Claude/gpu vm config simplify 2iq62m

.gitattributes

@@ -0,0 +1,11 @@
+# Nix embeds the contents of these files verbatim into derivation build
+# scripts.  A CR that survives into such a script reaches bash as a literal
+# $'\r' command and the build dies with exit code 127, so a Windows clone made
+# with the Git default core.autocrlf=true cannot build the images at all.
+# Normalise everything to LF in the working tree, not just in the blobs.
+* text=auto eol=lf
+
+# The CMD entry points are the exception: cmd.exe parses multi-line blocks
+# reliably only with CRLF.
+*.cmd text eol=crlf
+*.bat text eol=crlf

.github/workflows/ci.yml

@@ -0,0 +1,61 @@
+name: ci
+
+on:
+  push:
+    branches: [main]
+  pull_request:
+  workflow_dispatch:
+
+jobs:
+  nix:
+    name: flake check, manifest sync, home seed
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+
+      - uses: DeterminateSystems/nix-installer-action@main
+
+      - name: nix flake check
+        run: nix flake check --no-build -L
+
+      - name: manifest.json matches Nix
+        run: |
+          nix build .#qubix-manifest-json --out-link manifest.generated
+          if ! diff -u manifest.json manifest.generated; then
+            echo "::error::manifest.json is stale. Run tools/update-manifest.sh and commit the result."
+            exit 1
+          fi
+
+      - name: home seed image builds
+        run: nix build .#spotibox-home-vhdx -L --no-link
+
+  powershell:
+    name: controller lint + unit checks (${{ matrix.shell }})
+    runs-on: windows-latest
+    strategy:
+      fail-fast: false
+      matrix:
+        # Windows PowerShell 5.1 is what qubix-up.cmd runs; pwsh is the
+        # developer console.  Both must stay happy.
+        shell: [powershell, pwsh]
+    defaults:
+      run:
+        # A step's own `shell:` accepts no contexts at all, so the matrix
+        # value has to arrive through the job defaults instead.
+        shell: ${{ matrix.shell }}
+    steps:
+      - uses: actions/checkout@v4
+
+      - name: PSScriptAnalyzer
+        if: matrix.shell == 'pwsh'
+        shell: pwsh
+        run: |
+          Install-Module PSScriptAnalyzer -Scope CurrentUser -Force
+          $results = Invoke-ScriptAnalyzer -Path tools -Recurse -Settings ./PSScriptAnalyzerSettings.psd1
+          $results | Format-Table -AutoSize | Out-String | Write-Host
+          if ($results.Count -gt 0) { exit 1 }
+
+      - name: unit checks
+        run: |
+          & ./tests/qubixctl.Tests.ps1
+          if ($LASTEXITCODE -ne 0) { exit $LASTEXITCODE }

.github/workflows/release.yml

@@ -0,0 +1,73 @@
+name: release
+
+# Builds the Hyper-V images with Nix and attaches them to the GitHub release
+# for the tag.  Windows hosts then need nothing but Hyper-V and PowerShell:
+# `qubixctl -Command up` downloads these assets, no WSL involved.
+on:
+  push:
+    tags: ['v*']
+  workflow_dispatch:
+    inputs:
+      tag:
+        description: 'Existing tag to (re)build and publish'
+        required: true
+        type: string
+
+permissions:
+  contents: write
+
+jobs:
+  build:
+    name: build and publish images
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+        with:
+          ref: ${{ inputs.tag || github.ref }}
+
+      - name: Enable KVM for the Nix build sandbox
+        # make-disk-image builds the VHDX inside a QEMU VM; without KVM it
+        # would crawl through TCG emulation.
+        run: |
+          echo 'KERNEL=="kvm", GROUP="kvm", MODE="0666", OPTIONS+="static_node=kvm"' | sudo tee /etc/udev/rules.d/99-kvm4all.rules
+          sudo udevadm control --reload-rules
+          sudo udevadm trigger --name-match=kvm
+          ls -la /dev/kvm
+
+      - name: Free disk space
+        run: |
+          sudo rm -rf /usr/share/dotnet /usr/local/lib/android /opt/ghc /opt/hostedtoolcache/CodeQL
+          df -h /
+
+      - uses: DeterminateSystems/nix-installer-action@main
+        with:
+          extra-conf: |
+            system-features = nixos-test benchmark big-parallel kvm
+
+      - name: Build release bundle
+        run: nix build .#spotibox-release -L --out-link release
+
+      - name: Inspect assets
+        run: |
+          ls -la release/
+          cat release/SHA256SUMS
+          for f in release/*.gz; do
+            size=$(stat -L -c %s "$f")
+            if [ "$size" -ge 2000000000 ]; then
+              echo "::error::$f is $size bytes, above the 2 GB GitHub release asset limit"
+              exit 1
+            fi
+          done
+
+      - name: Version stamp
+        run: |
+          tag="${{ inputs.tag || github.ref_name }}"
+          printf 'tag=%s\nrev=%s\n' "$tag" "$(git rev-parse HEAD)" > VERSION
+          cat VERSION
+
+      - uses: softprops/action-gh-release@v2
+        with:
+          tag_name: ${{ inputs.tag || github.ref_name }}
+          files: |
+            release/*
+            VERSION

.gitignore

@@ -1,6 +1,7 @@
 result
 result-*
 .qubix/
+manifest.generated
 *.vhd
 *.vhdx
 *.qcow2

PSScriptAnalyzerSettings.psd1

@@ -0,0 +1,8 @@
+@{
+    Severity = @('Error', 'Warning')
+    ExcludeRules = @(
+        # qubixctl is an interactive CLI: progress lines are for the person
+        # watching the console, not for a pipeline.  Write-Host is the tool.
+        'PSAvoidUsingWriteHost'
+    )
+}