[RELEASE] NeMo-Agent-Toolkit v1.7.0

.coderabbit.yaml

@@ -115,6 +115,15 @@ reviews:
         3. Using remote MCP tools or A2A agents should be placed in `build-workflows/`
         4. Serving workflows via MCP/A2A should be placed in `run-workflows/`
 
+    - path: "skills/**/*"
+      instructions: >-
+        This directory contains portable AI coding agent skills and reference material, not published documentation or
+        runtime package code. Treat `SKILL.md` frontmatter with `author: NVIDIA Corporation and Affiliates` and
+        `license: Apache-2.0` as the license signal; do not request full Apache license headers in skill files.
+        Allow concise, agent-facing wording and illustrative placeholder paths in references. Only flag path-like text
+        when it is misleading for an agent or when a cross-skill reference is actually broken. Enforce the official
+        product name `NeMo Agent Toolkit` in prose.
+
     - path: "examples/**/*"
       instructions: >-
         - This directory contains example code and usage scenarios for the toolkit, at a minimum an example should

.github/workflows/ci_pipe.yml

@@ -53,11 +53,9 @@ defaults:
     shell: bash
 
 env:
-  GH_TOKEN: "${{ github.token }}"
   GIT_COMMIT: "${{ github.sha }}"
   BASE_SHA: "${{ inputs.base_sha }}"
   BUILD_NAT_COMPAT: "true"
-  RAPIDS_CONDA_RETRY_MAX: "5"
   WORKSPACE: "${{ github.workspace }}/nat"
   WORKSPACE_TMP: "${{ github.workspace }}/tmp"
   UV_CACHE_DIR: .uv-cache
@@ -89,7 +87,7 @@ jobs:
 
     steps:
       - name: Checkout
-        uses: actions/checkout@v6
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
         with:
           fetch-depth: 0
           path: 'nat'
@@ -125,7 +123,7 @@ jobs:
 
     steps:
       - name: Checkout
-        uses: actions/checkout@v6
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
         with:
           fetch-depth: 0
           fetch-tags: true
@@ -137,15 +135,15 @@ jobs:
         run: ./nat/ci/scripts/github/tests.sh
 
       - name: Upload Test Results
-        uses: actions/upload-artifact@v6
+        uses: actions/upload-artifact@b7c566a772e6b6bfb58ed0dc250532a479d7789f # v6
         # Upload test results even if the tests fail
         if: ${{ always() }}
         with:
           name: "test-results-${{ matrix.arch }}-py${{ matrix.python-version }}"
           path: "${{ github.workspace }}/tmp/reports/*.xml"
           if-no-files-found: error
       - name: Upload coverage to Codecov
-        uses: codecov/codecov-action@v5
+        uses: codecov/codecov-action@75cd11691c0faa626561e295848008c8a7dddffe # v5
         # Upload test results even if the tests fail
         if: ${{ always() }}
         with:
@@ -169,7 +167,7 @@ jobs:
 
     steps:
       - name: Checkout
-        uses: actions/checkout@v6
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
         with:
           fetch-tags: true
           path: 'nat'
@@ -179,7 +177,7 @@ jobs:
         run: ./nat/ci/scripts/github/docs.sh
 
       - name: Upload Documentation
-        uses: actions/upload-artifact@v6
+        uses: actions/upload-artifact@b7c566a772e6b6bfb58ed0dc250532a479d7789f # v6
         with:
           name: "docs"
           path: "${{ github.workspace }}/tmp/docs.tar.bz2"
@@ -199,7 +197,7 @@ jobs:
 
     steps:
       - name: Checkout
-        uses: actions/checkout@v6
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
         with:
           fetch-depth: 0
           fetch-tags: true
@@ -210,7 +208,7 @@ jobs:
         run: ./nat/ci/scripts/github/build_wheel.sh
 
       - name: Upload Package Reports
-        uses: actions/upload-artifact@v6
+        uses: actions/upload-artifact@b7c566a772e6b6bfb58ed0dc250532a479d7789f # v6
         if: ${{ always() }}
         with:
           name: "package_listings"
@@ -219,7 +217,7 @@ jobs:
           compression-level: 0
 
       - name: Upload Wheels
-        uses: actions/upload-artifact@v6
+        uses: actions/upload-artifact@b7c566a772e6b6bfb58ed0dc250532a479d7789f # v6
         with:
           name: "wheels"
           path: "${{ github.workspace }}/tmp/wheels/*.whl"

.github/workflows/pr.yaml

@@ -50,7 +50,7 @@ jobs:
       - prepare
       - ci_pipe
     secrets: inherit
-    uses: rapidsai/shared-workflows/.github/workflows/pr-builder.yaml@branch-25.04
+    uses: rapidsai/shared-workflows/.github/workflows/pr-builder.yaml@5fe52098676ca51435a73337131685e340658c51 # branch-25.04
 
   prepare:
     # Executes the get-pr-info action to determine if the PR has the skip-ci label, if the action fails we assume the
@@ -60,7 +60,7 @@ jobs:
     steps:
       - name: Get PR Info
         id: get-pr-info
-        uses: nv-gha-runners/get-pr-info@main
+        uses: nv-gha-runners/get-pr-info@090577647b8ddc4e06e809e264f7881650ecdccf # main
         if: ${{ startsWith(github.ref_name, 'pull-request/') }}
     outputs:
       is_pr: ${{ startsWith(github.ref_name, 'pull-request/') }}

.gitignore

@@ -1,4 +1,5 @@
 ###### Place new entries directly below this line! ######
+/.codex
 
 # auto-generated chainlit stuff
 chainlit.md

.gitlab-ci.yml

@@ -130,7 +130,7 @@ test:python_tests:
       alias: mysql
       pull_policy: if-not-present
 
-    - name: arizephoenix/phoenix:latest
+    - name: arizephoenix/phoenix:13.22
       alias: phoenix
       pull_policy: if-not-present
 
@@ -325,6 +325,8 @@ package:wheel:
     - if: $CI_COMMIT_BRANCH =~ /^release\/.*$/
 
 upload:artifactory:
+  # Container defined in ci/scripts/gitlab/artifactory/Dockerfile
+  image: $CI_REGISTRY_IMAGE/artifactory:20260413
   stage: upload
   script:
     - echo "Uploading wheel to artifactory"

AGENTS.md

@@ -0,0 +1,83 @@
+<!--
+SPDX-FileCopyrightText: Copyright (c) 2026, NVIDIA CORPORATION & AFFILIATES. All rights reserved.
+SPDX-License-Identifier: Apache-2.0
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+-->
+
+# AGENTS.md - NVIDIA NeMo Agent Toolkit AI Agent Entry Point
+
+AI agent skills for the NVIDIA NeMo Agent Toolkit live in **`skills/`** at the repository root and use a **flat layout**. Read this file first, then choose skills from the task routing index below.
+
+## Mandatory Repository Rules
+
+- Preserve user changes. Check `git status` before editing and do not revert unrelated work.
+- Prefer existing project patterns, examples, and documentation over new abstractions.
+- Do not add dependencies, update lock files, or run package installation commands unless the task requires it.
+- Use the full product name "NVIDIA NeMo Agent Toolkit" on first use in public documentation, then "NeMo Agent Toolkit" or "the toolkit". Use `nat` only for the CLI, Python namespace, package metadata, and other technical identifiers.
+- Keep examples runnable from the repository root unless the surrounding file uses a different convention.
+- For ambiguous tasks, clarify the intended outcome or cover each plausible interpretation and report what you did.
+
+## Skills Directory (Flat)
+
+- `skills/nat-user-rules/` - General behavior, naming conventions, discovery rules, and task routing.
+- `skills/nat-installation/` - Installation, optional extras, CLI verification, and first workflow setup.
+- `skills/nat-workflow-creation/` - Workflow YAML authoring, component discovery, LLM configuration, and common CLI commands.
+- `skills/nat-agent-configuration/` - Agent selection, built-in agent configuration, control flow, and sub-agent composition.
+- `skills/nat-tools-and-functions/` - Custom functions, tools, function groups, and Python extension patterns.
+- `skills/nat-evaluation/` - Evaluation methodology, datasets, evaluator selection, ATIF surfaces, and `nat eval`.
+- `skills/nat-optimization/` - `nat optimize`, optimizer configuration, parameter selection, and output interpretation.
+- `skills/nat-telemetry/` - Logging, tracing, profiling, OpenTelemetry, and telemetry exporters.
+- `skills/nat-mcp-and-serving/` - MCP clients and servers, FastAPI, and workflow serving.
+- `skills/nat-path-checks/` - Documentation path-check failures, Markdown escaping, and slash-delimited token fixes.
+- `skills/skill-evolution/` - Creating, refining, and maintaining AI coding agent skills.
+
+## Task Routing
+
+Use the routing table before opening detailed references inside the skill.
+
+| Task | Skill and Reference |
+| --- | --- |
+| Installing or configuring NeMo Agent Toolkit | `skills/nat-installation/SKILL.md` |
+| Discovering registered component `_type` values | `skills/nat-workflow-creation/SKILL.md` |
+| Writing or editing workflow YAML | `skills/nat-workflow-creation/SKILL.md` |
+| Configuring LLMs | `skills/nat-workflow-creation/SKILL.md` |
+| Choosing or configuring agents | `skills/nat-agent-configuration/SKILL.md` |
+| Writing custom tools or functions | `skills/nat-tools-and-functions/SKILL.md` |
+| Wiring MCP client or server workflows | `skills/nat-mcp-and-serving/SKILL.md` |
+| Serving with FastAPI | `skills/nat-mcp-and-serving/SKILL.md` |
+| Composing sub-agents | `skills/nat-agent-configuration/SKILL.md` |
+| Adding tracing or telemetry | `skills/nat-telemetry/SKILL.md` |
+| Designing an evaluation suite | `skills/nat-evaluation/SKILL.md` |
+| Choosing an evaluator | `skills/nat-evaluation/SKILL.md` |
+| Running `nat optimize` | `skills/nat-optimization/SKILL.md` |
+| Fixing documentation path-check failures | `skills/nat-path-checks/SKILL.md` |
+| Creating or improving skills | `skills/skill-evolution/SKILL.md` |
+
+## Skill Evolution
+
+Before creating, editing, or deciding whether to update any file under `skills/`, read `skills/skill-evolution/SKILL.md` first. For skill routing and skill maintenance tasks, treat skill-evolution as an explicit pre-edit gate (i.e., don't jump directly to editing a named target skill without consulting skill-evolution). Then read the target skill and make the smallest warranted change.
+
+When a user corrects your approach, a command fails and you recover, or you discover a generalizable gotcha, finish the task first and then read `skills/skill-evolution/SKILL.md` to decide whether the skills should be updated.
+
+## Quick Commands
+
+Run commands from the repository root unless a skill or package README says otherwise.
+
+```bash
+uv run nat --help
+uv run pytest packages/nvidia_nat_core
+NAT_DISABLE_API_BUILD=1 make -C docs html
+```
+
+For local documentation details, read `docs/README.md`. For contribution details, read `docs/source/resources/contributing/index.md`.