ci: build and release on Hanzo Git runners

fmt, clippy -D warnings and tests on hanzo-build-macos-arm64 with a cargo check -p vm-linux leg on hanzo-build-linux-arm64; v* tags build the codesigned CLI and the guest OS image and upload them as release assets with gh. Co-authored-by: Hanzo Dev <[email protected]>
2026-10-01 00:47:56 +00:00 · 2026-09-01 11:49:14 -07:00
parent 51a68b9311
commit dbf0a3c699
2 changed files with 110 additions and 0 deletions
@@ -0,0 +1,30 @@
+# Runs on the Hanzo Git act_runners (git.hanzo.ai); labels from
+# hanzoai/.github/RUNNERS.md. The workspace's default members exclude vm-linux,
+# so the Linux leg checks it by name.
+name: ci
+on:
+  push:
+    branches: [main]
+  pull_request:
+  workflow_dispatch:
+
+jobs:
+  macos:
+    runs-on: hanzo-build-macos-arm64
+    timeout-minutes: 90
+    steps:
+      - uses: actions/checkout@v4
+      - uses: dtolnay/rust-toolchain@stable
+        with:
+          components: rustfmt, clippy
+      - run: cargo fmt --all -- --check
+      - run: cargo clippy --all-targets -- -D warnings
+      - run: cargo test
+
+  linux:
+    runs-on: hanzo-build-linux-arm64
+    timeout-minutes: 60
+    steps:
+      - uses: actions/checkout@v4
+      - uses: dtolnay/rust-toolchain@stable
+      - run: cargo check -p vm-linux
@@ -0,0 +1,80 @@
+# A v* tag builds the CLI (macOS arm64, Linux arm64) and the guest image
+# (kernel, initramfs, rootfs with vm-guest) and attaches them to the GitHub
+# release the CLI downloads from (crates/vm-cli/src/assets.rs). Asset names:
+#   hanzo-vm-<tag>-darwin-aarch64.tar.gz   hanzo-vm binary
+#   hanzo-vm-<tag>-linux-aarch64.tar.gz    hanzo-vm binary
+#   hanzo-vm-os-<tag>-aarch64.tar.gz       Image, initramfs.cpio.gz, rootfs.ext4
+# Uploads use gh with the runner's GITHUB_TOKEN, as hanzoai/engine does.
+name: release
+on:
+  push:
+    tags: ['v*']
+  workflow_dispatch:
+    inputs:
+      tag:
+        description: "Tag to build and upload (e.g. v0.1.0)"
+        required: true
+        type: string
+
+permissions:
+  contents: write
+
+env:
+  TAG: ${{ inputs.tag || github.ref_name }}
+  GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+  GH_REPO: hanzoai/vm
+
+jobs:
+  cli-darwin:
+    runs-on: hanzo-build-macos-arm64
+    timeout-minutes: 90
+    steps:
+      - uses: actions/checkout@v4
+        with:
+          ref: ${{ inputs.tag || github.ref }}
+      - uses: dtolnay/rust-toolchain@stable
+      - run: cargo build --release -p hanzo-vm
+      - run: codesign --entitlements vm.entitlements --force -s - target/release/hanzo-vm
+      - run: tar czf "hanzo-vm-${TAG}-darwin-aarch64.tar.gz" -C target/release hanzo-vm
+      - run: |
+          gh release create "$TAG" --title "$TAG" --notes "Release $TAG" 2>/dev/null || true
+          gh release upload "$TAG" "hanzo-vm-${TAG}-darwin-aarch64.tar.gz" --clobber
+
+  cli-linux:
+    runs-on: hanzo-build-linux-arm64
+    timeout-minutes: 90
+    steps:
+      - uses: actions/checkout@v4
+        with:
+          ref: ${{ inputs.tag || github.ref }}
+      - uses: dtolnay/rust-toolchain@stable
+      - run: cargo build --release -p hanzo-vm
+      - run: tar czf "hanzo-vm-${TAG}-linux-aarch64.tar.gz" -C target/release hanzo-vm
+      - run: |
+          gh release create "$TAG" --title "$TAG" --notes "Release $TAG" 2>/dev/null || true
+          gh release upload "$TAG" "hanzo-vm-${TAG}-linux-aarch64.tar.gz" --clobber
+
+  os:
+    runs-on: hanzo-build-linux-arm64
+    timeout-minutes: 180
+    steps:
+      - uses: actions/checkout@v4
+        with:
+          ref: ${{ inputs.tag || github.ref }}
+      - uses: dtolnay/rust-toolchain@stable
+        with:
+          targets: aarch64-unknown-linux-musl
+      - run: |
+          sudo apt-get update -qq
+          sudo apt-get install -y -qq musl-tools debootstrap e2fsprogs busybox-static pax-utils cpio \
+            build-essential bc flex bison libelf-dev libssl-dev curl xz-utils
+      - run: cargo build -p vm-guest --target aarch64-unknown-linux-musl --release
+        env:
+          CARGO_TARGET_AARCH64_UNKNOWN_LINUX_MUSL_LINKER: musl-gcc
+      - run: ./scripts/prepare-rootfs.sh
+        env:
+          HANZO_VM_HOME: ${{ github.workspace }}/os
+      - run: tar czf "hanzo-vm-os-${TAG}-aarch64.tar.gz" -C os Image initramfs.cpio.gz rootfs.ext4
+      - run: |
+          gh release create "$TAG" --title "$TAG" --notes "Release $TAG" 2>/dev/null || true
+          gh release upload "$TAG" "hanzo-vm-os-${TAG}-aarch64.tar.gz" --clobber