Upstream sync: shared image builds, settings flow, and warning cleanup by linuxdevel · Pull Request #550 · NVIDIA/OpenShell

linuxdevel · 2026-03-23T18:25:27Z

Summary

sync the accumulated upstream branch changes across build pipelines, runtime-bundle image flows, provider/auth handling, gateway settings, server/sandbox updates, and related docs/CI wiring
keep the fork-owned Docker/build migration work aligned with the branch by retaining the shared Dockerfile.images path and the current provider-agnostic runtime bundle flow
reduce current Rust clippy warning noise in the touched crates, then verify the full branch with mise run pre-commit and mise run ci

Test Plan

mise run pre-commit
mise run ci
targeted crate checks and tests were also run during the warning-reduction batches before the final full-branch verification

…DIA#442) The vouch-check workflow was closing PRs from NVIDIA org members because the GITHUB_TOKEN lacks read:org scope, causing orgs.checkMembershipForUser to return 404 for non-public members. The catch block silently swallowed these as expected 'not found' responses. Add an author_association check from the webhook payload as the primary bypass. GitHub sets this field server-side (MEMBER, OWNER, COLLABORATOR) regardless of membership visibility, with no extra token permissions needed. The existing API calls are kept as fallbacks. Fixes the false positive that closed NVIDIA#430. Co-authored-by: John Myers <johntmyers@users.noreply.github.com>

…load (NVIDIA#444) The webhook payload field context.payload.pull_request.author_association is unreliable under pull_request_target events — it was absent or not populated, causing the previous fix (NVIDIA#442) to still fail. Switch to fetching author_association via pulls.get REST API, which only needs pull-requests permission (already granted) and reliably returns MEMBER for org members regardless of membership visibility. Also removes the redundant orgs.checkMembershipForUser and repos.checkCollaborator fallbacks, which suffered from the same GITHUB_TOKEN permission limitation that started this bug. Co-authored-by: John Myers <johntmyers@users.noreply.github.com>

…NVIDIA#418) The trigger-wheel-publish job was downloading the wheel artifact onto a persistent self-hosted runner just to glob the filenames. Since download-artifact does not clean the destination directory, stale .whl files from every previous run accumulated in release/ and were all sent to GitLab as WHEEL_FILENAMES. Confirmed on the runner: /home/ubuntu/actions-runner/_work/OpenShell/ OpenShell/release/ contained 120+ wheels spanning versions 0.0.5 through 0.0.10. Fix: capture wheel filenames as a job output in build-python-wheels and pass them directly to trigger-wheel-publish. The trigger job no longer downloads the artifact at all — it only needs the filenames to construct GitHub release asset URLs for GitLab/Kitmaker.

…VIDIA#445) The GITHUB_TOKEN cannot determine org membership — it lacks read:org scope and this is not configurable via the permissions block. Both author_association and orgs.checkMembershipForUser return NONE/404 for org members (even public ones) when called with the repo-scoped token. Use an ORG_READ_TOKEN secret (fine-grained PAT with read:org) when available, falling back to GITHUB_TOKEN. Also restores the checkCollaborator fallback since the PAT can resolve that too. Setup required: create a fine-grained PAT with Organization > Members > Read permission, then add it as a repo secret named ORG_READ_TOKEN. Co-authored-by: John Myers <johntmyers@users.noreply.github.com>

…#446) The ORG_READ_TOKEN (read:org PAT) was being used for all API calls, including closing PRs and posting comments, which it lacks permissions for. Split into two steps: 1. Org membership check — uses ORG_READ_TOKEN exclusively 2. VOUCHED.td check + close — uses default GITHUB_TOKEN (has repo write) Step 2 is skipped entirely if step 1 confirms org membership. Co-authored-by: John Myers <johntmyers@users.noreply.github.com>

… env var (NVIDIA#419)

NVIDIA#452) The secrets context is not available in step-level if expressions in GitHub Actions — only in with and env blocks. This caused the workflow file to be invalid, failing every run with: Unrecognized named-value: 'secrets' Fix by exporting the secret to a job-level env var and checking that in the step condition instead. Co-authored-by: John Myers <johntmyers@users.noreply.github.com>

NVIDIA#464)

…res (NVIDIA#466)

* add guidance for OpenAI-compatible cloud providers * add provider list and xref link * add xref * add provider name value column

…A#480) (NVIDIA#481)

* feat(providers): add GitHub Copilot CLI agent provider Source: https://docs.github.com/en/copilot/reference/copilot-allowlist-reference

… chart (NVIDIA#497) Disables GPU Feature Discovery and Node Feature Discovery DaemonSets and overrides the device plugin's default nodeAffinity to null so it schedules unconditionally on the single-node gateway without requiring NFD/GFD labels. Setting affinity to an empty map ({}) does not override the chart defaults because Helm deep-merges user values with chart defaults. Using null explicitly removes the key, causing the chart template to skip the affinity block entirely.

…VIDIA#453)

…, formatters, and tracing layers (NVIDIA#489) feat(ocsf): create openshell-ocsf crate with OCSF v1.7.0 event types, formatters, and tracing layers

* feat(gateway/sandbox): add global and sandbox runtime settings flow

…y with read path (NVIDIA#515)

…x RPC (NVIDIA#522)

…VIDIA#511) features

github-actions · 2026-03-23T18:25:38Z

Thank you for your interest in contributing to OpenShell, @linuxdevel.

This project uses a vouch system for first-time contributors. Before submitting a pull request, you need to be vouched by a maintainer.

To get vouched:

Open a Vouch Request discussion.
Describe what you want to change and why.
Write in your own words — do not have an AI generate the request.
A maintainer will comment /vouch if approved.
Once vouched, open a new PR (preferred) or reopen this one after a few minutes.

See CONTRIBUTING.md for details.

github-actions · 2026-03-23T18:25:38Z

Thank you for your submission! We ask that you all sign our Developer Certificate of Origin before we can accept your contribution. You can sign the DCO by adding a comment below using this text:

I have read the DCO document and I hereby sign the DCO.

10 out of 11 committers have signed the DCO.
✅ (johntmyers)[https://github.com/johntmyers]
✅ (pimlock)[https://github.com/pimlock]
✅ (drew)[https://github.com/drew]
✅ (miyoungc)[https://github.com/miyoungc]
✅ (Kh4L)[https://github.com/Kh4L]
✅ (geelen)[https://github.com/geelen]
✅ (htekdev)[https://github.com/htekdev]
✅ (elezar)[https://github.com/elezar]
✅ (ParthSareen)[https://github.com/ParthSareen]
✅ (khaile)[https://github.com/khaile]
❌ @linuxdevel
_{You can retrigger this bot by commenting recheck in this Pull Request.}_{Posted by the DCO Assistant Lite bot.}

linuxdevel · 2026-03-23T19:01:19Z

Sorry, this was my AI going crazy. It was supposed to create a PR on my fork.

linuxdevel and others added 30 commits March 21, 2026 01:08

feat(deploy): consume verified runtime bundles for cluster builds

a328c76

feat(sandbox): add tool adapter validation and fork-owned trust

446d867

fix(docs): align fork-owned installer references

5151cfc

feat(sandbox): project opencode copilot auth state

8e92b1a

fix(sandbox): stage opencode copilot auth in cluster mode

890a19f

fix(cli): suppress browser popup during auth via OPENSHELL_NO_BROWSER…

ff50944

… env var (NVIDIA#419)

chore(repo): migrate github label taxonomy (NVIDIA#454)

63c4eed

fix(bootstrap): auto-cleanup Docker resources on failed gateway deploy (

f18f195

NVIDIA#464)

fix(bootstrap): surface diagnostics for K8s namespace not ready failu…

cb2ed22

…res (NVIDIA#466)

docs: add guidance for OpenAI-compatible cloud providers (NVIDIA#458)

0c42a50

* add guidance for OpenAI-compatible cloud providers * add provider list and xref link * add xref * add provider name value column

fix(sandbox): rotate openshell.log daily, keep 3 files (NVIDIA#431)

7701a69

fix(e2e): update log-reading helpers for rolling file appender (NVIDI…

abfea11

…A#480) (NVIDIA#481)

fix(router): increase inference validation token budget (NVIDIA#432)

6043c83

fix(gateway): allow first live network policy update (NVIDIA#493)

679d855

feat(providers): add GitHub Copilot CLI agent provider (NVIDIA#476)

22249fc

* feat(providers): add GitHub Copilot CLI agent provider Source: https://docs.github.com/en/copilot/reference/copilot-allowlist-reference

fix(ci): simplify dev release install instructions to use install.sh (N…

7d63b0e

…VIDIA#453)

feat(ocsf): create openshell-ocsf crate — standalone OCSF event types…

0e13a5c

…, formatters, and tracing layers (NVIDIA#489) feat(ocsf): create openshell-ocsf crate with OCSF v1.7.0 event types, formatters, and tracing layers

feat(settings): gateway-to-sandbox runtime settings channel (NVIDIA#474)

d9c2bcc

* feat(gateway/sandbox): add global and sandbox runtime settings flow

refactor(proto): rename UpdateSettings to UpdateConfig for consistenc…

3e2f211

…y with read path (NVIDIA#515)

refactor(sandbox): remove unused pod_template field from CreateSandbo…

dc44ee5

…x RPC (NVIDIA#522)

docs(ollama): update ollama tutorial and references to match latest (N…

5dc87f2

…VIDIA#511) features

docs(ollama): fix references to renamed tutorial file (NVIDIA#513)

7aaa191

ci(release): restrict auto-tag to weekdays only (NVIDIA#507)

e4db41b

khaile and others added 12 commits March 23, 2026 10:02

docs(providers): add Groq to the supported providers table (NVIDIA#518)

1f20708

fix(docs): remove trailing whitespace from upstream sync

a14e32b

fix(docker): port build compatibility fixes

a9abf9b

chore(lockfile): sync openshell-ocsf version

f001760

refactor(docker): add shared image build graph

e26043f

refactor(tasks): unify docker image build entrypoint

29daa4f

refactor(tasks): add shared docker task surface

9db2a35

refactor(tasks): normalize python and publish task names

85b693c

refactor(build): rewire deploy and publish flows

bf37650

docs(build): document shared image targets

cf39f27

refactor(build): migrate to shared image dockerfile

9848d04

refactor(rust): reduce workspace clippy warning noise

683724e

linuxdevel requested a review from a team as a code owner March 23, 2026 18:25

github-actions bot closed this Mar 23, 2026

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Upstream sync: shared image builds, settings flow, and warning cleanup#550

Upstream sync: shared image builds, settings flow, and warning cleanup#550
linuxdevel wants to merge 42 commits intoNVIDIA:mainfrom
linuxdevel:upstream-sync

linuxdevel commented Mar 23, 2026

Uh oh!

github-actions bot commented Mar 23, 2026

Uh oh!

github-actions bot commented Mar 23, 2026

Uh oh!

linuxdevel commented Mar 23, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

11 participants

Conversation

linuxdevel commented Mar 23, 2026

Summary

Test Plan

Uh oh!

github-actions bot commented Mar 23, 2026

Uh oh!

github-actions bot commented Mar 23, 2026

Uh oh!

linuxdevel commented Mar 23, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

11 participants