9c4439f7a79c9d3b115472bb18c739ed1586e12d3914ccf94ade8169eeda7332fc204f8be9c27d9f!] - MACOS_SIGN_PASSWORD: ENCRYPTED[!417423346c567f12007f42d084bff1cfee30ee14f7e8258550157679a269c70d541c9f19224224ab0293b10f2c6d4c5e!] - MACOS_NOTARY_ISSUER_ID: ENCRYPTED[!74076906e9fa36bca3c1da1637b0759b58bb009eb1a707446896eefad3767e8dba1d0f87e71106b98cde98ac4b037a2a!] - MACOS_NOTARY_KEY_ID: ENCRYPTED[!af9e5da1010a6b04e548ef494acc77a6e0ce176549de98f81c5b5cdd72856de09f77e51cf0849e3c4b7a2d2c22f25ca8!] - MACOS_NOTARY_KEY: ENCRYPTED[!c70c53f3e6c163931c7cdf9d90aff8934ef21d5dd1090158688e00b94e97c68257d9cf4ae1df873e6ae0d949866aee72!] - GITHUB_TOKEN: ENCRYPTED[!98ace8259c6024da912c14d5a3c5c6aac186890a8d4819fad78f3e0c41a4e0cd3a2537dd6e91493952fb056fa434be7c!] - GORELEASER_KEY: ENCRYPTED[!9b80b6ef684ceaf40edd4c7af93014ee156c8aba7e6e5795f41c482729887b5c31f36b651491d790f1f668670888d9fd!] - FURY_TOKEN: ENCRYPTED[!97fe4497d9aca60a3d64904883b81e21f19706c6aedda625c97f62f67ec46b8efa74c55699956158bbf0a23726e7d9f6!] - container: - image: golang:latest - cpu: 4 - memory: 12G - matrix: - - name: Release Binaries - only_if: $CIRRUS_TAG != '' - install_goreleaser_script: - - echo 'deb [trusted=yes] https://repo.goreleaser.com/apt/ /' | tee /etc/apt/sources.list.d/goreleaser.list - - apt update && apt -y install goreleaser-pro - release_script: goreleaser - - name: Release Binaries (Dry Run) - only_if: $CIRRUS_TAG == '' - install_goreleaser_script: - - echo 'deb [trusted=yes] https://repo.goreleaser.com/apt/ /' | tee /etc/apt/sources.list.d/goreleaser.list - - apt update && apt -y install goreleaser-pro - release_script: goreleaser release --skip=publish --snapshot --clean --verbose - binaries_artifacts: - path: "dist/orchard_*/orchard*" - -docker_builder: - name: Release Docker Image - only_if: $CIRRUS_TAG != '' - depends_on: - - Lint - - Test (macOS) - env: - GITHUB_TOKEN: ENCRYPTED[!82ed873afdf627284305afef4958c85a8f73127b09978a9786ac521559630ea6c9a5ab6e7f8315abf9ead09b6eff6eae!] - login_script: - - echo $GITHUB_TOKEN | docker login ghcr.io -u fkorotkov --password-stdin - setup_script: - - docker buildx create --name multibuilder - - docker buildx use multibuilder - - docker buildx inspect --bootstrap - deploy_script: | - docker buildx build --push --platform linux/amd64,linux/arm64 \ - --tag ghcr.io/cirruslabs/orchard:$CIRRUS_TAG \ - --tag ghcr.io/cirruslabs/orchard:latest \ - . diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml new file mode 100644 index 00000000..e7a7dc2c --- /dev/null +++ b/.github/workflows/ci.yml @@ -0,0 +1,75 @@ +name: CI + +on: + merge_group: + pull_request: + push: + branches: + - main + workflow_dispatch: + +permissions: + contents: read + pull-requests: read + +jobs: + lint: + name: Lint + runs-on: ubuntu-latest + timeout-minutes: 15 + steps: + - uses: actions/checkout@v6 + - uses: actions/setup-go@v6 + with: + go-version-file: go.mod + cache: true + - uses: golangci/golangci-lint-action@v9 + with: + version: v2.12.0 + only-new-issues: true + + test-linux: + name: Test (Linux) + runs-on: ghcr.io/cirruslabs/ubuntu-runner-amd64:24.04-md + timeout-minutes: 60 + steps: + - uses: actions/checkout@v6 + - uses: actions/setup-go@v6 + with: + go-version-file: go.mod + cache: true + - name: Check out Vetu + uses: actions/checkout@v6 + with: + repository: openai/vetu + path: _vetu + - name: Build Vetu + working-directory: _vetu + run: | + go build -o "$RUNNER_TEMP/vetu" cmd/vetu/main.go + sudo setcap cap_net_raw,cap_net_admin+eip "$RUNNER_TEMP/vetu" + echo "$RUNNER_TEMP" >> "$GITHUB_PATH" + - name: Pre-pull default Vetu image + run: vetu pull ghcr.io/cirruslabs/ubuntu-runner-amd64:latest + - name: Run tests + run: go test -v -count=1 ./... + + test-macos: + name: Test (macOS) + runs-on: ghcr.io/cirruslabs/macos-runner:tahoe + timeout-minutes: 45 + steps: + - uses: actions/checkout@v6 + - uses: actions/setup-go@v6 + with: + go-version-file: go.mod + cache: true + - name: Pre-pull default Tart image + run: tart pull ghcr.io/cirruslabs/macos-tahoe-base:latest + - name: Run tests + run: go test -timeout=20m -ldflags="-B gobuildid" -v -count=1 ./... + - name: Clean up test VMs + if: always() + run: | + tart list + rm -rf ~/.tart/vms/orchard-* diff --git a/.github/workflows/main.yml b/.github/workflows/main.yml deleted file mode 100644 index 5c878ace..00000000 --- a/.github/workflows/main.yml +++ /dev/null @@ -1,24 +0,0 @@ -name: Main - -on: - push: - -jobs: - test: - name: Test (Linux) - runs-on: ghcr.io/cirruslabs/ubuntu-runner-amd64:24.04-md - steps: - - uses: actions/checkout@v4 - - uses: actions/setup-go@v5 - with: - go-version: stable - - name: Install Vetu - run: | - sudo apt-get update && sudo apt-get -y install apt-transport-https ca-certificates - echo "deb [trusted=yes] https://apt.fury.io/cirruslabs/ /" | sudo tee /etc/apt/sources.list.d/cirruslabs.list - sudo apt-get update && sudo apt-get -y install vetu - - name: Pre-pull default Vetu image for use in tests - run: | - vetu pull ghcr.io/cirruslabs/ubuntu-runner-amd64:latest - - name: Run tests - run: go test -v -count=1 ./... diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml new file mode 100644 index 00000000..620a8595 --- /dev/null +++ b/.github/workflows/release.yml @@ -0,0 +1,81 @@ +name: Release + +on: + push: + tags: + - "*" + workflow_dispatch: + +permissions: + contents: write + packages: write + +jobs: + release: + name: ${{ github.ref_type == 'tag' && 'Release Binaries' || 'Release Binaries (Dry Run)' }} + runs-on: ubuntu-latest + timeout-minutes: 60 + env: + GITHUB_TOKEN: ${{ secrets.GH_PAT }} + GORELEASER_KEY: ${{ secrets.GORELEASER_KEY }} + MACOS_NOTARY_ISSUER_ID: ${{ secrets.MACOS_NOTARY_ISSUER_ID }} + MACOS_NOTARY_KEY: ${{ secrets.MACOS_NOTARY_KEY }} + MACOS_NOTARY_KEY_ID: ${{ secrets.MACOS_NOTARY_KEY_ID }} + MACOS_SIGN_P12: ${{ secrets.MACOS_SIGN_P12 }} + MACOS_SIGN_PASSWORD: ${{ secrets.MACOS_SIGN_PASSWORD }} + steps: + - uses: actions/checkout@v6 + with: + fetch-depth: 0 + - uses: actions/setup-go@v6 + with: + go-version-file: go.mod + cache: true + - name: Release + if: github.ref_type == 'tag' + uses: goreleaser/goreleaser-action@v7 + with: + distribution: goreleaser-pro + version: "~> v2" + args: release --clean + - name: Release dry run + if: github.ref_type != 'tag' + uses: goreleaser/goreleaser-action@v7 + with: + distribution: goreleaser-pro + version: "~> v2" + args: release --skip=publish --snapshot --clean + - name: Upload dry-run artifacts + if: github.ref_type != 'tag' + uses: actions/upload-artifact@v6 + with: + name: orchard-snapshot + path: dist/** + + docker: + name: Release Docker Image + if: github.ref_type == 'tag' + needs: release + runs-on: ubuntu-latest + timeout-minutes: 60 + steps: + - uses: actions/checkout@v6 + - uses: docker/setup-qemu-action@v4 + - uses: docker/setup-buildx-action@v4 + - uses: docker/login-action@v4 + with: + registry: ghcr.io + username: ${{ github.actor }} + password: ${{ github.token }} + - name: Build and push + uses: docker/build-push-action@v7 + with: + context: . + platforms: linux/amd64,linux/arm64 + push: true + tags: | + ghcr.io/openai/orchard:${{ github.ref_name }} + ghcr.io/openai/orchard:latest + build-args: | + VERSION=${{ github.ref_name }} + COMMIT=${{ github.sha }} diff --git a/.golangci.yml b/.golangci.yml index 367df6eb..1354c277 100644 --- a/.golangci.yml +++ b/.golangci.yml @@ -1,24 +1,30 @@ -version: 2 +version: "2" run: timeout: 5m -linters-settings: - # Even in Rust you can get away with partial matching, - # so make sure that the linter respects the programmer's - # intent expressed in the form of "default" case. - exhaustive: - default-signifies-exhaustive: true - - gosec: - excludes: - - G115 - formatters: - enable-all: true + enable: + - gci + - gofmt + - gofumpt + - goimports + - golines + - swaggo linters: - enable-all: true + default: all + + settings: + # Even in Rust you can get away with partial matching, + # so make sure that the linter respects the programmer's + # intent expressed in the form of "default" case. + exhaustive: + default-signifies-exhaustive: true + + gosec: + excludes: + - G115 disable: # We don't have high-performance requirements at this moment, so sacrificing diff --git a/.goreleaser.yml b/.goreleaser.yml index b53d35cb..3643afb8 100644 --- a/.goreleaser.yml +++ b/.goreleaser.yml @@ -23,7 +23,8 @@ builds: archives: - id: binary - format: binary + formats: + - binary name_template: "{{ .ProjectName }}-{{ .Os }}-{{ .Arch }}" - id: regular name_template: "{{ .ProjectName }}-{{ .Os }}-{{ .Arch }}" @@ -31,28 +32,6 @@ archives: release: prerelease: auto -nfpms: - - package_name: orchard-controller - vendor: Cirrus Labs, Inc. - homepage: https://github.com/cirruslabs/orchard - maintainer: support@cirruslabs.org - description: Orchestrator for running Tart Virtual Machines on a cluster of Apple Silicon devices - section: misc - formats: - - deb - - rpm - contents: - - src: packaging/orchard-controller.service - dst: /lib/systemd/system/orchard-controller.service - type: config - scripts: - postinstall: packaging/postinstall.sh - preremove: packaging/preremove.sh - postremove: packaging/postremove.sh - -furies: - - account: cirruslabs - notarize: macos: - enabled: '{{ isEnvSet "MACOS_SIGN_P12" }}' @@ -75,6 +54,6 @@ brews: bin.install "orchard" generate_completions_from_executable(bin/"orchard", "completion") caveats: See the Github repository for more information - homepage: https://github.com/cirruslabs/orchard + homepage: https://github.com/openai/orchard description: Orchestrator for running Tart Virtual Machines on a cluster of Apple Silicon devices skip_upload: auto diff --git a/Dockerfile b/Dockerfile index 3fd1aefc..7a5df4dd 100644 --- a/Dockerfile +++ b/Dockerfile @@ -1,22 +1,29 @@ -FROM golang:latest AS builder +FROM golang:1.25 AS builder -# Install GoReleaser Pro -RUN echo 'deb [trusted=yes] https://repo.goreleaser.com/apt/ /' | tee /etc/apt/sources.list.d/goreleaser.list -RUN apt update && apt -y install goreleaser-pro +WORKDIR /src -WORKDIR /tmp/orchard -ADD . /tmp/orchard/ +COPY go.mod go.sum ./ +RUN go mod download -RUN goreleaser build --single-target --snapshot --timeout 60m +COPY . . + +ARG VERSION=dev +ARG COMMIT=unknown + +RUN CGO_ENABLED=0 go build \ + -trimpath \ + -ldflags="-X github.com/cirruslabs/orchard/internal/version.Version=${VERSION} -X github.com/cirruslabs/orchard/internal/version.Commit=${COMMIT} -B gobuildid" \ + -o /out/orchard \ + cmd/orchard/main.go FROM gcr.io/distroless/base -LABEL org.opencontainers.image.source=https://github.com/cirruslabs/orchard +LABEL org.opencontainers.image.source=https://github.com/openai/orchard ENV GIN_MODE=release ENV ORCHARD_HOME=/data EXPOSE 6120 -COPY --from=builder /tmp/orchard/dist/linux_*/orchard_linux_*/orchard /bin/orchard +COPY --from=builder /out/orchard /bin/orchard ENTRYPOINT ["/bin/orchard"] diff --git a/packaging/orchard-controller.service b/packaging/orchard-controller.service deleted file mode 100644 index 96a93abd..00000000 --- a/packaging/orchard-controller.service +++ /dev/null @@ -1,12 +0,0 @@ -[Unit] -Description=Orchard Controller -Wants=network-online.target -After=network-online.target - -[Service] -Type=simple -User=orchard-controller -ExecStart=/usr/bin/orchard controller run - -[Install] -WantedBy=multi-user.target diff --git a/packaging/postinstall.sh b/packaging/postinstall.sh deleted file mode 100644 index 54643713..00000000 --- a/packaging/postinstall.sh +++ /dev/null @@ -1,17 +0,0 @@ -#!/bin/bash - -# Set shell options to enable fail-fast behavior -# -# * -e: fail the script when an error occurs or command fails -# * -u: fail the script when attempting to reference unset parameters -# * -o pipefail: by default an exit status of a pipeline is that of its -# last command, this fails the pipe early if an error in -# any of its commands occurs -# -set -euo pipefail - -# Create "orchard-controller" user and group -useradd --system --create-home --home-dir /var/lib/orchard-controller --user-group orchard-controller - -# Now that the orchard-controller.service file is installed, reflect the changes in systemd -systemctl daemon-reload diff --git a/packaging/postremove.sh b/packaging/postremove.sh deleted file mode 100644 index 743ea460..00000000 --- a/packaging/postremove.sh +++ /dev/null @@ -1,20 +0,0 @@ -#!/bin/bash - -# Set shell options to enable fail-fast behavior -# -# * -e: fail the script when an error occurs or command fails -# * -u: fail the script when attempting to reference unset parameters -# * -o pipefail: by default an exit status of a pipeline is that of its -# last command, this fails the pipe early if an error in -# any of its commands occurs -# -set -euo pipefail - -# Delete "orchard-controller" user and group -if id "orchard-controller" &>/dev/null -then - userdel orchard-controller -fi - -# Now that the orchard-controller.service file is removed, reflect the changes in systemd -systemctl daemon-reload diff --git a/packaging/preremove.sh b/packaging/preremove.sh deleted file mode 100644 index 687c57e4..00000000 --- a/packaging/preremove.sh +++ /dev/null @@ -1,14 +0,0 @@ -#!/bin/bash - -# Set shell options to enable fail-fast behavior -# -# * -e: fail the script when an error occurs or command fails -# * -u: fail the script when attempting to reference unset parameters -# * -o pipefail: by default an exit status of a pipeline is that of its -# last command, this fails the pipe early if an error in -# any of its commands occurs -# -set -euo pipefail - -# Stop the service, otherwise we won't be able to remove the "orchard-controller" user -systemctl stop orchard-controller.service From 2fc8b8e264a8998d9ff655166bc07a61091d4cf1 Mon Sep 17 00:00:00 2001 From: Fedor Korotkov Date: Mon, 6 Jul 2026 13:05:18 -0400 Subject: [PATCH 02/20] Publish Orchard through the OpenAI Homebrew tap --- .github/workflows/release.yml | 30 +++++++++++++++++++++++++++--- .goreleaser.yml | 8 ++++++-- 2 files changed, 33 insertions(+), 5 deletions(-) diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml index 620a8595..d7077321 100644 --- a/.github/workflows/release.yml +++ b/.github/workflows/release.yml @@ -7,16 +7,15 @@ on: workflow_dispatch: permissions: - contents: write - packages: write + contents: read jobs: release: name: ${{ github.ref_type == 'tag' && 'Release Binaries' || 'Release Binaries (Dry Run)' }} runs-on: ubuntu-latest timeout-minutes: 60 + environment: publish env: - GITHUB_TOKEN: ${{ secrets.GH_PAT }} GORELEASER_KEY: ${{ secrets.GORELEASER_KEY }} MACOS_NOTARY_ISSUER_ID: ${{ secrets.MACOS_NOTARY_ISSUER_ID }} MACOS_NOTARY_KEY: ${{ secrets.MACOS_NOTARY_KEY }} @@ -31,6 +30,25 @@ jobs: with: go-version-file: go.mod cache: true + - name: Create release app token for this repo + if: github.ref_type == 'tag' + id: app-token + uses: actions/create-github-app-token@1b10c78c7865c340bc4f6099eb2f838309f1e8c3 # v3.1.1 + with: + app-id: ${{ secrets.RELEASE_APP_ID }} + private-key: ${{ secrets.RELEASE_APP_PRIVATE_KEY }} + permission-contents: write + - name: Create release app token for homebrew-tools + if: github.ref_type == 'tag' + id: tap-token + uses: actions/create-github-app-token@1b10c78c7865c340bc4f6099eb2f838309f1e8c3 # v3.1.1 + with: + app-id: ${{ secrets.RELEASE_APP_ID }} + private-key: ${{ secrets.RELEASE_APP_PRIVATE_KEY }} + owner: openai + repositories: homebrew-tools + permission-contents: write + permission-pull-requests: write - name: Release if: github.ref_type == 'tag' uses: goreleaser/goreleaser-action@v7 @@ -38,6 +56,9 @@ jobs: distribution: goreleaser-pro version: "~> v2" args: release --clean + env: + GITHUB_TOKEN: ${{ steps.app-token.outputs.token }} + HOMEBREW_TAP_GITHUB_TOKEN: ${{ steps.tap-token.outputs.token }} - name: Release dry run if: github.ref_type != 'tag' uses: goreleaser/goreleaser-action@v7 @@ -58,6 +79,9 @@ jobs: needs: release runs-on: ubuntu-latest timeout-minutes: 60 + permissions: + contents: read + packages: write steps: - uses: actions/checkout@v6 - uses: docker/setup-qemu-action@v4 diff --git a/.goreleaser.yml b/.goreleaser.yml index 3643afb8..74473a90 100644 --- a/.goreleaser.yml +++ b/.goreleaser.yml @@ -48,8 +48,12 @@ brews: ids: - regular repository: - owner: cirruslabs - name: homebrew-cli + owner: openai + name: homebrew-tools + token: "{{ .Env.HOMEBREW_TAP_GITHUB_TOKEN }}" + branch: "orchard-{{ .Version }}" + pull_request: + enabled: true install: | bin.install "orchard" generate_completions_from_executable(bin/"orchard", "completion") From 641d86716f5391919d6e7ada11047c6951850372 Mon Sep 17 00:00:00 2001 From: Fedor Korotkov Date: Mon, 6 Jul 2026 13:10:14 -0400 Subject: [PATCH 03/20] Scope release secrets to GoReleaser steps --- .github/workflows/release.yml | 20 +++++++++++++------- 1 file changed, 13 insertions(+), 7 deletions(-) diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml index d7077321..910af922 100644 --- a/.github/workflows/release.yml +++ b/.github/workflows/release.yml @@ -15,13 +15,6 @@ jobs: runs-on: ubuntu-latest timeout-minutes: 60 environment: publish - env: - GORELEASER_KEY: ${{ secrets.GORELEASER_KEY }} - MACOS_NOTARY_ISSUER_ID: ${{ secrets.MACOS_NOTARY_ISSUER_ID }} - MACOS_NOTARY_KEY: ${{ secrets.MACOS_NOTARY_KEY }} - MACOS_NOTARY_KEY_ID: ${{ secrets.MACOS_NOTARY_KEY_ID }} - MACOS_SIGN_P12: ${{ secrets.MACOS_SIGN_P12 }} - MACOS_SIGN_PASSWORD: ${{ secrets.MACOS_SIGN_PASSWORD }} steps: - uses: actions/checkout@v6 with: @@ -58,7 +51,13 @@ jobs: args: release --clean env: GITHUB_TOKEN: ${{ steps.app-token.outputs.token }} + GORELEASER_KEY: ${{ secrets.GORELEASER_KEY }} HOMEBREW_TAP_GITHUB_TOKEN: ${{ steps.tap-token.outputs.token }} + MACOS_NOTARY_ISSUER_ID: ${{ secrets.MACOS_NOTARY_ISSUER_ID }} + MACOS_NOTARY_KEY: ${{ secrets.MACOS_NOTARY_KEY }} + MACOS_NOTARY_KEY_ID: ${{ secrets.MACOS_NOTARY_KEY_ID }} + MACOS_SIGN_P12: ${{ secrets.MACOS_SIGN_P12 }} + MACOS_SIGN_PASSWORD: ${{ secrets.MACOS_SIGN_PASSWORD }} - name: Release dry run if: github.ref_type != 'tag' uses: goreleaser/goreleaser-action@v7 @@ -66,6 +65,13 @@ jobs: distribution: goreleaser-pro version: "~> v2" args: release --skip=publish --snapshot --clean + env: + GORELEASER_KEY: ${{ secrets.GORELEASER_KEY }} + MACOS_NOTARY_ISSUER_ID: ${{ secrets.MACOS_NOTARY_ISSUER_ID }} + MACOS_NOTARY_KEY: ${{ secrets.MACOS_NOTARY_KEY }} + MACOS_NOTARY_KEY_ID: ${{ secrets.MACOS_NOTARY_KEY_ID }} + MACOS_SIGN_P12: ${{ secrets.MACOS_SIGN_P12 }} + MACOS_SIGN_PASSWORD: ${{ secrets.MACOS_SIGN_PASSWORD }} - name: Upload dry-run artifacts if: github.ref_type != 'tag' uses: actions/upload-artifact@v6 From 0b796b0ae011776847573744d5d9873397c7edc9 Mon Sep 17 00:00:00 2001 From: Fedor Korotkov Date: Mon, 6 Jul 2026 13:22:07 -0400 Subject: [PATCH 04/20] Separate release and snapshot trust paths --- .github/workflows/release.yml | 29 ++++++++++++++++------------- .goreleaser.yml | 1 + 2 files changed, 17 insertions(+), 13 deletions(-) diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml index 910af922..1056c573 100644 --- a/.github/workflows/release.yml +++ b/.github/workflows/release.yml @@ -11,7 +11,8 @@ permissions: jobs: release: - name: ${{ github.ref_type == 'tag' && 'Release Binaries' || 'Release Binaries (Dry Run)' }} + name: Release Binaries + if: github.ref_type == 'tag' runs-on: ubuntu-latest timeout-minutes: 60 environment: publish @@ -24,7 +25,6 @@ jobs: go-version-file: go.mod cache: true - name: Create release app token for this repo - if: github.ref_type == 'tag' id: app-token uses: actions/create-github-app-token@1b10c78c7865c340bc4f6099eb2f838309f1e8c3 # v3.1.1 with: @@ -32,7 +32,6 @@ jobs: private-key: ${{ secrets.RELEASE_APP_PRIVATE_KEY }} permission-contents: write - name: Create release app token for homebrew-tools - if: github.ref_type == 'tag' id: tap-token uses: actions/create-github-app-token@1b10c78c7865c340bc4f6099eb2f838309f1e8c3 # v3.1.1 with: @@ -43,7 +42,6 @@ jobs: permission-contents: write permission-pull-requests: write - name: Release - if: github.ref_type == 'tag' uses: goreleaser/goreleaser-action@v7 with: distribution: goreleaser-pro @@ -58,22 +56,27 @@ jobs: MACOS_NOTARY_KEY_ID: ${{ secrets.MACOS_NOTARY_KEY_ID }} MACOS_SIGN_P12: ${{ secrets.MACOS_SIGN_P12 }} MACOS_SIGN_PASSWORD: ${{ secrets.MACOS_SIGN_PASSWORD }} + + snapshot: + name: Release Binaries (Dry Run) + if: github.event_name == 'workflow_dispatch' + runs-on: ubuntu-latest + timeout-minutes: 60 + steps: + - uses: actions/checkout@v6 + with: + fetch-depth: 0 + - uses: actions/setup-go@v6 + with: + go-version-file: go.mod + cache: true - name: Release dry run - if: github.ref_type != 'tag' uses: goreleaser/goreleaser-action@v7 with: distribution: goreleaser-pro version: "~> v2" args: release --skip=publish --snapshot --clean - env: - GORELEASER_KEY: ${{ secrets.GORELEASER_KEY }} - MACOS_NOTARY_ISSUER_ID: ${{ secrets.MACOS_NOTARY_ISSUER_ID }} - MACOS_NOTARY_KEY: ${{ secrets.MACOS_NOTARY_KEY }} - MACOS_NOTARY_KEY_ID: ${{ secrets.MACOS_NOTARY_KEY_ID }} - MACOS_SIGN_P12: ${{ secrets.MACOS_SIGN_P12 }} - MACOS_SIGN_PASSWORD: ${{ secrets.MACOS_SIGN_PASSWORD }} - name: Upload dry-run artifacts - if: github.ref_type != 'tag' uses: actions/upload-artifact@v6 with: name: orchard-snapshot diff --git a/.goreleaser.yml b/.goreleaser.yml index 74473a90..62cf6a3f 100644 --- a/.goreleaser.yml +++ b/.goreleaser.yml @@ -45,6 +45,7 @@ notarize: brews: - name: orchard + directory: Formula ids: - regular repository: From 533bb80eee0956f5b536f96988fb276d2510d7f8 Mon Sep 17 00:00:00 2001 From: Fedor Korotkov Date: Tue, 7 Jul 2026 12:51:14 -0400 Subject: [PATCH 05/20] Use GitHub-hosted macOS 26 runner --- .github/workflows/ci.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml index e7a7dc2c..d35be9dd 100644 --- a/.github/workflows/ci.yml +++ b/.github/workflows/ci.yml @@ -56,7 +56,7 @@ jobs: test-macos: name: Test (macOS) - runs-on: ghcr.io/cirruslabs/macos-runner:tahoe + runs-on: macos-26 timeout-minutes: 45 steps: - uses: actions/checkout@v6 From 46f9c3286d3dcafb0b12cdd98debb025d0b0b21a Mon Sep 17 00:00:00 2001 From: Fedor Korotkov Date: Tue, 7 Jul 2026 12:53:50 -0400 Subject: [PATCH 06/20] Run macOS unit tests on hosted runner --- .github/workflows/ci.yml | 11 ++--------- 1 file changed, 2 insertions(+), 9 deletions(-) diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml index d35be9dd..ac397c5c 100644 --- a/.github/workflows/ci.yml +++ b/.github/workflows/ci.yml @@ -64,12 +64,5 @@ jobs: with: go-version-file: go.mod cache: true - - name: Pre-pull default Tart image - run: tart pull ghcr.io/cirruslabs/macos-tahoe-base:latest - - name: Run tests - run: go test -timeout=20m -ldflags="-B gobuildid" -v -count=1 ./... - - name: Clean up test VMs - if: always() - run: | - tart list - rm -rf ~/.tart/vms/orchard-* + - name: Run unit tests + run: go list ./... | grep -v '/internal/tests' | xargs go test -timeout=20m -ldflags="-B gobuildid" -v -count=1 From 0001c7da605ef69e2e8d1300dd2909bc065f614e Mon Sep 17 00:00:00 2001 From: Fedor Korotkov Date: Tue, 7 Jul 2026 13:42:02 -0400 Subject: [PATCH 07/20] Update Homebrew install command --- README.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/README.md b/README.md index a2a6c826..ee7d3ed6 100644 --- a/README.md +++ b/README.md @@ -32,7 +32,7 @@ Orchard is an orchestration system for [Tart](https://github.com/cirruslabs/tart The fastest way to get started with Orchard is to use a local development mode: ```shell -brew install cirruslabs/cli/orchard +brew install openai/tools/orchard orchard dev ``` From 059b6b63075bae5878bc8aa584928971102b4a41 Mon Sep 17 00:00:00 2001 From: Fedor Korotkov Date: Tue, 7 Jul 2026 14:21:47 -0400 Subject: [PATCH 08/20] Build Docker image with GoReleaser --- .github/workflows/release.yml | 41 +++++++++-------------------------- .goreleaser.yml | 11 ++++++++++ Dockerfile | 22 +++---------------- 3 files changed, 24 insertions(+), 50 deletions(-) diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml index 1056c573..b95f3098 100644 --- a/.github/workflows/release.yml +++ b/.github/workflows/release.yml @@ -16,6 +16,9 @@ jobs: runs-on: ubuntu-latest timeout-minutes: 60 environment: publish + permissions: + contents: read + packages: write steps: - uses: actions/checkout@v6 with: @@ -24,6 +27,13 @@ jobs: with: go-version-file: go.mod cache: true + - uses: docker/setup-qemu-action@v4 + - uses: docker/setup-buildx-action@v4 + - uses: docker/login-action@v4 + with: + registry: ghcr.io + username: ${{ github.actor }} + password: ${{ github.token }} - name: Create release app token for this repo id: app-token uses: actions/create-github-app-token@1b10c78c7865c340bc4f6099eb2f838309f1e8c3 # v3.1.1 @@ -81,34 +91,3 @@ jobs: with: name: orchard-snapshot path: dist/** - - docker: - name: Release Docker Image - if: github.ref_type == 'tag' - needs: release - runs-on: ubuntu-latest - timeout-minutes: 60 - permissions: - contents: read - packages: write - steps: - - uses: actions/checkout@v6 - - uses: docker/setup-qemu-action@v4 - - uses: docker/setup-buildx-action@v4 - - uses: docker/login-action@v4 - with: - registry: ghcr.io - username: ${{ github.actor }} - password: ${{ github.token }} - - name: Build and push - uses: docker/build-push-action@v7 - with: - context: . - platforms: linux/amd64,linux/arm64 - push: true - tags: | - ghcr.io/openai/orchard:${{ github.ref_name }} - ghcr.io/openai/orchard:latest - build-args: | - VERSION=${{ github.ref_name }} - COMMIT=${{ github.sha }} diff --git a/.goreleaser.yml b/.goreleaser.yml index 62cf6a3f..045195e0 100644 --- a/.goreleaser.yml +++ b/.goreleaser.yml @@ -43,6 +43,17 @@ notarize: key_id: "{{.Env.MACOS_NOTARY_KEY_ID}}" key: "{{.Env.MACOS_NOTARY_KEY}}" +dockers_v2: + - images: + - ghcr.io/openai/orchard + tags: + - "{{ .Tag }}" + - latest + platforms: + - linux/amd64 + - linux/arm64 + disable: "{{ .IsSnapshot }}" + brews: - name: orchard directory: Formula diff --git a/Dockerfile b/Dockerfile index 7a5df4dd..6cdcd60f 100644 --- a/Dockerfile +++ b/Dockerfile @@ -1,29 +1,13 @@ -FROM golang:1.25 AS builder - -WORKDIR /src - -COPY go.mod go.sum ./ -RUN go mod download - -COPY . . - -ARG VERSION=dev -ARG COMMIT=unknown - -RUN CGO_ENABLED=0 go build \ - -trimpath \ - -ldflags="-X github.com/cirruslabs/orchard/internal/version.Version=${VERSION} -X github.com/cirruslabs/orchard/internal/version.Commit=${COMMIT} -B gobuildid" \ - -o /out/orchard \ - cmd/orchard/main.go - FROM gcr.io/distroless/base +ARG TARGETPLATFORM + LABEL org.opencontainers.image.source=https://github.com/openai/orchard ENV GIN_MODE=release ENV ORCHARD_HOME=/data EXPOSE 6120 -COPY --from=builder /out/orchard /bin/orchard +COPY $TARGETPLATFORM/orchard /bin/orchard ENTRYPOINT ["/bin/orchard"] From fd3d772ae8f123ece6f58e9550725d3cab9ed2ad Mon Sep 17 00:00:00 2001 From: Fedor Korotkov Date: Thu, 9 Jul 2026 10:24:09 -0400 Subject: [PATCH 09/20] Use GitHub-hosted Linux runner --- .github/workflows/ci.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml index ac397c5c..2020d177 100644 --- a/.github/workflows/ci.yml +++ b/.github/workflows/ci.yml @@ -30,7 +30,7 @@ jobs: test-linux: name: Test (Linux) - runs-on: ghcr.io/cirruslabs/ubuntu-runner-amd64:24.04-md + runs-on: ubuntu-latest timeout-minutes: 60 steps: - uses: actions/checkout@v6 From 59d73c6e560e72ea87555362fc28f9ed03add4db Mon Sep 17 00:00:00 2001 From: Fedor Korotkov Date: Thu, 9 Jul 2026 18:35:02 -0400 Subject: [PATCH 10/20] Use smaller Vetu image for Linux tests --- .github/workflows/ci.yml | 2 +- internal/imageconstant/imageconstant.go | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml index 2020d177..990e21db 100644 --- a/.github/workflows/ci.yml +++ b/.github/workflows/ci.yml @@ -50,7 +50,7 @@ jobs: sudo setcap cap_net_raw,cap_net_admin+eip "$RUNNER_TEMP/vetu" echo "$RUNNER_TEMP" >> "$GITHUB_PATH" - name: Pre-pull default Vetu image - run: vetu pull ghcr.io/cirruslabs/ubuntu-runner-amd64:latest + run: vetu pull ghcr.io/cirruslabs/ubuntu:latest - name: Run tests run: go test -v -count=1 ./... diff --git a/internal/imageconstant/imageconstant.go b/internal/imageconstant/imageconstant.go index 1a51d1be..0a119421 100644 --- a/internal/imageconstant/imageconstant.go +++ b/internal/imageconstant/imageconstant.go @@ -2,5 +2,5 @@ package imageconstant const ( DefaultMacosImage = "ghcr.io/cirruslabs/macos-tahoe-base:latest" - DefaultLinuxImage = "ghcr.io/cirruslabs/ubuntu-runner-amd64:latest" + DefaultLinuxImage = "ghcr.io/cirruslabs/ubuntu:latest" ) From b1c468340c2557578fb7f0a9b813675cbbbc7513 Mon Sep 17 00:00:00 2001 From: Fedor Korotkov Date: Thu, 16 Jul 2026 10:48:45 -0400 Subject: [PATCH 11/20] Run Linux tests on hosted ARM runner --- .github/workflows/ci.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml index 990e21db..8e43e614 100644 --- a/.github/workflows/ci.yml +++ b/.github/workflows/ci.yml @@ -30,7 +30,7 @@ jobs: test-linux: name: Test (Linux) - runs-on: ubuntu-latest + runs-on: ubuntu-24.04-arm timeout-minutes: 60 steps: - uses: actions/checkout@v6 From 93fde28cbd728c2d26b407a8ae602922333ffd1c Mon Sep 17 00:00:00 2001 From: Fedor Korotkov Date: Thu, 16 Jul 2026 11:02:14 -0400 Subject: [PATCH 12/20] Use host architecture for Linux integration tests --- internal/tests/platformdependent/platformdependent.go | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/internal/tests/platformdependent/platformdependent.go b/internal/tests/platformdependent/platformdependent.go index d9fb4d2a..6646e687 100644 --- a/internal/tests/platformdependent/platformdependent.go +++ b/internal/tests/platformdependent/platformdependent.go @@ -26,7 +26,7 @@ func VM(name string) *v1.VM { if runtime.GOOS == "linux" { vm.Image = imageconstant.DefaultLinuxImage vm.OS = v1.OSLinux - vm.Arch = v1.ArchitectureAMD64 + vm.Arch = v1.Architecture(runtime.GOARCH) vm.Runtime = v1.RuntimeVetu } From d118199424e111a59f8db6bb75bf0957914c0fda Mon Sep 17 00:00:00 2001 From: Fedor Korotkov Date: Thu, 16 Jul 2026 11:15:58 -0400 Subject: [PATCH 13/20] Preinstall Cloud Hypervisor for Linux tests --- .github/workflows/ci.yml | 6 ++++++ 1 file changed, 6 insertions(+) diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml index 8e43e614..db839d72 100644 --- a/.github/workflows/ci.yml +++ b/.github/workflows/ci.yml @@ -49,6 +49,12 @@ jobs: go build -o "$RUNNER_TEMP/vetu" cmd/vetu/main.go sudo setcap cap_net_raw,cap_net_admin+eip "$RUNNER_TEMP/vetu" echo "$RUNNER_TEMP" >> "$GITHUB_PATH" + - name: Install Cloud Hypervisor + run: | + curl --fail --location --retry 3 \ + --output "$RUNNER_TEMP/cloud-hypervisor" \ + https://github.com/cloud-hypervisor/cloud-hypervisor/releases/latest/download/cloud-hypervisor-static-aarch64 + chmod +x "$RUNNER_TEMP/cloud-hypervisor" - name: Pre-pull default Vetu image run: vetu pull ghcr.io/cirruslabs/ubuntu:latest - name: Run tests From f3493a427fed985f744d8f5207f139c0b7ea0d70 Mon Sep 17 00:00:00 2001 From: Fedor Korotkov Date: Thu, 16 Jul 2026 16:43:12 -0400 Subject: [PATCH 14/20] Select Linux test images by architecture --- .github/workflows/ci.yml | 6 +- internal/imageconstant/imageconstant.go | 33 +++++++- internal/imageconstant/imageconstant_test.go | 78 +++++++++++++++++++ .../platformdependent/platformdependent.go | 72 +++++++++++++---- 4 files changed, 167 insertions(+), 22 deletions(-) create mode 100644 internal/imageconstant/imageconstant_test.go diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml index db839d72..c8a15283 100644 --- a/.github/workflows/ci.yml +++ b/.github/workflows/ci.yml @@ -30,7 +30,7 @@ jobs: test-linux: name: Test (Linux) - runs-on: ubuntu-24.04-arm + runs-on: ubuntu-latest timeout-minutes: 60 steps: - uses: actions/checkout@v6 @@ -53,10 +53,10 @@ jobs: run: | curl --fail --location --retry 3 \ --output "$RUNNER_TEMP/cloud-hypervisor" \ - https://github.com/cloud-hypervisor/cloud-hypervisor/releases/latest/download/cloud-hypervisor-static-aarch64 + https://github.com/cloud-hypervisor/cloud-hypervisor/releases/latest/download/cloud-hypervisor-static chmod +x "$RUNNER_TEMP/cloud-hypervisor" - name: Pre-pull default Vetu image - run: vetu pull ghcr.io/cirruslabs/ubuntu:latest + run: vetu pull ghcr.io/cirruslabs/ubuntu-amd64:24.04 - name: Run tests run: go test -v -count=1 ./... diff --git a/internal/imageconstant/imageconstant.go b/internal/imageconstant/imageconstant.go index 0a119421..51502a50 100644 --- a/internal/imageconstant/imageconstant.go +++ b/internal/imageconstant/imageconstant.go @@ -1,6 +1,35 @@ package imageconstant +import ( + "fmt" + + v1 "github.com/cirruslabs/orchard/pkg/resource/v1" +) + const ( - DefaultMacosImage = "ghcr.io/cirruslabs/macos-tahoe-base:latest" - DefaultLinuxImage = "ghcr.io/cirruslabs/ubuntu:latest" + DefaultMacosImage = "ghcr.io/cirruslabs/macos-tahoe-base:latest" + DefaultLinuxAMD64Image = "ghcr.io/cirruslabs/ubuntu-amd64:24.04" + DefaultLinuxARM64Image = "ghcr.io/cirruslabs/ubuntu:24.04" ) + +func DefaultImage(os v1.OS, architecture v1.Architecture) (string, error) { + switch os { + case v1.OSDarwin: + if architecture != v1.ArchitectureARM64 { + return "", fmt.Errorf("no default image for %s/%s", os, architecture) + } + + return DefaultMacosImage, nil + case v1.OSLinux: + switch architecture { + case v1.ArchitectureAMD64: + return DefaultLinuxAMD64Image, nil + case v1.ArchitectureARM64: + return DefaultLinuxARM64Image, nil + default: + return "", fmt.Errorf("no default image for %s/%s", os, architecture) + } + default: + return "", fmt.Errorf("no default image for %s/%s", os, architecture) + } +} diff --git a/internal/imageconstant/imageconstant_test.go b/internal/imageconstant/imageconstant_test.go new file mode 100644 index 00000000..01548fcd --- /dev/null +++ b/internal/imageconstant/imageconstant_test.go @@ -0,0 +1,78 @@ +package imageconstant_test + +import ( + "testing" + + "github.com/cirruslabs/orchard/internal/imageconstant" + v1 "github.com/cirruslabs/orchard/pkg/resource/v1" + "github.com/stretchr/testify/require" +) + +func TestDefaultImage(t *testing.T) { + tests := []struct { + name string + os v1.OS + architecture v1.Architecture + expected string + }{ + { + name: "macOS ARM64", + os: v1.OSDarwin, + architecture: v1.ArchitectureARM64, + expected: imageconstant.DefaultMacosImage, + }, + { + name: "Linux AMD64", + os: v1.OSLinux, + architecture: v1.ArchitectureAMD64, + expected: imageconstant.DefaultLinuxAMD64Image, + }, + { + name: "Linux ARM64", + os: v1.OSLinux, + architecture: v1.ArchitectureARM64, + expected: imageconstant.DefaultLinuxARM64Image, + }, + } + + for _, test := range tests { + t.Run(test.name, func(t *testing.T) { + actual, err := imageconstant.DefaultImage(test.os, test.architecture) + + require.NoError(t, err) + require.Equal(t, test.expected, actual) + }) + } +} + +func TestDefaultImageRejectsUnsupportedPlatforms(t *testing.T) { + tests := []struct { + name string + os v1.OS + architecture v1.Architecture + }{ + { + name: "unsupported OS", + os: v1.OS("windows"), + architecture: v1.ArchitectureAMD64, + }, + { + name: "unsupported Linux architecture", + os: v1.OSLinux, + architecture: v1.Architecture("riscv64"), + }, + { + name: "unsupported macOS architecture", + os: v1.OSDarwin, + architecture: v1.ArchitectureAMD64, + }, + } + + for _, test := range tests { + t.Run(test.name, func(t *testing.T) { + _, err := imageconstant.DefaultImage(test.os, test.architecture) + + require.Error(t, err) + }) + } +} diff --git a/internal/tests/platformdependent/platformdependent.go b/internal/tests/platformdependent/platformdependent.go index 6646e687..0ea3fccf 100644 --- a/internal/tests/platformdependent/platformdependent.go +++ b/internal/tests/platformdependent/platformdependent.go @@ -2,6 +2,7 @@ package platformdependent import ( "context" + "fmt" "runtime" "github.com/cirruslabs/orchard/internal/imageconstant" @@ -13,20 +14,29 @@ import ( ) func VM(name string) *v1.VM { + hostOS, hostArchitecture, err := hostPlatform() + if err != nil { + panic(err) + } + + image, err := imageconstant.DefaultImage(hostOS, hostArchitecture) + if err != nil { + panic(err) + } + vm := &v1.VM{ Meta: v1.Meta{ Name: name, }, - Image: imageconstant.DefaultMacosImage, + Image: image, CPU: 4, Memory: 8 * 1024, Headless: true, } - if runtime.GOOS == "linux" { - vm.Image = imageconstant.DefaultLinuxImage - vm.OS = v1.OSLinux - vm.Arch = v1.Architecture(runtime.GOARCH) + if hostOS == v1.OSLinux { + vm.OS = hostOS + vm.Arch = hostArchitecture vm.Runtime = v1.RuntimeVetu } @@ -34,26 +44,54 @@ func VM(name string) *v1.VM { } func CloneDefaultImage(ctx context.Context, logger *zap.SugaredLogger, destination string) error { - var err error + hostOS, hostArchitecture, err := hostPlatform() + if err != nil { + return err + } + + image, err := imageconstant.DefaultImage(hostOS, hostArchitecture) + if err != nil { + return err + } - if runtime.GOOS == "linux" { - _, _, err = vetu.Vetu(ctx, logger, "clone", imageconstant.DefaultLinuxImage, destination) - } else { - _, _, err = tart.Tart(ctx, logger, "clone", imageconstant.DefaultMacosImage, destination) + switch hostOS { + case v1.OSLinux: + _, _, err = vetu.Vetu(ctx, logger, "clone", image, destination) + case v1.OSDarwin: + _, _, err = tart.Tart(ctx, logger, "clone", image, destination) + default: + return fmt.Errorf("unsupported host OS: %q", hostOS) } return err } func ListVMs(ctx context.Context, logger *zap.SugaredLogger) ([]vmmanager.VMInfo, error) { - var vms []vmmanager.VMInfo - var err error + hostOS, _, err := hostPlatform() + if err != nil { + return nil, err + } + + switch hostOS { + case v1.OSLinux: + return vetu.List(ctx, logger) + case v1.OSDarwin: + return tart.List(ctx, logger) + default: + return nil, fmt.Errorf("unsupported host OS: %q", hostOS) + } +} + +func hostPlatform() (v1.OS, v1.Architecture, error) { + hostOS, err := v1.NewOSFromString(runtime.GOOS) + if err != nil { + return "", "", err + } - if runtime.GOOS == "linux" { - vms, err = vetu.List(ctx, logger) - } else { - vms, err = tart.List(ctx, logger) + hostArchitecture, err := v1.NewArchitectureFromString(runtime.GOARCH) + if err != nil { + return "", "", err } - return vms, err + return hostOS, hostArchitecture, nil } From e82a258c1eedb90cf09f54ef59566c46a964f34d Mon Sep 17 00:00:00 2001 From: Fedor Korotkov Date: Thu, 16 Jul 2026 16:52:40 -0400 Subject: [PATCH 15/20] Satisfy platform image lint rules --- internal/imageconstant/imageconstant.go | 13 ++++++++----- .../tests/platformdependent/platformdependent.go | 4 ++-- 2 files changed, 10 insertions(+), 7 deletions(-) diff --git a/internal/imageconstant/imageconstant.go b/internal/imageconstant/imageconstant.go index 51502a50..9e2a238b 100644 --- a/internal/imageconstant/imageconstant.go +++ b/internal/imageconstant/imageconstant.go @@ -1,22 +1,25 @@ package imageconstant import ( + "errors" "fmt" v1 "github.com/cirruslabs/orchard/pkg/resource/v1" ) +var ErrUnsupportedPlatform = errors.New("unsupported platform") + const ( DefaultMacosImage = "ghcr.io/cirruslabs/macos-tahoe-base:latest" DefaultLinuxAMD64Image = "ghcr.io/cirruslabs/ubuntu-amd64:24.04" DefaultLinuxARM64Image = "ghcr.io/cirruslabs/ubuntu:24.04" ) -func DefaultImage(os v1.OS, architecture v1.Architecture) (string, error) { - switch os { +func DefaultImage(operatingSystem v1.OS, architecture v1.Architecture) (string, error) { + switch operatingSystem { case v1.OSDarwin: if architecture != v1.ArchitectureARM64 { - return "", fmt.Errorf("no default image for %s/%s", os, architecture) + return "", fmt.Errorf("%w: %s/%s", ErrUnsupportedPlatform, operatingSystem, architecture) } return DefaultMacosImage, nil @@ -27,9 +30,9 @@ func DefaultImage(os v1.OS, architecture v1.Architecture) (string, error) { case v1.ArchitectureARM64: return DefaultLinuxARM64Image, nil default: - return "", fmt.Errorf("no default image for %s/%s", os, architecture) + return "", fmt.Errorf("%w: %s/%s", ErrUnsupportedPlatform, operatingSystem, architecture) } default: - return "", fmt.Errorf("no default image for %s/%s", os, architecture) + return "", fmt.Errorf("%w: %s/%s", ErrUnsupportedPlatform, operatingSystem, architecture) } } diff --git a/internal/tests/platformdependent/platformdependent.go b/internal/tests/platformdependent/platformdependent.go index 0ea3fccf..d682b8ee 100644 --- a/internal/tests/platformdependent/platformdependent.go +++ b/internal/tests/platformdependent/platformdependent.go @@ -60,7 +60,7 @@ func CloneDefaultImage(ctx context.Context, logger *zap.SugaredLogger, destinati case v1.OSDarwin: _, _, err = tart.Tart(ctx, logger, "clone", image, destination) default: - return fmt.Errorf("unsupported host OS: %q", hostOS) + return fmt.Errorf("%w: %q", imageconstant.ErrUnsupportedPlatform, hostOS) } return err @@ -78,7 +78,7 @@ func ListVMs(ctx context.Context, logger *zap.SugaredLogger) ([]vmmanager.VMInfo case v1.OSDarwin: return tart.List(ctx, logger) default: - return nil, fmt.Errorf("unsupported host OS: %q", hostOS) + return nil, fmt.Errorf("%w: %q", imageconstant.ErrUnsupportedPlatform, hostOS) } } From 8475ddf08b2cc620e3ed3f3e4541a3d4991d57ba Mon Sep 17 00:00:00 2001 From: Fedor Korotkov Date: Thu, 16 Jul 2026 16:54:20 -0400 Subject: [PATCH 16/20] Format platform image errors --- internal/imageconstant/imageconstant.go | 14 ++++++++++++-- 1 file changed, 12 insertions(+), 2 deletions(-) diff --git a/internal/imageconstant/imageconstant.go b/internal/imageconstant/imageconstant.go index 9e2a238b..5fe32467 100644 --- a/internal/imageconstant/imageconstant.go +++ b/internal/imageconstant/imageconstant.go @@ -19,7 +19,12 @@ func DefaultImage(operatingSystem v1.OS, architecture v1.Architecture) (string, switch operatingSystem { case v1.OSDarwin: if architecture != v1.ArchitectureARM64 { - return "", fmt.Errorf("%w: %s/%s", ErrUnsupportedPlatform, operatingSystem, architecture) + return "", fmt.Errorf( + "%w: %s/%s", + ErrUnsupportedPlatform, + operatingSystem, + architecture, + ) } return DefaultMacosImage, nil @@ -30,7 +35,12 @@ func DefaultImage(operatingSystem v1.OS, architecture v1.Architecture) (string, case v1.ArchitectureARM64: return DefaultLinuxARM64Image, nil default: - return "", fmt.Errorf("%w: %s/%s", ErrUnsupportedPlatform, operatingSystem, architecture) + return "", fmt.Errorf( + "%w: %s/%s", + ErrUnsupportedPlatform, + operatingSystem, + architecture, + ) } default: return "", fmt.Errorf("%w: %s/%s", ErrUnsupportedPlatform, operatingSystem, architecture) From 98269e9f32916fc6136826588a02e50ce56f4d0b Mon Sep 17 00:00:00 2001 From: Fedor Korotkov Date: Thu, 16 Jul 2026 16:56:07 -0400 Subject: [PATCH 17/20] Enable KVM access for Linux tests --- .github/workflows/ci.yml | 2 ++ 1 file changed, 2 insertions(+) diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml index c8a15283..933afe78 100644 --- a/.github/workflows/ci.yml +++ b/.github/workflows/ci.yml @@ -55,6 +55,8 @@ jobs: --output "$RUNNER_TEMP/cloud-hypervisor" \ https://github.com/cloud-hypervisor/cloud-hypervisor/releases/latest/download/cloud-hypervisor-static chmod +x "$RUNNER_TEMP/cloud-hypervisor" + - name: Enable KVM access + run: sudo chmod 0666 /dev/kvm - name: Pre-pull default Vetu image run: vetu pull ghcr.io/cirruslabs/ubuntu-amd64:24.04 - name: Run tests From 564823e1a45f88a4c18f703a90465d77cbf7ceb4 Mon Sep 17 00:00:00 2001 From: Fedor Korotkov Date: Thu, 16 Jul 2026 17:10:15 -0400 Subject: [PATCH 18/20] Honor VM wait time in WebSocket requests --- .github/workflows/ci.yml | 2 +- pkg/client/client.go | 31 +++++++++++++++++++++++++++++-- pkg/client/vms_test.go | 25 +++++++++++++++++++------ 3 files changed, 49 insertions(+), 9 deletions(-) diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml index 933afe78..48f2410b 100644 --- a/.github/workflows/ci.yml +++ b/.github/workflows/ci.yml @@ -60,7 +60,7 @@ jobs: - name: Pre-pull default Vetu image run: vetu pull ghcr.io/cirruslabs/ubuntu-amd64:24.04 - name: Run tests - run: go test -v -count=1 ./... + run: go test -timeout=20m -v -count=1 ./... test-macos: name: Test (macOS) diff --git a/pkg/client/client.go b/pkg/client/client.go index 20420a75..842c9374 100644 --- a/pkg/client/client.go +++ b/pkg/client/client.go @@ -13,6 +13,7 @@ import ( "net" "net/http" "net/url" + "strconv" "time" "github.com/cirruslabs/orchard/internal/config" @@ -25,6 +26,8 @@ import ( "google.golang.org/grpc/metadata" ) +const defaultHTTPTimeout = 30 * time.Second + type APIError struct { StatusCode int } @@ -107,7 +110,7 @@ func New(opts ...Option) (*Client, error) { // the requests may hang indefinitely. See [1] for more details. // // [1]: https://github.com/cirruslabs/orchard/issues/152#issuecomment-1927091747 - Timeout: 30 * time.Second, + Timeout: defaultHTTPTimeout, Transport: transport, } @@ -315,7 +318,7 @@ func (client *Client) wsRequestRaw( endpointURL.RawQuery = values.Encode() dialOptions := &websocket.DialOptions{ - HTTPClient: client.httpClient, + HTTPClient: client.httpClientForWebSocket(params), HTTPHeader: make(http.Header), } @@ -337,6 +340,30 @@ func (client *Client) wsRequestRaw( return conn, nil } +func (client *Client) httpClientForWebSocket(params map[string]string) *http.Client { + waitRaw, ok := params["wait"] + if !ok { + return client.httpClient + } + + waitSeconds, err := strconv.ParseUint(waitRaw, 10, 16) + if err != nil { + return client.httpClient + } + + waitTimeout := time.Duration(waitSeconds)*time.Second + defaultHTTPTimeout + if client.httpClient.Timeout == 0 || client.httpClient.Timeout >= waitTimeout { + return client.httpClient + } + + return &http.Client{ + CheckRedirect: client.httpClient.CheckRedirect, + Jar: client.httpClient.Jar, + Timeout: waitTimeout, + Transport: client.httpClient.Transport, + } +} + func (client *Client) formatPath(path string) *url.URL { endpointURL := &url.URL{ Scheme: client.baseURL.Scheme, diff --git a/pkg/client/vms_test.go b/pkg/client/vms_test.go index 710c30b5..8fe2e79c 100644 --- a/pkg/client/vms_test.go +++ b/pkg/client/vms_test.go @@ -4,21 +4,34 @@ import ( "net/http" "net/http/httptest" "testing" + "time" "github.com/coder/websocket" "github.com/stretchr/testify/require" ) +func TestHTTPClientForWebSocketHonorsWait(t *testing.T) { + devClient, err := New(WithAddress("http://localhost")) + require.NoError(t, err) + + httpClient := devClient.httpClientForWebSocket(map[string]string{"wait": "120"}) + + require.Equal(t, 150*time.Second, httpClient.Timeout) + require.Same(t, devClient.httpClient.Transport, httpClient.Transport) +} + func TestExecSessionBuildsReconnectableQuery(t *testing.T) { var query map[string][]string - server := httptest.NewServer(http.HandlerFunc(func(writer http.ResponseWriter, request *http.Request) { - query = request.URL.Query() + server := httptest.NewServer( + http.HandlerFunc(func(writer http.ResponseWriter, request *http.Request) { + query = request.URL.Query() - conn, err := websocket.Accept(writer, request, nil) - require.NoError(t, err) - defer conn.CloseNow() - })) + conn, err := websocket.Accept(writer, request, nil) + require.NoError(t, err) + defer conn.CloseNow() + }), + ) defer server.Close() devClient, err := New(WithAddress(server.URL)) From 201490999b6d83fa2d938b8b74e838bc8e162849 Mon Sep 17 00:00:00 2001 From: Fedor Korotkov Date: Thu, 16 Jul 2026 17:13:31 -0400 Subject: [PATCH 19/20] Satisfy WebSocket client lint rules --- pkg/client/client.go | 53 ++++++++++++++++++++++-------------------- pkg/client/vms_test.go | 11 ++++++--- 2 files changed, 36 insertions(+), 28 deletions(-) diff --git a/pkg/client/client.go b/pkg/client/client.go index 842c9374..a43cd521 100644 --- a/pkg/client/client.go +++ b/pkg/client/client.go @@ -26,7 +26,10 @@ import ( "google.golang.org/grpc/metadata" ) -const defaultHTTPTimeout = 30 * time.Second +const ( + defaultHTTPTimeout = 30 * time.Second + waitParameterName = "wait" +) type APIError struct { StatusCode int @@ -340,30 +343,6 @@ func (client *Client) wsRequestRaw( return conn, nil } -func (client *Client) httpClientForWebSocket(params map[string]string) *http.Client { - waitRaw, ok := params["wait"] - if !ok { - return client.httpClient - } - - waitSeconds, err := strconv.ParseUint(waitRaw, 10, 16) - if err != nil { - return client.httpClient - } - - waitTimeout := time.Duration(waitSeconds)*time.Second + defaultHTTPTimeout - if client.httpClient.Timeout == 0 || client.httpClient.Timeout >= waitTimeout { - return client.httpClient - } - - return &http.Client{ - CheckRedirect: client.httpClient.CheckRedirect, - Jar: client.httpClient.Jar, - Timeout: waitTimeout, - Transport: client.httpClient.Transport, - } -} - func (client *Client) formatPath(path string) *url.URL { endpointURL := &url.URL{ Scheme: client.baseURL.Scheme, @@ -424,3 +403,27 @@ func (client *Client) RPC() *RPCService { client: client, } } + +func (client *Client) httpClientForWebSocket(params map[string]string) *http.Client { + waitRaw, ok := params[waitParameterName] + if !ok { + return client.httpClient + } + + waitSeconds, err := strconv.ParseUint(waitRaw, 10, 16) + if err != nil { + return client.httpClient + } + + waitTimeout := time.Duration(waitSeconds)*time.Second + defaultHTTPTimeout + if client.httpClient.Timeout == 0 || client.httpClient.Timeout >= waitTimeout { + return client.httpClient + } + + return &http.Client{ + CheckRedirect: client.httpClient.CheckRedirect, + Jar: client.httpClient.Jar, + Timeout: waitTimeout, + Transport: client.httpClient.Transport, + } +} diff --git a/pkg/client/vms_test.go b/pkg/client/vms_test.go index 8fe2e79c..0e4ca239 100644 --- a/pkg/client/vms_test.go +++ b/pkg/client/vms_test.go @@ -14,7 +14,7 @@ func TestHTTPClientForWebSocketHonorsWait(t *testing.T) { devClient, err := New(WithAddress("http://localhost")) require.NoError(t, err) - httpClient := devClient.httpClientForWebSocket(map[string]string{"wait": "120"}) + httpClient := devClient.httpClientForWebSocket(map[string]string{waitParameterName: "120"}) require.Equal(t, 150*time.Second, httpClient.Timeout) require.Same(t, devClient.httpClient.Transport, httpClient.Transport) @@ -28,7 +28,12 @@ func TestExecSessionBuildsReconnectableQuery(t *testing.T) { query = request.URL.Query() conn, err := websocket.Accept(writer, request, nil) - require.NoError(t, err) + if err != nil { + t.Errorf("failed to accept WebSocket connection: %v", err) + + return + } + defer conn.CloseNow() }), ) @@ -58,6 +63,6 @@ func TestExecSessionBuildsReconnectableQuery(t *testing.T) { require.Equal(t, []string{"80"}, query["cols"]) require.Equal(t, []string{"hello"}, query["env[GREETING]"]) require.Equal(t, []string{"/tmp"}, query["workdir"]) - require.Equal(t, []string{"7"}, query["wait"]) + require.Equal(t, []string{"7"}, query[waitParameterName]) require.Equal(t, []string{"resume-me"}, query["session"]) } From 6cd49ac05fd8e7eb2ca7105a7be5dff4d0093d41 Mon Sep 17 00:00:00 2001 From: Fedor Korotkov Date: Thu, 16 Jul 2026 17:36:24 -0400 Subject: [PATCH 20/20] Allow hosted Linux integration tests more time --- .github/workflows/ci.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml index 48f2410b..e6d6554e 100644 --- a/.github/workflows/ci.yml +++ b/.github/workflows/ci.yml @@ -60,7 +60,7 @@ jobs: - name: Pre-pull default Vetu image run: vetu pull ghcr.io/cirruslabs/ubuntu-amd64:24.04 - name: Run tests - run: go test -timeout=20m -v -count=1 ./... + run: go test -timeout=30m -v -count=1 ./... test-macos: name: Test (macOS)