dynamo/.github/workflows/shared-compliance.yml at main · CentML/dynamo · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
# SPDX-FileCopyrightText: Copyright (c) 2024-2026 NVIDIA CORPORATION & AFFILIATES. All rights reserved.
# SPDX-License-Identifier: Apache-2.0

name: Shared Compliance Scan

on:
  workflow_call:
    inputs:
      framework:
        description: 'Framework name (vllm, sglang, trtllm)'
        required: true
        type: string
      target:
        description: 'Target docker stage'
        required: true
        type: string
      target_tag_plain:
        description: 'Plain runtime image tag prefix from the build workflow'
        required: true
        type: string
      cuda_version:
        description: 'CUDA versions to test as a JSON array'
        required: true
        type: string
      platform:
        description: 'Target platforms to test as a JSON array'
        required: true
        type: string
      compliance_timeout_minutes:
        description: 'Timeout in minutes for the compliance scan job'
        required: false
        type: number
        default: 15
    secrets:
      AWS_DEFAULT_REGION:
        required: true
      AWS_ACCOUNT_ID:
        required: true
      AZURE_ACR_HOSTNAME:
        required: true
      AZURE_ACR_USER:
        required: true
      AZURE_ACR_PASSWORD:
        required: true

jobs:
  compliance:
    strategy:
      fail-fast: false
      matrix:
        platform: ${{ fromJson(inputs.platform) }}
        cuda_version: ${{ fromJson(inputs.cuda_version) }}
    runs-on: prod-builder-v3
    # cuda_version not empty -- name: cuda12, linux/amd64
    # cuda_version empty -- name: cpu, linux/amd64
    name: Compliance ${{ matrix.cuda_version == '' && 'cpu' || format('cuda{0}', matrix.cuda_version) }}, ${{ matrix.platform }}
    timeout-minutes: ${{ inputs.compliance_timeout_minutes }}
    steps:
      - name: Checkout repository
        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd  # v6.0.2
      - name: Docker Login
        uses: $/.github/actions/docker-login
        with:
          aws_default_region: ${{ vars.AWS_DEFAULT_REGION }}
          ecr_registry: ${{ vars.ECR_REGISTRY }}
          azure_acr_hostname: ${{ secrets.AZURE_ACR_HOSTNAME }}
          azure_acr_user: ${{ secrets.AZURE_ACR_USER }}
          azure_acr_password: ${{ secrets.AZURE_ACR_PASSWORD }}
      - name: Calculate target tag
        id: calculate-target-tag
        shell: bash
        env:
          ECR_REPOSITORY: ${{ vars.ECR_REGISTRY }}/${{ vars.ECR_REPOSITORY }}
        run: |
          CUDA_VERSION="${{ matrix.cuda_version }}"
          TARGET_TAG_PLAIN="${{ inputs.target_tag_plain }}"

          IMAGE_TAG=${{ github.sha }}-${TARGET_TAG_PLAIN}
          if [ -n "${CUDA_VERSION}" ]; then
            CUDA_MAJOR=${CUDA_VERSION%%.*}
            IMAGE_TAG="${IMAGE_TAG}-cuda${CUDA_MAJOR}"
          fi

          RUNTIME_IMAGE=${ECR_REPOSITORY}:${IMAGE_TAG}
          echo "runtime_image=${RUNTIME_IMAGE}" >> $GITHUB_OUTPUT
      - name: Compliance scan
        uses: $/.github/actions/compliance-scan
        with:
          image: ${{ steps.calculate-target-tag.outputs.runtime_image }}
          artifact_name: compliance-${{ inputs.target_tag_plain }}-${{ matrix.cuda_version }}-${{ matrix.platform }}
          namespace: ${{ vars.BUILDKIT_NAMESPACE }}
          arch: ${{ matrix.platform }}
          framework: ${{ inputs.framework }}
          target: ${{ inputs.target }}
          cuda_version: ${{ matrix.cuda_version }}