ci: run checks and builds on GitHub Actions, with release-intent automation (#87)

* ci: add GitHub Actions checks and unsigned installer builds

Runs the header, desktop, and Go test suites on pull requests and pushes to
main and develop, plus unsigned installers across a six-way matrix. Windows
builds natively rather than cross-compiled under wine.

Also runs services/build.sh and build.bat natively on each platform. That is
a second, independent build path over the same Go code: it parses versions
with jq and stamps -ldflags -X main.Version, where the desktop path
cross-compiles through a TypeScript script. Either can break alone.

Neither workflow holds a secret or requests an OIDC token: both execute code
from the pull request, so there must be no credential for that code to
reach. Actions are pinned to full commit SHAs. Signed releases are built
elsewhere, from a tag.

Signed-off-by: Terve <ntervalon@nvidia.com>

* docs: add public changelog seeded from the published releases

Records the 0.1.0 and 0.1.1 notes as published on the releases page. This
repository had no changelog, so release history was only discoverable there.

Seeded from the published notes rather than carrying over historical
development entries, and tracks the 0.1.x version that desktop/package.json
and the release tags use.

Signed-off-by: Terve <ntervalon@nvidia.com>

* refactor: rename versions.json product to services, drop installer

The field called `product` only ever versioned the services suite: it is
declared inside services/, stamps the standalone installer and Go
main.Version, and the version users install lives in desktop/package.json,
which was explicitly out of scope for it. The two had drifted to 0.91.7 and
0.1.1, which is the clearest evidence they were never one number.

`installer` is dropped: documented as 'always equals product', it could
never differ from another field. Readers of '.installer // .product' now
read '.services'.

Updates all nine consumers, including build.sh which was reading .product
and would have silently resolved null. The versions card already displayed
this as 'Services', so no user-visible string changes.

Signed-off-by: Terve <ntervalon@nvidia.com>

* ci: add release-intent automation

Contributors declare version bumps and changelog text in the pull request
body; a check validates it, and after the merge lands on develop a bot
applies it to desktop/package.json, services/versions.json, and CHANGELOG.md
in one commit via the git data API. The contents API is one commit per file,
which would land a release in pieces with a window where the changelog names
a version package.json does not carry.

The release version is not declared. It patch-bumps automatically whenever an
intent declares a release, so the only judgement left is services and
component severity; a minor or major release is a deliberate manual bump.

validate_pr.py reads the body from the webhook payload, so it needs no
credential and runs on fork pull requests. It has its own workflow so it can
also trigger on 'edited': a body can change after checks go green, and apply
reads the live body at merge time. Apply rejects unknown keys for the same
reason, but tolerates missing ones, which is a concurrent pull request adding
a component rather than tampering.

The app token gets contents: write and not the Workflows permission, so a
compromise of the apply job cannot rewrite the pipeline.

Ports from the GitLab implementation, dropping its description-truncation
fallback, the protected-variable split that fallback needed, and its
url.insteadOf workaround — all GitLab Runner specifics. Also corrects the
pull request template, which told contributors to hand-edit
services/versions.json; the bot-owned path check rejects exactly that, so
every pull request would have failed.

Signed-off-by: Terve <ntervalon@nvidia.com>

* ci: declare toolchain versions once in a composite action

Node and Go versions were duplicated between ci.yml and build.yml. GitHub
Actions has no shared constants file — env: is per-workflow and one workflow
cannot read another — so a local composite action is the only way to declare
them once without moving them out of the repository into repository variables,
where they would stop being reviewable.

Bumping one copy and forgetting the other would have pull request checks and
release builds running different toolchains, which is the failure this
removes.

Inputs keep what each job actually needs: the header check takes Node without
an npm cache it has no install to populate, and the build-script job takes Go
without Node. Checkout stays in the callers, since a local action cannot exist
before its own repository is on disk.

Signed-off-by: Terve <ntervalon@nvidia.com>

* ci: point setup-go at the module lockfiles

setup-go caches by default and looks for a dependency file at the repository
root. Every Go module lives under services/, so the action found nothing and
reported 'Dependencies file is not found' on each run — a warning in current
versions, a hard failure in some earlier ones.

Naming the path fixes that and makes the caching real: a cold build pulls
roughly 40 seconds of modules, repeated across the services job, the
three-platform build-script job, and the installer builds.

It also pins the cache key, which is version-dependent otherwise: older
setup-go hashes go.sum, newer hashes go.mod.

Signed-off-by: Terve <ntervalon@nvidia.com>

* ci: assert staged binaries match versions.json, not a count

The check asserted 'at least 13'. A floor stops asserting anything the
moment the real number grows: add a fourteenth component and it keeps
passing, so the check quietly becomes decoration.

A hardcoded '-eq 13' fixes that but still only sees the count, and 13 is a
magic number with no relationship to where components are actually declared.

Compares the staged names against the component keys in versions.json
instead. Adding, removing, or renaming a component now fails until the build
script and the manifest agree, and the failure names which side is missing
what rather than reporting a number.

Signed-off-by: Terve <ntervalon@nvidia.com>

* docs: regenerate services-api.md after the versions rename

The product-to-services rename changed a line that verify-service-contracts
generates into docs/services-api.md, but the generated file was not
regenerated to match, so the freshness gate failed.

Generated output only; produced by npm run service-contracts:write.

Signed-off-by: Terve <ntervalon@nvidia.com>

* ci: make the staged-binary check immune to line endings

The check compared two lists built by different pipelines, so a stray
carriage return made every entry differ while printing identically. The
failure output then showed the same names on both sides, which reads as
nonsense rather than as a diagnosis.

Both sides now run through one normalizer, in an order that matters: CR is
stripped before the .exe suffix, because under Git Bash a CRLF line leaves
.exe mid-string and 's/\.exe$//' never matches. LC_ALL=C makes the sort
byte-wise, which is what the comm calls already assumed.

On failure it also dumps the raw listing and both lists through 'sed -n l',
so an invisible character shows up as \r instead of as two identical lists.

Verified against a CRLF versions.json with .exe binaries, a POSIX checkout,
a missing component, and an undeclared one.

Signed-off-by: Terve <ntervalon@nvidia.com>

* ci: fix release-intent triggers and the installer path filter

Three review findings.

The apply workflow's concurrency group did not serialize applies, it dropped
them. GitHub keeps one pending run per group and cancels any earlier one, and
cancel-in-progress: false only protects the running job, not the queued one.
Because an app installation token push does start workflow runs, the bot's own
commit queues a third run that evicts a genuine merge waiting behind it — a
lost bump with no failure anywhere. apply_pr.py already handles ordering by
committing with force: false and re-reading a moved ref, so the group was an
extra failure mode rather than belt and braces. Replaces it with a job-level
guard that skips the bot's own pushes without booting a runner.

The check workflow gated pull requests into main, but apply only runs on
pushes to develop, so a pull request targeting main was required to declare
bumps and then had them silently discarded. Restricting the check to develop
also unblocks the release cut, whose develop -> main pull request carries the
bot's own edits to the two paths check_forbidden_paths rejects.

The installer path filter covered .github/workflows/** but not
.github/actions/**, so a Node or Go bump in the composite action ran ci.yml on
the new toolchain and skipped the six-way matrix.

Signed-off-by: Terve <ntervalon@nvidia.com>

* fix: rebuild cli-bin when only the services version changes

The manifest currency check compared the fingerprint, platform, arch, and
component versions but not the services version, so a services-only bump left
an existing manifest counting as current and the stale version was what the UI
reported in dev.

Verified: with no change the build skips as before; bumping only services now
rebuilds and rewrites the manifest.

Signed-off-by: Terve <ntervalon@nvidia.com>

* docs: point contributors at develop and the intent block

AGENTS.md, CONTRIBUTING.md, and desktop/docs/services-backend.md all still told
contributors to bump services/versions.json by hand, which CI now rejects.
services/readme.md and the pull request template were updated when the rule
landed; these three were missed. The internal job that used to enforce this is
stripped from the public cut, so for public contributors the rule is new and
the docs are the only thing announcing it.

CONTRIBUTING.md also told contributors to branch from main and never named
develop, walking them straight into a pull request whose declared bumps would
be discarded on merge.

Records four limits that were real but undocumented: apply resolves only the
head commit's pull request, so develop must take one merge per push; the apply
workflow must not gain a concurrency group; a literal '### ' line truncates a
changelog body; and the gate assumes branch protection requires the check.
Also notes that the app and its two settings must exist before the first push
to develop.

Signed-off-by: Terve <ntervalon@nvidia.com>

---------

Signed-off-by: Terve <ntervalon@nvidia.com>

Author: Noah-Tervalon-Nvidia

.github/PULL_REQUEST_TEMPLATE.md

@@ -3,6 +3,40 @@
 <!-- Explain the problem and the user-visible outcome. -->
 <!-- Link issues with "Closes #123". -->
 
+## Release intent
+
+<!-- Keep the fences exactly as they are; CI parses between them. -->
+<!-- Set each bump to none, patch, minor, or major. Leave the key names. -->
+<!-- `services` must be >= the highest component bump. -->
+<!-- Set the title and body to n/a when no bump is a release. -->
+<!-- The release version users see is NOT declared here: it patch-bumps by
+     itself whenever any bump above is a release. -->
+<!-- Keep the changelog body to prose and bullets. A line starting with "### "
+     ends the section and silently truncates the rest. -->
+
+<!-- pair-release-intent:v1 -->
+### Changelog title
+n/a
+
+### Changelog body
+n/a
+
+### Bumps
+- services: none
+- nvpair-cluster-manager: none
+- nvpair-engine-manager: none
+- nvpair-errors: none
+- nvpair-job-scheduler: none
+- nvpair-manual-nodes: none
+- nvpair-node-info: none
+- nvpair-node-scanner: none
+- nvpair-node-settings: none
+- nvpair-proxy: none
+- nvpair-tui: none
+- nvpair-ui-broker: none
+- nvpair-workload-manager: none
+<!-- /pair-release-intent:v1 -->
+
 ## Scope
 
 <!-- What is intentionally included and excluded? -->
@@ -23,4 +57,4 @@
 - [ ] Relevant documentation is updated.
 - [ ] I checked the diff, changed filenames, and commit messages for credentials, private data, internal URLs, internal issue identifiers, and generated artifacts.
 - [ ] I recorded the validation commands and results above.
-- [ ] I bumped any affected component in `services/versions.json`, and described user-visible changes above so they reach the release notes.
+- [ ] I declared version bumps in the release-intent block above. `services/versions.json` is written by automation — do not edit it by hand.

.github/actions/setup/action.yml

@@ -0,0 +1,70 @@
+# SPDX-FileCopyrightText: Copyright (c) 2026 NVIDIA CORPORATION & AFFILIATES. All rights reserved.
+# SPDX-License-Identifier: Apache-2.0
+
+# The single place the Node and Go versions are declared.
+#
+# GitHub Actions has no shared constants file: `env:` is per-workflow and one
+# workflow cannot read another. Four workflows exist because each needs a
+# distinct `on:` block, so without this they would each carry their own copy of
+# the versions, and bumping one while forgetting another would have pull request
+# checks and release builds running different toolchains.
+#
+# The caller must check out the repository first — a local action cannot exist
+# until its own repo is on disk, so checkout stays in the workflow.
+#
+# On a fork pull request this file comes from the fork, like every other script
+# those jobs run. That adds no exposure: those jobs already execute the pull
+# request's `npm ci` and `go test`, hold no secret, and run on hosted runners.
+name: Set up toolchains
+description: Installs the pinned Node and Go toolchains used across all workflows.
+
+inputs:
+    node:
+        description: Install Node.
+        default: 'true'
+    go:
+        description: Install Go.
+        default: 'false'
+    npm-cache:
+        description: Cache the npm download cache. Pointless without an npm install.
+        default: 'true'
+
+runs:
+    using: composite
+    steps:
+        # desktop/package.json engines requires >=25.5.0. Pinned to a major
+        # rather than read from that range, which would drift to whatever Node
+        # is newest.
+        - if: inputs.node == 'true'
+          uses: actions/setup-node@a0853c24544627f65ddf259abe73b1d18a591444 # v5
+          with:
+              node-version: '25'
+              cache: ${{ inputs.npm-cache == 'true' && 'npm' || '' }}
+              cache-dependency-path: desktop/package-lock.json
+
+        # Forbids the surprise toolchain download, so the version below is the
+        # one that actually builds. Set before setup-go because setup-go reads
+        # GOTOOLCHAIN when resolving a version file.
+        - if: inputs.go == 'true'
+          shell: bash
+          run: echo 'GOTOOLCHAIN=local' >> "$GITHUB_ENV"
+
+        # Must be >= the highest `go` directive across services/*/go.mod, which
+        # GOTOOLCHAIN=local would otherwise refuse to satisfy.
+        #
+        # cache-dependency-path is required, not an optimization. setup-go
+        # caches by default and looks for the dependency file at the repository
+        # root, where there is none — every Go module lives under services/.
+        # Left unset it reports "Dependencies file is not found" on every run.
+        # Naming the path also pins the cache key: older versions hash go.sum,
+        # newer ones hash go.mod.
+        #
+        # scripts/ matches nothing today; it is listed so a Go dependency added
+        # to the support tooling joins the key instead of silently missing it.
+        - if: inputs.go == 'true'
+          uses: actions/setup-go@924ae3a1cded613372ab5595356fb5720e22ba16 # v6
+          with:
+              go-version: '1.26.7'
+              cache-dependency-path: |
+                  services/**/go.sum
+                  scripts/**/go.sum

.github/workflows/build.yml

@@ -0,0 +1,109 @@
+# SPDX-FileCopyrightText: Copyright (c) 2026 NVIDIA CORPORATION & AFFILIATES. All rights reserved.
+# SPDX-License-Identifier: Apache-2.0
+
+# Unsigned installer builds on GitHub-hosted runners.
+#
+# These are verification and pull-request artifacts, never releases: every
+# target ends in `electron-builder --publish never`, and this workflow holds no
+# signing or publishing credentials. Signed releases are produced separately
+# from a tag, and are rebuilt from source rather than signing anything this
+# workflow produced.
+name: Build
+
+on:
+    workflow_dispatch:
+    push:
+        branches: [main, develop]
+    pull_request:
+        branches: [main, develop]
+        paths:
+            - '.github/workflows/**'
+            # The composite action pins the Node and Go versions. Without this
+            # a toolchain bump would run ci.yml and skip the installer matrix,
+            # which is the cross-workflow drift the action exists to prevent.
+            - '.github/actions/**'
+            - 'scripts/**'
+            - 'services/**'
+            - 'desktop/package.json'
+            - 'desktop/package-lock.json'
+            - 'desktop/src/**'
+            - 'desktop/scripts/**'
+            - 'desktop/native/**'
+            - 'desktop/resources/**'
+            - 'desktop/tsconfig*.json'
+            - 'desktop/vite.*.config.ts'
+            - 'desktop/electron.vite.config.ts'
+            - 'desktop/electron-builder.config.ts'
+
+permissions:
+    contents: read
+
+concurrency:
+    group: build-${{ github.ref }}
+    cancel-in-progress: ${{ github.event_name == 'pull_request' }}
+
+# Toolchain versions are declared once, in .github/actions/setup.
+
+jobs:
+    build:
+        name: ${{ matrix.name }}
+        runs-on: ${{ matrix.os }}
+        timeout-minutes: 60
+        strategy:
+            # One platform failing should not hide the state of the other five.
+            fail-fast: false
+            matrix:
+                include:
+                    - name: linux-x64
+                      os: ubuntu-latest
+                      script: build:linux:x64
+                    - name: linux-arm64
+                      os: ubuntu-latest
+                      script: build:linux:arm64
+                    - name: win-x64
+                      os: windows-latest
+                      script: build:win:x64
+                    - name: win-arm64
+                      os: windows-latest
+                      script: build:win:arm64
+                    - name: mac-arm64
+                      os: macos-latest
+                      script: build:mac:arm64
+                    - name: mac-x64
+                      os: macos-15-intel
+                      script: build:mac:x64
+        steps:
+            - uses: actions/checkout@fbc6f3992d24b796d5a048ff273f7fcc4a7b6c09 # v5
+
+            # Recorded so a failure can be read against the machine it ran on.
+            - name: Report runner capacity
+              shell: bash
+              run: |
+                  echo "label:  ${{ matrix.os }}"
+                  echo "kernel: $(uname -s) $(uname -m)"
+                  echo "cpus:   $(nproc 2>/dev/null || sysctl -n hw.ncpu 2>/dev/null || echo unknown)"
+                  free -h 2>/dev/null || sysctl -n hw.memsize 2>/dev/null || echo "mem: unknown"
+                  df -h . | tail -1
+
+            - uses: ./.github/actions/setup
+              with:
+                  go: 'true'
+
+            # electron-builder needs fakeroot and rpm to stage Linux packages;
+            # ubuntu-latest ships neither.
+            - name: Install Linux packaging tools
+              if: runner.os == 'Linux'
+              run: sudo apt-get update -qq && sudo apt-get install -y -qq fakeroot rpm
+
+            - run: npm --prefix desktop ci --prefer-offline
+
+            - name: Build ${{ matrix.name }}
+              run: npm --prefix desktop run ${{ matrix.script }}
+
+            - uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4
+              if: always()
+              with:
+                  name: unsigned-${{ matrix.name }}
+                  path: desktop/release/**
+                  retention-days: 7
+                  if-no-files-found: warn