Merge branch 'main' into jtoelke/os-128-use-prebuilt-binaries-flag

Author: jtoelke2

.github/actions/setup-buildx/action.yml

@@ -1,15 +1,22 @@
 name: Setup Docker Buildx
 description: >
-  Create a multi-arch Docker Buildx builder using remote BuildKit nodes.
-  The builder is automatically removed when the job finishes (cleanup is
-  enabled by default in docker/setup-buildx-action).
+  Create a Docker Buildx builder. Two modes:
+    * driver=remote (default) — multi-arch builder against in-cluster BuildKit
+      pods. Requires EKS connectivity. Behaviour unchanged from prior versions.
+    * driver=local — single-node buildx on the local docker-container driver.
+      Pair with cache-to/cache-from=type=gha on build steps for persistence.
+      Works on nv-gha-runners; no EKS needed.
+  Cleanup is automatic when the job finishes (docker/setup-buildx-action default).
 
 inputs:
+  driver:
+    description: "buildx driver: 'remote' or 'local'"
+    default: remote
   amd64-endpoint:
-    description: BuildKit endpoint for linux/amd64
+    description: BuildKit endpoint for linux/amd64 (remote driver only)
     default: tcp://buildkit-amd64.buildkit:1234
   arm64-endpoint:
-    description: BuildKit endpoint for linux/arm64
+    description: BuildKit endpoint for linux/arm64 (remote driver only)
     default: tcp://buildkit-arm64.buildkit:1234
   name:
     description: Builder instance name
@@ -18,7 +25,8 @@ inputs:
 runs:
   using: composite
   steps:
-    - name: Set up Docker Buildx
+    - name: Set up Docker Buildx (remote)
+      if: inputs.driver == 'remote'
       uses: docker/setup-buildx-action@v3
       with:
         name: ${{ inputs.name }}
@@ -28,3 +36,11 @@ runs:
         append: |
           - endpoint: ${{ inputs.arm64-endpoint }}
             platforms: linux/arm64
+
+    - name: Set up Docker Buildx (local)
+      if: inputs.driver == 'local'
+      uses: docker/setup-buildx-action@v3
+      with:
+        name: ${{ inputs.name }}
+        driver: docker-container
+        platforms: linux/amd64,linux/arm64

.github/workflows/shadow-shared-cpu-spike.yml

@@ -0,0 +1,65 @@
+name: Shadow — Shared CPU Spike
+
+# OS-49 Phase 2 / PR 1 — non-blocking spike. Runs `cargo check` on the
+# nv-gha-runners shared CPU pool (`linux-{amd64,arm64}-cpu8`) with a
+# GHA-backed sccache.
+#
+# Plan, decision thresholds, and results live in the Linear doc attached
+# to OS-126 ("OS-126 — Shared CPU spike plan & results"). Dispatch this
+# workflow 4–5 times after merge and record numbers there.
+
+on:
+  workflow_dispatch:
+
+permissions:
+  contents: read
+  packages: read
+
+env:
+  CARGO_TERM_COLOR: always
+  CARGO_INCREMENTAL: "0"
+  MISE_GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+  # Wire sccache (already RUSTC_WRAPPER in mise.toml) to the GHA cache
+  # backend instead of the EKS memcached used by ARC.
+  SCCACHE_GHA_ENABLED: "true"
+
+jobs:
+  rust-check:
+    name: cargo check (${{ matrix.runner }})
+    strategy:
+      fail-fast: false
+      matrix:
+        runner: [linux-amd64-cpu8, linux-arm64-cpu8]
+    runs-on: ${{ matrix.runner }}
+    container:
+      image: ghcr.io/nvidia/openshell/ci:latest
+      credentials:
+        username: ${{ github.actor }}
+        password: ${{ secrets.GITHUB_TOKEN }}
+    timeout-minutes: 60
+    steps:
+      - uses: actions/checkout@v4
+
+      - name: Install tools
+        run: mise install
+
+      - name: Configure GHA sccache backend
+        # Exposes ACTIONS_CACHE_URL / ACTIONS_RUNTIME_TOKEN to subsequent steps
+        # so sccache (wrapped around rustc via RUSTC_WRAPPER in mise.toml) can
+        # initialize the GHA cache. Without this, sccache fails at startup with
+        # "cache url for ghac not found". The action also installs its own
+        # sccache binary; harmless since mise's sccache remains on PATH.
+        uses: mozilla-actions/sccache-action@7d986dd989559c6ecdb630a3fd2557667be217ad # v0.0.9
+
+      - name: Cache Rust target and registry
+        uses: Swatinem/rust-cache@779680da715d629ac1d338a641029a2f4372abb5 # v2
+        with:
+          shared-key: shadow-shared-cpu-spike-${{ matrix.runner }}
+          cache-directories: .cache/sccache
+
+      - name: cargo check
+        run: mise x -- cargo check --workspace --all-targets
+
+      - name: sccache stats
+        if: always()
+        run: mise x -- sccache --show-stats