ci: Manage more tooling with flox

.flox/env/manifest.toml

@@ -1,26 +1,19 @@
-schema-version = "1.11.0"
+schema-version = "1.13.0"
 
+[profile]
+common = '''
+  test -f .git/hooks/pre-commit || pre-commit install
 
-[install]
-# Python
-python3.pkg-path = "python3"
-uv.pkg-path = "uv"
-uv.version = "~0.9"
-
-# Utilities
-gnutar.pkg-path = "gnutar"
-
-# Tools
-open-policy-agent.pkg-path = "open-policy-agent"
-open-policy-agent.version = "1.8.0"
-open-policy-agent.pkg-group = "tools"
-osv-scanner.pkg-path = "osv-scanner"
-osv-scanner.pkg-group = "tools"
+  gum style "NeMo Platform"
+'''
 
-[vars]
-[hook]
-[profile]
-[services]
 [include]
-[build]
-[options]
+environments = [
+    { dir = "tools/common" },
+    { dir = "tools/helm" },
+    { dir = "tools/actionlint" },
+    { dir = "tools/python" },
+    { dir = "tools/nodejs" },
+    { dir = "tools/osv-scanner" },
+    { dir = "tools/open-policy-agent" },
+]

.github/actions/build-nemo-platform-wheel/action.yaml

@@ -121,7 +121,7 @@ runs:
       if: inputs.package == 'nemo-platform'
       uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
       with:
-        node-version: "22"
+        node-version-file: ${{ inputs.source-root }}/.nvmrc
 
     - name: Install pnpm via Corepack
       if: inputs.package == 'nemo-platform'
@@ -163,7 +163,7 @@ runs:
       if: inputs.package == 'nemo-platform'
       uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
       with:
-        node-version: "22"
+        node-version-file: ${{ inputs.source-root }}/.nvmrc
         cache: pnpm
         cache-dependency-path: ${{ inputs.source-root }}/${{ inputs.studio-web-root }}/pnpm-lock.yaml
 

.github/actions/build-policy-wasm/action.yaml

@@ -1,42 +1,19 @@
 name: Build OPA policy WASM
 description: >
-  Installs OPA and builds the authorization policy WASM asset at
+  Installs Flox, activates the OPA environment, and builds the authorization
+  policy WASM asset at
   services/core/auth/src/nmp/core/auth/assets/policy.wasm. Assumes the
-  repository has already been checked out. This is used in two locations, so
-  keeping it here prevents version drift, etc.
+  repository has already been checked out.
 
 runs:
   using: composite
   steps:
-    # build_policy_wasm.sh already prefers a cached binary at .cache/opa/<version>/ before reaching
-    # out to openpolicyagent.org, but nothing ever populated that directory in CI, so every run
-    # depended on that download — and it has repeatedly failed, taking a required job down with it.
-    # Restoring the cache means the fetch is only needed the first time a pinned version is seen.
-    - name: Resolve pinned OPA version
-      id: opa
-      shell: bash
-      env:
-        REPO_ROOT: ${{ github.action_path }}/../../..
-      run: |
-        # Parse rather than source: the script builds the WASM on execution, so sourcing it here
-        # would do the work twice (and before the cache is restored).
-        version="$(sed -n 's/^OPA_VERSION="\${OPA_VERSION:-\([^}]*\)}"/\1/p' "${REPO_ROOT}/script/build_policy_wasm.sh" | head -1)"
-        if [ -z "${version}" ]; then
-          echo "Could not parse the pinned OPA version from script/build_policy_wasm.sh" >&2
-          echo "If the OPA_VERSION line moved, update this step — a wrong cache key silently disables caching." >&2
-          exit 1
-        fi
-        echo "version=${version}" >> "${GITHUB_OUTPUT}"
-        echo "Pinned OPA version: ${version}"
-
-    - name: Cache the pinned OPA binary
-      uses: actions/cache@v4
+    - name: Install Flox
+      uses: flox/install-flox-action@c94e7e1ab56ae14fe98bae4fd84384fd135f0c2a # v2.4.0
       with:
-        path: .cache/opa
-        key: opa-${{ runner.os }}-${{ runner.arch }}-${{ steps.opa.outputs.version }}
-
+        disable-metrics: "true"
     - name: Build policy WASM
-      shell: bash
-      env:
-        REPO_ROOT: ${{ github.action_path }}/../../..
-      run: "${REPO_ROOT}/script/build_policy_wasm.sh"
+      uses: flox/activate-action@410568008895a0f2e09a34bbd9523f8ef1f2d292 # v1.1.0
+      with:
+        dir: ./tools/open-policy-agent
+        command: ./script/build_policy_wasm.sh

.github/actions/changes/action.yaml

@@ -80,6 +80,10 @@ runs:
             - 'pyproject.toml'
             - 'uv.lock'
             - '.pre-commit-config.yaml'
+            - '.flox/**'
+            - 'tools/common/**'
+            - 'tools/osv-scanner/**'
+            - 'tools/python/**'
           fabric:
             - 'packages/nemo_evaluator_sdk/src/nemo_evaluator_sdk/agent_eval/runtimes/fabric/**'
             - 'packages/nemo_evaluator_sdk/tests/agent_eval/test_fabric_*.py'
@@ -95,6 +99,8 @@ runs:
             - 'tools/**'
           web-studio:
             - 'web/**'
+            - '.nvmrc'
+            - 'tools/nodejs/**'
           docker:
             - 'docker-bake.hcl'
             - 'docker/**'
@@ -105,6 +111,7 @@ runs:
           helm:
             - 'k8s/**'
             - 'tools/lint/lint-helm.sh'
+            - 'tools/helm/**'
             - '.github/workflows/ci.yaml'
             - '.github/actions/changes/action.yaml'
             - '.pre-commit-config.yaml'

.github/workflows/ci.yaml

@@ -64,20 +64,15 @@ jobs:
         uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
         with:
           persist-credentials: false
-      - name: Install actionlint
-        shell: bash
-        run: |
-          mkdir -p "${RUNNER_TEMP}/actionlint"
-          curl -fsSL \
-            -o "${RUNNER_TEMP}/actionlint.tar.gz" \
-            "https://github.com/rhysd/actionlint/releases/download/v1.7.12/actionlint_1.7.12_linux_amd64.tar.gz"
-          echo "8aca8db96f1b94770f1b0d72b6dddcb1ebb8123cb3712530b08cc387b349a3d8  ${RUNNER_TEMP}/actionlint.tar.gz" \
-            | sha256sum -c -
-          tar -xzf "${RUNNER_TEMP}/actionlint.tar.gz" -C "${RUNNER_TEMP}/actionlint"
+      - name: Install Flox
+        uses: flox/install-flox-action@c94e7e1ab56ae14fe98bae4fd84384fd135f0c2a # v2.4.0
+        with:
+          disable-metrics: "true"
       - name: Lint GitHub workflows and actions
-        shell: bash
-        run: |
-          "${RUNNER_TEMP}/actionlint/actionlint"
+        uses: flox/activate-action@410568008895a0f2e09a34bbd9523f8ef1f2d292 # v1.1.0
+        with:
+          dir: ./tools/actionlint
+          command: actionlint
 
   ngc-metadata-test:
     name: Test NGC metadata sync
@@ -545,41 +540,20 @@ jobs:
     env:
       HELM_FOLDER: k8s/helm
       HELM_RELEASE_NAME: nemo-platform
-      KUBECONFORM_VERSION: v0.6.7
     steps:
       - name: Checkout code
         uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
         with:
           persist-credentials: false
-      - name: Install Helm
-        uses: azure/setup-helm@dda3372f752e03dde6b3237bc9431cdc2f7a02a2 # v5.0.0
-      - name: Install kubeconform
-        shell: bash
-        run: |
-          set -euo pipefail
-
-          mkdir -p "${RUNNER_TEMP}/kubeconform"
-          kubeconform_archive="kubeconform-linux-amd64.tar.gz"
-          curl -fsSL \
-            -o "${RUNNER_TEMP}/kubeconform.tar.gz" \
-            "https://github.com/yannh/kubeconform/releases/download/${KUBECONFORM_VERSION}/${kubeconform_archive}"
-          curl -fsSL \
-            -o "${RUNNER_TEMP}/kubeconform.CHECKSUMS" \
-            "https://github.com/yannh/kubeconform/releases/download/${KUBECONFORM_VERSION}/CHECKSUMS"
-          grep "  ${kubeconform_archive}$" "${RUNNER_TEMP}/kubeconform.CHECKSUMS" \
-            | sed "s#  ${kubeconform_archive}#  ${RUNNER_TEMP}/kubeconform.tar.gz#" \
-            | sha256sum -c -
-          tar -xzf "${RUNNER_TEMP}/kubeconform.tar.gz" -C "${RUNNER_TEMP}/kubeconform" kubeconform
-          chmod +x "${RUNNER_TEMP}/kubeconform/kubeconform"
-          echo "${RUNNER_TEMP}/kubeconform" >> "${GITHUB_PATH}"
-      - name: Add NVIDIA Helm repo
-        shell: bash
-        run: |
-          helm repo add nvidia https://helm.ngc.nvidia.com/nvidia
-          helm repo update
+      - name: Install Flox
+        uses: flox/install-flox-action@c94e7e1ab56ae14fe98bae4fd84384fd135f0c2a # v2.4.0
+        with:
+          disable-metrics: "true"
       - name: Lint and validate Helm chart
-        shell: bash
-        run: tools/lint/lint-helm.sh
+        uses: flox/activate-action@410568008895a0f2e09a34bbd9523f8ef1f2d292 # v1.1.0
+        with:
+          dir: ./tools/helm
+          command: tools/lint/lint-helm.sh
       - name: Upload Helm lint artifacts
         if: failure()
         uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
@@ -732,33 +706,40 @@ jobs:
       - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
         with:
           persist-credentials: false
+      - name: Install flox
+        uses: flox/install-flox-action@c94e7e1ab56ae14fe98bae4fd84384fd135f0c2a # v2.4.0 
+        with:
+          disable-metrics: "true"
       - name: Install uv
         uses: astral-sh/setup-uv@37802adc94f370d6bfd71619e3f0bf239e1f3b78 # v7.6.0
         with:
           enable-cache: true
           python-version: "3.12"
           cache-dependency-glob: uv.lock
-      - uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
+      - name: Install nodejs
+        uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
         with:
-          node-version: '22'
+          node-version-file: .nvmrc
       - name: Install pnpm via corepack
-        run: npm i -g corepack@0.31.0 && corepack enable pnpm
+        run: |
+          npm i -g corepack@0.31.0
+          corepack enable pnpm
       - name: Install web dependencies
         working-directory: web
         run: pnpm install --frozen-lockfile
-      - name: Install scanner dependencies
-        shell: bash
-        run: script/install_osv_scanner.sh
-      - name: Run lint
-        run: tools/lint/lint-all.sh
-        shell: bash
+      - name: Run Lint
+        uses: flox/activate-action@410568008895a0f2e09a34bbd9523f8ef1f2d292 # v1.1.0
         env:
           CI_PROJECT_DIR: ${{ github.workspace }}
+        with:
+          dir: ./tools/lint
+          command: |
+            tools/lint/lint-all.sh
       - name: Upload lint artifacts
         if: failure()
         uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
         with:
-          name: lint-artifacts
+          name: Lint Artifacts
           retention-days: 7
           path: |
             third_party/
@@ -1449,7 +1430,7 @@ jobs:
           persist-credentials: false
       - uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
         with:
-          node-version: "22"
+          node-version-file: .nvmrc
       - name: Install pnpm via corepack
         run: npm i -g corepack@0.31.0 && corepack enable pnpm
       - name: Install dependencies
@@ -1482,7 +1463,7 @@ jobs:
           persist-credentials: false
       - uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
         with:
-          node-version: "22"
+          node-version-file: .nvmrc
       - name: Install pnpm via corepack
         run: npm i -g corepack@0.31.0 && corepack enable pnpm
       - name: Install dependencies
@@ -1515,7 +1496,7 @@ jobs:
           persist-credentials: false
       - uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
         with:
-          node-version: "22"
+          node-version-file: .nvmrc
       - name: Install pnpm via corepack
         run: npm i -g corepack@0.31.0 && corepack enable pnpm
       - name: Install dependencies
@@ -1542,7 +1523,7 @@ jobs:
           persist-credentials: false
       - uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
         with:
-          node-version: "22"
+          node-version-file: .nvmrc
       - name: Install pnpm via corepack
         run: npm i -g corepack@0.31.0 && corepack enable pnpm
       - name: Install dependencies
@@ -1570,7 +1551,7 @@ jobs:
           persist-credentials: false
       - uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
         with:
-          node-version: "22"
+          node-version-file: .nvmrc
       - name: Install pnpm via corepack
         run: npm i -g corepack@0.31.0 && corepack enable pnpm
       - name: Install dependencies
@@ -1599,7 +1580,7 @@ jobs:
           persist-credentials: false
       - uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
         with:
-          node-version: "22"
+          node-version-file: .nvmrc
       - name: Install pnpm via corepack
         run: npm i -g corepack@0.31.0 && corepack enable pnpm
       - name: Install dependencies
@@ -1621,7 +1602,7 @@ jobs:
           persist-credentials: false
       - uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
         with:
-          node-version: "22"
+          node-version-file: .nvmrc
       - name: Install pnpm via corepack
         run: npm i -g corepack@0.31.0 && corepack enable pnpm
       - name: Install dependencies
@@ -1851,20 +1832,23 @@ jobs:
           path: summary.md
 
   opa-policy-test:
+    name: Test OPA Policy
     runs-on: ubuntu-latest
     steps:
       - name: Checkout code
         uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
         with:
           persist-credentials: false
-      - name: Install OPA 1.8.0
-        run: |
-          curl -L -o opa https://github.com/open-policy-agent/opa/releases/download/v1.8.0/opa_linux_amd64_static
-          chmod +x opa
-          ./opa version
-      - name: Run test
-        run: |
-          ./opa test services/core/auth/src/nmp/core/auth/app/policies services/core/auth/src/nmp/core/auth/app/policy_tests services/core/auth/src/nmp/core/auth/assets/static-authz.yaml -v
+      - name: Install Deps
+        uses: flox/install-flox-action@c94e7e1ab56ae14fe98bae4fd84384fd135f0c2a # v2.4.0 
+        with:
+          disable-metrics: "true"
+      - name: Policy Test
+        uses: flox/activate-action@410568008895a0f2e09a34bbd9523f8ef1f2d292 # v1.1.0
+        with:
+          dir: ./tools/open-policy-agent
+          command: |
+            opa test services/core/auth/src/nmp/core/auth/app/policies services/core/auth/src/nmp/core/auth/app/policy_tests services/core/auth/src/nmp/core/auth/assets/static-authz.yaml -v
 
   require-nvskills:
     runs-on: ubuntu-latest