fix(server): preserve in-memory SQLite across reconnects

.github/workflows/docker-build.yml

@@ -1,94 +1,331 @@
-# SPDX-FileCopyrightText: Copyright (c) 2025-2026 NVIDIA CORPORATION & AFFILIATES. All rights reserved.
-# SPDX-License-Identifier: Apache-2.0
-
 name: Docker Build
 
 on:
   workflow_call:
     inputs:
       component:
+        description: "Component to build (gateway, supervisor, cli)"
         required: true
         type: string
-      binary:
-        required: true
+      timeout-minutes:
+        description: "Per-arch Docker image job timeout in minutes"
+        required: false
+        type: number
+        default: 20
+      push:
+        description: "Push image to registry"
+        required: false
+        type: boolean
+        default: true
+      platform:
+        description: "Target platform(s) for Docker build"
+        required: false
         type: string
-      target-suffix:
-        required: true
+        default: "linux/amd64,linux/arm64"
+      runner:
+        description: "Deprecated; per-arch native runners are selected automatically"
+        required: false
+        type: string
+        default: "linux-amd64-cpu8"
+      cargo-version:
+        description: "Pre-computed cargo version (skips internal git-based computation)"
+        required: false
         type: string
+        default: ""
+      auditable:
+        description: "Embed cargo-auditable dependency metadata in image binaries"
+        required: false
+        type: boolean
+        default: false
       image-tag:
+        description: "Image tag base to build/push (defaults to the GitHub SHA)"
         required: false
         type: string
         default: ""
       checkout-ref:
+        description: "Git ref to check out for build inputs (defaults to the workflow SHA)"
         required: false
         type: string
         default: ""
+      publish-manifest:
+        description: "Push the bare-SHA manifest. Set false for single-arch branch workflows."
+        required: false
+        type: boolean
+        default: true
+
+env:
+  MISE_GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
 
 permissions:
   contents: read
   packages: write
 
+defaults:
+  run:
+    shell: bash
+
 jobs:
-  build:
-    name: ${{ inputs.component }} (${{ matrix.platform }})
+  resolve:
+    name: Resolve build plan
+    runs-on: ubuntu-latest
+    outputs:
+      matrix: ${{ steps.resolve.outputs.matrix }}
+      platform_count: ${{ steps.resolve.outputs.platform_count }}
+      arches: ${{ steps.resolve.outputs.arches }}
+      binary_component: ${{ steps.resolve.outputs.binary_component }}
+      binary_name: ${{ steps.resolve.outputs.binary_name }}
+      artifact_prefix: ${{ steps.resolve.outputs.artifact_prefix }}
+      image_tag_base: ${{ steps.resolve.outputs.image_tag_base }}
+      features: ${{ steps.resolve.outputs.features }}
+      has_image: ${{ steps.resolve.outputs.has_image }}
+    steps:
+      - name: Resolve component and platform matrix
+        id: resolve
+        run: |
+          set -euo pipefail
+
+          component="${{ inputs.component }}"
+          case "$component" in
+            gateway)
+              binary_component=gateway
+              binary_name=openshell-gateway
+              features="bundled-z3"
+              has_image=true
+              ;;
+            supervisor)
+              binary_component=sandbox
+              binary_name=openshell-sandbox
+              features=""
+              has_image=true
+              ;;
+            cli)
+              binary_component=cli
+              binary_name=openshell
+              features=""
+              has_image=true
+              ;;
+            *)
+              echo "unsupported component: $component" >&2
+              exit 1
+              ;;
+          esac
+
+          image_tag_base="${{ inputs['image-tag'] }}"
+          if [[ -z "$image_tag_base" ]]; then
+            image_tag_base="$GITHUB_SHA"
+          fi
+
+          platform_input="${{ inputs.platform }}"
+          platform_input="${platform_input//[[:space:]]/}"
+          if [[ -z "$platform_input" ]]; then
+            echo "platform input must not be empty" >&2
+            exit 1
+          fi
+
+          IFS=',' read -r -a platforms <<< "$platform_input"
+          matrix='{"include":['
+          arches=()
+          count=0
+
+          for platform in "${platforms[@]}"; do
+            case "$platform" in
+              linux/amd64)
+                arch=amd64
+                runner=linux-amd64-cpu8
+                ;;
+              linux/arm64)
+                arch=arm64
+                runner=linux-arm64-cpu8
+                ;;
+              *)
+                echo "unsupported platform: $platform" >&2
+                echo "supported platforms: linux/amd64, linux/arm64" >&2
+                exit 1
+                ;;
+            esac
+
+            if [[ $count -gt 0 ]]; then
+              matrix+=','
+            fi
+            matrix+='{"platform":"'"$platform"'","arch":"'"$arch"'","runner":"'"$runner"'"}'
+            arches+=("$arch")
+            count=$((count + 1))
+          done
+
+          matrix+=']}'
+          {
+            echo "matrix=$matrix"
+            echo "platform_count=$count"
+            echo "arches=${arches[*]}"
+            echo "binary_component=$binary_component"
+            echo "binary_name=$binary_name"
+            echo "artifact_prefix=rust-binary-${component}"
+            echo "image_tag_base=$image_tag_base"
+            echo "features=$features"
+            echo "has_image=$has_image"
+          } >> "$GITHUB_OUTPUT"
+
+  rust-binary:
+    name: Rust ${{ needs.resolve.outputs.binary_component }} (${{ matrix.arch }})
+    needs: resolve
+    permissions:
+      contents: read
+      packages: read
     strategy:
       fail-fast: false
-      matrix:
-        include:
-          - arch: amd64
-            rust_arch: x86_64
-            platform: linux/amd64
-            runner: linux-amd64-cpu8
-          - arch: arm64
-            rust_arch: aarch64
-            platform: linux/arm64
-            runner: linux-arm64-cpu8
+      matrix: ${{ fromJSON(needs.resolve.outputs.matrix) }}
+    uses: ./.github/workflows/rust-native-build.yml
+    with:
+      component: ${{ needs.resolve.outputs.binary_component }}
+      arch: ${{ matrix.arch }}
+      cargo-version: ${{ inputs['cargo-version'] }}
+      image-tag: ${{ needs.resolve.outputs.image_tag_base }}
+      checkout-ref: ${{ inputs['checkout-ref'] }}
+      features: ${{ needs.resolve.outputs.features }}
+      auditable: ${{ inputs.auditable }}
+      artifact-name: ${{ needs.resolve.outputs.artifact_prefix }}-linux-${{ matrix.arch }}
+    secrets: inherit
+
+  build:
+    name: Build ${{ inputs.component }} (${{ matrix.arch }})
+    needs: [resolve, rust-binary]
+    if: needs.resolve.outputs.has_image == 'true'
     runs-on: ${{ matrix.runner }}
-    timeout-minutes: 20
+    timeout-minutes: ${{ inputs['timeout-minutes'] }}
+    strategy:
+      fail-fast: false
+      matrix: ${{ fromJSON(needs.resolve.outputs.matrix) }}
+    container:
+      image: ghcr.io/nvidia/openshell/ci:latest
+      credentials:
+        username: ${{ github.actor }}
+        password: ${{ secrets.GITHUB_TOKEN }}
+      options: --privileged
+      volumes:
+        - /var/run/docker.sock:/var/run/docker.sock
+        # Expose the nv-gha-runners buildkitd.toml registry mirror config
+        # inside the container so setup-buildx can read it.
+        - /etc/buildkit:/etc/buildkit:ro
+    env:
+      IMAGE_TAG: ${{ format('{0}-{1}', needs.resolve.outputs.image_tag_base, matrix.arch) }}
+      IMAGE_REGISTRY: ghcr.io/nvidia/openshell
+      DOCKER_PUSH: ${{ inputs.push && '1' || '0' }}
+      DOCKER_PLATFORM: ${{ matrix.platform }}
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           ref: ${{ inputs['checkout-ref'] || github.sha }}
+          fetch-depth: 0
+
+      - name: Mark workspace safe for git
+        run: git config --global --add safe.directory "$GITHUB_WORKSPACE"
+
+      - name: Install tools
+        run: mise install --locked
+
+      - name: Log in to GHCR
+        if: ${{ inputs.push }}
+        run: echo "${{ secrets.GITHUB_TOKEN }}" | docker login ghcr.io -u "${{ github.actor }}" --password-stdin
+
+      - name: Set up buildx (local driver)
+        uses: ./.github/actions/setup-buildx
+        with:
+          buildkitd-config: /etc/buildkit/buildkitd.toml
 
-      - uses: ./.github/actions/build-docker-image
+      - name: Download Rust binary artifact
+        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
         with:
-          component: ${{ inputs.component }}
-          binary: ${{ inputs.binary }}
-          triple: ${{ matrix.rust_arch }}-${{ inputs['target-suffix'] }}
-          arch: ${{ matrix.arch }}
-          platform: ${{ matrix.platform }}
-          image-tag: ${{ inputs.image-tag || github.sha }}
-          github-token: ${{ secrets.GITHUB_TOKEN }}
-
-  manifest:
-    name: ${{ inputs.component }} manifest
-    needs: build
+          name: ${{ needs.resolve.outputs.artifact_prefix }}-linux-${{ matrix.arch }}
+          path: prebuilt-rust-binary
+
+      - name: Stage Rust binary in Docker build context
+        run: |
+          set -euo pipefail
+          binary="${{ needs.resolve.outputs.binary_name }}"
+          download_dir="prebuilt-rust-binary"
+          stage="deploy/docker/.build/prebuilt-binaries/${{ matrix.arch }}"
+          found="$(find "$download_dir" -type f -name "$binary" -print -quit)"
+          if [[ -z "$found" ]]; then
+            echo "missing downloaded artifact file: $binary" >&2
+            find "$download_dir" -maxdepth 4 -type f -print >&2 || true
+            exit 1
+          fi
+          mkdir -p "$stage"
+          install -m 0755 "$found" "$stage/$binary"
+          ls -lh "$stage/"
+
+      - name: Build ${{ inputs.component }} image
+        env:
+          DOCKER_BUILDER: openshell
+        run: |
+          set -euo pipefail
+          mise exec -- tasks/scripts/docker-build-image.sh "${{ inputs.component }}" \
+            --cache-from "type=gha,scope=${{ inputs.component }}-${{ matrix.arch }}" \
+            --cache-to "type=gha,mode=max,scope=${{ inputs.component }}-${{ matrix.arch }}"
+
+      - name: Smoke check ${{ inputs.component }} image
+        run: |
+          set -euo pipefail
+          image="${IMAGE_REGISTRY}/${{ inputs.component }}:${IMAGE_TAG}"
+          case "${{ inputs.component }}" in
+            gateway)
+              output="$(docker run --rm --platform "${{ matrix.platform }}" "$image" --version)"
+              echo "$output"
+              grep -q '^openshell-gateway ' <<<"$output"
+              ;;
+            supervisor)
+              output="$(docker run --rm --platform "${{ matrix.platform }}" --entrypoint /openshell-sandbox "$image" --version)"
+              echo "$output"
+              grep -q '^openshell-sandbox ' <<<"$output"
+              ;;
+            cli)
+              output="$(docker run --rm --platform "${{ matrix.platform }}" "$image" --version)"
+              echo "$output"
+              grep -q '^openshell ' <<<"$output"
+              ;;
+          esac
+
+  merge:
+    name: Merge ${{ inputs.component }} manifest
+    needs: [resolve, build]
+    if: ${{ inputs.push && inputs['publish-manifest'] && needs.resolve.outputs.has_image == 'true' }}
     runs-on: linux-amd64-cpu8
     timeout-minutes: 10
+    container:
+      image: ghcr.io/nvidia/openshell/ci:latest
+      credentials:
+        username: ${{ github.actor }}
+        password: ${{ secrets.GITHUB_TOKEN }}
+      volumes:
+        - /var/run/docker.sock:/var/run/docker.sock
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           ref: ${{ inputs['checkout-ref'] || github.sha }}
 
       - name: Log in to GHCR
-        shell: bash
-        run: echo "${{ secrets.GITHUB_TOKEN }}" | docker login ghcr.io -u "${GITHUB_ACTOR}" --password-stdin
+        run: echo "${{ secrets.GITHUB_TOKEN }}" | docker login ghcr.io -u "${{ github.actor }}" --password-stdin
 
-      - name: Create manifest
-        shell: bash
-        env:
-          IMAGE_TAG: ${{ inputs.image-tag || github.sha }}
-          INPUTS_COMPONENT: ${{ inputs.component }}
+      - name: Create multi-arch manifest
         run: |
-          image=ghcr.io/nvidia/openshell/${INPUTS_COMPONENT}
+          set -euo pipefail
+          image="ghcr.io/nvidia/openshell/${{ inputs.component }}"
+          refs=()
+          for arch in ${{ needs.resolve.outputs.arches }}; do
+            refs+=("${image}:${{ needs.resolve.outputs.image_tag_base }}-${arch}")
+          done
           docker buildx imagetools create \
             --prefer-index=false \
-            --tag "$image:${IMAGE_TAG}" \
-            "$image:${IMAGE_TAG}-amd64" \
-            "$image:${IMAGE_TAG}-arm64"
+            -t "${image}:${{ needs.resolve.outputs.image_tag_base }}" \
+            "${refs[@]}"
 
       - name: Verify merged manifest SBOM attestation
-        shell: bash
         env:
-          IMAGE_REF: ghcr.io/nvidia/openshell/${{ inputs.component }}:${{ inputs.image-tag || github.sha }}
-        run: tasks/scripts/verify-image-sbom.sh "${IMAGE_REF}" --require-cargo
+          IMAGE_REF: ghcr.io/nvidia/openshell/${{ inputs.component }}:${{ needs.resolve.outputs.image_tag_base }}
+          REQUIRE_CARGO: ${{ inputs.auditable }}
+        run: |
+          args=("${IMAGE_REF}")
+          if [[ "${REQUIRE_CARGO}" == "true" ]]; then
+            args+=(--require-cargo)
+          fi
+          tasks/scripts/verify-image-sbom.sh "${args[@]}"