ci: Manage more tooling with flox

.flox/env/manifest.toml

@@ -1,26 +1,22 @@
-schema-version = "1.11.0"
+schema-version = "1.13.0"
 
+[profile]
+common = '''
+  test -f .git/hooks/pre-commit || pre-commit install
 
-[install]
-# Python
-python3.pkg-path = "python3"
-uv.pkg-path = "uv"
-uv.version = "~0.9"
-
-# Utilities
-gnutar.pkg-path = "gnutar"
-
-# Tools
-open-policy-agent.pkg-path = "open-policy-agent"
-open-policy-agent.version = "1.8.0"
-open-policy-agent.pkg-group = "tools"
-osv-scanner.pkg-path = "osv-scanner"
-osv-scanner.pkg-group = "tools"
+  gum style "NeMo Platform"
+'''
 
-[vars]
-[hook]
-[profile]
-[services]
 [include]
-[build]
+environments = [
+    { dir = "tools/common" },
+    { dir = "tools/helm" },
+    { dir = "tools/actionlint" },
+    { dir = "tools/python" },
+    { dir = "tools/nodejs" },
+    { dir = "tools/osv-scanner" },
+    { dir = "tools/open-policy-agent" },
+]
+
 [options]
+systems = ["aarch64-darwin", "aarch64-linux", "x86_64-linux"]

.github/actions/build-nemo-platform-wheel/action.yaml

@@ -73,9 +73,9 @@ runs:
     - name: Install uv
       uses: astral-sh/setup-uv@37802adc94f370d6bfd71619e3f0bf239e1f3b78 # v7.6.0
       with:
+        version: ${{ env.UV_VERSION }}
         python-version: ${{ inputs.python-version }}
         enable-cache: true
-        version-file: ${{ inputs.source-root }}/pyproject.toml
         cache-dependency-glob: ${{ inputs.source-root }}/uv.lock
 
     # Resolve early, before pnpm/node setup, so bad cadence/label/timestamp
@@ -121,7 +121,7 @@ runs:
       if: inputs.package == 'nemo-platform'
       uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
       with:
-        node-version: "22"
+        node-version-file: ${{ inputs.source-root }}/.nvmrc
 
     - name: Install pnpm via Corepack
       if: inputs.package == 'nemo-platform'
@@ -163,7 +163,7 @@ runs:
       if: inputs.package == 'nemo-platform'
       uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
       with:
-        node-version: "22"
+        node-version-file: ${{ inputs.source-root }}/.nvmrc
         cache: pnpm
         cache-dependency-path: ${{ inputs.source-root }}/${{ inputs.studio-web-root }}/pnpm-lock.yaml
 

.github/actions/build-policy-wasm/action.yaml

@@ -1,42 +1,19 @@
 name: Build OPA policy WASM
 description: >
-  Installs OPA and builds the authorization policy WASM asset at
+  Installs Flox, activates the OPA environment, and builds the authorization
+  policy WASM asset at
   services/core/auth/src/nmp/core/auth/assets/policy.wasm. Assumes the
-  repository has already been checked out. This is used in two locations, so
-  keeping it here prevents version drift, etc.
+  repository has already been checked out.
 
 runs:
   using: composite
   steps:
-    # build_policy_wasm.sh already prefers a cached binary at .cache/opa/<version>/ before reaching
-    # out to openpolicyagent.org, but nothing ever populated that directory in CI, so every run
-    # depended on that download — and it has repeatedly failed, taking a required job down with it.
-    # Restoring the cache means the fetch is only needed the first time a pinned version is seen.
-    - name: Resolve pinned OPA version
-      id: opa
-      shell: bash
-      env:
-        REPO_ROOT: ${{ github.action_path }}/../../..
-      run: |
-        # Parse rather than source: the script builds the WASM on execution, so sourcing it here
-        # would do the work twice (and before the cache is restored).
-        version="$(sed -n 's/^OPA_VERSION="\${OPA_VERSION:-\([^}]*\)}"/\1/p' "${REPO_ROOT}/script/build_policy_wasm.sh" | head -1)"
-        if [ -z "${version}" ]; then
-          echo "Could not parse the pinned OPA version from script/build_policy_wasm.sh" >&2
-          echo "If the OPA_VERSION line moved, update this step — a wrong cache key silently disables caching." >&2
-          exit 1
-        fi
-        echo "version=${version}" >> "${GITHUB_OUTPUT}"
-        echo "Pinned OPA version: ${version}"
-
-    - name: Cache the pinned OPA binary
-      uses: actions/cache@v4
+    - name: Install Flox
+      uses: flox/install-flox-action@c94e7e1ab56ae14fe98bae4fd84384fd135f0c2a # v2.4.0
       with:
-        path: .cache/opa
-        key: opa-${{ runner.os }}-${{ runner.arch }}-${{ steps.opa.outputs.version }}
-
+        disable-metrics: "true"
     - name: Build policy WASM
-      shell: bash
-      env:
-        REPO_ROOT: ${{ github.action_path }}/../../..
-      run: "${REPO_ROOT}/script/build_policy_wasm.sh"
+      uses: flox/activate-action@410568008895a0f2e09a34bbd9523f8ef1f2d292 # v1.1.0
+      with:
+        dir: ./tools/open-policy-agent
+        command: ./script/build_policy_wasm.sh

.github/actions/changes/action.yaml

@@ -89,6 +89,10 @@ runs:
             - 'pyproject.toml'
             - 'uv.lock'
             - '.pre-commit-config.yaml'
+            - '.flox/**'
+            - 'tools/common/**'
+            - 'tools/osv-scanner/**'
+            - 'tools/python/**'
           fabric:
             - 'packages/nemo_evaluator_sdk/src/nemo_evaluator_sdk/agent_eval/runtimes/fabric/**'
             - 'packages/nemo_evaluator_sdk/tests/agent_eval/test_fabric_*.py'
@@ -104,6 +108,8 @@ runs:
             - 'tools/**'
           web-studio:
             - 'web/**'
+            - '.nvmrc'
+            - 'tools/nodejs/**'
           docker:
             - 'docker-bake.hcl'
             - 'docker/**'
@@ -114,6 +120,7 @@ runs:
           helm:
             - 'k8s/**'
             - 'tools/lint/lint-helm.sh'
+            - 'tools/helm/**'
             - '.github/workflows/ci.yaml'
             - '.github/actions/changes/action.yaml'
             - '.pre-commit-config.yaml'

.github/actions/insights-testbed-prep/action.yml

@@ -13,6 +13,7 @@ runs:
     - name: Install uv
       uses: astral-sh/setup-uv@37802adc94f370d6bfd71619e3f0bf239e1f3b78 # v7.6.0
       with:
+        version: ${{ env.UV_VERSION }}
         working-directory: nemo-platform
     - name: Sync + judge repoint
       shell: bash

.github/actions/setup-kind-cluster/action.yaml

@@ -104,9 +104,9 @@ runs:
     - name: Install uv
       uses: astral-sh/setup-uv@37802adc94f370d6bfd71619e3f0bf239e1f3b78 # v7.6.0
       with:
+        version: ${{ env.UV_VERSION }}
         python-version: "3.13"
         enable-cache: true
-        version-file: pyproject.toml
         cache-dependency-glob: uv.lock
 
     - name: Start kind cluster