feat(release): build/upload gvproxy/initramfs/rootfs by twitchyliquid64 · Pull Request #622 · gominimal/minimal

twitchyliquid64 · 2026-07-02T23:47:16Z

Builds:

virtio-kernel-amd64 / virtio-kernel-arm64 (vmlinuz-amd64 / vmlinuz-arm64)
minvmd-rootfs-amd64 / minvmd-rootfs-arm64 (rootfs-amd64.img / rootfs-arm64.img)
minimald-initramfs-amd64 / minimald-initramfs-arm64 (initramfs-amd64.cpio / initramfs-arm64.cpio)
gvproxy-linux-amd64 / gvproxy-linux-arm64 / gvproxy-darwin-arm64 (already amd64/arm64)

The x86_64/aarch64 strings that remain are only script arguments — fetch-artifact.sh's --arch value and build-initramfs.sh's rust target triples, which must stay in that form.

Summary by CodeRabbit

New Features
- Release builds now include prepackaged guest artifacts for both x86_64 and arm64 targets, helping ensure complete release assets are available.
- Release uploads now cover additional platform-specific binaries, including Linux and macOS variants.
Bug Fixes
- Improved download handling so a specific release asset can be chosen directly instead of relying only on the current machine’s platform.

coderabbitai · 2026-07-02T23:47:33Z

📝 Walkthrough

Walkthrough

Adds a new build-release-guest-artifacts CI job that assembles guest microVM release artifacts (kernel, rootfs, initramfs, gvproxy) for multiple architectures and wires it as a dependency of the release job. Updates fetch-gvproxy.sh to accept an optional explicit asset argument instead of always deriving it from host OS/arch.

Changes

Guest release artifacts

Layer / File(s)	Summary
Asset selection in fetch script `scripts/fetch-gvproxy.sh`	Script accepts an optional second argument to select the gvproxy asset/platform explicitly, falling back to host-based `uname` detection when omitted; usage docs updated.
New guest artifact build job and release wiring `.github/workflows/release.yml`	Adds `build-release-guest-artifacts` job installing protobuf/cpio tools and cross-compilation setup, downloading pinned kernel/rootfs for x86_64/aarch64, building initramfs images, fetching pinned gvproxy binaries for linux amd64/arm64 and darwin-arm64, uploading arch-suffixed artifacts, and caching cargo outputs; adds this job to the `release` job's `needs` list.

Estimated code review effort: 2 (Simple) | ~15 minutes

Possibly related PRs

gominimal/minimal#503: Both PRs modify the same scripts/fetch-gvproxy.sh logic for downloading a pinned/verified gvproxy binary.

Suggested reviewers: bryan-minimal

Poem

A rabbit hops through YAML fields so wide,
Fetching kernels, rootfs, gvproxy with pride,
Two arches packed, darwin joins the crew,
One more needs line, and the release comes through!
🐇📦✨

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly summarizes the main release artifact build and upload changes.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

✨ Finishing Touches

📝 Generate docstrings

Create stacked PR
Commit on current branch

_{Comment @coderabbitai help to get the list of available commands.}

coderabbitai

🧹 Nitpick comments (1)

.github/workflows/release.yml (1)
275-277: 📐 Maintainability & Code Quality | 🔵 Trivial | ⚡ Quick win

Inconsistent persist-credentials hardening across jobs.

This checkout step sets persist-credentials: false, but test, build-release-linux-amd64, build-release-linux-arm64, and release (the job with contents: write/id-token: write permissions) do not. This is the exact pattern flagged previously — apply consistently across all workflow checkout steps, or omit it here to match current file convention.

Based on learnings, in this repo don't harden individual actions/checkout steps with persist-credentials: false only in some jobs — apply it repo-wide if adopted, since previously "don’t harden individual actions/checkout steps by adding persist-credentials: false only in one workflow/step."
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In @.github/workflows/release.yml around lines 275 - 277, Make the checkout
credential hardening consistent across the workflow: this `actions/checkout`
step in the release job uses `persist-credentials: false`, but the `test`,
`build-release-linux-amd64`, `build-release-linux-arm64`, and `release` jobs do
not. Either apply `persist-credentials: false` to all `actions/checkout` steps
in this workflow (including the other jobs) or remove it here to match the
repo’s current convention; use the existing `actions/checkout` steps in these
jobs as the places to update.
Source: Learnings

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Nitpick comments:
In @.github/workflows/release.yml:
- Around line 275-277: Make the checkout credential hardening consistent across
the workflow: this `actions/checkout` step in the release job uses
`persist-credentials: false`, but the `test`, `build-release-linux-amd64`,
`build-release-linux-arm64`, and `release` jobs do not. Either apply
`persist-credentials: false` to all `actions/checkout` steps in this workflow
(including the other jobs) or remove it here to match the repo’s current
convention; use the existing `actions/checkout` steps in these jobs as the
places to update.

ℹ️ Review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro

Run ID: f32db411-e59a-4927-82fd-c4da04562f76

📥 Commits

Reviewing files that changed from the base of the PR and between 0661629 and 699380f.

📒 Files selected for processing (2)

.github/workflows/release.yml
scripts/fetch-gvproxy.sh

feat(release): build/upload gvproxy/initramfs/rootfs

699380f

twitchyliquid64 requested a review from norrietaylor July 2, 2026 23:47

coderabbitai Bot reviewed Jul 2, 2026

View reviewed changes

norrietaylor approved these changes Jul 2, 2026

View reviewed changes

twitchyliquid64 enabled auto-merge (squash) July 3, 2026 00:00

twitchyliquid64 merged commit 6747db4 into main Jul 3, 2026
56 checks passed

twitchyliquid64 deleted the tom/release branch July 3, 2026 00:18

coderabbitai Bot mentioned this pull request Jul 9, 2026

feat(gha): use released mip to fetch pkgs artifacts for CI #692

Merged

Navigation Menu

Uh oh!

feat(release): build/upload gvproxy/initramfs/rootfs - #622

feat(release): build/upload gvproxy/initramfs/rootfs#622
twitchyliquid64 merged 1 commit into
mainfrom
tom/release

twitchyliquid64 commented Jul 2, 2026 •

edited by coderabbitai Bot

Loading

Uh oh!

coderabbitai Bot commented Jul 2, 2026 •

edited

Loading

Walkthrough

Changes

Uh oh!

coderabbitai Bot left a comment

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

Uh oh!

Conversation

twitchyliquid64 commented Jul 2, 2026 • edited by coderabbitai Bot Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Summary by CodeRabbit

Uh oh!

coderabbitai Bot commented Jul 2, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Walkthrough

Changes

Uh oh!

coderabbitai Bot left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

twitchyliquid64 commented Jul 2, 2026 •

edited by coderabbitai Bot

Loading

coderabbitai Bot commented Jul 2, 2026 •

edited

Loading