Migrate CI from Cirrus CI to GitHub Actions (#447)

* Migrate CI to GitHub Actions * Publish Orchard through the OpenAI Homebrew tap * Scope release secrets to GoReleaser steps * Separate release and snapshot trust paths * Use GitHub-hosted macOS 26 runner * Run macOS unit tests on hosted runner * Update Homebrew install command * Build Docker image with GoReleaser * Use GitHub-hosted Linux runner * Use smaller Vetu image for Linux tests * Run Linux tests on hosted ARM runner * Use host architecture for Linux integration tests * Preinstall Cloud Hypervisor for Linux tests * Select Linux test images by architecture * Satisfy platform image lint rules * Format platform image errors * Enable KVM access for Linux tests * Honor VM wait time in WebSocket requests * Satisfy WebSocket client lint rules * Allow hosted Linux integration tests more time
2026-07-16 17:57:06 -04:00 · 2026-07-16 17:57:06 -04:00 · 461af8de47
parent b898769396
commit 461af8de47
18 changed files with 451 additions and 243 deletions
--- a/.cirrus.star
+++ b/.cirrus.star
@ -1,4 +0,0 @@
-load("github.com/cirrus-modules/golang@main", "lint_task")
-
-def main(ctx):
-    return [lint_task()]
--- a/.cirrus.yml
+++ b/.cirrus.yml
@ -1,68 +0,0 @@
-task:
-  name: Test (macOS)
-  persistent_worker:
-    labels:
-      name: dev-mini
-    resources:
-      tart-vms: 2
-  pre_pull_script:
-    - tart pull ghcr.io/cirruslabs/macos-tahoe-base:latest
-  test_script:
-    - go test -timeout=20m -ldflags="-B gobuildid" -v -count=1 ./...
-  always:
-    cleanup_script:
-      - tart list
-      - rm -rf ~/.tart/vms/orchard-*
-
-task:
-  depends_on:
-    - Lint
-    - Test (macOS)
-  env:
-    MACOS_SIGN_P12: ENCRYPTED[!183482723ca1a95f9c4439f7a79c9d3b115472bb18c739ed1586e12d3914ccf94ade8169eeda7332fc204f8be9c27d9f!]
-    MACOS_SIGN_PASSWORD: ENCRYPTED[!417423346c567f12007f42d084bff1cfee30ee14f7e8258550157679a269c70d541c9f19224224ab0293b10f2c6d4c5e!]
-    MACOS_NOTARY_ISSUER_ID: ENCRYPTED[!74076906e9fa36bca3c1da1637b0759b58bb009eb1a707446896eefad3767e8dba1d0f87e71106b98cde98ac4b037a2a!]
-    MACOS_NOTARY_KEY_ID: ENCRYPTED[!af9e5da1010a6b04e548ef494acc77a6e0ce176549de98f81c5b5cdd72856de09f77e51cf0849e3c4b7a2d2c22f25ca8!]
-    MACOS_NOTARY_KEY: ENCRYPTED[!c70c53f3e6c163931c7cdf9d90aff8934ef21d5dd1090158688e00b94e97c68257d9cf4ae1df873e6ae0d949866aee72!]
-    GITHUB_TOKEN: ENCRYPTED[!98ace8259c6024da912c14d5a3c5c6aac186890a8d4819fad78f3e0c41a4e0cd3a2537dd6e91493952fb056fa434be7c!]
-    GORELEASER_KEY: ENCRYPTED[!9b80b6ef684ceaf40edd4c7af93014ee156c8aba7e6e5795f41c482729887b5c31f36b651491d790f1f668670888d9fd!]
-    FURY_TOKEN: ENCRYPTED[!97fe4497d9aca60a3d64904883b81e21f19706c6aedda625c97f62f67ec46b8efa74c55699956158bbf0a23726e7d9f6!]
-  container:
-    image: golang:latest
-    cpu: 4
-    memory: 12G
-  matrix:
-    - name: Release Binaries
-      only_if: $CIRRUS_TAG != ''
-      install_goreleaser_script:
-        - echo 'deb [trusted=yes] https://repo.goreleaser.com/apt/ /' | tee /etc/apt/sources.list.d/goreleaser.list
-        - apt update && apt -y install goreleaser-pro
-      release_script: goreleaser
-    - name: Release Binaries (Dry Run)
-      only_if: $CIRRUS_TAG == ''
-      install_goreleaser_script:
-        - echo 'deb [trusted=yes] https://repo.goreleaser.com/apt/ /' | tee /etc/apt/sources.list.d/goreleaser.list
-        - apt update && apt -y install goreleaser-pro
-      release_script: goreleaser release --skip=publish --snapshot --clean --verbose
-      binaries_artifacts:
-        path: "dist/orchard_*/orchard*"
-
-docker_builder:
-  name: Release Docker Image
-  only_if: $CIRRUS_TAG != ''
-  depends_on:
-    - Lint
-    - Test (macOS)
-  env:
-    GITHUB_TOKEN: ENCRYPTED[!82ed873afdf627284305afef4958c85a8f73127b09978a9786ac521559630ea6c9a5ab6e7f8315abf9ead09b6eff6eae!]
-  login_script:
-    - echo $GITHUB_TOKEN | docker login ghcr.io -u fkorotkov --password-stdin
-  setup_script:
-    - docker buildx create --name multibuilder
-    - docker buildx use multibuilder
-    - docker buildx inspect --bootstrap
-  deploy_script: |
-    docker buildx build --push --platform linux/amd64,linux/arm64 \
-      --tag ghcr.io/cirruslabs/orchard:$CIRRUS_TAG \
-      --tag ghcr.io/cirruslabs/orchard:latest \
-      .
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@ -0,0 +1,76 @@
+name: CI
+
+on:
+  merge_group:
+  pull_request:
+  push:
+    branches:
+      - main
+  workflow_dispatch:
+
+permissions:
+  contents: read
+  pull-requests: read
+
+jobs:
+  lint:
+    name: Lint
+    runs-on: ubuntu-latest
+    timeout-minutes: 15
+    steps:
+      - uses: actions/checkout@v6
+      - uses: actions/setup-go@v6
+        with:
+          go-version-file: go.mod
+          cache: true
+      - uses: golangci/golangci-lint-action@v9
+        with:
+          version: v2.12.0
+          only-new-issues: true
+
+  test-linux:
+    name: Test (Linux)
+    runs-on: ubuntu-latest
+    timeout-minutes: 60
+    steps:
+      - uses: actions/checkout@v6
+      - uses: actions/setup-go@v6
+        with:
+          go-version-file: go.mod
+          cache: true
+      - name: Check out Vetu
+        uses: actions/checkout@v6
+        with:
+          repository: openai/vetu
+          path: _vetu
+      - name: Build Vetu
+        working-directory: _vetu
+        run: |
+          go build -o "$RUNNER_TEMP/vetu" cmd/vetu/main.go
+          sudo setcap cap_net_raw,cap_net_admin+eip "$RUNNER_TEMP/vetu"
+          echo "$RUNNER_TEMP" >> "$GITHUB_PATH"
+      - name: Install Cloud Hypervisor
+        run: |
+          curl --fail --location --retry 3 \
+            --output "$RUNNER_TEMP/cloud-hypervisor" \
+            https://github.com/cloud-hypervisor/cloud-hypervisor/releases/latest/download/cloud-hypervisor-static
+          chmod +x "$RUNNER_TEMP/cloud-hypervisor"
+      - name: Enable KVM access
+        run: sudo chmod 0666 /dev/kvm
+      - name: Pre-pull default Vetu image
+        run: vetu pull ghcr.io/cirruslabs/ubuntu-amd64:24.04
+      - name: Run tests
+        run: go test -timeout=30m -v -count=1 ./...
+
+  test-macos:
+    name: Test (macOS)
+    runs-on: macos-26
+    timeout-minutes: 45
+    steps:
+      - uses: actions/checkout@v6
+      - uses: actions/setup-go@v6
+        with:
+          go-version-file: go.mod
+          cache: true
+      - name: Run unit tests
+        run: go list ./... | grep -v '/internal/tests' | xargs go test -timeout=20m -ldflags="-B gobuildid" -v -count=1
--- a/.github/workflows/main.yml
+++ b/.github/workflows/main.yml
@ -1,24 +0,0 @@
-name: Main
-
-on:
-  push:
-
-jobs:
-  test:
-    name: Test (Linux)
-    runs-on: ghcr.io/cirruslabs/ubuntu-runner-amd64:24.04-md
-    steps:
-      - uses: actions/checkout@v4
-      - uses: actions/setup-go@v5
-        with:
-          go-version: stable
-      - name: Install Vetu
-        run: |
-          sudo apt-get update && sudo apt-get -y install apt-transport-https ca-certificates
-          echo "deb [trusted=yes] https://apt.fury.io/cirruslabs/ /" | sudo tee /etc/apt/sources.list.d/cirruslabs.list
-          sudo apt-get update && sudo apt-get -y install vetu
-      - name: Pre-pull default Vetu image for use in tests
-        run: |
-          vetu pull ghcr.io/cirruslabs/ubuntu-runner-amd64:latest
-      - name: Run tests
-        run: go test -v -count=1 ./...
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@ -0,0 +1,93 @@
+name: Release
+
+on:
+  push:
+    tags:
+      - "*"
+  workflow_dispatch:
+
+permissions:
+  contents: read
+
+jobs:
+  release:
+    name: Release Binaries
+    if: github.ref_type == 'tag'
+    runs-on: ubuntu-latest
+    timeout-minutes: 60
+    environment: publish
+    permissions:
+      contents: read
+      packages: write
+    steps:
+      - uses: actions/checkout@v6
+        with:
+          fetch-depth: 0
+      - uses: actions/setup-go@v6
+        with:
+          go-version-file: go.mod
+          cache: true
+      - uses: docker/setup-qemu-action@v4
+      - uses: docker/setup-buildx-action@v4
+      - uses: docker/login-action@v4
+        with:
+          registry: ghcr.io
+          username: ${{ github.actor }}
+          password: ${{ github.token }}
+      - name: Create release app token for this repo
+        id: app-token
+        uses: actions/create-github-app-token@1b10c78c7865c340bc4f6099eb2f838309f1e8c3 # v3.1.1
+        with:
+          app-id: ${{ secrets.RELEASE_APP_ID }}
+          private-key: ${{ secrets.RELEASE_APP_PRIVATE_KEY }}
+          permission-contents: write
+      - name: Create release app token for homebrew-tools
+        id: tap-token
+        uses: actions/create-github-app-token@1b10c78c7865c340bc4f6099eb2f838309f1e8c3 # v3.1.1
+        with:
+          app-id: ${{ secrets.RELEASE_APP_ID }}
+          private-key: ${{ secrets.RELEASE_APP_PRIVATE_KEY }}
+          owner: openai
+          repositories: homebrew-tools
+          permission-contents: write
+          permission-pull-requests: write
+      - name: Release
+        uses: goreleaser/goreleaser-action@v7
+        with:
+          distribution: goreleaser-pro
+          version: "~> v2"
+          args: release --clean
+        env:
+          GITHUB_TOKEN: ${{ steps.app-token.outputs.token }}
+          GORELEASER_KEY: ${{ secrets.GORELEASER_KEY }}
+          HOMEBREW_TAP_GITHUB_TOKEN: ${{ steps.tap-token.outputs.token }}
+          MACOS_NOTARY_ISSUER_ID: ${{ secrets.MACOS_NOTARY_ISSUER_ID }}
+          MACOS_NOTARY_KEY: ${{ secrets.MACOS_NOTARY_KEY }}
+          MACOS_NOTARY_KEY_ID: ${{ secrets.MACOS_NOTARY_KEY_ID }}
+          MACOS_SIGN_P12: ${{ secrets.MACOS_SIGN_P12 }}
+          MACOS_SIGN_PASSWORD: ${{ secrets.MACOS_SIGN_PASSWORD }}
+
+  snapshot:
+    name: Release Binaries (Dry Run)
+    if: github.event_name == 'workflow_dispatch'
+    runs-on: ubuntu-latest
+    timeout-minutes: 60
+    steps:
+      - uses: actions/checkout@v6
+        with:
+          fetch-depth: 0
+      - uses: actions/setup-go@v6
+        with:
+          go-version-file: go.mod
+          cache: true
+      - name: Release dry run
+        uses: goreleaser/goreleaser-action@v7
+        with:
+          distribution: goreleaser-pro
+          version: "~> v2"
+          args: release --skip=publish --snapshot --clean
+      - name: Upload dry-run artifacts
+        uses: actions/upload-artifact@v6
+        with:
+          name: orchard-snapshot
+          path: dist/**
--- a/.golangci.yml
+++ b/.golangci.yml
@ -1,24 +1,30 @@
-version: 2
+version: "2"

 run:
  timeout: 5m

-linters-settings:
-  # Even in Rust you can get away with partial matching,
-  # so make sure that the linter respects the programmer's
-  # intent expressed in the form of "default" case.
-  exhaustive:
-    default-signifies-exhaustive: true
-
-  gosec:
-    excludes:
-      - G115
-
 formatters:
-  enable-all: true
+  enable:
+    - gci
+    - gofmt
+    - gofumpt
+    - goimports
+    - golines
+    - swaggo

 linters:
-  enable-all: true
+  default: all
+
+  settings:
+    # Even in Rust you can get away with partial matching,
+    # so make sure that the linter respects the programmer's
+    # intent expressed in the form of "default" case.
+    exhaustive:
+      default-signifies-exhaustive: true
+
+    gosec:
+      excludes:
+        - G115

  disable:
    # We don't have high-performance requirements at this moment, so sacrificing
--- a/.goreleaser.yml
+++ b/.goreleaser.yml
@ -23,7 +23,8 @@ builds:

 archives:
  - id: binary
-    format: binary
+    formats:
+      - binary
    name_template: "{{ .ProjectName }}-{{ .Os }}-{{ .Arch }}"
  - id: regular
    name_template: "{{ .ProjectName }}-{{ .Os }}-{{ .Arch }}"
@ -31,28 +32,6 @@ archives:
 release:
  prerelease: auto

-nfpms:
-  - package_name: orchard-controller
-    vendor: Cirrus Labs, Inc.
-    homepage: https://github.com/cirruslabs/orchard
-    maintainer: support@cirruslabs.org
-    description: Orchestrator for running Tart Virtual Machines on a cluster of Apple Silicon devices
-    section: misc
-    formats:
-      - deb
-      - rpm
-    contents:
-      - src: packaging/orchard-controller.service
-        dst: /lib/systemd/system/orchard-controller.service
-        type: config
-    scripts:
-      postinstall: packaging/postinstall.sh
-      preremove: packaging/preremove.sh
-      postremove: packaging/postremove.sh
-
-furies:
-  - account: cirruslabs
-
 notarize:
  macos:
    - enabled: '{{ isEnvSet "MACOS_SIGN_P12" }}'
@ -64,17 +43,33 @@ notarize:
        key_id: "{{.Env.MACOS_NOTARY_KEY_ID}}"
        key: "{{.Env.MACOS_NOTARY_KEY}}"

+dockers_v2:
+  - images:
+      - ghcr.io/openai/orchard
+    tags:
+      - "{{ .Tag }}"
+      - latest
+    platforms:
+      - linux/amd64
+      - linux/arm64
+    disable: "{{ .IsSnapshot }}"
+
 brews:
  - name: orchard
+    directory: Formula
    ids:
      - regular
    repository:
-      owner: cirruslabs
-      name: homebrew-cli
+      owner: openai
+      name: homebrew-tools
+      token: "{{ .Env.HOMEBREW_TAP_GITHUB_TOKEN }}"
+      branch: "orchard-{{ .Version }}"
+      pull_request:
+        enabled: true
    install: |
      bin.install "orchard"
      generate_completions_from_executable(bin/"orchard", "completion")
    caveats: See the Github repository for more information
-    homepage: https://github.com/cirruslabs/orchard
+    homepage: https://github.com/openai/orchard
    description: Orchestrator for running Tart Virtual Machines on a cluster of Apple Silicon devices
    skip_upload: auto
--- a/17
+++ b/17
@ -1,22 +1,13 @@
-FROM golang:latest AS builder
-
-# Install GoReleaser Pro
-RUN echo 'deb [trusted=yes] https://repo.goreleaser.com/apt/ /' | tee /etc/apt/sources.list.d/goreleaser.list
-RUN apt update && apt -y install goreleaser-pro
-
-WORKDIR /tmp/orchard
-ADD . /tmp/orchard/
-
-RUN goreleaser build --single-target --snapshot --timeout 60m
-
 FROM gcr.io/distroless/base

-LABEL org.opencontainers.image.source=https://github.com/cirruslabs/orchard
+ARG TARGETPLATFORM
+
+LABEL org.opencontainers.image.source=https://github.com/openai/orchard
 ENV GIN_MODE=release
 ENV ORCHARD_HOME=/data
 EXPOSE 6120

-COPY --from=builder /tmp/orchard/dist/linux_*/orchard_linux_*/orchard /bin/orchard
+COPY $TARGETPLATFORM/orchard /bin/orchard

 ENTRYPOINT ["/bin/orchard"]

--- a/README.md
+++ b/README.md
@ -32,7 +32,7 @@ Orchard is an orchestration system for [Tart](https://github.com/cirruslabs/tart
 The fastest way to get started with Orchard is to use a local development mode:

 ```shell
-brew install cirruslabs/cli/orchard
+brew install openai/tools/orchard
 orchard dev
 ```

--- a/internal/imageconstant/imageconstant.go
+++ b/internal/imageconstant/imageconstant.go
@ -1,6 +1,48 @@
 package imageconstant

-const (
-	DefaultMacosImage = "ghcr.io/cirruslabs/macos-tahoe-base:latest"
-	DefaultLinuxImage = "ghcr.io/cirruslabs/ubuntu-runner-amd64:latest"
+import (
+	"errors"
+	"fmt"
+
+	v1 "github.com/cirruslabs/orchard/pkg/resource/v1"
 )
+
+var ErrUnsupportedPlatform = errors.New("unsupported platform")
+
+const (
+	DefaultMacosImage      = "ghcr.io/cirruslabs/macos-tahoe-base:latest"
+	DefaultLinuxAMD64Image = "ghcr.io/cirruslabs/ubuntu-amd64:24.04"
+	DefaultLinuxARM64Image = "ghcr.io/cirruslabs/ubuntu:24.04"
+)
+
+func DefaultImage(operatingSystem v1.OS, architecture v1.Architecture) (string, error) {
+	switch operatingSystem {
+	case v1.OSDarwin:
+		if architecture != v1.ArchitectureARM64 {
+			return "", fmt.Errorf(
+				"%w: %s/%s",
+				ErrUnsupportedPlatform,
+				operatingSystem,
+				architecture,
+			)
+		}
+
+		return DefaultMacosImage, nil
+	case v1.OSLinux:
+		switch architecture {
+		case v1.ArchitectureAMD64:
+			return DefaultLinuxAMD64Image, nil
+		case v1.ArchitectureARM64:
+			return DefaultLinuxARM64Image, nil
+		default:
+			return "", fmt.Errorf(
+				"%w: %s/%s",
+				ErrUnsupportedPlatform,
+				operatingSystem,
+				architecture,
+			)
+		}
+	default:
+		return "", fmt.Errorf("%w: %s/%s", ErrUnsupportedPlatform, operatingSystem, architecture)
+	}
+}
--- a/internal/imageconstant/imageconstant_test.go
+++ b/internal/imageconstant/imageconstant_test.go
@ -0,0 +1,78 @@
+package imageconstant_test
+
+import (
+	"testing"
+
+	"github.com/cirruslabs/orchard/internal/imageconstant"
+	v1 "github.com/cirruslabs/orchard/pkg/resource/v1"
+	"github.com/stretchr/testify/require"
+)
+
+func TestDefaultImage(t *testing.T) {
+	tests := []struct {
+		name         string
+		os           v1.OS
+		architecture v1.Architecture
+		expected     string
+	}{
+		{
+			name:         "macOS ARM64",
+			os:           v1.OSDarwin,
+			architecture: v1.ArchitectureARM64,
+			expected:     imageconstant.DefaultMacosImage,
+		},
+		{
+			name:         "Linux AMD64",
+			os:           v1.OSLinux,
+			architecture: v1.ArchitectureAMD64,
+			expected:     imageconstant.DefaultLinuxAMD64Image,
+		},
+		{
+			name:         "Linux ARM64",
+			os:           v1.OSLinux,
+			architecture: v1.ArchitectureARM64,
+			expected:     imageconstant.DefaultLinuxARM64Image,
+		},
+	}
+
+	for _, test := range tests {
+		t.Run(test.name, func(t *testing.T) {
+			actual, err := imageconstant.DefaultImage(test.os, test.architecture)
+
+			require.NoError(t, err)
+			require.Equal(t, test.expected, actual)
+		})
+	}
+}
+
+func TestDefaultImageRejectsUnsupportedPlatforms(t *testing.T) {
+	tests := []struct {
+		name         string
+		os           v1.OS
+		architecture v1.Architecture
+	}{
+		{
+			name:         "unsupported OS",
+			os:           v1.OS("windows"),
+			architecture: v1.ArchitectureAMD64,
+		},
+		{
+			name:         "unsupported Linux architecture",
+			os:           v1.OSLinux,
+			architecture: v1.Architecture("riscv64"),
+		},
+		{
+			name:         "unsupported macOS architecture",
+			os:           v1.OSDarwin,
+			architecture: v1.ArchitectureAMD64,
+		},
+	}
+
+	for _, test := range tests {
+		t.Run(test.name, func(t *testing.T) {
+			_, err := imageconstant.DefaultImage(test.os, test.architecture)
+
+			require.Error(t, err)
+		})
+	}
+}
--- a/internal/tests/platformdependent/platformdependent.go
+++ b/internal/tests/platformdependent/platformdependent.go
@ -2,6 +2,7 @@ package platformdependent

 import (
 	"context"
+	"fmt"
 	"runtime"

 	"github.com/cirruslabs/orchard/internal/imageconstant"
@ -13,20 +14,29 @@ import (
 )

 func VM(name string) *v1.VM {
+	hostOS, hostArchitecture, err := hostPlatform()
+	if err != nil {
+		panic(err)
+	}
+
+	image, err := imageconstant.DefaultImage(hostOS, hostArchitecture)
+	if err != nil {
+		panic(err)
+	}
+
 	vm := &v1.VM{
 		Meta: v1.Meta{
 			Name: name,
 		},
-		Image:    imageconstant.DefaultMacosImage,
+		Image:    image,
 		CPU:      4,
 		Memory:   8 * 1024,
 		Headless: true,
 	}

-	if runtime.GOOS == "linux" {
-		vm.Image = imageconstant.DefaultLinuxImage
-		vm.OS = v1.OSLinux
-		vm.Arch = v1.ArchitectureAMD64
+	if hostOS == v1.OSLinux {
+		vm.OS = hostOS
+		vm.Arch = hostArchitecture
 		vm.Runtime = v1.RuntimeVetu
 	}

@ -34,26 +44,54 @@ func VM(name string) *v1.VM {
 }

 func CloneDefaultImage(ctx context.Context, logger *zap.SugaredLogger, destination string) error {
-	var err error
+	hostOS, hostArchitecture, err := hostPlatform()
+	if err != nil {
+		return err
+	}

-	if runtime.GOOS == "linux" {
-		_, _, err = vetu.Vetu(ctx, logger, "clone", imageconstant.DefaultLinuxImage, destination)
-	} else {
-		_, _, err = tart.Tart(ctx, logger, "clone", imageconstant.DefaultMacosImage, destination)
+	image, err := imageconstant.DefaultImage(hostOS, hostArchitecture)
+	if err != nil {
+		return err
+	}
+
+	switch hostOS {
+	case v1.OSLinux:
+		_, _, err = vetu.Vetu(ctx, logger, "clone", image, destination)
+	case v1.OSDarwin:
+		_, _, err = tart.Tart(ctx, logger, "clone", image, destination)
+	default:
+		return fmt.Errorf("%w: %q", imageconstant.ErrUnsupportedPlatform, hostOS)
 	}

 	return err
 }

 func ListVMs(ctx context.Context, logger *zap.SugaredLogger) ([]vmmanager.VMInfo, error) {
-	var vms []vmmanager.VMInfo
-	var err error
-
-	if runtime.GOOS == "linux" {
-		vms, err = vetu.List(ctx, logger)
-	} else {
-		vms, err = tart.List(ctx, logger)
+	hostOS, _, err := hostPlatform()
+	if err != nil {
+		return nil, err
 	}

-	return vms, err
+	switch hostOS {
+	case v1.OSLinux:
+		return vetu.List(ctx, logger)
+	case v1.OSDarwin:
+		return tart.List(ctx, logger)
+	default:
+		return nil, fmt.Errorf("%w: %q", imageconstant.ErrUnsupportedPlatform, hostOS)
+	}
+}
+
+func hostPlatform() (v1.OS, v1.Architecture, error) {
+	hostOS, err := v1.NewOSFromString(runtime.GOOS)
+	if err != nil {
+		return "", "", err
+	}
+
+	hostArchitecture, err := v1.NewArchitectureFromString(runtime.GOARCH)
+	if err != nil {
+		return "", "", err
+	}
+
+	return hostOS, hostArchitecture, nil
 }
--- a/packaging/orchard-controller.service
+++ b/packaging/orchard-controller.service
@ -1,12 +0,0 @@
-[Unit]
-Description=Orchard Controller
-Wants=network-online.target
-After=network-online.target
-
-[Service]
-Type=simple
-User=orchard-controller
-ExecStart=/usr/bin/orchard controller run
-
-[Install]
-WantedBy=multi-user.target
--- a/packaging/postinstall.sh
+++ b/packaging/postinstall.sh
@ -1,17 +0,0 @@
-#!/bin/bash
-
-# Set shell options to enable fail-fast behavior
-#
-# * -e: fail the script when an error occurs or command fails
-# * -u: fail the script when attempting to reference unset parameters
-# * -o pipefail: by default an exit status of a pipeline is that of its
-#                last command, this fails the pipe early if an error in
-#                any of its commands occurs
-#
-set -euo pipefail
-
-# Create "orchard-controller" user and group
-useradd --system --create-home --home-dir /var/lib/orchard-controller --user-group orchard-controller
-
-# Now that the orchard-controller.service file is installed, reflect the changes in systemd
-systemctl daemon-reload
--- a/packaging/postremove.sh
+++ b/packaging/postremove.sh
@ -1,20 +0,0 @@
-#!/bin/bash
-
-# Set shell options to enable fail-fast behavior
-#
-# * -e: fail the script when an error occurs or command fails
-# * -u: fail the script when attempting to reference unset parameters
-# * -o pipefail: by default an exit status of a pipeline is that of its
-#                last command, this fails the pipe early if an error in
-#                any of its commands occurs
-#
-set -euo pipefail
-
-# Delete "orchard-controller" user and group
-if id "orchard-controller" &>/dev/null
-then
-  userdel orchard-controller
-fi
-
-# Now that the orchard-controller.service file is removed, reflect the changes in systemd
-systemctl daemon-reload
--- a/packaging/preremove.sh
+++ b/packaging/preremove.sh
@ -1,14 +0,0 @@
-#!/bin/bash
-
-# Set shell options to enable fail-fast behavior
-#
-# * -e: fail the script when an error occurs or command fails
-# * -u: fail the script when attempting to reference unset parameters
-# * -o pipefail: by default an exit status of a pipeline is that of its
-#                last command, this fails the pipe early if an error in
-#                any of its commands occurs
-#
-set -euo pipefail
-
-# Stop the service, otherwise we won't be able to remove the "orchard-controller" user
-systemctl stop orchard-controller.service
--- a/pkg/client/client.go
+++ b/pkg/client/client.go
@ -13,6 +13,7 @@ import (
 	"net"
 	"net/http"
 	"net/url"
+	"strconv"
 	"time"

 	"github.com/cirruslabs/orchard/internal/config"
@ -25,6 +26,11 @@ import (
 	"google.golang.org/grpc/metadata"
 )

+const (
+	defaultHTTPTimeout = 30 * time.Second
+	waitParameterName  = "wait"
+)
+
 type APIError struct {
 	StatusCode int
 }
@ -107,7 +113,7 @@ func New(opts ...Option) (*Client, error) {
 		// the requests may hang indefinitely. See [1] for more details.
 		//
 		// [1]: https://github.com/cirruslabs/orchard/issues/152#issuecomment-1927091747
-		Timeout:   30 * time.Second,
+		Timeout:   defaultHTTPTimeout,
 		Transport: transport,
 	}

@ -315,7 +321,7 @@ func (client *Client) wsRequestRaw(
 	endpointURL.RawQuery = values.Encode()

 	dialOptions := &websocket.DialOptions{
-		HTTPClient: client.httpClient,
+		HTTPClient: client.httpClientForWebSocket(params),
 		HTTPHeader: make(http.Header),
 	}

@ -397,3 +403,27 @@ func (client *Client) RPC() *RPCService {
 		client: client,
 	}
 }
+
+func (client *Client) httpClientForWebSocket(params map[string]string) *http.Client {
+	waitRaw, ok := params[waitParameterName]
+	if !ok {
+		return client.httpClient
+	}
+
+	waitSeconds, err := strconv.ParseUint(waitRaw, 10, 16)
+	if err != nil {
+		return client.httpClient
+	}
+
+	waitTimeout := time.Duration(waitSeconds)*time.Second + defaultHTTPTimeout
+	if client.httpClient.Timeout == 0 || client.httpClient.Timeout >= waitTimeout {
+		return client.httpClient
+	}
+
+	return &http.Client{
+		CheckRedirect: client.httpClient.CheckRedirect,
+		Jar:           client.httpClient.Jar,
+		Timeout:       waitTimeout,
+		Transport:     client.httpClient.Transport,
+	}
+}
--- a/pkg/client/vms_test.go
+++ b/pkg/client/vms_test.go
@ -4,21 +4,39 @@ import (
 	"net/http"
 	"net/http/httptest"
 	"testing"
+	"time"

 	"github.com/coder/websocket"
 	"github.com/stretchr/testify/require"
 )

+func TestHTTPClientForWebSocketHonorsWait(t *testing.T) {
+	devClient, err := New(WithAddress("http://localhost"))
+	require.NoError(t, err)
+
+	httpClient := devClient.httpClientForWebSocket(map[string]string{waitParameterName: "120"})
+
+	require.Equal(t, 150*time.Second, httpClient.Timeout)
+	require.Same(t, devClient.httpClient.Transport, httpClient.Transport)
+}
+
 func TestExecSessionBuildsReconnectableQuery(t *testing.T) {
 	var query map[string][]string

-	server := httptest.NewServer(http.HandlerFunc(func(writer http.ResponseWriter, request *http.Request) {
-		query = request.URL.Query()
+	server := httptest.NewServer(
+		http.HandlerFunc(func(writer http.ResponseWriter, request *http.Request) {
+			query = request.URL.Query()

-		conn, err := websocket.Accept(writer, request, nil)
-		require.NoError(t, err)
-		defer conn.CloseNow()
-	}))
+			conn, err := websocket.Accept(writer, request, nil)
+			if err != nil {
+				t.Errorf("failed to accept WebSocket connection: %v", err)
+
+				return
+			}
+
+			defer conn.CloseNow()
+		}),
+	)
 	defer server.Close()

 	devClient, err := New(WithAddress(server.URL))
@ -45,6 +63,6 @@ func TestExecSessionBuildsReconnectableQuery(t *testing.T) {
 	require.Equal(t, []string{"80"}, query["cols"])
 	require.Equal(t, []string{"hello"}, query["env[GREETING]"])
 	require.Equal(t, []string{"/tmp"}, query["workdir"])
-	require.Equal(t, []string{"7"}, query["wait"])
+	require.Equal(t, []string{"7"}, query[waitParameterName])
 	require.Equal(t, []string{"resume-me"}, query["session"])
 }