feat: ANS identity extension for NVIDIA OpenShell

.dockerignore

@@ -0,0 +1,8 @@
+.git
+bin/
+coverage*.out
+deploy/helm/
+docs/
+examples/
+.github/
+*.md

.github/dependabot.yml

@@ -0,0 +1,13 @@
+version: 2
+updates:
+  - package-ecosystem: gomod
+    directory: /
+    schedule:
+      interval: weekly
+    groups:
+      go-minor-patch:
+        update-types: [minor, patch]
+  - package-ecosystem: github-actions
+    directory: /
+    schedule:
+      interval: weekly

.github/workflows/ci.yml

@@ -0,0 +1,94 @@
+# Build, test with a coverage gate, lint, and check that generated bindings match the vendored protos.
+name: CI
+
+on:
+  push:
+    branches: [main]
+  pull_request:
+    branches: [main]
+
+permissions:
+  contents: read
+
+jobs:
+  build-and-test:
+    name: Build & Test
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 #v7.0.1
+      - uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e #v7.0.0
+        with:
+          go-version: "1.26.9"
+      - uses: azure/setup-helm@b9e51907a09c216f16ebe8536097933489208112 #v4.3.0
+      - name: Build
+        run: go build ./...
+      - name: Test
+        run: go test -race -coverprofile=coverage.out -covermode=atomic ./...
+      - name: Coverage gate
+        run: |
+          # Generated bindings, thin main packages and the demo are exercised end to end,
+          # not by unit tests; the gate covers the library packages.
+          grep -v -e '/gen/' -e '/cmd/' -e '/examples/' coverage.out > coverage.lib.out
+          COVERAGE=$(go tool cover -func=coverage.lib.out | grep '^total:' | awk '{print $NF}' | tr -d '%')
+          echo "library coverage: ${COVERAGE}%"
+          THRESHOLD=95
+          if [ "$(echo "${COVERAGE} < ${THRESHOLD}" | bc -l)" -eq 1 ]; then
+            echo "::error::Coverage ${COVERAGE}% is below the required ${THRESHOLD}% threshold"
+            exit 1
+          fi
+      - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a #v7.0.1
+        with:
+          name: coverage-report
+          path: coverage.out
+          retention-days: 30
+
+  lint:
+    name: Lint
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 #v7.0.1
+      - uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e #v7.0.0
+        with:
+          go-version: "1.26.9"
+      - uses: golangci/golangci-lint-action@ba0d7d2ec06a0ea1cb5fa41b2e4a3ab91d21278a #v9.3.0
+        with:
+          version: v2.10.1
+          args: --verbose --concurrency=4 --allow-parallel-runners
+
+  deploy-artifacts:
+    name: Container images & Helm chart
+    runs-on: ubuntu-latest
+    strategy:
+      matrix:
+        cmd: [ans-openshell-middleware, ans-openshell-interceptor, ans-ocsf-hydrator, ans-reference-callee]
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 #v7.0.1
+      - name: Build image
+        run: docker build -f deploy/Dockerfile --build-arg CMD=${{ matrix.cmd }} -t ${{ matrix.cmd }}:ci .
+      - uses: azure/setup-helm@b9e51907a09c216f16ebe8536097933489208112 #v4.3.0
+      - name: Lint and render chart
+        run: |
+          helm lint deploy/helm/ans-openshell
+          helm template ci deploy/helm/ans-openshell --set hydrator.enabled=true > /dev/null
+
+  proto-drift:
+    name: Generated bindings match protos
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 #v7.0.1
+      - uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e #v7.0.0
+        with:
+          go-version: "1.26.9"
+      - uses: bufbuild/buf-action@8c6a16e16f12ba20b6470afa9c2ba9b5ba8c97c3 #v1
+        with:
+          setup_only: true
+          # Pinned so the drift check is reproducible; make proto documents the plugin pins.
+          version: 1.73.0
+      - name: Install protoc plugins
+        run: |
+          go install google.golang.org/protobuf/cmd/protoc-gen-go@v1.36.12
+          go install google.golang.org/grpc/cmd/protoc-gen-go-grpc@v1.6.2
+      - name: Regenerate and diff
+        run: |
+          buf generate
+          git diff --exit-code -- gen/

.github/workflows/dco-merge-group.yml

@@ -0,0 +1,19 @@
+name: DCO merge-group shim
+
+# The org-wide DCO app (https://github.com/apps/dco) validates sign-offs on
+# pull requests but does not report on merge-queue (merge_group) commits, so
+# a required "DCO" check would stall the queue. This shim reports a passing
+# "DCO" check for merge groups only — the real validation already happened
+# on the pull request. Same pattern as onnx/onnx#5399.
+
+on:
+  merge_group:
+
+permissions: {}
+
+jobs:
+  dco:
+    name: DCO
+    runs-on: ubuntu-latest
+    steps:
+      - run: echo "DCO was validated on the pull request by the DCO app."

.github/workflows/release.yml

@@ -0,0 +1,109 @@
+# Automatically creates release PRs and, when a release-please release lands,
+# builds and uploads the four ans-openshell binaries to that release and
+# publishes the chart's container images to ghcr.io in the same workflow run.
+#
+# Why these are combined: events triggered by GITHUB_TOKEN (such as
+# release-please publishing a release) do NOT trigger downstream workflows.
+# Splitting goreleaser into its own `release: published` workflow would silently
+# never fire. Running goreleaser as a needs:-gated job in the same workflow
+# avoids this entirely without requiring a PAT.
+# Docs: https://docs.github.com/en/actions/security-guides/automatic-token-authentication
+name: Release
+
+on:
+  push:
+    branches:
+      - main
+  # Manual trigger for recovery scenarios (e.g., re-running after a failed release).
+  workflow_dispatch:
+
+# contents:write is required for creating git tags, GitHub Releases, and uploading release assets.
+# pull-requests:write is required for creating and updating release PRs.
+permissions:
+  contents: write
+  pull-requests: write
+
+jobs:
+  release-please:
+    name: Release Please
+    runs-on: ubuntu-latest
+    outputs:
+      release_created: ${{ steps.release.outputs.release_created }}
+      tag_name: ${{ steps.release.outputs.tag_name }}
+    steps:
+      - name: Run Release Please
+        id: release
+        uses: googleapis/release-please-action@45996ed1f6d02564a971a2fa1b5860e934307cf7 # v5.0.0
+        with:
+          token: ${{ secrets.GITHUB_TOKEN }}
+          config-file: release-please-config.json
+          manifest-file: .release-please-manifest.json
+
+  goreleaser:
+    name: Build & upload binaries
+    needs: release-please
+    if: needs.release-please.outputs.release_created == 'true'
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout code
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          # Full history + tags so `git describe` resolves the version.
+          fetch-depth: 0
+          ref: ${{ needs.release-please.outputs.tag_name }}
+
+      - name: Setup Go
+        uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0
+        with:
+          go-version: "1.26.9"
+
+      - name: Run GoReleaser
+        uses: goreleaser/goreleaser-action@f06c13b6b1a9625abc9e6e439d9c05a8f2190e94 # v7.2.3
+        with:
+          distribution: goreleaser
+          version: "~> v2"
+          args: release --clean
+        env:
+          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+
+  publish-images:
+    name: Publish container images
+    needs: release-please
+    if: needs.release-please.outputs.release_created == 'true'
+    runs-on: ubuntu-latest
+    permissions:
+      contents: read
+      packages: write
+    strategy:
+      matrix:
+        cmd: [ans-openshell-middleware, ans-openshell-interceptor, ans-ocsf-hydrator]
+    env:
+      TAG: ${{ needs.release-please.outputs.tag_name }}
+      CMD: ${{ matrix.cmd }}
+      OWNER: ${{ github.repository_owner }}
+    steps:
+      - name: Checkout code
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          ref: ${{ needs.release-please.outputs.tag_name }}
+          persist-credentials: false
+
+      - name: Set up Docker Buildx
+        uses: docker/setup-buildx-action@f87e5991a6d7451dcb8d9637bfbc97413f497069 # v4.4.1
+
+      - name: Log in to ghcr.io
+        run: echo "${GITHUB_TOKEN}" | docker login ghcr.io -u "${GITHUB_ACTOR}" --password-stdin
+        env:
+          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+
+      # release-please tags vX.Y.Z and bumps Chart.yaml appVersion to X.Y.Z, the chart's
+      # default image tag, so the pushed tag is the version without its v prefix. The
+      # Dockerfile cross-compiles, so both platforms build natively. The first push
+      # creates each package private; make it public once in the organisation's package
+      # settings or the chart defaults cannot pull it.
+      - name: Build and push
+        run: |
+          VERSION="${TAG#v}"
+          docker buildx build --platform linux/amd64,linux/arm64 -f deploy/Dockerfile \
+            --build-arg CMD="${CMD}" --build-arg VERSION="${VERSION}" \
+            -t "ghcr.io/${OWNER}/${CMD}:${VERSION}" --push .

.gitignore

@@ -0,0 +1,43 @@
+# Binaries
+/bin/
+/dist/
+*.exe
+*.exe~
+*.dll
+*.so
+*.dylib
+/ans-openshell-middleware
+/ans-openshell-interceptor
+/ans-ocsf-hydrator
+/ans-reference-callee
+/demo
+
+# Test binaries, built with `go test -c`
+*.test
+
+# Output of the go coverage tool
+*.out
+coverage.html
+
+# Dependency directories and workspace files
+vendor/
+go.work
+go.work.sum
+
+# IDE
+.idea/
+.vscode/
+*.swp
+*.swo
+*~
+
+# OS files
+.DS_Store
+Thumbs.db
+
+# Secrets and certificates
+.env
+.env.*
+*.pem
+*.key
+*.csr