build(nix): add per-crate crane workspace builds by SDAChess · Pull Request #1652 · NVIDIA/OpenShell

SDAChess · 2026-06-01T15:10:13Z

Add crane-based package outputs for the main OpenShell crates and a default symlinkJoin package. The new workspace helper derives each crate's transitive workspace dependency closure, builds from minimal source trees, and declares the assets each crate needs at compile time.

Build each crate in three layers:

crates.io dependencies with crane buildDepsOnly
first-party workspace dependency libraries
the final real crate

The workspace-libs layer builds the selected package with the same -p <crate> selection as final so Cargo feature unification matches, but overlays a crane-generated dummy source for the leaf crate. After that layer builds, remove the dummy leaf artifacts with cargo clean --release -p <crate> so the final layer cannot reuse or package stub outputs. This lets leaf edits reuse cached first-party libs while still compiling and linking the real leaf crate.

Add explicit [lib] target names and path = "src/lib.rs" entries to workspace crates. The Nix source minimizer keeps every member Cargo.toml but omits source trees outside the selected crate closure; explicit target paths let Cargo resolve those member manifests without relying on auto-discovery of files that are intentionally absent. They also give crane's dummy source generation a stable target shape.

Guard the openshell-core build script's .git rerun paths so Cargo does not mark core dirty in Nix source trees where .git is absent. Without this, core recompiled in the final layer and cascaded into its dependents.

Known limitation: the VM driver package is wired into the flake, but the Nix build does not yet provide the compressed VM runtime artifacts that openshell-driver-vm embeds. For now that crate builds via its stub-resource fallback rather than producing a fully usable VM driver package.

Ignore Nix result* symlinks created by local builds.

Summary

Related Issue

Changes

Testing

mise run pre-commit passes
Unit tests added/updated
E2E tests added/updated (if applicable)

Checklist

Follows Conventional Commits
Commits are signed off (DCO)
Architecture docs updated (if applicable)

copy-pr-bot · 2026-06-01T15:10:20Z

This pull request requires additional validation before any workflows can run on NVIDIA's runners.

Pull request vetters can view their responsibilities here.

Contributors can view more details about this message here.

SDAChess · 2026-06-09T10:05:35Z

/ok-to-test deea799

SDAChess · 2026-06-09T10:32:06Z

/ok-to-test ab56476

SDAChess · 2026-06-09T12:39:40Z

/ok-to-test 1036e11

SDAChess · 2026-06-09T13:10:43Z

/ok-to-test 37097f1

SDAChess · 2026-06-09T13:18:24Z

/ok-to-test 58bafc4

SDAChess · 2026-06-09T13:25:45Z

/ok-to-test 1912489

SDAChess · 2026-06-09T14:08:00Z

/ok-to-test 8ac1241

SDAChess · 2026-06-09T14:18:53Z

/ok-to-test 886053a

elezar · 2026-06-15T14:12:28Z

Does this mean that we've removed the e2e tests?

elezar · 2026-06-15T14:14:21Z

+            openshell-vfio-test
+          cachix_auth_token: ${{ secrets.CACHIX_AUTH_TOKEN }}
+
+  lint:


Does this mean that the lint step is run after the test step?

elezar · 2026-06-15T14:15:37Z

-          fi
-          exit 0
-
-  python:


Should we still run a python linter?

elezar · 2026-06-15T14:16:10Z

-      - name: Test
-        run: mise run test:python
-
-  markdown:


I didn't see a markdown linter in the nix targets.

elezar · 2026-06-15T14:17:02Z

-            exit 1
-          fi
-
-  license-headers:


Is this the same as the spdx-headers nix check?

elezar · 2026-06-15T14:17:45Z

Do we have a nix equivalent?

drew · 2026-06-16T04:25:40Z

  description = "OpenShell development environment";

+  nixConfig = {
+    extra-substituters = [ "https://openshell.cachix.org" ];


Can you expand on what this does?

This is responsible for the caching. This is a temporary hosted cache for you to try out the caching feature. Only CI can push to it but everyone can pull.

drew · 2026-06-16T04:26:44Z

+        crates = {
+          openshell = workspaceCrates.openshell-cli.package;
+          openshell-gateway = workspaceCrates.openshell-server.package;
+          openshell-sandbox = workspaceCrates.openshell-sandbox.package;
+          openshell-driver-vm = workspaceCrates.openshell-driver-vm.package;
+          openshell-driver-kubernetes = workspaceCrates.openshell-driver-kubernetes.package;
+          openshell-driver-podman = workspaceCrates.openshell-driver-podman.package;
+        };


This looks like a subset of our crates. What's special about these?

These are the only crates that produce binaries afaik.

drew · 2026-06-16T04:29:30Z

+            openshell-bootstrap-test
+            openshell-cli-test
+            openshell-core-test
+            openshell-driver-docker-test
+            openshell-driver-kubernetes-test
+            openshell-driver-podman-test
+            openshell-driver-vm-test
+            openshell-ocsf-test
+            openshell-policy-test
+            openshell-prover-test
+            openshell-providers-test
+            openshell-router-test
+            openshell-sandbox-test
+            openshell-server-macros-test
+            openshell-server-test
+            openshell-tui-test
+            openshell-vfio-test


This is somewhat of an arbitrary location to start the 🧵, but one that that jumped out as I'm reviewing is how often we need to repeat crate names. Is that assessment right? Is this something we can improve on?

It depends, we can definitely store this in a variable. I just wanted to be as explicit as possible but we can definitely make it shorter.

Add crane-based package outputs for the main OpenShell crates and a default symlinkJoin package. The new workspace helper derives each crate's transitive workspace dependency closure, builds from minimal source trees, and declares the assets each crate needs at compile time. Build each crate in three layers: 1. crates.io dependencies with crane buildDepsOnly 2. first-party workspace dependency libraries 3. the final real crate The workspace-libs layer builds the selected package with the same `-p <crate>` selection as final so Cargo feature unification matches, but overlays a crane-generated dummy source for the leaf crate. After that layer builds, remove the dummy leaf artifacts with `cargo clean --release -p <crate>` so the final layer cannot reuse or package stub outputs. This lets leaf edits reuse cached first-party libs while still compiling and linking the real leaf crate. Add explicit `[lib]` target names and `path = "src/lib.rs"` entries to workspace crates. The Nix source minimizer keeps every member Cargo.toml but omits source trees outside the selected crate closure; explicit target paths let Cargo resolve those member manifests without relying on auto-discovery of files that are intentionally absent. They also give crane's dummy source generation a stable target shape. Guard the openshell-core build script's `.git` rerun paths so Cargo does not mark core dirty in Nix source trees where `.git` is absent. Without this, core recompiled in the final layer and cascaded into its dependents. Known limitation: the VM driver package is wired into the flake, but the Nix build does not yet provide the compressed VM runtime artifacts that openshell-driver-vm embeds. For now that crate builds via its stub-resource fallback rather than producing a fully usable VM driver package. Ignore Nix `result*` symlinks created by local builds.

Signed-off-by: Simon Scatton <sscatton@nvidia.com>

Signed-off-by: Evan Lezar <elezar@nvidia.com>

SDAChess requested review from a team, derekwaynecarr, maxamillion and mrunalp as code owners June 1, 2026 15:10

SDAChess self-assigned this Jun 1, 2026

drew reviewed Jun 2, 2026

View reviewed changes

Comment thread nix/workspace.nix

SDAChess force-pushed the sscatton/nix-add-build-with-crane branch 2 times, most recently from 2adab70 to 3db6ac8 Compare June 9, 2026 10:00

SDAChess marked this pull request as draft June 9, 2026 10:04

SDAChess force-pushed the sscatton/nix-add-build-with-crane branch from 37097f1 to 58bafc4 Compare June 9, 2026 13:17

SDAChess force-pushed the sscatton/nix-add-build-with-crane branch from 58bafc4 to 1912489 Compare June 9, 2026 13:25

elezar reviewed Jun 15, 2026

View reviewed changes

Comment thread .github/workflows/branch-e2e.yml

elezar Jun 15, 2026

Copy link
Copy Markdown

Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Does this mean that we've removed the e2e tests?

elezar reviewed Jun 15, 2026

View reviewed changes

Comment thread .github/workflows/branch-checks.yml

fi

exit 0

python:

elezar Jun 15, 2026

Copy link
Copy Markdown

Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Should we still run a python linter?

elezar reviewed Jun 15, 2026

View reviewed changes

Comment thread .github/workflows/helm-lint.yml

elezar Jun 15, 2026

Copy link
Copy Markdown

Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Do we have a nix equivalent?

drew reviewed Jun 16, 2026

View reviewed changes

SDAChess force-pushed the sscatton/nix-add-build-with-crane branch from 886053a to 2fbf7e3 Compare June 17, 2026 08:50

SDAChess and others added 17 commits June 24, 2026 11:24

refactor(nix): centralize crate build specs

4c896f9

fix(nix): provide protoc for builds

b40bbf7

refactor(nix): propagate workspace crate inputs

2584fe1

test(sandbox): make unit tests hermetic

bffcd76

test(nix): add per-crate cargo test checks

e02b655

ci: replace branch checks with nix workflow

06cdc26

ci: add nix rustfmt lint check

0c3cd1f

ci: add nix clippy lint checks

86c1dee

ci: upload nix outputs to cachix

1daafb9

ci: use cachix action for nix cache

d7bc4a7

ci: deduplicate nix workflow setup

3df3532

ci: factor nix build workflow action

a1de5fd

ci: build nix container images

cad0cde

ci: add nix SPDX header check

8cb82f1

Signed-off-by: Simon Scatton <sscatton@nvidia.com>

ci: batch nix workflow targets

3576220

fix(nix): repair supervisor crate source packaging (#1953)

eab1d5e

Signed-off-by: Evan Lezar <elezar@nvidia.com>

SDAChess force-pushed the sscatton/nix-add-build-with-crane branch from adf92e7 to eab1d5e Compare June 24, 2026 09:24

-                        fi
-                        exit 0
-                python:

Uh oh!

Conversation

SDAChess commented Jun 1, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Summary

Related Issue

Changes

Testing

Checklist

Uh oh!

copy-pr-bot Bot commented Jun 1, 2026

Uh oh!

Uh oh!

SDAChess commented Jun 9, 2026

Uh oh!

SDAChess commented Jun 9, 2026

Uh oh!

SDAChess commented Jun 9, 2026

Uh oh!

SDAChess commented Jun 9, 2026

Uh oh!

SDAChess commented Jun 9, 2026

Uh oh!

SDAChess commented Jun 9, 2026

Uh oh!

SDAChess commented Jun 9, 2026

Uh oh!

SDAChess commented Jun 9, 2026

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

drew Jun 16, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

SDAChess commented Jun 1, 2026 •

edited

Loading

drew Jun 16, 2026 •

edited

Loading