woa-validation-dispatch.yml

# SPDX-FileCopyrightText: Copyright (c) 2026 NVIDIA CORPORATION & AFFILIATES. All rights reserved.
#
# SPDX-License-Identifier: Apache-2.0

name: "WoA validation dispatch"
run-name: "WoA exact dispatch for ${{ inputs.public_run_id || 'latest successful public main CI run' }}"

on:
  workflow_dispatch:
    inputs:
      public_run_id:
        description: Successful public main CI run; leave empty to find the latest successful main CI run
        required: false
        type: string

permissions: {}

jobs:
  resolve-public-build:
    if: ${{ github.repository == 'NVIDIA/cuda-python' }}
    runs-on: ubuntu-latest
    timeout-minutes: 10
    permissions:
      actions: read
      contents: read
      checks: read
    outputs:
      correlation-id: ${{ steps.resolve.outputs.correlation_id }}
      public-run-id: ${{ steps.resolve.outputs.public_run_id }}
      public-sha: ${{ steps.resolve.outputs.public_sha }}
    steps:
      - name: Checkout main run lookup helper
        if: ${{ inputs.public_run_id == '' }}
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7.0.1
        with:
          ref: main
          persist-credentials: false
          sparse-checkout: ci/tools/lookup-run-id
          sparse-checkout-cone-mode: false

      - name: Resolve exact successful public build
        id: resolve
        env:
          GH_TOKEN: ${{ github.token }}
          PUBLIC_RUN_ID: ${{ inputs.public_run_id }}
        run: |
          set -euo pipefail
          public_sha=''
          if [[ -z "$PUBLIC_RUN_ID" ]]; then
            lookup_output=$(./ci/tools/lookup-run-id --branch main --head-sha NVIDIA/cuda-python CI)
            mapfile -t lookup_result <<< "$lookup_output"
            [[ ${#lookup_result[@]} == 2 ]]
            PUBLIC_RUN_ID=${lookup_result[0]}
            public_sha=${lookup_result[1]}
            [[ "$public_sha" =~ ^[0-9a-f]{40}$ ]]
          fi
          [[ "$PUBLIC_RUN_ID" =~ ^[1-9][0-9]*$ ]]
          run=$(gh api \
            -H 'X-GitHub-Api-Version: 2026-03-10' \
            "repos/NVIDIA/cuda-python/actions/runs/$PUBLIC_RUN_ID")
          jq -e --arg sha "$public_sha" '
            .repository.full_name == "NVIDIA/cuda-python" and
            .workflow_id == 155304118 and
            .path == ".github/workflows/ci.yml" and
            .event == "push" and
            .head_branch == "main" and
            .status == "completed" and
            .conclusion == "success" and
            ($sha == "" or .head_sha == $sha) and
            (.head_sha | test("^[0-9a-f]{40}$"))
          ' <<< "$run" >/dev/null
          if [[ -z "$public_sha" ]]; then
            public_sha=$(jq -r .head_sha <<< "$run")
          fi

          comparison=$(gh api \
            -H 'X-GitHub-Api-Version: 2026-03-10' \
            "repos/NVIDIA/cuda-python/compare/$public_sha...main")
          jq -e '.status == "ahead" or .status == "identical"' <<< "$comparison" >/dev/null

          correlation_id="v1:NVIDIA/cuda-python:$PUBLIC_RUN_ID:$public_sha"
          echo "correlation_id=$correlation_id" >> "$GITHUB_OUTPUT"
          echo "public_run_id=$PUBLIC_RUN_ID" >> "$GITHUB_OUTPUT"
          echo "public_sha=$public_sha" >> "$GITHUB_OUTPUT"
          {
            echo "Resolved successful public run \`$PUBLIC_RUN_ID\` at commit \`$public_sha\`."
          } >> "$GITHUB_STEP_SUMMARY"

  dispatch-private-validation:
    needs: resolve-public-build
    runs-on: ubuntu-latest
    timeout-minutes: 10
    permissions: {}
    steps:
      - name: Create private dispatch token
        id: private-app-token
        uses: actions/create-github-app-token@bcd2ba49218906704ab6c1aa796996da409d3eb1  # v3
        with:
          client-id: ${{ vars.CUDA_PYTHON_WOA_XREPO_CI_PRIVATE_APP_CLIENT_ID }}
          private-key: ${{ secrets.CUDA_PYTHON_WOA_XREPO_CI_PRIVATE_APP_PRIVATE_KEY }}
          owner: NVIDIA-dev
          repositories: cuda-python-private
          permission-actions: write

      - name: Dispatch and verify exact private validation
        env:
          CORRELATION_ID: ${{ needs.resolve-public-build.outputs.correlation-id }}
          GH_TOKEN: ${{ steps.private-app-token.outputs.token }}
          PUBLIC_RUN_ID: ${{ needs.resolve-public-build.outputs.public-run-id }}
          PUBLIC_SHA: ${{ needs.resolve-public-build.outputs.public-sha }}
        run: |
          set -euo pipefail
          payload=$(jq -n \
            --arg correlation_id "$CORRELATION_ID" \
            --arg run_id "$PUBLIC_RUN_ID" \
            --arg sha "$PUBLIC_SHA" \
            '{
              ref: "ctk-next",
              return_run_details: true,
              inputs: {
                schema_version: "1",
                public_repository: "NVIDIA/cuda-python",
                public_workflow_id: "155304118",
                public_run_id: $run_id,
                public_sha: $sha,
                baseline_sha: "",
                commit_count: "1",
                correlation_id: $correlation_id
              }
            }')
          response=$(gh api \
            --method POST \
            -H 'X-GitHub-Api-Version: 2026-03-10' \
            repos/NVIDIA-dev/cuda-python-private/actions/workflows/ctk-next-woa-validation.yml/dispatches \
            --input - <<< "$payload")
          private_run_id=$(jq -er '.workflow_run_id | tostring' <<< "$response")
          run=$(gh api \
            -H 'X-GitHub-Api-Version: 2026-03-10' \
            "repos/NVIDIA-dev/cuda-python-private/actions/runs/$private_run_id")
          jq -e '
            .repository.full_name == "NVIDIA-dev/cuda-python-private" and
            .path == ".github/workflows/ctk-next-woa-validation.yml" and
            .event == "workflow_dispatch" and
            .head_branch == "ctk-next"
          ' <<< "$run" >/dev/null
          echo "Private validation workflow accepted the exact dispatch." >> "$GITHUB_STEP_SUMMARY"