[Don't Merge] Add miles grpo test case

.github/workflows/miles-pin-freshness.yml

@@ -0,0 +1,164 @@
+# Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved.
+# SPDX-License-Identifier: MIT-0
+#
+# Fails if an external artifact that 3.test_cases/pytorch/miles pins by tag/version has
+# disappeared from its registry/source. This test case needs 8-16 H200 GPUs to run GRPO
+# end to end, and no runner in this repo (GitHub-hosted or self-hosted) provides that for
+# miles today, so this workflow does NOT build the image and does NOT run training -- it
+# only asserts that each pin still resolves. That is a real, current failure mode: the
+# base image tag pinned in miles.Dockerfile (MILES_BASE_TAG=dev-202607182122) has already
+# been deleted from Docker Hub.
+#
+# What this catches:
+#   - the pinned base image digest (MILES_BASE_DIGEST) removed from the registry, and
+#     separately, the documented tag drifting off that digest (advisory)
+#   - the EFA installer tarball for EFA_INSTALLER_VERSION removed from the AWS download host
+#   - the GDRCopy tag for GDRCOPY_VERSION deleted from NVIDIA/gdrcopy on GitHub
+#   - a reward_service/requirements.txt pin no longer published on PyPI
+#
+# What this does NOT catch (needs hardware -- see README.md "Verification Status"):
+#   - whether a replacement image/version still builds, boots, or trains correctly
+#   - behavioral drift in a dev tag that still resolves (radixark/miles dev-* tags are
+#     mutable snapshots; "resolves" is not "is the bits this test case was verified against")
+#   - drift in references with no separate pin, e.g. the exact radixark/Megatron-LM commit
+#     or SGLang 0.5.16.dev bundled inside MILES_BASE_TAG
+#   - the top-level requirements.txt, which its own header marks reference-only (miles.Dockerfile
+#     never installs from it)
+#
+# A registry/API hiccup (rate limit, 5xx, timeout) is logged as a warning, not a failure --
+# only a confirmed 404 (tag/version/ref genuinely absent) fails the job.
+
+name: miles pin freshness
+
+on:
+  pull_request:
+    paths:
+      - "3.test_cases/pytorch/miles/**"
+  schedule:
+    # Independent of PR activity: radixark/miles prunes dev-* tags on its own cadence, so a
+    # pin can go stale with zero activity in this repo. Weekly, Monday morning UTC.
+    - cron: "17 6 * * 1"
+  workflow_dispatch:
+
+permissions:
+  contents: read
+
+jobs:
+  check-pins:
+    runs-on: ubuntu-latest
+    timeout-minutes: 10
+    defaults:
+      run:
+        working-directory: 3.test_cases/pytorch/miles
+    steps:
+      - uses: actions/checkout@v4
+
+      - name: Check the pinned base image digest still resolves
+        run: |
+          set -euo pipefail
+          # The build resolves MILES_BASE_DIGEST, so that is what has to be checked. The tag
+          # is read only to report which snapshot the digest came from, and to warn if the
+          # two have drifted apart (the tag moved, or was bumped without the digest).
+          DIGEST=$(grep -oP '^ARG MILES_BASE_DIGEST=\K\S+' miles.Dockerfile)
+          TAG=$(grep -oP '^ARG MILES_BASE_TAG=\K\S+' miles.Dockerfile)
+          echo "pinned digest: ${DIGEST}"
+          echo "documented tag: ${TAG}"
+
+          TOKEN=$(curl -s --max-time 20 --retry 2 --retry-delay 5 \
+            "https://auth.docker.io/token?service=registry.docker.io&scope=repository:radixark/miles:pull" \
+            | python3 -c 'import sys,json; print(json.load(sys.stdin)["token"])') || TOKEN=""
+          if [ -z "${TOKEN}" ]; then
+            echo "::warning::Could not obtain a Docker Hub token; skipping the digest check."
+            exit 0
+          fi
+          ACCEPT='application/vnd.oci.image.index.v1+json,application/vnd.docker.distribution.manifest.list.v2+json,application/vnd.docker.distribution.manifest.v2+json'
+
+          CODE=$(curl -s -o /dev/null -w '%{http_code}' --max-time 30 --retry 2 --retry-delay 5 \
+            -H "Authorization: Bearer ${TOKEN}" -H "Accept: ${ACCEPT}" \
+            "https://registry-1.docker.io/v2/radixark/miles/manifests/${DIGEST}" || echo 000)
+          if [ "${CODE}" = "404" ]; then
+            echo "::error file=3.test_cases/pytorch/miles/miles.Dockerfile::The pinned base image digest ${DIGEST} is gone from the registry. Pick a live dated tag from https://hub.docker.com/r/radixark/miles/tags, resolve its digest (see the comment in miles.Dockerfile), re-run the hardware verification matrix in README.md, then bump both MILES_BASE_DIGEST and MILES_BASE_TAG."
+            exit 1
+          elif [ "${CODE}" != "200" ]; then
+            echo "::warning::Digest check was inconclusive (HTTP ${CODE}); not failing the job."
+            exit 0
+          fi
+          echo "OK: the pinned digest still resolves."
+
+          # Advisory only: a dev-* tag is mutable, so the tag pointing elsewhere is normal
+          # and is not a build problem. It does mean the comment is stale.
+          TAG_DIGEST=$(curl -sI --max-time 30 -H "Authorization: Bearer ${TOKEN}" -H "Accept: ${ACCEPT}" \
+            "https://registry-1.docker.io/v2/radixark/miles/manifests/${TAG}" \
+            | tr -d '\r' | awk 'tolower($1)=="docker-content-digest:"{print $2}') || TAG_DIGEST=""
+          if [ -n "${TAG_DIGEST}" ] && [ "${TAG_DIGEST}" != "${DIGEST}" ]; then
+            echo "::warning::${TAG} now points at ${TAG_DIGEST}, not the pinned ${DIGEST}. The build is unaffected, but the documented tag no longer names the pinned image."
+          fi
+
+      - name: Check EFA installer tarball is still downloadable
+        run: |
+          set -euo pipefail
+          VER=$(grep -oP '^ARG EFA_INSTALLER_VERSION=\K\S+' miles.Dockerfile)
+          echo "EFA_INSTALLER_VERSION=${VER}"
+          URL="https://efa-installer.amazonaws.com/aws-efa-installer-${VER}.tar.gz"
+          CODE=$(curl -s -o /dev/null -I -w '%{http_code}' --max-time 20 --retry 2 --retry-delay 5 "${URL}" || echo 000)
+          if [ "${CODE}" = "200" ]; then
+            echo "OK: EFA installer ${VER} tarball is downloadable."
+          elif [ "${CODE}" = "404" ]; then
+            echo "::error file=3.test_cases/pytorch/miles/miles.Dockerfile::${URL} is gone (HTTP 404). Bump EFA_INSTALLER_VERSION to a version still published at https://efa-installer.amazonaws.com/."
+            exit 1
+          else
+            echo "::warning::EFA installer URL check was inconclusive (HTTP ${CODE}); not failing the job."
+          fi
+
+      - name: Check GDRCopy tag exists on GitHub
+        run: |
+          set -euo pipefail
+          VER=$(grep -oP '^ARG GDRCOPY_VERSION=\K\S+' miles.Dockerfile)
+          echo "GDRCOPY_VERSION=${VER}"
+          URL="https://api.github.com/repos/NVIDIA/gdrcopy/git/refs/tags/${VER}"
+          CODE=$(curl -s -o /dev/null -w '%{http_code}' --max-time 20 --retry 2 --retry-delay 5 "${URL}" || echo 000)
+          if [ "${CODE}" = "200" ]; then
+            echo "OK: NVIDIA/gdrcopy@${VER} exists."
+          elif [ "${CODE}" = "404" ]; then
+            echo "::error file=3.test_cases/pytorch/miles/miles.Dockerfile::NVIDIA/gdrcopy tag ${VER} is gone (HTTP 404 from the GitHub API). Bump GDRCOPY_VERSION to a tag that still exists."
+            exit 1
+          else
+            echo "::warning::GDRCopy tag check was inconclusive (HTTP ${CODE}); not failing the job. The GitHub API is rate-limited for unauthenticated requests (60/hour/IP), which shared GitHub-hosted runner IPs can hit."
+          fi
+
+      - name: Check reward_service pinned PyPI packages still exist
+        run: |
+          set -euo pipefail
+          python3 - << 'PY'
+          import re
+          import sys
+          import urllib.error
+          import urllib.request
+
+          fail = False
+          with open("reward_service/requirements.txt") as f:
+              for line in f:
+                  line = line.strip()
+                  m = re.match(r'^([A-Za-z0-9_.\-]+)(?:\[[A-Za-z0-9_,.\-]+\])?==([A-Za-z0-9_.\-]+)$', line)
+                  if not m:
+                      continue
+                  pkg, ver = m.group(1), m.group(2)
+                  url = f"https://pypi.org/pypi/{pkg}/{ver}/json"
+                  try:
+                      with urllib.request.urlopen(url, timeout=20) as resp:
+                          code = resp.status
+                  except urllib.error.HTTPError as e:
+                      code = e.code
+                  except Exception as e:
+                      print(f"::warning::PyPI check for {pkg}=={ver} was inconclusive ({e}); not failing the job.")
+                      continue
+                  if code == 200:
+                      print(f"OK: {pkg}=={ver} exists on PyPI.")
+                  elif code == 404:
+                      print(f"::error file=3.test_cases/pytorch/miles/reward_service/requirements.txt::{pkg}=={ver} is gone from PyPI (HTTP 404). Bump the pin in reward_service/requirements.txt.")
+                      fail = True
+                  else:
+                      print(f"::warning::PyPI check for {pkg}=={ver} was inconclusive (HTTP {code}); not failing the job.")
+          if fail:
+              sys.exit(1)
+          PY

3.test_cases/pytorch/miles/.gitignore

@@ -0,0 +1,9 @@
+# Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved.
+# SPDX-License-Identifier: MIT-0
+
+# Local environment files with filled-in secrets/values -- never commit
+env_vars
+env_vars.disaggregated
+
+# Eval / training artifacts
+eval_results/