Skip to content

Commit 1cd41ea

Browse files
isVoidisVoid
authored
[WoA] Add manual cross-repository broker (#3025)
* ci: add manual WoA cross-repository broker * ci: dispatch exact WoA producer identity * ci: clarify WoA workflow roles * Target transport smoke at public main * Use repository names for WoA cross-repository identity * Find latest successful main CI run when WoA run ID is omitted * Simplify WoA dispatch to identify artifacts by public run
1 parent 3f58a7b commit 1cd41ea

2 files changed

Lines changed: 254 additions & 0 deletions

File tree

‎.github/workflows/woa-transport-check.yml‎

Lines changed: 108 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,108 @@
1+
# SPDX-FileCopyrightText: Copyright (c) 2026 NVIDIA CORPORATION & AFFILIATES. All rights reserved.
2+
#
3+
# SPDX-License-Identifier: Apache-2.0
4+
5+
name: "WoA transport check"
6+
run-name: "WoA transport smoke for current public main"
7+
8+
on:
9+
workflow_dispatch:
10+
11+
permissions: {}
12+
13+
jobs:
14+
resolve-public-main:
15+
if: ${{ github.repository == 'NVIDIA/cuda-python' }}
16+
runs-on: ubuntu-latest
17+
timeout-minutes: 5
18+
permissions:
19+
contents: read
20+
outputs:
21+
correlation-id: ${{ steps.resolve.outputs.correlation_id }}
22+
public-sha: ${{ steps.resolve.outputs.public_sha }}
23+
steps:
24+
- name: Resolve exact public main commit
25+
id: resolve
26+
env:
27+
GH_TOKEN: ${{ github.token }}
28+
run: |
29+
set -euo pipefail
30+
31+
public_sha=$(gh api \
32+
-H 'X-GitHub-Api-Version: 2026-03-10' \
33+
repos/NVIDIA/cuda-python/git/ref/heads/main \
34+
--jq .object.sha)
35+
[[ "$public_sha" =~ ^[0-9a-f]{40}$ ]]
36+
37+
commit=$(gh api \
38+
-H 'X-GitHub-Api-Version: 2026-03-10' \
39+
"repos/NVIDIA/cuda-python/commits/$public_sha")
40+
jq -e --arg sha "$public_sha" '.sha == $sha' <<< "$commit" >/dev/null
41+
42+
comparison=$(gh api \
43+
-H 'X-GitHub-Api-Version: 2026-03-10' \
44+
"repos/NVIDIA/cuda-python/compare/$public_sha...main")
45+
jq -e \
46+
--arg sha "$public_sha" \
47+
'.base_commit.sha == $sha and
48+
.merge_base_commit.sha == $sha and
49+
(.status == "ahead" or .status == "identical")' \
50+
<<< "$comparison" >/dev/null
51+
52+
correlation_id="smoke:NVIDIA/cuda-python:main:$public_sha:${GITHUB_RUN_ID}:${GITHUB_RUN_ATTEMPT}"
53+
echo "public_sha=$public_sha" >> "$GITHUB_OUTPUT"
54+
echo "correlation_id=$correlation_id" >> "$GITHUB_OUTPUT"
55+
echo "Transport smoke will report on public main commit \`$public_sha\`." >> "$GITHUB_STEP_SUMMARY"
56+
57+
dispatch-private-smoke:
58+
needs: resolve-public-main
59+
runs-on: ubuntu-latest
60+
timeout-minutes: 10
61+
permissions: {}
62+
steps:
63+
- name: Create private dispatch token
64+
id: private-app-token
65+
uses: actions/create-github-app-token@bcd2ba49218906704ab6c1aa796996da409d3eb1 # v3
66+
with:
67+
client-id: ${{ vars.CUDA_PYTHON_WOA_XREPO_CI_PRIVATE_APP_CLIENT_ID }}
68+
private-key: ${{ secrets.CUDA_PYTHON_WOA_XREPO_CI_PRIVATE_APP_PRIVATE_KEY }}
69+
owner: NVIDIA-dev
70+
repositories: cuda-python-private
71+
permission-actions: write
72+
73+
- name: Dispatch and verify private smoke workflow
74+
env:
75+
CORRELATION_ID: ${{ needs.resolve-public-main.outputs.correlation-id }}
76+
GH_TOKEN: ${{ steps.private-app-token.outputs.token }}
77+
PUBLIC_SHA: ${{ needs.resolve-public-main.outputs.public-sha }}
78+
run: |
79+
set -euo pipefail
80+
payload=$(jq -n \
81+
--arg correlation_id "$CORRELATION_ID" \
82+
--arg public_sha "$PUBLIC_SHA" \
83+
'{
84+
ref: "ctk-next",
85+
return_run_details: true,
86+
inputs: {
87+
schema_version: "2",
88+
public_repository: "NVIDIA/cuda-python",
89+
public_sha: $public_sha,
90+
correlation_id: $correlation_id
91+
}
92+
}')
93+
response=$(gh api \
94+
--method POST \
95+
-H 'X-GitHub-Api-Version: 2026-03-10' \
96+
repos/NVIDIA-dev/cuda-python-private/actions/workflows/ctk-next-woa-transport-check.yml/dispatches \
97+
--input - <<< "$payload")
98+
private_run_id=$(jq -er '.workflow_run_id | tostring' <<< "$response")
99+
run=$(gh api \
100+
-H 'X-GitHub-Api-Version: 2026-03-10' \
101+
"repos/NVIDIA-dev/cuda-python-private/actions/runs/$private_run_id")
102+
jq -e '
103+
.repository.full_name == "NVIDIA-dev/cuda-python-private" and
104+
.path == ".github/workflows/ctk-next-woa-transport-check.yml" and
105+
.event == "workflow_dispatch" and
106+
.head_branch == "ctk-next"
107+
' <<< "$run" >/dev/null
108+
echo "Private transport-smoke workflow accepted the exact dispatch." >> "$GITHUB_STEP_SUMMARY"

‎.github/workflows/woa-validation-dispatch.yml‎

Lines changed: 146 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,146 @@
1+
# SPDX-FileCopyrightText: Copyright (c) 2026 NVIDIA CORPORATION & AFFILIATES. All rights reserved.
2+
#
3+
# SPDX-License-Identifier: Apache-2.0
4+
5+
name: "WoA validation dispatch"
6+
run-name: "WoA exact dispatch for ${{ inputs.public_run_id || 'latest successful public main CI run' }}"
7+
8+
on:
9+
workflow_dispatch:
10+
inputs:
11+
public_run_id:
12+
description: Successful public main CI run; leave empty to find the latest successful main CI run
13+
required: false
14+
type: string
15+
16+
permissions: {}
17+
18+
jobs:
19+
resolve-public-build:
20+
if: ${{ github.repository == 'NVIDIA/cuda-python' }}
21+
runs-on: ubuntu-latest
22+
timeout-minutes: 10
23+
permissions:
24+
actions: read
25+
contents: read
26+
checks: read
27+
outputs:
28+
correlation-id: ${{ steps.resolve.outputs.correlation_id }}
29+
public-run-id: ${{ steps.resolve.outputs.public_run_id }}
30+
public-sha: ${{ steps.resolve.outputs.public_sha }}
31+
steps:
32+
- name: Checkout main run lookup helper
33+
if: ${{ inputs.public_run_id == '' }}
34+
uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
35+
with:
36+
ref: main
37+
persist-credentials: false
38+
sparse-checkout: ci/tools/lookup-run-id
39+
sparse-checkout-cone-mode: false
40+
41+
- name: Resolve exact successful public build
42+
id: resolve
43+
env:
44+
GH_TOKEN: ${{ github.token }}
45+
PUBLIC_RUN_ID: ${{ inputs.public_run_id }}
46+
run: |
47+
set -euo pipefail
48+
public_sha=''
49+
if [[ -z "$PUBLIC_RUN_ID" ]]; then
50+
lookup_output=$(./ci/tools/lookup-run-id --branch main --head-sha NVIDIA/cuda-python CI)
51+
mapfile -t lookup_result <<< "$lookup_output"
52+
[[ ${#lookup_result[@]} == 2 ]]
53+
PUBLIC_RUN_ID=${lookup_result[0]}
54+
public_sha=${lookup_result[1]}
55+
[[ "$public_sha" =~ ^[0-9a-f]{40}$ ]]
56+
fi
57+
[[ "$PUBLIC_RUN_ID" =~ ^[1-9][0-9]*$ ]]
58+
run=$(gh api \
59+
-H 'X-GitHub-Api-Version: 2026-03-10' \
60+
"repos/NVIDIA/cuda-python/actions/runs/$PUBLIC_RUN_ID")
61+
jq -e --arg sha "$public_sha" '
62+
.repository.full_name == "NVIDIA/cuda-python" and
63+
.workflow_id == 155304118 and
64+
.path == ".github/workflows/ci.yml" and
65+
.event == "push" and
66+
.head_branch == "main" and
67+
.status == "completed" and
68+
.conclusion == "success" and
69+
($sha == "" or .head_sha == $sha) and
70+
(.head_sha | test("^[0-9a-f]{40}$"))
71+
' <<< "$run" >/dev/null
72+
if [[ -z "$public_sha" ]]; then
73+
public_sha=$(jq -r .head_sha <<< "$run")
74+
fi
75+
76+
comparison=$(gh api \
77+
-H 'X-GitHub-Api-Version: 2026-03-10' \
78+
"repos/NVIDIA/cuda-python/compare/$public_sha...main")
79+
jq -e '.status == "ahead" or .status == "identical"' <<< "$comparison" >/dev/null
80+
81+
correlation_id="v1:NVIDIA/cuda-python:$PUBLIC_RUN_ID:$public_sha"
82+
echo "correlation_id=$correlation_id" >> "$GITHUB_OUTPUT"
83+
echo "public_run_id=$PUBLIC_RUN_ID" >> "$GITHUB_OUTPUT"
84+
echo "public_sha=$public_sha" >> "$GITHUB_OUTPUT"
85+
{
86+
echo "Resolved successful public run \`$PUBLIC_RUN_ID\` at commit \`$public_sha\`."
87+
} >> "$GITHUB_STEP_SUMMARY"
88+
89+
dispatch-private-validation:
90+
needs: resolve-public-build
91+
runs-on: ubuntu-latest
92+
timeout-minutes: 10
93+
permissions: {}
94+
steps:
95+
- name: Create private dispatch token
96+
id: private-app-token
97+
uses: actions/create-github-app-token@bcd2ba49218906704ab6c1aa796996da409d3eb1 # v3
98+
with:
99+
client-id: ${{ vars.CUDA_PYTHON_WOA_XREPO_CI_PRIVATE_APP_CLIENT_ID }}
100+
private-key: ${{ secrets.CUDA_PYTHON_WOA_XREPO_CI_PRIVATE_APP_PRIVATE_KEY }}
101+
owner: NVIDIA-dev
102+
repositories: cuda-python-private
103+
permission-actions: write
104+
105+
- name: Dispatch and verify exact private validation
106+
env:
107+
CORRELATION_ID: ${{ needs.resolve-public-build.outputs.correlation-id }}
108+
GH_TOKEN: ${{ steps.private-app-token.outputs.token }}
109+
PUBLIC_RUN_ID: ${{ needs.resolve-public-build.outputs.public-run-id }}
110+
PUBLIC_SHA: ${{ needs.resolve-public-build.outputs.public-sha }}
111+
run: |
112+
set -euo pipefail
113+
payload=$(jq -n \
114+
--arg correlation_id "$CORRELATION_ID" \
115+
--arg run_id "$PUBLIC_RUN_ID" \
116+
--arg sha "$PUBLIC_SHA" \
117+
'{
118+
ref: "ctk-next",
119+
return_run_details: true,
120+
inputs: {
121+
schema_version: "1",
122+
public_repository: "NVIDIA/cuda-python",
123+
public_workflow_id: "155304118",
124+
public_run_id: $run_id,
125+
public_sha: $sha,
126+
baseline_sha: "",
127+
commit_count: "1",
128+
correlation_id: $correlation_id
129+
}
130+
}')
131+
response=$(gh api \
132+
--method POST \
133+
-H 'X-GitHub-Api-Version: 2026-03-10' \
134+
repos/NVIDIA-dev/cuda-python-private/actions/workflows/ctk-next-woa-validation.yml/dispatches \
135+
--input - <<< "$payload")
136+
private_run_id=$(jq -er '.workflow_run_id | tostring' <<< "$response")
137+
run=$(gh api \
138+
-H 'X-GitHub-Api-Version: 2026-03-10' \
139+
"repos/NVIDIA-dev/cuda-python-private/actions/runs/$private_run_id")
140+
jq -e '
141+
.repository.full_name == "NVIDIA-dev/cuda-python-private" and
142+
.path == ".github/workflows/ctk-next-woa-validation.yml" and
143+
.event == "workflow_dispatch" and
144+
.head_branch == "ctk-next"
145+
' <<< "$run" >/dev/null
146+
echo "Private validation workflow accepted the exact dispatch." >> "$GITHUB_STEP_SUMMARY"

0 commit comments

Comments
 (0)