Merge branch 'main' into fix/temporal-namespace-retention

Author: osu

.github/CODEOWNERS

@@ -17,9 +17,9 @@
 /helm/ @NVIDIA/dsx-sw-helm
 /helm-prereqs/ @NVIDIA/dsx-sw-helm @shayan1995
 
-# Documentation
-/docs/ @CoCo-Ben
-/fern/ @CoCo-Ben
+# Documentation (To be re-enabled once as have a doc reviewer)
+#/docs/ @CoCo-Ben
+#/fern/ @CoCo-Ben
 
 # Network IP module
 /common/network/src/ip/ @DrewBloechl

.github/actions/setup-mkosi-environment/action.yml

@@ -4,7 +4,7 @@ inputs:
   rust-version:
     description: 'Rust toolchain version to install'
     required: false
-    default: '1.90.0'
+    default: '1.96.0'
   arch:
     description: 'Target architecture (x86_64 or aarch64)'
     required: false

.github/workflows/build-boot-artifacts.yml

@@ -140,7 +140,7 @@ jobs:
         if: inputs.build_type == 'ephemeral'
         uses: ./.github/actions/setup-mkosi-environment
         with:
-          rust-version: '1.90.0'
+          rust-version: '1.96.0'
           arch: ${{ inputs.arch }}
 
       # Setup Docker for container-based builds

.github/workflows/ci.yaml

@@ -20,7 +20,6 @@ on:
   push:
     branches:
       - main
-      - release/*
       - "pull-request/[0-9]+"
     tags:
       - "v[0-9]*.[0-9]*.[0-9]*"
@@ -510,6 +509,43 @@ jobs:
       tag_latest: false
     secrets: inherit
 
+  # Combine the per-arch nvmetal-carbide images into a single multi-arch manifest
+  # at the bare tag, so the carbide control plane can be scheduled on both amd64
+  # and arm64 nodes. The per-arch images are still pushed individually
+  # (nvmetal-carbide = amd64, nvmetal-carbide-aarch64 = arm64). Sources are
+  # referenced by digest so re-runs are idempotent. Push refs only.
+  merge-manifests-nvmetal-carbide:
+    needs:
+      - prepare
+      - build-release-container-x86_64
+      - build-release-container-aarch64
+    if: ${{ !cancelled() && github.event_name != 'schedule' && !contains(github.ref, 'pull-request/') && needs.build-release-container-x86_64.result == 'success' && needs.build-release-container-aarch64.result == 'success' }}
+    runs-on: linux-amd64-cpu4
+    steps:
+      - name: Checkout code
+        uses: actions/checkout@v4
+
+      - name: Set up Docker Buildx
+        uses: docker/setup-buildx-action@v3
+
+      - name: Login to NVCR
+        uses: ./.github/actions/docker-auth
+        with:
+          username: ${{ secrets.NVCR_USERNAME }}
+          token: ${{ secrets.NVCR_TOKEN }}
+
+      - name: Create and push multi-arch manifest
+        uses: nick-fields/retry@ce71cc2ab81d554ebbe88c79ab5975992d79ba08
+        with:
+          max_attempts: 3
+          timeout_minutes: 10
+          retry_wait_seconds: 20
+          command: |
+            docker buildx imagetools create -t \
+              nvcr.io/0837451325059433/carbide-dev/nvmetal-carbide:${{ needs.prepare.outputs.version }} \
+              nvcr.io/0837451325059433/carbide-dev/nvmetal-carbide@${{ needs.build-release-container-x86_64.outputs.image_digest }} \
+              nvcr.io/0837451325059433/carbide-dev/nvmetal-carbide-aarch64@${{ needs.build-release-container-aarch64.outputs.image_digest }}
+
   test-release-container-services:
     if: ${{ always() && github.event_name != 'schedule' && needs.prepare.result == 'success' }}
     needs:
@@ -734,7 +770,12 @@ jobs:
       dockerfile_path: dev/docker/Dockerfile.release-artifacts-x86_64
       image_name: nvcr.io/0837451325059433/carbide-dev/boot-artifacts-x86_64
       image_tag: ${{ needs.prepare.outputs.version }}
-      platforms: linux/amd64
+      # Multi-arch on push so this x86_64 boot-artifacts carrier can run as an
+      # init container on both amd64 and arm64 control-plane nodes; the payload
+      # it ships is unchanged (x86_64 boot blobs). The Dockerfile has no RUN
+      # steps (FROM alpine + COPY only), so no QEMU is needed. Single-arch on PR
+      # so the image loads to the daemon for the Grype scan.
+      platforms: ${{ !contains(github.ref, 'pull-request/') && 'linux/amd64,linux/arm64' || 'linux/amd64' }}
       runner: linux-amd64-cpu4
       push: ${{ !contains(github.ref, 'pull-request/') }}
       load: true
@@ -760,7 +801,12 @@ jobs:
       dockerfile_path: dev/docker/Dockerfile.release-artifacts-aarch64
       image_name: nvcr.io/0837451325059433/carbide-dev/boot-artifacts-aarch64
       image_tag: ${{ needs.prepare.outputs.version }}
-      platforms: linux/amd64  # Note: aarch64 artifacts packaged in x86_64 image
+      # Container arch is independent of the payload: this carrier always ships
+      # the aarch64 boot blobs as files. Build it multi-arch on push so it can
+      # run as an init container on both amd64 and arm64 control-plane nodes. The
+      # Dockerfile has no RUN steps (FROM alpine + COPY only), so no QEMU is
+      # needed. Single-arch on PR so the image loads to the daemon for Grype.
+      platforms: ${{ !contains(github.ref, 'pull-request/') && 'linux/amd64,linux/arm64' || 'linux/amd64' }}
       runner: linux-amd64-cpu4
       push: ${{ !contains(github.ref, 'pull-request/') }}
       load: true
@@ -868,6 +914,65 @@ jobs:
       scan: true
     secrets: inherit
 
+  # arm64 container build of the machine-validation config carrier, so it can run
+  # as an init container on arm64 control-plane nodes. FROM the aarch64 runtime
+  # base; pushed as machine_validation-aarch64 and merged into the bare
+  # machine_validation tag below. (The bundled validation runner payload staying
+  # arm64-capable is tracked separately — this only makes the carrier runnable on
+  # arm64 nodes.)
+  build-release-machine-validation-artifacts-arm-host:
+    needs:
+      - prepare
+      - build-runtime-container-aarch64
+    if: ${{ !cancelled() && github.event_name != 'schedule' && needs.prepare.result == 'success' && contains('success,skipped', needs.build-runtime-container-aarch64.result) }}
+    uses: ./.github/workflows/docker-build.yml
+    with:
+      dockerfile_path: dev/docker/Dockerfile.machine-validation-config-aarch64
+      image_name: nvcr.io/0837451325059433/carbide-dev/machine_validation-aarch64
+      image_tag: ${{ needs.prepare.outputs.version }}
+      build_args: '{"CI_COMMIT_SHORT_SHA":"${{ needs.prepare.outputs.short_sha }}","CONTAINER_RUNTIME_AARCH64":"nvcr.io/0837451325059433/carbide-dev/runtime-container-aarch64:${{ needs.prepare.outputs.runtime_container_aarch64_version }}"}'
+      platforms: linux/arm64
+      runner: linux-arm64-cpu4
+      push: ${{ !contains(github.ref, 'pull-request/') }}
+      load: true  # load to daemon so the Grype scan can read it on PR builds
+      scan: true
+    secrets: inherit
+
+  # Combine machine_validation (amd64) and machine_validation-aarch64 into a
+  # single multi-arch manifest at the bare machine_validation tag. Sources are
+  # referenced by digest so re-runs are idempotent. Push refs only.
+  merge-manifests-machine-validation:
+    needs:
+      - prepare
+      - build-release-machine-validation-artifacts-x86-host
+      - build-release-machine-validation-artifacts-arm-host
+    if: ${{ !cancelled() && github.event_name != 'schedule' && !contains(github.ref, 'pull-request/') && needs.build-release-machine-validation-artifacts-x86-host.result == 'success' && needs.build-release-machine-validation-artifacts-arm-host.result == 'success' }}
+    runs-on: linux-amd64-cpu4
+    steps:
+      - name: Checkout code
+        uses: actions/checkout@v4
+
+      - name: Set up Docker Buildx
+        uses: docker/setup-buildx-action@v3
+
+      - name: Login to NVCR
+        uses: ./.github/actions/docker-auth
+        with:
+          username: ${{ secrets.NVCR_USERNAME }}
+          token: ${{ secrets.NVCR_TOKEN }}
+
+      - name: Create and push multi-arch manifest
+        uses: nick-fields/retry@ce71cc2ab81d554ebbe88c79ab5975992d79ba08
+        with:
+          max_attempts: 3
+          timeout_minutes: 10
+          retry_wait_seconds: 20
+          command: |
+            docker buildx imagetools create -t \
+              nvcr.io/0837451325059433/carbide-dev/machine_validation:${{ needs.prepare.outputs.version }} \
+              nvcr.io/0837451325059433/carbide-dev/machine_validation@${{ needs.build-release-machine-validation-artifacts-x86-host.outputs.image_digest }} \
+              nvcr.io/0837451325059433/carbide-dev/machine_validation-aarch64@${{ needs.build-release-machine-validation-artifacts-arm-host.outputs.image_digest }}
+
   proto-police:
     needs:
       - prepare
@@ -1407,7 +1512,7 @@ jobs:
   # ============================================================================
 
   notify-build-status:
-    if: ${{ always() && (github.ref == 'refs/heads/main' || startsWith(github.ref, 'refs/heads/release/')) && github.event_name != 'schedule' }}
+    if: ${{ always() && (github.ref == 'refs/heads/main' || startsWith(github.ref, 'refs/heads/release/') || startsWith(github.ref, 'refs/tags/')) && github.event_name != 'schedule' }}
     needs:
       - prepare
       - build-container-x86_64

.github/workflows/rest-build-binaries.yml

@@ -23,7 +23,7 @@ defaults:
     working-directory: rest-api
 
 env:
-  GO_VERSION: "1.25.4"
+  GO_VERSION: "1.25.11"
 
 jobs:
   build-binaries: