You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
{{ message }}
Repository navigation
[WoA] Automate public cross-repository dispatch - #3026
Automatically requests private GB10 Windows ARM64 validation of public main builds, extending merged #3025. Renames woa-validation-dispatch.yml to woa-main-ci.yml and removes the phase-1 transport diagnostic.
Public ci.yml calls the reusable dispatch workflow only for pushes to NVIDIA/cuda-python:main, after build-linux-64 and build-windows-arm64 succeed. Linux supplies the shared pathfinder wheel. Private tests can overlap the remaining public CI jobs. PR builds do not dispatch private validation.
A read-only job resolves and selects the public build. A separate credential-bearing job dispatches the private workflow without checking out code or processing artifacts.
ci/tools/select-woa-batch selects the candidate after three commits since the nearest older successful App-owned WoA check, or when the oldest pending commit is at least two hours old. It scans up to 100 main commits, bootstraps without a baseline, and suppresses an already-recorded attempt for the exact run/SHA.
Selection runs on eligible main pushes or manual invocation. There is no cron or idle timer: a deferred batch waits for another eligible push or a manual invocation, even after two hours elapse.
Manual dispatch accepts an optional public run ID. Leaving it empty finds a successful main/push CI run through lookup-run-id --event push. Explicit IDs may identify an eligible in-progress main/push run. Manual dispatch follows the same batching and deduplication rules.
lookup-run-id gains optional branch-mode --event filtering; callers that omit it retain their existing behavior.
Dispatch uses non-cancelling workflow concurrency. It sends six inputs—schema version, repository name, approved workflow ID, public run ID, SHA, and correlation ID—to ctk-next-woa-main-ci.yml on private ctk-next, then verifies the returned private run metadata.
Public results
The paired private workflow validates the exact public artifacts and test sources, reads the CUDA version and supported Python variants from the tested public commit, and runs installed-wheel tests on GB10.
It publishes the aggregate cuda-python WoA integration check and one check per supported Python version on the public commit. Checks contain status/conclusion and a link to the private workflow run. Logs and JUnit artifacts remain private and require private-repository access.
The aggregate App check provides the batching baseline. These checks remain separate from public Check job status.
Rollout and validation
Merge private #651 first so the renamed endpoint exists, then merge this PR. Existing App credentials and permissions are reused.
The current public PR CI checks pass, including Windows ARM64 wheel builds and Linux/Windows pre-commit checks.
A read-only contract check confirms the six dispatch inputs match the private receiver. All 15 expected artifacts for seven Python variants exist in successful public main run 41487299755.
The merged manual pilot completed a real round trip. The expanded automatic/all-Python/full-suite path still requires actual GB10 validation.
Batch selection uses bounded commit/check history. Recovery from whole-workflow cancellation or a reporting-service outage remains deferred.
It looks like this branch is under active development. To avoid overwhelming you with review comments due to an influx of new commits, CodeRabbit has automatically paused this review. You can configure this behavior by changing the reviews.auto_review.auto_pause_after_reviewed_commits setting.
Automated WoA validation now starts after successful Linux and Windows ARM64 builds.
Validation runs are batched to avoid redundant checks, with earlier runs scheduled when enough changes have accumulated or a wait threshold is reached.
Run selection can now be limited to a specific event type, improving consistency when identifying successful builds.
The CI workflow now triggers WoA main CI after eligible main-branch builds succeed. The WoA workflow resolves and validates a public run, selects whether to dispatch private WoA main CI, and sends the selected run ID and SHA. The manual transport-check workflow was removed.
Changes: WoA main CI
Layer / File(s)
Summary
Main-run trigger and public run resolution .github/workflows/ci.yml, .github/workflows/woa-main-ci.yml, ci/tools/lookup-run-id
The CI workflow invokes WoA main CI after the Linux x64 and Windows ARM64 builds succeed on a main push. The WoA workflow accepts reusable and manual triggers, validates in-progress or successful runs, and uses branch lookup that can filter successful runs by event.
The selector suppresses dispatch when a matching check exists. Otherwise, it checks for a successful baseline and uses pending commit count and age to decide whether to dispatch. The workflow gates dispatch on the selector output.
The private dispatch now targets ctk-next-woa-main-ci.yml and passes the public run ID and SHA. The manual transport-check workflow was removed.
Possibly related issues
Issue 2616 describes a condition where build-windows-arm64 can be skipped on stable channels. The new dispatch job requires that build to succeed, and this PR does not change the condition.
Possibly related PRs
NVIDIA/cuda-python#3176: Adds the --event branch filter to ci/tools/lookup-run-id, which this PR uses as part of public-run lookup.
Suggested reviewers:leofang
Priority: Normal
Change: Feature
Merge Risk: Low · up to e0f73
The workflow unnecessarily exposes unrelated caller credentials, so pass only the required secret before merging.
- [ ] Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts
Comment @coderabbitai help to get the list of available commands.
Reviewing files that changed from the base of the PR and between 1cd41ea and 9db98f2.
📒 Files selected for processing: 6
.github/workflows/ci.yml
.github/workflows/woa-main-ci.yml
.github/workflows/woa-transport-check.yml
ci/tools/lookup-run-id
ci/tools/select-woa-batch
ci/tools/tests/test_lookup_run_id.py
💤 Files with no reviewable changes: 1
.github/workflows/woa-transport-check.yml
Included review availability: This review used your included allowance. Your plan provides up to 12 included reviews per hour; 11 remain after this review.
Reviewing files that changed from the base of the PR and between 9db98f2 and 0b144bd.
📒 Files selected for processing: 3
.github/workflows/woa-main-ci.yml
ci/tools/select-woa-batch
ci/tools/tests/test_woa_main_ci.py
🚧 Files skipped from review as they are similar to previous changes: 1
ci/tools/select-woa-batch
Included review availability: This review used your included allowance. Your plan provides up to 12 included reviews per hour; 11 remain after this review.
important: Restore the hourly schedule. The selector defers batches below three commits until the oldest pending commit is two hours old. With only reusable and manual triggers, that time limit does not start another run. A deferred batch can remain unvalidated until another push or manual dispatch. Restore the minute-17 schedule and update the no-cron assertion in ci/tools/tests/test_woa_main_ci.py. This repeats a concern marked addressed in an earlier review.
Reviewing files that changed from the base of the PR and between 0b144bd and d1ea93a.
📒 Files selected for processing: 4
.github/workflows/ci.yml
.github/workflows/woa-main-ci.yml
ci/tools/select-woa-batch
ci/tools/tests/test_woa_main_ci.py
🚧 Files skipped from review as they are similar to previous changes: 1
ci/tools/select-woa-batch
Included review availability: This review used your included allowance. Your plan provides up to 12 included reviews per hour; 11 remain after this review.
Reviewing files that changed from the base of the PR and between dcd7b6f and e0f7368.
Files selected for processing: 1
.github/workflows/ci.yml
Included review availability: This review used your included allowance. Your plan provides up to 12 included reviews per hour; 11 remain after this review.
The reason will be displayed to describe this comment to others. Learn more.
Minor · Security & Privacy · Quick win
important: Pass only the required secret.
secrets: inherit gives woa-main-ci.yml every available caller secret, although its workflow_call contract declares only CUDA_PYTHON_WOA_XREPO_CI_PRIVATE_APP_PRIVATE_KEY. Pass that secret by name to limit credential exposure in the called workflow. GitHub documents that inherit passes all caller secrets. (docs.github.com) As per path instructions, “focus on least-privilege permissions” and “security boundaries.”
Tools
zizmor (1.30.1)
[warning] 7-759: overly broad permissions (excessive-permissions): default permissions used due to no permissions: block
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
rwgk
left a comment
Summary
Automatically requests private GB10 Windows ARM64 validation of public main builds, extending merged #3025. Renames
woa-validation-dispatch.ymltowoa-main-ci.ymland removes the phase-1 transport diagnostic.Paired private PR: https://github.com/NVIDIA-dev/cuda-python-private/pull/651. Tracks https://github.com/NVIDIA-dev/cuda-python-private/issues/584.
Dispatch and batching
ci.ymlcalls the reusable dispatch workflow only for pushes toNVIDIA/cuda-python:main, afterbuild-linux-64andbuild-windows-arm64succeed. Linux supplies the shared pathfinder wheel. Private tests can overlap the remaining public CI jobs. PR builds do not dispatch private validation.ci/tools/select-woa-batchselects the candidate after three commits since the nearest older successful App-owned WoA check, or when the oldest pending commit is at least two hours old. It scans up to 100 main commits, bootstraps without a baseline, and suppresses an already-recorded attempt for the exact run/SHA.lookup-run-id --event push. Explicit IDs may identify an eligible in-progress main/push run. Manual dispatch follows the same batching and deduplication rules.lookup-run-idgains optional branch-mode--eventfiltering; callers that omit it retain their existing behavior.ctk-next-woa-main-ci.ymlon privatectk-next, then verifies the returned private run metadata.Public results
The paired private workflow validates the exact public artifacts and test sources, reads the CUDA version and supported Python variants from the tested public commit, and runs installed-wheel tests on GB10.
It publishes the aggregate
cuda-python WoA integrationcheck and one check per supported Python version on the public commit. Checks contain status/conclusion and a link to the private workflow run. Logs and JUnit artifacts remain private and require private-repository access.The aggregate App check provides the batching baseline. These checks remain separate from public
Check job status.Rollout and validation
Merge private #651 first so the renamed endpoint exists, then merge this PR. Existing App credentials and permissions are reused.
Batch selection uses bounded commit/check history. Recovery from whole-workflow cancellation or a reporting-service outage remains deferred.