ci: Major refactor of release-workflows by ko3n1g · Pull Request #502 · NVIDIA-NeMo/Run

ko3n1g · 2026-05-05T08:55:06Z

Why

See the design discussion in NVIDIA-NeMo/FW-CI-templates#466.

What

Delete .github/workflows/build-test-publish-wheel.yml.
Rewrite .github/workflows/release.yml as the single caller for both push and workflow_dispatch.

Test plan

PR validate-only (pull_request, sha 12a0e14, 2026-05-07T11:27:50Z, success): https://github.com/NVIDIA-NeMo/Run/actions/runs/25493007157
workflow_dispatch dry-run=true (sha 12a0e14, 2026-05-07T11:29:02Z, success): https://github.com/NVIDIA-NeMo/Run/actions/runs/25493058831
Real release via workflow_dispatch dry-run=false on the next planned RC.

Rollout

Land FW-CI-templates#466.
Cut FW-CI-templates v1.0.0.
Bump the SHA pin in this PR → tag.

…nly mode See NVIDIA-NeMo/FW-CI-templates#466 for design discussion. - Delete build-test-publish-wheel.yml. - Rewrite release.{yml,yaml} as the single caller for both push and workflow_dispatch. validate-only derives from the trigger. - One pin to FW-CI-templates governs PR rehearsal and real release. Signed-off-by: oliver könig <okoenig@nvidia.com>

…etuptools Signed-off-by: oliver könig <okoenig@nvidia.com>

Signed-off-by: oliver könig <okoenig@nvidia.com>

…st/<n> instead Signed-off-by: oliver könig <okoenig@nvidia.com>

…public env) Signed-off-by: oliver könig <okoenig@nvidia.com>

…ered rehearsal Signed-off-by: oliver könig <okoenig@nvidia.com>

Signed-off-by: oliver könig <okoenig@nvidia.com>

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com> Signed-off-by: oliver könig <okoenig@nvidia.com>

…quirements-file) Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com> Signed-off-by: oliver könig <okoenig@nvidia.com>

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com> Signed-off-by: oliver könig <okoenig@nvidia.com>

…ansformer Why: HYBRID mode renders raw commits when no PR matches by merge_commit_sha (helps release branches built via cherry-pick). The transformer cleans up cp titles to show the inner PR title only. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com> Signed-off-by: oliver könig <okoenig@nvidia.com>

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com> Signed-off-by: oliver könig <okoenig@nvidia.com>

ko3n1g · 2026-05-07T08:26:43Z

/ok to test 364c72c

…ry-run) Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com> Signed-off-by: oliver könig <okoenig@nvidia.com>

ko3n1g · 2026-05-07T08:28:21Z

/ok to test c6664a9

…sthrough Why: SLACK_WEBHOOK now resolves at the env scope (public/main) so the env-scoped secret value is used. No longer pass it as a workflow_call secret. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com> Signed-off-by: oliver könig <okoenig@nvidia.com>

Lets env-scoped SLACK_WEBHOOK reach the notify job in the called workflow. Signed-off-by: oliver könig <okoenig@nvidia.com>

Signed-off-by: oliver könig <okoenig@nvidia.com>

ko3n1g · 2026-05-07T11:29:03Z

/ok to test 12a0e14

Signed-off-by: oliver könig <okoenig@nvidia.com>

ko3n1g had a problem deploying to main May 5, 2026 08:55 — with GitHub Actions Failure

ko3n1g mentioned this pull request May 5, 2026

feat: Major refactoring of the release-workflows NVIDIA-NeMo/FW-CI-templates#466

Merged

8 tasks

ko3n1g had a problem deploying to main May 5, 2026 08:58 — with GitHub Actions Failure

ko3n1g had a problem deploying to main May 5, 2026 09:01 — with GitHub Actions Failure

ko3n1g added 2 commits May 5, 2026 09:04

[ci] fix: bump FW-CI pin to slack-notify gate; correct packaging to s…

dc559d2

…etuptools Signed-off-by: oliver könig <okoenig@nvidia.com>

[ci] chore: bump FW-CI pin to step-level webhook gate

422ef0e

Signed-off-by: oliver könig <okoenig@nvidia.com>

ko3n1g had a problem deploying to main May 5, 2026 09:07 — with GitHub Actions Failure

ko3n1g temporarily deployed to main May 5, 2026 09:08 — with GitHub Actions Inactive

ko3n1g temporarily deployed to public May 5, 2026 09:12 — with GitHub Actions Inactive

[ci] chore: bump FW-CI pin to manifest-skip + app-id optional

388ab3c

Signed-off-by: oliver könig <okoenig@nvidia.com>

ko3n1g had a problem deploying to main May 5, 2026 09:15 — with GitHub Actions Failure

ko3n1g temporarily deployed to main May 5, 2026 09:15 — with GitHub Actions Inactive

ko3n1g temporarily deployed to public May 5, 2026 09:19 — with GitHub Actions Inactive

ko3n1g temporarily deployed to public May 5, 2026 09:20 — with GitHub Actions Inactive

[ci] chore: bump FW-CI pin to PAT-forwarding fix

3e5f435

Signed-off-by: oliver könig <okoenig@nvidia.com>

ko3n1g had a problem deploying to main May 5, 2026 09:21 — with GitHub Actions Failure

[ci] chore: bump FW-CI pin to skip-wheel-build + advisory check-manifest

32e308e

Signed-off-by: oliver könig <okoenig@nvidia.com>

ko3n1g had a problem deploying to main May 5, 2026 09:42 — with GitHub Actions Failure

[ci] chore: bump FW-CI pin to strict check-manifest

79dcccc

Signed-off-by: oliver könig <okoenig@nvidia.com>

ko3n1g had a problem deploying to main May 5, 2026 09:49 — with GitHub Actions Failure

ko3n1g added 7 commits May 5, 2026 10:45

[ci] fix: drop pull_request trigger; copy-pr-bot pushes to pull-reque…

86fa947

…st/<n> instead Signed-off-by: oliver könig <okoenig@nvidia.com>

[ci] chore: bump FW-CI pin to env-conditional bump (validate-only -> …

afaf1a3

…public env) Signed-off-by: oliver könig <okoenig@nvidia.com>

[ci] chore: bump FW-CI pin + default publish-docs=true for push-trigg…

0935c7f

…ered rehearsal Signed-off-by: oliver könig <okoenig@nvidia.com>

[ci] chore: default publish-docs=true to rehearse build-docs on PR push

4f1f754

Signed-off-by: oliver könig <okoenig@nvidia.com>

[ci] chore: bump FW-CI pin (drop hatch support)

132c8a7

Signed-off-by: oliver könig <okoenig@nvidia.com>

[ci] chore: bump FW-CI pin (drop PAT support)

c0e6e52

Signed-off-by: oliver könig <okoenig@nvidia.com>

[ci] chore: drop PAT secret (now unused after FW-CI App-only refactor)

5eee7e4

Signed-off-by: oliver könig <okoenig@nvidia.com>

ko3n1g temporarily deployed to main May 5, 2026 14:16 — with GitHub Actions Inactive

ko3n1g temporarily deployed to public May 6, 2026 16:24 — with GitHub Actions Inactive

refactor(release): bump FW-CI pin to 6afcae2 (build-docs root-dir)

2f550e1

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com> Signed-off-by: oliver könig <okoenig@nvidia.com>

ko3n1g temporarily deployed to public May 6, 2026 16:43 — with GitHub Actions Inactive

ko3n1g had a problem deploying to main May 6, 2026 16:43 — with GitHub Actions Failure

ko3n1g temporarily deployed to public May 6, 2026 16:45 — with GitHub Actions Inactive

ko3n1g temporarily deployed to main May 6, 2026 16:46 — with GitHub Actions Inactive

ko3n1g temporarily deployed to public May 6, 2026 16:46 — with GitHub Actions Inactive

refactor(release): bump FW-CI pin to 2a43619 (docs-root-dir / docs-re…

b254023

…quirements-file) Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com> Signed-off-by: oliver könig <okoenig@nvidia.com>

ko3n1g temporarily deployed to public May 6, 2026 16:49 — with GitHub Actions Inactive

ko3n1g temporarily deployed to public May 6, 2026 16:51 — with GitHub Actions Inactive

ko3n1g temporarily deployed to public May 6, 2026 16:52 — with GitHub Actions Inactive

ko3n1g temporarily deployed to public May 6, 2026 16:53 — with GitHub Actions Inactive

ko3n1g and others added 3 commits May 6, 2026 19:06

refactor(release): bump FW-CI pin to 2f00056 (Slack only on dispatch)

26dd79e

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com> Signed-off-by: oliver könig <okoenig@nvidia.com>

refactor(release): bump FW-CI pin to b57ebf9 ([skip ci] on bump commit)

364c72c

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com> Signed-off-by: oliver könig <okoenig@nvidia.com>

refactor(release): bump FW-CI pin to cb5e93b (notify env public for d…

c6664a9

…ry-run) Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com> Signed-off-by: oliver könig <okoenig@nvidia.com>

ko3n1g and others added 4 commits May 7, 2026 08:44

ci: bump FW-CI pin to d2f3dd3 + use secrets inherit

c8ba0e0

Lets env-scoped SLACK_WEBHOOK reach the notify job in the called workflow. Signed-off-by: oliver könig <okoenig@nvidia.com>

ci: strip orphan secret keys after secrets inherit

e6ba589

Signed-off-by: oliver könig <okoenig@nvidia.com>

ci: bump FW-CI pin to 64293f6 (slack render fix)

12a0e14

Signed-off-by: oliver könig <okoenig@nvidia.com>

ko3n1g added 2 commits May 7, 2026 20:14

ci: pin FW-CI templates to v1.0.0

ef21527

Signed-off-by: oliver könig <okoenig@nvidia.com>

ci: pragma allowlist secret on 'secrets: inherit' lines

af179e7

Signed-off-by: oliver könig <okoenig@nvidia.com>

chtruong814 previously approved these changes May 7, 2026

View reviewed changes

ci: simplify release-summary if-block (always() was dead code)

00e3875

Signed-off-by: oliver könig <okoenig@nvidia.com>

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

ci: Major refactor of release-workflows#502

ci: Major refactor of release-workflows#502
ko3n1g wants to merge 36 commits intomainfrom
ko3n1g/refactor/validate-only-release

ko3n1g commented May 5, 2026 •

edited

Loading

Uh oh!

ko3n1g commented May 7, 2026

Uh oh!

ko3n1g commented May 7, 2026

Uh oh!

ko3n1g commented May 7, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

Conversation

ko3n1g commented May 5, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Why

What

Test plan

Rollout

Uh oh!

ko3n1g commented May 7, 2026

Uh oh!

ko3n1g commented May 7, 2026

Uh oh!

ko3n1g commented May 7, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

ko3n1g commented May 5, 2026 •

edited

Loading