You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
{{ message }}
Repository navigation
[WoA] Automate public cross-repository dispatch - #3026
Automates public-to-private WoA validation, incrementally on top of merged #3025. Renames woa-validation-dispatch.yml to woa-main-ci.yml; removes the completed phase-1 transport diagnostic rather than adding another automation wrapper.
Public ci.yml calls the reusable dispatch workflow only for pushes to NVIDIA/cuda-python:main, after the Windows ARM64 and Linux build groups succeed. Linux provides the shared pathfinder wheel. Private testing can overlap remaining public CI jobs; PR CI does not dispatch WoA tests.
The existing two-job separation remains: a read-only resolver/selector, then a credential-bearing dispatch job with no checkout or artifact processing.
ci/tools/select-woa-batch selects a batch after three commits since the nearest older successful App-owned WoA check, or once the oldest pending commit is at least two hours old. It scans up to 100 main commits, bootstraps when no baseline is found, and suppresses an already-recorded attempt for the exact run/SHA.
An hourly schedule at minute 17 UTC revisits deferred batches. Manual dispatch accepts an optional public run ID; leaving it empty finds a successful main/push CI run. Manual dispatch still follows batching and deduplication, not a force-run bypass.
lookup-run-id gains optional branch-mode --event filtering without changing callers that omit it. Explicit run IDs also allow an eligible in-progress main/push run, enabling early dispatch after the required builds.
Public dispatch is non-cancelling and concurrency-controlled. It sends only schema version, repository name, approved workflow ID, run ID, SHA, and correlation ID to ctk-next-woa-main-ci.yml on private ctk-next, then verifies the returned private run metadata.
Public Results
The private workflow creates and completes the aggregate cuda-python WoA integration check plus one check per supported Python version on the public commit. Checks report status/conclusion and link to the private workflow run; viewing its logs and JUnit artifacts requires private-repository access. No raw JUnit XML or test output is uploaded publicly.
The aggregate App check remains the batching baseline. These checks are not integrated into public Check job status in this PR.
Rollout
Merge private #651 first, then this PR: the public workflow dispatches the renamed private endpoint. Existing App credentials and variables are reused; no new secrets or App permissions are introduced.
Validation
Local regression tests cover lookup event filtering and backwards compatibility; workflow lint, Bash syntax, and diff checks are exercised.
Local simulations cover batching/deduplication and the coordinated six-input dispatch contract.
The pre-commit failure identified in this sweep was missing SPDX headers on the new selector and lookup tests; this update adds the standard repository headers.
The earlier merged manual pilot completed a real round trip. The expanded automatic/all-Python/full-suite path still needs actual GB10 validation; local mocks do not establish hardware success.
Known Limits
Batch selection uses bounded commit/check history, not a durable external ledger. Workflow cancellation or a reporting-service outage can leave checks incomplete; durable recovery is not included here.
It looks like this branch is under active development. To avoid overwhelming you with review comments due to an influx of new commits, CodeRabbit has automatically paused this review. You can configure this behavior by changing the reviews.auto_review.auto_pause_after_reviewed_commits setting.
Automated WoA validation now starts after successful Linux and Windows ARM64 builds.
Validation runs are batched to avoid redundant checks, with earlier runs scheduled when enough changes have accumulated or a wait threshold is reached.
Run selection can now be limited to a specific event type, improving consistency when identifying successful builds.
The CI workflow now triggers WoA main CI after eligible main-branch builds succeed. The WoA workflow resolves and validates a public run, selects whether to dispatch private WoA main CI, and sends the selected run ID and SHA. The manual transport-check workflow was removed.
Changes: WoA main CI
Layer / File(s)
Summary
Main-run trigger and public run resolution .github/workflows/ci.yml, .github/workflows/woa-main-ci.yml, ci/tools/lookup-run-id
The CI workflow invokes WoA main CI after the Linux x64 and Windows ARM64 builds succeed on a main push. The WoA workflow accepts reusable and manual triggers, validates in-progress or successful runs, and uses branch lookup that can filter successful runs by event.
The selector suppresses dispatch when a matching check exists. Otherwise, it checks for a successful baseline and uses pending commit count and age to decide whether to dispatch. The workflow gates dispatch on the selector output.
The private dispatch now targets ctk-next-woa-main-ci.yml and passes the public run ID and SHA. The manual transport-check workflow was removed.
Possibly related issues
Issue 2616 describes a condition where build-windows-arm64 can be skipped on stable channels. The new dispatch job requires that build to succeed, and this PR does not change the condition.
Possibly related PRs
NVIDIA/cuda-python#3176: Adds the --event branch filter to ci/tools/lookup-run-id, which this PR uses as part of public-run lookup.
Suggested reviewers:leofang
Priority: Normal
Change: Feature
Merge Risk: Low · up to e0f73
The workflow unnecessarily exposes unrelated caller credentials, so pass only the required secret before merging.
- [ ] Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts
Comment @coderabbitai help to get the list of available commands.
Reviewing files that changed from the base of the PR and between 1cd41ea and 9db98f2.
📒 Files selected for processing: 6
.github/workflows/ci.yml
.github/workflows/woa-main-ci.yml
.github/workflows/woa-transport-check.yml
ci/tools/lookup-run-id
ci/tools/select-woa-batch
ci/tools/tests/test_lookup_run_id.py
💤 Files with no reviewable changes: 1
.github/workflows/woa-transport-check.yml
Included review availability: This review used your included allowance. Your plan provides up to 12 included reviews per hour; 11 remain after this review.
Reviewing files that changed from the base of the PR and between 9db98f2 and 0b144bd.
📒 Files selected for processing: 3
.github/workflows/woa-main-ci.yml
ci/tools/select-woa-batch
ci/tools/tests/test_woa_main_ci.py
🚧 Files skipped from review as they are similar to previous changes: 1
ci/tools/select-woa-batch
Included review availability: This review used your included allowance. Your plan provides up to 12 included reviews per hour; 11 remain after this review.
important: Restore the hourly schedule. The selector defers batches below three commits until the oldest pending commit is two hours old. With only reusable and manual triggers, that time limit does not start another run. A deferred batch can remain unvalidated until another push or manual dispatch. Restore the minute-17 schedule and update the no-cron assertion in ci/tools/tests/test_woa_main_ci.py. This repeats a concern marked addressed in an earlier review.
Reviewing files that changed from the base of the PR and between 0b144bd and d1ea93a.
📒 Files selected for processing: 4
.github/workflows/ci.yml
.github/workflows/woa-main-ci.yml
ci/tools/select-woa-batch
ci/tools/tests/test_woa_main_ci.py
🚧 Files skipped from review as they are similar to previous changes: 1
ci/tools/select-woa-batch
Included review availability: This review used your included allowance. Your plan provides up to 12 included reviews per hour; 11 remain after this review.
Reviewing files that changed from the base of the PR and between dcd7b6f and e0f7368.
Files selected for processing: 1
.github/workflows/ci.yml
Included review availability: This review used your included allowance. Your plan provides up to 12 included reviews per hour; 11 remain after this review.
The reason will be displayed to describe this comment to others. Learn more.
Minor · Security & Privacy · Quick win
important: Pass only the required secret.
secrets: inherit gives woa-main-ci.yml every available caller secret, although its workflow_call contract declares only CUDA_PYTHON_WOA_XREPO_CI_PRIVATE_APP_PRIVATE_KEY. Pass that secret by name to limit credential exposure in the called workflow. GitHub documents that inherit passes all caller secrets. (docs.github.com) As per path instructions, “focus on least-privilege permissions” and “security boundaries.”
Tools
zizmor (1.30.1)
[warning] 7-759: overly broad permissions (excessive-permissions): default permissions used due to no permissions: block
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
rwgk
left a comment
Summary
Automates public-to-private WoA validation, incrementally on top of merged #3025. Renames
woa-validation-dispatch.ymltowoa-main-ci.yml; removes the completed phase-1 transport diagnostic rather than adding another automation wrapper.Paired private PR: https://github.com/NVIDIA-dev/cuda-python-private/pull/651. Tracks https://github.com/NVIDIA-dev/cuda-python-private/issues/584.
Behavior
ci.ymlcalls the reusable dispatch workflow only for pushes toNVIDIA/cuda-python:main, after the Windows ARM64 and Linux build groups succeed. Linux provides the shared pathfinder wheel. Private testing can overlap remaining public CI jobs; PR CI does not dispatch WoA tests.ci/tools/select-woa-batchselects a batch after three commits since the nearest older successful App-owned WoA check, or once the oldest pending commit is at least two hours old. It scans up to 100 main commits, bootstraps when no baseline is found, and suppresses an already-recorded attempt for the exact run/SHA.lookup-run-idgains optional branch-mode--eventfiltering without changing callers that omit it. Explicit run IDs also allow an eligible in-progress main/push run, enabling early dispatch after the required builds.ctk-next-woa-main-ci.ymlon privatectk-next, then verifies the returned private run metadata.Public Results
The private workflow creates and completes the aggregate
cuda-python WoA integrationcheck plus one check per supported Python version on the public commit. Checks report status/conclusion and link to the private workflow run; viewing its logs and JUnit artifacts requires private-repository access. No raw JUnit XML or test output is uploaded publicly.The aggregate App check remains the batching baseline. These checks are not integrated into public
Check job statusin this PR.Rollout
Merge private #651 first, then this PR: the public workflow dispatches the renamed private endpoint. Existing App credentials and variables are reused; no new secrets or App permissions are introduced.
Validation
Known Limits
Batch selection uses bounded commit/check history, not a durable external ledger. Workflow cancellation or a reporting-service outage can leave checks incomplete; durable recovery is not included here.