ci: gate PRs on Actions and bridge to Blossom - #1
Merged
Conversation
letientai299
force-pushed
the
tai/gh-actions
branch
from
August 19, 2026 10:47
7d37131 to
6cb733c
Compare
letientai299
changed the title
letientai299
changed the title
letientai299
force-pushed
the
tai/gh-actions
branch
6 times, most recently
from
August 19, 2026 14:32
7e71212 to
f6f19c3
Compare
letientai299
changed the title
Collaborator
Author
|
/build-ci |
Lint and pull-request hygiene, the slice of the suite that needs no hardware, and the wheel — none of which needs a GPU. GitLab stays the source of truth for the GPU suite and the benchmarks. - prek runs the hooks prek.toml pins over the whole tree. - Title lints the PR title, which squash-merge turns into the commit subject. That holds only because the repo sets squash_merge_commit_title = PR_TITLE; the COMMIT_OR_PR_TITLE default would take a single-commit PR's own subject, which nothing but the opt-in commit-msg hook lints. - DCO checks every commit the PR adds carries a matching sign-off. - contract runs tests/contract and tests/cubin, which import only the standard library and pytest. - wheel builds the extension and imports it. cpp/CMakeLists.txt declares LANGUAGES CXX ASM, so nvcc compiles nothing: the kernels are precompiled CUBINs assembled in as .incbin shards, and the only CUDA dependency is CUDA::cuda_driver against the toolkit's libcuda stub. Nothing links PyTorch, which is why the GitLab job for this already runs on a CPU runner. The first three plus contract share one always-on trigger, so they live in ci.yml. The wheel keeps its own file: it is the only one worth starting by hand, and workflow_dispatch there builds from any branch or tag without a pull request to open first. Adding dispatch grants nothing new — a pull_request run already executes the workflow file from the PR head — and it needs actions: write, so it stays with write collaborators. Both jobs that need LFS fetch the CUBIN packs by pattern rather than passing lfs: true, which pulls 88.2 MB where 2.5 MB is read. They are also the two that keep checkout's credentials, because git lfs pull authenticates with them on an internal repo; the other three drop the token. Every pin is read out of the file that declares it, so CI cannot drift from what `pip install -e '.[dev]'` gives a contributor: prek from requirements-dev.txt, pytest from the same, Python from pyproject.toml. The Python floor rather than python-version-file, which resolves ">=3.12,<4.0" to the newest 3.x the runner has — the published wheel is cp312, and a gate that compiles a different ABI is not the gate docs/dev.md promises. The prek hook cache carries restore-keys, so bumping one hook's rev rebuilds that hook rather than all nine. Title opts out of the cache entirely: it builds commitizen's environment and nothing else, which costs about what saving it does, and skipping it removes the per-job cache key the two jobs otherwise needed to avoid clobbering each other. Jimver/cuda-toolkit is the only third-party action and is pinned to a commit, per NVIDIA ProdSec and NVIDIA/warp's own practice. There is no first-party alternative: the org pattern is to run inside nvcr.io/nvidia/cuda, which ships neither git-lfs for the packs nor a Python setup-python recognises. Signed-off-by: Tai Le <taile@nvidia.com>
The GPU suite, the image build and the extension build cannot run on GitHub runners, so a maintainer asks for them with `/build-ci` and Blossom carries the request to internal Jenkins. GitHub keeps the trigger, the authorization and the result; nothing behind the firewall is exposed. Two gates guard it: the actor must be in `BLOSSOM_AUTHORIZED_USERS`, and `blossom-ci` re-checks them against Blossom's own database and Duo. The list is a repository variable rather than a literal in this file, so on- and offboarding is a settings edit. It is seeded from the `bioir` team but is deliberately not the team -- approving a run spends GPU hours, which is a narrower permission than reviewing code. The chain stays advisory. It only reports once someone asks, so requiring it would block every pull request until a maintainer typed the command. Secrets `BLOSSOM_KEY` and `CI_SERVER` and the self-hosted runner are not in place yet, so the first run of this will queue rather than start. Signed-off-by: Tai Le <taile@nvidia.com>
Two values in .github/ were still written out by hand while everything around them is read from where it is declared. The LFS pack pattern appeared three times. Its source of truth is .gitattributes, which a contract test pins, so a copy that drifts fails quietly: the pull matches nothing, the packs stay pointers, and the error arrives later as "is a Git LFS pointer" rather than as a stale glob. It now lives in a composite action, next to the prek and python ones. The wheel job installed a fixed CUDA 13.2.0 while docker/Dockerfile declares 13.0.2 as the runtime. setup.py turns the toolkit's `nvcc --version` into the wheel's `+cuXYZ` local version segment, so that gap published a wheel labelled for a CUDA no other build path here produces. Reading RUNTIME_TAG closes it; the wheel this job builds is now `+cu130`. Signed-off-by: Tai Le <taile@nvidia.com>
letientai299
force-pushed
the
tai/gh-actions
branch
from
August 19, 2026 16:00
2571b1b to
e9050e4
Compare
letientai299
changed the title
letientai299
marked this pull request as ready for review
August 19, 2026 16:56
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to subscribe to this conversation on GitHub.
Already have an account?
Sign in.
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Description
Lint and pull-request hygiene only. GitLab stays the source of truth for
builds, GPU tests and benchmarks, so nothing here compiles the extension,
pulls LFS objects, or asks for a GPU.
style.ymlprekprek run --all-files, the hooks pinned inprek.tomlpr.ymlTitlepr.ymlDCOSigned-off-byThe
prekpin is read out ofrequirements-dev.txtrather than repeated, so CIcannot drift from what
pip install -e '.[dev]'gives a contributor. The Titlejob runs
prek run commitizen --stage commit-msgagainst the title, socommitizen's version and pattern stay single-sourced too; it strips a leading
[PROJ-123]/[5123456]first, which commitizen would otherwise reject.A PR title is attacker-controlled, so it reaches the script through the
environment, never through
${{ }}interpolation inside arun:block.Type of change
Checklist
git commit -s