shared-build-image.yml

# SPDX-FileCopyrightText: Copyright (c) 2024-2026 NVIDIA CORPORATION & AFFILIATES. All rights reserved.
# SPDX-License-Identifier: Apache-2.0

name: Shared Build Image

on:
  workflow_call:
    inputs:
      framework:
        description: 'Framework name (vllm, sglang, trtllm)'
        required: true
        type: string
      target:
        description: 'Target stage for Docker rendering'
        required: false
        type: string
        default: 'runtime'
      cuda_version:
        description: 'CUDA versions to build as a JSON array'
        required: true
        type: string
      platform:
        description: 'Target platforms to build as a JSON array'
        required: true
        type: string
      builder_name:
        description: 'Buildkit builder name'
        required: true
        type: string
      build_timeout_minutes:
        description: 'Timeout in minutes for the build step'
        required: false
        type: number
        default: 60
      extra_tags:
        description: 'Additional tags (newline-separated, -$platform suffix auto-appended)'
        required: false
        type: string
        default: ''
      test_extra_tags:
        description: 'Additional tags for the -test image only (newline-separated plain tag names, no ECR prefix). Unlike extra_tags (runtime image), the -test image otherwise gets no floating tag.'
        required: false
        type: string
        default: ''
      no_cache:
        description: 'Disable Docker build cache'
        required: false
        type: boolean
        default: false
      fresh_builder:
        description: 'Always create a fresh K8s BuildKit builder (skip remote worker routing)'
        required: false
        type: boolean
        default: false
      push_image:
        description: 'Push image to registry'
        required: false
        type: boolean
        default: true
      no_load:
        description: 'Do not load the image into docker'
        required: false
        type: boolean
        default: true
      show_summary:
        description: 'Show summary'
        required: false
        type: boolean
        default: false
      make_efa:
        description: 'Enable AWS EFA support in the build'
        required: false
        type: boolean
        default: false
      sanitized_ref_name:
        description: 'Sanitized git ref name for branch-tagged images'
        required: false
        type: string
        default: ''
      build_only:
        description: 'Build and push only — skip tests and prepare branch tags'
        required: false
        type: boolean
        default: false
      extra_build_args:
        description: 'Extra build args to pass to docker build (newline-separated)'
        required: false
        type: string
        default: ''
      dev_version_suffix:
        description: 'PEP 440 dev suffix (e.g. .dev20260423+g1234567). Empty = stable build.'
        required: false
        type: string
        default: ''
      archive_sources:
        description: |
          Build with ENABLE_SOURCE_ARCHIVAL=true and extract /sources.zip
          as a workflow artifact. Off by default — top-level callers
          opt-in (post-merge-ci.yml sets true for push to release/*.*.*
          branches; nightly-ci.yml sets it true unconditionally; PR /
          on-demand callers leave it false). Source archives are
          GB-scale; gathering them per-build would balloon ECR/artifact
          storage.
        required: false
        type: boolean
        default: false
      source_ref:
        description: 'Git ref/SHA to checkout and tag images with. Empty = caller SHA (github.sha).'
        required: false
        type: string
        default: ''
      image_tag_suffix:
        description: 'Suffix appended to the SHA-keyed image tag (e.g. "-nightly"). Empty = no suffix.'
        required: false
        type: string
        default: ''
      compliance_only:
        description: |
          Run ONLY the compliance extract + verify (and artifact upload),
          skipping the image build/push, as a sibling job in parallel with
          tests instead of serially in the build job.

          NOTE: no caller sets this today — the compliance extract is folded
          into the build job via `inline_compliance` (same job → same warm
          builder → cache hit, vs. this sibling-job model which lands on a
          random pool pod and cold-rebuilds the whole image; see
          route_buildkit.sh:342). It is intentionally RETAINED so we can revert
          to the parallel-job model IF the warm-rebuild problem is solved at the
          routing layer (e.g. a deterministic run_id-seeded pod pick that pins
          the compliance job to the build job's warm pod). The `!compliance_only`
          guards on the build/test-image steps stay correct at the false default.
        required: false
        type: boolean
        default: false
      inline_compliance:
        description: |
          Run the compliance extract + verify as a step INSIDE this build job
          (after "Build and Push Image"), reusing the same warm builder. Set
          true by callers on the shipped-image build jobs (runtime / efa /
          planner / frontend); replaces the separate compliance_only sibling
          job. Skipped for dev / local-dev targets.
        required: false
        type: boolean
        default: false
      artifact_retention_days:
        description: |
          Retention (days) for the uploaded /legal NOTICES + /sboms CSV
          compliance artifacts. PR passes 7; post-merge / nightly default to 30.
        required: false
        type: string
        default: '30'
      diff_event_context:
        description: |
          Where this build runs, for OSRB CSV diff-baseline selection: 'pr' for a
          PR build (pass diff_base_branch and diff_merge_base_sha), 'push' for a
          post-merge build. Empty disables diffing.
        required: false
        type: string
        default: ''
      diff_current_branch:
        description: 'github.ref_name of this build (pull-request/N, main, release/X.Y.Z). Used for diff-baseline selection.'
        required: false
        type: string
        default: ''
      diff_base_branch:
        description: 'For PR builds, the PR''s target branch (e.g. main or release/1.3.0). Empty for pushes.'
        required: false
        type: string
        default: ''
      diff_merge_base_sha:
        description: 'For PR builds targeting main, the true merge-base SHA. Pins the diff baseline to the PR fork point.'
        required: false
        type: string
        default: ''
    secrets:
      AWS_DEFAULT_REGION:
        required: true
      AWS_ACCOUNT_ID:
        required: true
      AZURE_ACR_HOSTNAME:
        required: true
      AZURE_ACR_USER:
        required: true
      AZURE_ACR_PASSWORD:
        required: true
      SCCACHE_S3_BUCKET:
        required: false
      AWS_ACCESS_KEY_ID:
        required: false
      AWS_SECRET_ACCESS_KEY:
        required: false
      HF_TOKEN:
        required: false
    outputs:
      target_tag_plain:
        description: 'Plain runtime image tag prefix'
        value: ${{ jobs.build.outputs.target_tag_plain }}
      baseline_sbom_file:
        description: 'Baseline SBOM stem baked into the rendered Dockerfile (for the compliance-audit job)'
        value: ${{ jobs.build.outputs.baseline_sbom_file }}

jobs:
  build:
    strategy:
      fail-fast: false
      matrix:
        cuda_version: ${{ fromJson(inputs.cuda_version) }}
    runs-on: prod-builder-v3
    # cuda_version not empty -- name: cuda12, linux/amd64
    # cuda_version empty -- name: cpu, linux/amd64
    name: Build multi-arch ${{ matrix.cuda_version == '' && 'cpu' || format('cuda{0}', matrix.cuda_version) }}
    timeout-minutes: ${{ inputs.build_timeout_minutes }}
    # contents: read for checkout; actions: read lets the compliance-extract
    # action download a PRIOR run's baseline compliance artifact (cross-run) to
    # diff this build's OSRB CSV against. Callers must also grant actions: read
    # (a reusable workflow's token can't exceed the caller's) — pr.yaml and
    # post-merge-ci.yml do. When it's not granted the diff soft-degrades.
    permissions:
      contents: read
      actions: read
    outputs:
      target_tag_plain: ${{ steps.calculate-target-tag.outputs.target_tag_plain }}
      test_tag_plain: ${{ steps.calculate-target-tag.outputs.test_tag_plain }}
      baseline_sbom_file: ${{ steps.gen-dockerfile.outputs.baseline_stem }}
    steps:
      - name: Checkout repository
        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd  # v6.0.2
        with:
          ref: ${{ inputs.source_ref != '' && inputs.source_ref || github.sha }}
          lfs: true
      - name: Docker Login
        uses: $/.github/actions/docker-login
        with:
          aws_default_region: ${{ vars.AWS_DEFAULT_REGION }}
          ecr_registry: ${{ vars.ECR_REGISTRY }}
          azure_acr_hostname: ${{ secrets.AZURE_ACR_HOSTNAME }}
          azure_acr_user: ${{ secrets.AZURE_ACR_USER }}
          azure_acr_password: ${{ secrets.AZURE_ACR_PASSWORD }}
      - name: Calculate target tag
        id: calculate-target-tag
        shell: bash
        env:
          ECR_REGISTRY: ${{ vars.ECR_REGISTRY }}
          ECR_REPOSITORY: ${{ vars.ECR_REPOSITORY }}
        run: |
          TAG_BUILDER=${{ inputs.framework }}-${{ inputs.target }}
          if [ "${{ inputs.make_efa }}" == "true" ]; then
            TAG_BUILDER+="-efa"
          fi
          TARGET_TAG_PLAIN=${TAG_BUILDER}
          if [ "${{ matrix.cuda_version }}" != "" ]; then
            CUDA_VERSION="${{ matrix.cuda_version }}"
            CUDA_MAJOR=${CUDA_VERSION%%.*}
            # cuda13 is the default — no suffix in the ECR tag. cuda12 (and
            # any future non-13 major) stays explicit so the tag still
            # disambiguates the variant. Keep the cuda-suffix expressions in
            # shared-test.yml and dynamo-pipeline.yml in sync with this rule.
            if [ "${CUDA_MAJOR}" != "13" ]; then
              TAG_BUILDER+="-cuda${CUDA_MAJOR}"
            fi
          fi
          SOURCE_SHA=${{ inputs.source_ref != '' && inputs.source_ref || github.sha }}
          IMAGE_TAG_SUFFIX='${{ inputs.image_tag_suffix }}'
          IMAGE_TAG=${SOURCE_SHA}-${TAG_BUILDER}${IMAGE_TAG_SUFFIX}
          TEST_IMAGE_TAG=${SOURCE_SHA}-${TAG_BUILDER}${IMAGE_TAG_SUFFIX}-test

          IMAGE_URI="${ECR_REGISTRY}/${ECR_REPOSITORY}:${IMAGE_TAG}"
          TEST_IMAGE_URI="${ECR_REGISTRY}/${ECR_REPOSITORY}:${TEST_IMAGE_TAG}"

          # When a suffix is set (e.g. "-nightly"), also emit a mutable,
          # SHA-less floating ECR tag (e.g. vllm-runtime-cuda12-nightly) so
          # consumers can pull the latest nightly without knowing the SHA.
          # Repushed on every build via extra_tags below; the immutable
          # SHA-keyed tag above is still the source of truth for promotions.
          MUTABLE_IMAGE_URI=""
          if [ -n "${IMAGE_TAG_SUFFIX}" ]; then
            MUTABLE_IMAGE_URI="${ECR_REGISTRY}/${ECR_REPOSITORY}:${TAG_BUILDER}${IMAGE_TAG_SUFFIX}"
          fi

          # cuda13 is the implicit default, so the tags above carry no cuda
          # suffix. Also publish explicit `-cuda13` aliases so consumers can
          # pin to cuda13 specifically (and won't get silently upgraded when
          # the default flips later). Same digest, additional tags.
          EXPLICIT_CUDA_IMAGE_URI=""
          EXPLICIT_CUDA_MUTABLE_IMAGE_URI=""
          if [ "${CUDA_MAJOR:-}" = "13" ]; then
            EXPLICIT_CUDA_IMAGE_URI="${ECR_REGISTRY}/${ECR_REPOSITORY}:${SOURCE_SHA}-${TAG_BUILDER}-cuda13${IMAGE_TAG_SUFFIX}"
            if [ -n "${IMAGE_TAG_SUFFIX}" ]; then
              EXPLICIT_CUDA_MUTABLE_IMAGE_URI="${ECR_REGISTRY}/${ECR_REPOSITORY}:${TAG_BUILDER}-cuda13${IMAGE_TAG_SUFFIX}"
            fi
          fi

          echo "target_tag_plain=${TARGET_TAG_PLAIN}" >> $GITHUB_OUTPUT
          echo "image_uri=${IMAGE_URI}" >> $GITHUB_OUTPUT
          echo "test_image_uri=${TEST_IMAGE_URI}" >> $GITHUB_OUTPUT
          echo "mutable_image_uri=${MUTABLE_IMAGE_URI}" >> $GITHUB_OUTPUT
          echo "explicit_cuda_image_uri=${EXPLICIT_CUDA_IMAGE_URI}" >> $GITHUB_OUTPUT
          echo "explicit_cuda_mutable_image_uri=${EXPLICIT_CUDA_MUTABLE_IMAGE_URI}" >> $GITHUB_OUTPUT
      - name: Calculate Builder Flavor
        id: calculate-builder-flavor
        shell: bash
        run: |
          if [[ ${{ inputs.framework }} != @(vllm|sglang|trtllm) ]]; then
            echo "builder_flavor=general" >> $GITHUB_OUTPUT
          else
            echo "builder_flavor=${{ inputs.framework }}" >> $GITHUB_OUTPUT
          fi
      - name: Initialize Dynamo Builder
        uses: $/.github/actions/init-dynamo-builder
        with:
          builder_name: ${{ inputs.builder_name }}
          flavor: ${{ steps.calculate-builder-flavor.outputs.builder_flavor }}
          arch: ${{ inputs.platform }}
          cuda_version: ${{ matrix.cuda_version }}
          fresh_builder: ${{ inputs.fresh_builder }}
          namespace: ${{ vars.BUILDKIT_NAMESPACE }}
      - name: Calculate extra tags
        id: extra-tags
        shell: bash
        env:
          ECR_REGISTRY: ${{ vars.ECR_REGISTRY }}
          ECR_REPOSITORY: ${{ vars.ECR_REPOSITORY }}
          EXTRA_TAGS: ${{ inputs.extra_tags }}
          MUTABLE_IMAGE_URI: ${{ steps.calculate-target-tag.outputs.mutable_image_uri }}
          EXPLICIT_CUDA_IMAGE_URI: ${{ steps.calculate-target-tag.outputs.explicit_cuda_image_uri }}
          EXPLICIT_CUDA_MUTABLE_IMAGE_URI: ${{ steps.calculate-target-tag.outputs.explicit_cuda_mutable_image_uri }}
        run: |
          RESULT=""
          if [ -n "$EXTRA_TAGS" ]; then
            while IFS= read -r tag; do
              if [ -n "$tag" ]; then
                RESULT+="${ECR_REGISTRY}/${ECR_REPOSITORY}:${tag}"$'\n'
              fi
            done <<< "$EXTRA_TAGS"
          fi
          # Append the mutable floating tag computed in calculate-target-tag
          # (e.g. vllm-runtime-cuda12-nightly). Empty for non-nightly builds.
          if [ -n "${MUTABLE_IMAGE_URI}" ]; then
            RESULT+="${MUTABLE_IMAGE_URI}"$'\n'
          fi
          # Append explicit -cuda13 aliases for cuda13 builds. Empty for
          # cuda12 / cpu builds.
          if [ -n "${EXPLICIT_CUDA_IMAGE_URI}" ]; then
            RESULT+="${EXPLICIT_CUDA_IMAGE_URI}"$'\n'
          fi
          if [ -n "${EXPLICIT_CUDA_MUTABLE_IMAGE_URI}" ]; then
            RESULT+="${EXPLICIT_CUDA_MUTABLE_IMAGE_URI}"$'\n'
          fi
          if [ -n "$RESULT" ]; then
            echo "tags<<EOF" >> $GITHUB_OUTPUT
            echo "$RESULT" >> $GITHUB_OUTPUT
            echo "EOF" >> $GITHUB_OUTPUT
          else
            echo "tags=" >> $GITHUB_OUTPUT
          fi
      - name: Print Build Container inputs
        shell: bash
        run: |
          echo "=== Build Container Inputs ==="
          echo "image_uri: ${{ steps.calculate-target-tag.outputs.image_uri }}"
          echo "framework: ${{ inputs.framework }}"
          echo "target: ${{ inputs.target }}"
          echo "platform: ${{ inputs.platform }}"
          echo "no_cache: ${{ inputs.no_cache }}"
          echo "extra_tags: ${{ steps.extra-tags.outputs.tags }}"
          echo "push_image: ${{ inputs.push_image }}"
          echo "no_load: ${{ inputs.no_load }}"
          echo "build_timeout_minutes: ${{ inputs.build_timeout_minutes }}"
      - name: Build EPP Image (For Frontend Only)
        id: build-epp-image
        if: ${{ inputs.target == 'frontend' }}
        shell: bash
        env:
          ECR_HOSTNAME: ${{ vars.ECR_REGISTRY }}
          IMAGE_REPOSITORY: ${{ vars.ECR_REPOSITORY }}
          AWS_DEFAULT_REGION: ${{ vars.AWS_DEFAULT_REGION }}
          SCCACHE_S3_BUCKET: ${{ secrets.SCCACHE_S3_BUCKET }}
        timeout-minutes: 60
        run: |
          set -x
          EPP_REPOSITORY="${{ env.IMAGE_REPOSITORY }}/dynamo-epp"
          EPP_IMAGE_REPO="${{ env.ECR_HOSTNAME }}/${EPP_REPOSITORY}"
          EPP_IMAGE_TAG="${{ inputs.source_ref != '' && inputs.source_ref || github.sha }}"
          EPP_IMAGE_REF="${EPP_REPOSITORY}:${EPP_IMAGE_TAG}"
          echo "epp_image_uri=${{ env.ECR_HOSTNAME }}/${EPP_IMAGE_REF}" >> $GITHUB_OUTPUT

          CACHE_ARGS=""
          if [[ "${{ inputs.no_cache }}" == "true" ]]; then
            CACHE_ARGS+="--no-cache "
          else
            # Content-addressed cache tag: key the registry :cache on a hash of
            # the Rust EPP Dockerfile so Dockerfile changes land in a fresh
            # cache namespace.
            EPP_CACHE_KEY="$(sha256sum deploy/inference-gateway/ext-proc/Dockerfile | cut -c1-12)"
            EPP_CACHE_REF="${ECR_HOSTNAME}/${EPP_REPOSITORY}:cache-${EPP_CACHE_KEY}"
            CACHE_ARGS+="--cache-from type=registry,ref=${EPP_CACHE_REF} "
            if [[ "$GITHUB_REF_NAME" == "main" ]]; then
              CACHE_ARGS+="--cache-to type=registry,ref=${EPP_CACHE_REF},mode=max "
            fi
          fi

          # Enable sccache to match the runtime image build path
          # (.github/actions/docker-remote-build). The runner pod injects
          # AWS_WEB_IDENTITY_TOKEN_FILE + AWS_ROLE_ARN via IRSA; the Makefile
          # forwards them to BuildKit as --secret mounts when both are set.
          # If IRSA is unavailable, sccache will fail to start inside the
          # container and the build proceeds without cache (never with a
          # stale one) -- same fallback as the wheel_builder Rust steps.
          SCCACHE_MAKE_ARGS=""
          if [ -n "${SCCACHE_S3_BUCKET:-}" ] \
              && [ -n "${AWS_WEB_IDENTITY_TOKEN_FILE:-}" ] \
              && [ -f "${AWS_WEB_IDENTITY_TOKEN_FILE}" ] \
              && [ -n "${AWS_ROLE_ARN:-}" ]; then
            SCCACHE_MAKE_ARGS="USE_SCCACHE=true SCCACHE_BUCKET=${SCCACHE_S3_BUCKET} SCCACHE_REGION=${AWS_DEFAULT_REGION}"
          else
            echo "::warning::sccache prerequisites missing (bucket or IRSA token); EPP Rust build will run without sccache"
          fi

          make -C deploy/inference-gateway/ext-proc image-multiarch-push \
            IMAGE_REPO="${EPP_IMAGE_REPO}" \
            GIT_TAG="${EPP_IMAGE_TAG}" \
            DOCKER_PROXY="${ECR_HOSTNAME}/dockerhub/" \
            ${SCCACHE_MAKE_ARGS} \
            EXTRA_BUILD_ARGS="${CACHE_ARGS}"
      - name: Refresh BuildKit builder (For Frontend Only)
        if: ${{ inputs.target == 'frontend' }}
        uses: $/.github/actions/builder-refresher
        with:
          builder_name: ${{ inputs.builder_name }}
          flavor: ${{ steps.calculate-builder-flavor.outputs.builder_flavor }}
          arch: ${{ inputs.platform }}
          namespace: ${{ vars.BUILDKIT_NAMESPACE }}
      - name: Generate Dockerfile
        id: gen-dockerfile
        shell: bash
        run: |
          echo "Generating Dockerfile for target: ${{ inputs.target }} and framework: ${{ inputs.framework }}"
          MAKE_EFA_FLAG=""
          if [ "${{ inputs.make_efa }}" == "true" ]; then
            MAKE_EFA_FLAG="--make-efa"
          fi
          # If CUDA version is empty, use empty arg to fallback to default (eg. for planner)
          if [ "${{ matrix.cuda_version }}" == "" ]; then
            CUDA_FLAG=""
          else
            CUDA_FLAG="--cuda-version=${{ matrix.cuda_version }}"
          fi

          python ./container/render.py \
              --target=${{ inputs.target }} \
              --framework=${{ inputs.framework }} \
              --platform=${{ inputs.platform }} \
              ${CUDA_FLAG} \
              ${MAKE_EFA_FLAG} \
              --show-result \
              --output-short-filename
          # Emit the baseline SBOM stem (arch-independent) for the
          # <framework>-compliance-audit job, so it doesn't need render.py (and
          # thus PyYAML/Jinja2/pip) on the lightweight audit runner. dev /
          # local-dev images render no BASELINE_SBOM_FILE ARG (they skip baseline
          # subtraction and never run the audit), so the grep finds nothing —
          # the trailing `|| true` keeps that from tripping the step's
          # `-e -o pipefail` shell (empty stem is correct for them).
          STEM=$(grep -E '^ARG BASELINE_SBOM_FILE=' container/rendered.Dockerfile | head -1 \
                 | sed -E 's/^ARG BASELINE_SBOM_FILE="?([^"]*)"?$/\1/' || true)
          echo "baseline_stem=${STEM}" >> "$GITHUB_OUTPUT"
      - name: Apply nightly dev version
        if: inputs.dev_version_suffix != ''
        shell: bash
        run: python3 .github/scripts/apply_dev_version.py "${{ inputs.dev_version_suffix }}" .
      - name: Build and Push Image
        id: build-image
        if: ${{ !inputs.compliance_only }}
        uses: $/.github/actions/docker-remote-build
        with:
          image_tag: ${{ steps.calculate-target-tag.outputs.image_uri }}
          framework: ${{ inputs.framework }}
          target: ${{ inputs.target }}
          build_target: ${{ (inputs.make_efa && (inputs.target == 'runtime' || inputs.target == 'dev')) && 'aws' || inputs.target }}
          platform: ${{ inputs.platform }}
          cuda_version: ${{ matrix.cuda_version }}
          aws_default_region: ${{ vars.AWS_DEFAULT_REGION }}
          sccache_s3_bucket: ${{ secrets.SCCACHE_S3_BUCKET }}
          no_cache: ${{ inputs.no_cache }}
          extra_tags: ${{ steps.extra-tags.outputs.tags }}
          push_image: ${{ inputs.push_image }}
          no_load: ${{ inputs.no_load }}
          extra_build_args: |
            DYNAMO_COMMIT_SHA=${{ inputs.source_ref != '' && inputs.source_ref || github.sha }}
            EPP_IMAGE=${{ steps.build-epp-image.outputs.epp_image_uri || '' }}
            ENABLE_SOURCE_ARCHIVAL=${{ inputs.archive_sources }}
            ${{ inputs.extra_build_args }}
      # Compliance extract + verify. Runs as a step INSIDE the build job
      # (inline_compliance), right after "Build and Push Image", so it reuses
      # the SAME warm builder — the licenses stage the runtime build already ran
      # is a cache hit, so this is just the small FROM-scratch /legal + /sboms
      # export (~1 min) instead of the cold full-image rebuild a separate pod
      # would do. Also runs in the legacy compliance_only sibling-job mode (no
      # caller sets that today; see the input note). Skipped for dev / local-dev
      # targets (those don't ship and don't go through OSRB).
      # Resolve which prior build's OSRB CSV to diff this one against. The rules
      # depend on where we run (PR merge-base vs post-merge main vs release branch);
      # see container/compliance/resolve_diff_base.py. Reads the current version
      # from pyproject.toml for the release-branch case, and deepens history by
      # one so HEAD~1 is reachable for the main post-merge case (checkout is
      # shallow). Best-effort: any failure leaves base_sha empty and the diff
      # step writes a baseline_unavailable marker (never fails the build).
      - name: Resolve diff baseline
        id: resolve-diff-base
        if: ${{ (inputs.compliance_only || inputs.inline_compliance) && inputs.target != 'dev' && inputs.target != 'local-dev' && inputs.diff_event_context != '' }}
        shell: bash
        # All workflow-context values are passed via env (never interpolated into
        # the script body) so attacker-controllable strings like branch names
        # can't inject shell — see zizmor "template-injection".
        env:
          # Used by the nightly context to query the Actions API for the previous
          # run (needs actions: read; the caller must grant it). Harmless otherwise.
          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
          DIFF_EVENT_CONTEXT: ${{ inputs.diff_event_context }}
          DIFF_CURRENT_BRANCH: ${{ inputs.diff_current_branch }}
          DIFF_BASE_BRANCH: ${{ inputs.diff_base_branch }}
          DIFF_MERGE_BASE_SHA: ${{ inputs.diff_merge_base_sha }}
          DIFF_CURRENT_SHA: ${{ inputs.source_ref != '' && inputs.source_ref || github.sha }}
          DIFF_REPO: ${{ github.repository }}
          DIFF_RUN_ID: ${{ github.run_id }}
          # Container artifact prefix: lets the main-baseline walk look up
          # compliance-<sha>-<prefix> availability per commit.
          DIFF_ARTIFACT_PREFIX: ${{ steps.calculate-target-tag.outputs.target_tag_plain }}
        run: |
          # The build checkout is shallow with no tags. Make the refs each
          # baseline rule needs reachable (all best-effort; a miss just yields an
          # empty base_sha and a baseline_unavailable diff). Depth 30 gives the
          # first-parent baseline walks enough history to find an artifact:
          git fetch --deepen=30 --quiet || true                                     # HEAD~N (main post-merge walk)
          git fetch --tags --quiet || true                                          # vX.Y.Z tags (release branch)
          if [ "${DIFF_BASE_BRANCH}" = "main" ] \
            && [ -n "${DIFF_MERGE_BASE_SHA}" ]; then
            git fetch --no-tags --depth=30 origin "${DIFF_MERGE_BASE_SHA}" --quiet || true # stable PR fork-point walk
          fi
          CURRENT_VERSION=$(grep -m1 -E '^version[[:space:]]*=' pyproject.toml | sed -E 's/.*"([^"]+)".*/\1/' || true)
          python3 container/compliance/resolve_diff_base.py \
            --event-context "${DIFF_EVENT_CONTEXT}" \
            --current-branch "${DIFF_CURRENT_BRANCH}" \
            --base-branch "${DIFF_BASE_BRANCH}" \
            --merge-base-sha "${DIFF_MERGE_BASE_SHA}" \
            --current-sha "${DIFF_CURRENT_SHA}" \
            --current-version "${CURRENT_VERSION}" \
            --artifact-prefix "${DIFF_ARTIFACT_PREFIX}" \
            --repo "${DIFF_REPO}" \
            --current-run-id "${DIFF_RUN_ID}" \
            >> "$GITHUB_OUTPUT"

      # builder's pinned to specific pods and the pool can scale down mid-job.
      # re-route first or the extract just dies on buildx's 20s connect timeout.
      - name: Refresh BuildKit builder
        if: ${{ (inputs.compliance_only || inputs.inline_compliance) && inputs.target != 'dev' && inputs.target != 'local-dev' }}
        uses: $/.github/actions/builder-refresher
        with:
          builder_name: ${{ inputs.builder_name }}
          flavor: ${{ steps.calculate-builder-flavor.outputs.builder_flavor }}
          arch: ${{ inputs.platform }}
          cuda_version: ${{ matrix.cuda_version }}
          namespace: ${{ vars.BUILDKIT_NAMESPACE }}
      - name: Compliance extract
        if: ${{ (inputs.compliance_only || inputs.inline_compliance) && inputs.target != 'dev' && inputs.target != 'local-dev' }}
        uses: $/.github/actions/compliance-extract
        with:
          # Diff baseline resolved above (empty when diffing is disabled or no
          # baseline applies); gh_token lets the action fetch it cross-run.
          diff_base_sha: ${{ steps.resolve-diff-base.outputs.base_sha }}
          diff_base_label: ${{ steps.resolve-diff-base.outputs.base_label }}
          diff_base_artifact_id: ${{ steps.resolve-diff-base.outputs.base_artifact_id }}
          diff_base_run_id: ${{ steps.resolve-diff-base.outputs.base_run_id }}
          gh_token: ${{ secrets.GITHUB_TOKEN }}
          framework: ${{ inputs.framework }}
          target: ${{ inputs.target }}
          platform: ${{ inputs.platform }}
          cuda_version: ${{ matrix.cuda_version }}
          builder_name: ${{ inputs.builder_name }}
          artifact_name_prefix: ${{ steps.calculate-target-tag.outputs.target_tag_plain }}
          git_sha: ${{ inputs.source_ref != '' && inputs.source_ref || github.sha }}
          # Freshly-built ECR EPP image (frontend only) — must match the build's
          # EPP_IMAGE so the epp stage cache-hits instead of resolving the
          # rendered default upstream staging tag, which gets garbage-collected.
          epp_image: ${{ steps.build-epp-image.outputs.epp_image_uri || '' }}
          # Match the build's sccache build-args so the extract reuses the warm
          # wheel_builder/pre_runtime cache instead of a cold rebuild.
          sccache_bucket: ${{ secrets.SCCACHE_S3_BUCKET }}
          sccache_region: ${{ vars.AWS_DEFAULT_REGION }}
          # Must match the build's render: EFA images attribute libfabric /
          # aws-ofi-nccl via --make-efa, and a mismatch would cold-miss the cache.
          make_efa: ${{ inputs.make_efa }}
          artifact_retention_days: ${{ inputs.artifact_retention_days }}
          # Source archival is opt-in per top-level caller (see the
          # `archive_sources` input above). PR / on-demand leave it false;
          # post-merge-ci + nightly flip it on (release/*.*.* / nightly) so
          # RC promotions inherit the source archive.
          archive_sources: ${{ inputs.archive_sources }}
      - name: Refresh BuildKit builder
        if: ${{ inputs.target != 'dev' && inputs.target != 'local-dev' && inputs.target != 'frontend' }}
        uses: $/.github/actions/builder-refresher
        with:
          builder_name: ${{ inputs.builder_name }}
          flavor: ${{ steps.calculate-builder-flavor.outputs.builder_flavor }}
          arch: ${{ inputs.platform }}
          cuda_version: ${{ matrix.cuda_version }}
          namespace: ${{ vars.BUILDKIT_NAMESPACE }}
      - name: Build and Push Test Image
        if: ${{ !inputs.compliance_only && inputs.target != 'dev' && inputs.target != 'local-dev' && inputs.target != 'frontend' }}
        shell: bash
        env:
          ECR_REGISTRY: ${{ vars.ECR_REGISTRY }}
          ECR_REPOSITORY: ${{ vars.ECR_REPOSITORY }}
          TEST_EXTRA_TAGS: ${{ inputs.test_extra_tags }}
          # Routed through env (not inlined via ${{ }}) so a value containing
          # shell metacharacters can't be interpreted as script rather than data.
          IMAGE_URI: ${{ steps.calculate-target-tag.outputs.image_uri }}
          TEST_IMAGE_URI: ${{ steps.calculate-target-tag.outputs.test_image_uri }}
        run: |
          PUSH_ARGS=""
          if [ "${{ inputs.push_image }}" == "true" ]; then
            PUSH_ARGS="--push"
          elif [ "${{ inputs.no_load }}" == "false" ]; then
            PUSH_ARGS="--load"
          fi

          NO_CACHE_ARG=""
          if [ "${{ inputs.no_cache }}" == "true" ]; then
            NO_CACHE_ARG="--no-cache"
          fi
          TEST_TARGET="test_image"
          if [ "${{ inputs.target }}" == "planner" ]; then
            TEST_TARGET="test_planner"
          fi

          PYPI_SECRET_ARGS=()
          if [ -n "${PIP_INDEX_URL:-}" ] \
            && [ -n "${UV_DEFAULT_INDEX:-}" ] \
            && [ -n "${NETRC:-}" ] \
            && [ -f "${NETRC}" ]; then
            PYPI_SECRET_ARGS+=(--secret id=pip-index-url,env=PIP_INDEX_URL)
            PYPI_SECRET_ARGS+=(--secret id=uv-default-index,env=UV_DEFAULT_INDEX)
            PYPI_SECRET_ARGS+=(--secret "id=pypi-netrc,src=${NETRC}")
          fi

          TEST_TAG_ARGS=(-t "${TEST_IMAGE_URI}")
          if [ -n "$TEST_EXTRA_TAGS" ]; then
            while IFS= read -r tag; do
              if [ -n "$tag" ]; then
                TEST_TAG_ARGS+=(-t "${ECR_REGISTRY}/${ECR_REPOSITORY}:${tag}")
              fi
            done <<< "$TEST_EXTRA_TAGS"
          fi

          docker buildx build \
            --progress=plain \
            ${PUSH_ARGS} \
            ${NO_CACHE_ARG} \
            "${PYPI_SECRET_ARGS[@]}" \
            --platform ${{ inputs.platform }} \
            --target ${TEST_TARGET} \
            -f container/Dockerfile.test \
            --build-arg BASE_IMAGE="${IMAGE_URI}" \
            "${TEST_TAG_ARGS[@]}" .
      - name: Show summary
        shell: bash
        if: ${{ inputs.push_image == 'true' && inputs.show_summary == 'true' }}
        run: |
          echo "### 🐳 ${{ steps.calculate-target-tag.outputs.target_tag_plain }} Default Image" >> $GITHUB_STEP_SUMMARY
          echo "" >> $GITHUB_STEP_SUMMARY
          echo "| Image URI |" >> $GITHUB_STEP_SUMMARY
          echo "|-----|" >> $GITHUB_STEP_SUMMARY
          echo "| \`${{ steps.calculate-target-tag.outputs.image_uri }}\` |" >> $GITHUB_STEP_SUMMARY
          EXTRA_TAGS="${{ steps.extra-tags.outputs.tags }}"
          if [ -n "$EXTRA_TAGS" ]; then
            echo "" >> $GITHUB_STEP_SUMMARY
            echo "### 🏷️ Extra Tags" >> $GITHUB_STEP_SUMMARY
            echo "" >> $GITHUB_STEP_SUMMARY
            echo "| Image URI |" >> $GITHUB_STEP_SUMMARY
            echo "|-----|" >> $GITHUB_STEP_SUMMARY
            while IFS= read -r tag; do
              if [ -n "$tag" ]; then
                echo "| \`${tag}\` |" >> $GITHUB_STEP_SUMMARY
              fi
            done <<< "$EXTRA_TAGS"
          fi