pr.yaml

# SPDX-FileCopyrightText: Copyright (c) 2024-2026 NVIDIA CORPORATION & AFFILIATES. All rights reserved.
# SPDX-License-Identifier: Apache-2.0

name: PR

on:
  push:
    branches:
      - "pull-request/[0-9]+"

concurrency:
  # The group name is the ref_name, so that workflows on the same PR/branch have the same group name for cancelling.
  group: docker-build-test-${{ github.ref_name }}
  cancel-in-progress: true

env:
  BUILDER_NAME: b-${{ github.run_id }}-${{ github.run_attempt }}

jobs:
  # ============================================================================
  # SETUP & DETECTION JOBS
  # ============================================================================
  changed-files:
    runs-on: ubuntu-latest
    outputs:
      core: ${{ steps.changes.outputs.core }}
      planner: ${{ steps.changes.outputs.planner }}
      operator: ${{ steps.changes.outputs.operator }}
      snapshot: ${{ steps.changes.outputs.snapshot }}
      power_agent: ${{ steps.changes.outputs.power_agent }}
      deploy: ${{ steps.changes.outputs.deploy }}
      vllm: ${{ steps.changes.outputs.vllm }}
      sglang: ${{ steps.changes.outputs.sglang }}
      trtllm: ${{ steps.changes.outputs.trtllm }}
      frontend: ${{ steps.changes.outputs.frontend }}
      benchmarks: ${{ steps.changes.outputs.benchmarks }}
      sample: ${{ steps.changes.outputs.sample }}
      efa: ${{ steps.changes.outputs.efa }}
      base_ref: ${{ steps.changes.outputs.base_ref }}
      merge_base_sha: ${{ steps.changes.outputs.merge_base_sha }}
      builder_name: ${{ steps.export-builder-name.outputs.builder_name }}
    steps:
      - name: Checkout code
        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd  # v6.0.2
        # Do not use fetch-depth: 0 — changed-files now works with shallow clone
      - name: Check for changes
        id: changes
        uses: ./.github/actions/changed-files
        with:
          gh_token: ${{ github.token }}
      - name: Export builder name
        id: export-builder-name
        run: |
          echo "builder_name=${{ env.BUILDER_NAME }}" >> $GITHUB_OUTPUT

  backend-status-check:
    runs-on: ubuntu-latest
    needs:
      - changed-files
      - operator
      - helm-chart-tests
      - snapshot-agent
      - snapshot-placeholder-vllm
      - snapshot-placeholder-sglang
      - snapshot-placeholder-trtllm
      - power-agent
      - vllm-build
      - vllm-dev-build
      - vllm-test
      - vllm-multi-gpu-test
      - vllm-copy-to-acr
      - sglang-build
      - sglang-dev-build
      - sglang-test
      - sglang-multi-gpu-test
      - sglang-copy-to-acr
      - trtllm-build
      - trtllm-dev-build
      - trtllm-test
      - trtllm-multi-gpu-test
      - trtllm-copy-to-acr
      - vllm-efa-build
      - sglang-efa-build
      - trtllm-efa-build
      - planner-build
      - planner-test
      - frontend-build
      - frontend-copy-to-acr
    if: always()
    steps:
      - name: Check all dependent jobs
        run: |
          echo '${{ toJson(needs) }}' | jq -e 'to_entries | map(.value.result) | all(. as $result | ["success", "skipped"] | any($result == .))'

  deploy-status-check:
    runs-on: ubuntu-latest
    needs:
      - deploy-operator
      - deploy-test-vllm
      - deploy-test-sglang
      - deploy-test-trtllm
      - deploy-operator-checkpoint-vllm
      - deploy-operator-checkpoint-sglang
      - deploy-operator-checkpoint-trtllm
      - deploy-snapshot-agent-checkpoint-vllm
      - deploy-snapshot-agent-checkpoint-sglang
      - deploy-snapshot-agent-checkpoint-trtllm
      - snapshot-placeholder-vllm
      - snapshot-placeholder-sglang
      - snapshot-placeholder-trtllm
      - frontend-copy-to-acr
      - deploy-test-checkpoint-vllm
      - deploy-test-checkpoint-sglang
      - deploy-test-checkpoint-trtllm
      - deploy-cleanup
      - deploy-cleanup-checkpoint-vllm
      - deploy-cleanup-checkpoint-sglang
      - deploy-cleanup-checkpoint-trtllm
    if: always()
    steps:
      - name: Check all deploy test jobs
        run: |
          echo '${{ toJson(needs) }}' | jq -e 'to_entries | map(.value.result) | all(. as $result | ["success", "skipped", "cancelled"] | any($result == .))'

  dynamo-status-check:
    runs-on: ubuntu-slim
    needs:
      - changed-files
      - dynamo-pipeline
    if: always()
    steps:
      - name: Check all dynamo jobs
        run: |
          echo '${{ toJson(needs) }}' | jq -e 'to_entries | map(.value.result) | all(. as $result | ["success", "skipped"] | any($result == .))'

  # ============================================================================
  # Operator
  # ============================================================================

  operator:
    needs: changed-files
    if: |
      needs.changed-files.outputs.operator == 'true' ||
      needs.changed-files.outputs.vllm == 'true' ||
      needs.changed-files.outputs.sglang == 'true' ||
      needs.changed-files.outputs.trtllm == 'true' ||
      needs.changed-files.outputs.deploy == 'true' ||
      needs.changed-files.outputs.snapshot == 'true'
    name: Operator
    runs-on: prod-default-v2
    # actions: read lets the compliance step download a prior run's baseline
    # operator compliance artifact to diff the OSRB CSV against. Missing -> the
    # diff soft-degrades, build stays green.
    permissions:
      contents: read
      actions: read
    outputs:
      operator_default_tag: ${{ steps.build.outputs.image_tag }}
    steps:
      - name: Checkout code
        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd  # v6.0.2
        # Do not use fetch-depth: 0 — it fetches all 1600+ branches (~3 min)
      - name: Build and push operator
        id: build
        uses: ./.github/actions/build-deploy-component
        with:
          component: operator
          image_tag: ${{ github.sha }}-operator
          builder_name: ${{ needs.changed-files.outputs.builder_name }}
          aws_default_region: ${{ secrets.AWS_DEFAULT_REGION }}
          aws_account_id: ${{ secrets.AWS_ACCOUNT_ID }}
          azure_acr_hostname: ${{ secrets.AZURE_ACR_HOSTNAME }}
          azure_acr_user: ${{ secrets.AZURE_ACR_USER }}
          azure_acr_password: ${{ secrets.AZURE_ACR_PASSWORD }}
          extra_tags: |
            ${{ secrets.AZURE_ACR_HOSTNAME }}/ai-dynamo/dynamo:${{ github.sha }}-operator
          # OSRB CSV diff baseline: the target branch selects the rule, while the
          # merge-base pins PR->main diffs to the PR's fork point.
          diff_event_context: pr
          diff_current_branch: ${{ github.ref_name }}
          diff_base_branch: ${{ needs.changed-files.outputs.base_ref }}
          diff_merge_base_sha: ${{ needs.changed-files.outputs.merge_base_sha }}
          gh_token: ${{ secrets.GITHUB_TOKEN }}


# ============================================================================
# Helm Chart Tests
# ============================================================================

  helm-chart-tests:
    needs: changed-files
    if: needs.changed-files.outputs.operator == 'true'
    name: Helm Chart Tests
    runs-on: ubuntu-latest
    steps:
      - name: Checkout code
        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd  # v6.0.2
      - name: Set up Helm
        uses: azure/setup-helm@9bc31f4ebc9c6b171d7bfbaa5d006ae7abdb4310  # v5.0.1
        with:
          version: 'v3.17.3'  # match deploy/operator/Makefile HELM_VERSION
      - name: Lint and test
        run: make -C deploy/helm/charts/platform lint test

# ============================================================================
# Snapshot Agent
# ============================================================================

  snapshot-agent:
    needs: changed-files
    if: |
      needs.changed-files.outputs.snapshot == 'true' ||
      needs.changed-files.outputs.operator == 'true' ||
      needs.changed-files.outputs.deploy == 'true'
    name: Snapshot Agent
    runs-on: prod-default-v2
    # actions: read lets the compliance step download a prior run's baseline
    # snapshot compliance artifact to diff the OSRB CSV against. Missing -> the
    # diff soft-degrades, build stays green.
    permissions:
      contents: read
      actions: read
    steps:
      - name: Checkout code
        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd  # v6.0.2
        # Do not use fetch-depth: 0 — it fetches all 1600+ branches (~3 min)
      - name: Build and push snapshot agent
        uses: ./.github/actions/build-deploy-component
        with:
          component: snapshot
          image_tag: ${{ github.sha }}-snapshot-agent
          builder_name: ${{ needs.changed-files.outputs.builder_name }}
          aws_default_region: ${{ secrets.AWS_DEFAULT_REGION }}
          aws_account_id: ${{ secrets.AWS_ACCOUNT_ID }}
          azure_acr_hostname: ${{ secrets.AZURE_ACR_HOSTNAME }}
          azure_acr_user: ${{ secrets.AZURE_ACR_USER }}
          azure_acr_password: ${{ secrets.AZURE_ACR_PASSWORD }}
          extra_tags: |
            ${{ secrets.AZURE_ACR_HOSTNAME }}/ai-dynamo/dynamo:${{ github.sha }}-snapshot-agent
          # OSRB CSV diff baseline: the target branch selects the rule, while the
          # merge-base pins PR->main diffs to the PR's fork point.
          diff_event_context: pr
          diff_current_branch: ${{ github.ref_name }}
          diff_base_branch: ${{ needs.changed-files.outputs.base_ref }}
          diff_merge_base_sha: ${{ needs.changed-files.outputs.merge_base_sha }}
          gh_token: ${{ secrets.GITHUB_TOKEN }}

# ============================================================================
# Power Agent
# ============================================================================

  power-agent:
    needs: changed-files
    if: needs.changed-files.outputs.power_agent == 'true'
    name: Power Agent
    runs-on: prod-default-v2
    steps:
      - name: Checkout code
        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd  # v6.0.2
        # Do not use fetch-depth: 0 — it fetches all 1600+ branches (~3 min)
      - name: Build and push power agent
        uses: ./.github/actions/build-deploy-component
        with:
          component: power-agent
          target: runtime  # push the slim shipped stage, not the test stage
          image_tag: ${{ github.sha }}-power-agent
          builder_name: ${{ needs.changed-files.outputs.builder_name }}
          aws_default_region: ${{ secrets.AWS_DEFAULT_REGION }}
          aws_account_id: ${{ secrets.AWS_ACCOUNT_ID }}
      - name: Refresh BuildKit builder
        # The runtime build above can leave the remote BuildKit connection stale;
        # re-establish it (re-routing only if unhealthy) before the test build.
        uses: ./.github/actions/builder-refresher
        with:
          builder_name: ${{ needs.changed-files.outputs.builder_name }}
          flavor: general
          arch: linux/amd64
      - name: Run unit tests inside the container image
        # Build the Dockerfile `test` stage (FROM runtime): its RUN pytest runs
        # the suite against the exact shipped image (Python 3.12 + baked deps),
        # validating the container itself rather than a pip-installed runner env.
        # Reuses the builder + ECR Docker Hub mirror the build step set up above
        # (runtime layers are a cache hit); no --push/--load runs pytest without
        # exporting the never-shipped test image.
        env:
          ECR_HOSTNAME: ${{ secrets.AWS_ACCOUNT_ID }}.dkr.ecr.${{ secrets.AWS_DEFAULT_REGION }}.amazonaws.com
        run: |
          docker buildx build --builder ${{ needs.changed-files.outputs.builder_name }} \
            --target test \
            --build-arg DOCKER_PROXY=${ECR_HOSTNAME}/dockerhub/ \
            -f deploy/power-agent/Dockerfile deploy/power-agent
      - name: Set up Helm
        uses: azure/setup-helm@9bc31f4ebc9c6b171d7bfbaa5d006ae7abdb4310  # v5.0.1
        with:
          version: 'v3.17.3'  # match deploy/operator/Makefile HELM_VERSION
      - name: Lint and test Helm chart
        run: make -C deploy/helm/charts/power-agent lint test

# ============================================================================
# FRAMEWORK PIPELINES (Build → Test → Copy)
# ============================================================================
  # ============================================================================
  # BUILD PIPELINES
  # ============================================================================

  vllm-build:
    name: vllm-runtime # This name overlaps with other vllm jobs to group them in the UI
    needs: [changed-files]
    # `sample` is here because sample tests piggyback on this image and run as part of vllm-test.
    # `operator` is here because operator changes run the deploy tests, which
    # deploy the CI-built runtime image. `snapshot` is here because
    # DynamoCheckpoint deploy tests build a snapshot placeholder from it.
    if: |
      needs.changed-files.outputs.core == 'true' ||
      needs.changed-files.outputs.vllm == 'true' ||
      needs.changed-files.outputs.deploy == 'true' ||
      needs.changed-files.outputs.sample == 'true' ||
      needs.changed-files.outputs.operator == 'true' ||
      needs.changed-files.outputs.snapshot == 'true'
    uses: ./.github/workflows/shared-build-image.yml
    with:
      framework: vllm
      target: runtime
      cuda_version: '["13.0"]'
      platform: 'linux/amd64,linux/arm64'
      builder_name: ${{ needs.changed-files.outputs.builder_name }}
      inline_compliance: true
      artifact_retention_days: '7'
      build_timeout_minutes: 60
      # OSRB CSV diff baseline: the target branch selects the rule, while the
      # merge-base pins PR->main diffs to the PR's fork point.
      diff_event_context: pr
      diff_current_branch: ${{ github.ref_name }}
      diff_base_branch: ${{ needs.changed-files.outputs.base_ref }}
      diff_merge_base_sha: ${{ needs.changed-files.outputs.merge_base_sha }}
    # actions: read lets the build download a prior run's baseline compliance
    # artifact to diff against (a reusable workflow's token can't exceed the
    # caller's). Missing -> the diff soft-degrades, build stays green.
    permissions:
      contents: read
      actions: read
    secrets: inherit

  vllm-dev-build:
    name: vllm-dev
    needs: [changed-files]
    if: needs.changed-files.outputs.core == 'true' || needs.changed-files.outputs.vllm == 'true'
    uses: ./.github/workflows/shared-build-image.yml
    with:
      framework: vllm
      target: dev
      cuda_version: '["13.0"]'
      platform: 'linux/amd64,linux/arm64'
      builder_name: ${{ needs.changed-files.outputs.builder_name }}
      push_image: false
      build_timeout_minutes: 60
    secrets: inherit

  sglang-build:
    name: sglang-runtime # This name overlaps with other sglang jobs to group them in the UI
    needs: [changed-files]
    # `operator` is here because operator changes run the deploy tests, which
    # deploy the CI-built runtime image. `snapshot` is here because
    # DynamoCheckpoint deploy tests build a snapshot placeholder from it.
    if: |
      needs.changed-files.outputs.core == 'true' ||
      needs.changed-files.outputs.sglang == 'true' ||
      needs.changed-files.outputs.deploy == 'true' ||
      needs.changed-files.outputs.operator == 'true' ||
      needs.changed-files.outputs.snapshot == 'true'
    uses: ./.github/workflows/shared-build-image.yml
    with:
      framework: sglang
      target: runtime
      cuda_version: '["13.0"]'
      platform: 'linux/amd64,linux/arm64'
      builder_name: ${{ needs.changed-files.outputs.builder_name }}
      inline_compliance: true
      artifact_retention_days: '7'
      build_timeout_minutes: 60
      # OSRB CSV diff baseline: the target branch selects the rule, while the
      # merge-base pins PR->main diffs to the PR's fork point.
      diff_event_context: pr
      diff_current_branch: ${{ github.ref_name }}
      diff_base_branch: ${{ needs.changed-files.outputs.base_ref }}
      diff_merge_base_sha: ${{ needs.changed-files.outputs.merge_base_sha }}
    # actions: read lets the build download a prior run's baseline compliance
    # artifact to diff against (a reusable workflow's token can't exceed the
    # caller's). Missing -> the diff soft-degrades, build stays green.
    permissions:
      contents: read
      actions: read
    secrets: inherit

  sglang-dev-build:
    name: sglang-dev
    needs: [changed-files]
    if: needs.changed-files.outputs.core == 'true' || needs.changed-files.outputs.sglang == 'true'
    uses: ./.github/workflows/shared-build-image.yml
    with:
      framework: sglang
      target: dev
      cuda_version: '["13.0"]'
      platform: 'linux/amd64,linux/arm64'
      builder_name: ${{ needs.changed-files.outputs.builder_name }}
      push_image: false
      build_timeout_minutes: 60
    secrets: inherit

  trtllm-build:
    name: trtllm-runtime # This name overlaps with other trtllm jobs to group them in the UI
    needs: [changed-files]
    # `operator` is here because operator changes run the deploy tests, which
    # deploy the CI-built runtime image. `snapshot` is here because
    # DynamoCheckpoint deploy tests build a snapshot placeholder from it.
    if: |
      needs.changed-files.outputs.core == 'true' ||
      needs.changed-files.outputs.trtllm == 'true' ||
      needs.changed-files.outputs.deploy == 'true' ||
      needs.changed-files.outputs.operator == 'true' ||
      needs.changed-files.outputs.snapshot == 'true'
    uses: ./.github/workflows/shared-build-image.yml
    with:
      framework: trtllm
      target: runtime
      cuda_version: '["13.1"]'
      platform: 'linux/amd64,linux/arm64'
      builder_name: ${{ needs.changed-files.outputs.builder_name }}
      inline_compliance: true
      artifact_retention_days: '7'
      build_timeout_minutes: 60
      # OSRB CSV diff baseline: the target branch selects the rule, while the
      # merge-base pins PR->main diffs to the PR's fork point.
      diff_event_context: pr
      diff_current_branch: ${{ github.ref_name }}
      diff_base_branch: ${{ needs.changed-files.outputs.base_ref }}
      diff_merge_base_sha: ${{ needs.changed-files.outputs.merge_base_sha }}
    # actions: read lets the build download a prior run's baseline compliance
    # artifact to diff against (a reusable workflow's token can't exceed the
    # caller's). Missing -> the diff soft-degrades, build stays green.
    permissions:
      contents: read
      actions: read
    secrets: inherit

  trtllm-dev-build:
    name: trtllm-dev
    needs: [changed-files]
    if: needs.changed-files.outputs.core == 'true' || needs.changed-files.outputs.trtllm == 'true'
    uses: ./.github/workflows/shared-build-image.yml
    with:
      framework: trtllm
      target: dev
      cuda_version: '["13.1"]'
      platform: 'linux/amd64,linux/arm64'
      builder_name: ${{ needs.changed-files.outputs.builder_name }}
      push_image: false
      build_timeout_minutes: 60
    secrets: inherit

  vllm-efa-build:
    name: vllm-runtime-efa
    needs: [changed-files]
    if: needs.changed-files.outputs.vllm == 'true' || needs.changed-files.outputs.efa == 'true'
    uses: ./.github/workflows/shared-build-image.yml
    with:
      framework: vllm
      target: runtime
      cuda_version: '["13.0"]'
      platform: 'linux/amd64,linux/arm64'
      make_efa: true
      builder_name: ${{ needs.changed-files.outputs.builder_name }}
      inline_compliance: true
      artifact_retention_days: '7'
      build_timeout_minutes: 60
      # OSRB CSV diff baseline: the target branch selects the rule, while the
      # merge-base pins PR->main diffs to the PR's fork point.
      diff_event_context: pr
      diff_current_branch: ${{ github.ref_name }}
      diff_base_branch: ${{ needs.changed-files.outputs.base_ref }}
      diff_merge_base_sha: ${{ needs.changed-files.outputs.merge_base_sha }}
    # actions: read lets the build download a prior run's baseline compliance
    # artifact to diff against (a reusable workflow's token can't exceed the
    # caller's). Missing -> the diff soft-degrades, build stays green.
    permissions:
      contents: read
      actions: read
    secrets: inherit

  sglang-efa-build:
    name: sglang-runtime-efa
    needs: [changed-files]
    if: needs.changed-files.outputs.sglang == 'true' || needs.changed-files.outputs.efa == 'true'
    uses: ./.github/workflows/shared-build-image.yml
    with:
      framework: sglang
      target: runtime
      cuda_version: '["13.0"]'
      platform: 'linux/amd64,linux/arm64'
      make_efa: true
      builder_name: ${{ needs.changed-files.outputs.builder_name }}
      inline_compliance: true
      artifact_retention_days: '7'
      build_timeout_minutes: 60
      # OSRB CSV diff baseline: the target branch selects the rule, while the
      # merge-base pins PR->main diffs to the PR's fork point.
      diff_event_context: pr
      diff_current_branch: ${{ github.ref_name }}
      diff_base_branch: ${{ needs.changed-files.outputs.base_ref }}
      diff_merge_base_sha: ${{ needs.changed-files.outputs.merge_base_sha }}
    # actions: read lets the build download a prior run's baseline compliance
    # artifact to diff against (a reusable workflow's token can't exceed the
    # caller's). Missing -> the diff soft-degrades, build stays green.
    permissions:
      contents: read
      actions: read
    secrets: inherit

  trtllm-efa-build:
    name: trtllm-runtime-efa
    needs: [changed-files]
    if: needs.changed-files.outputs.trtllm == 'true' || needs.changed-files.outputs.efa == 'true'
    uses: ./.github/workflows/shared-build-image.yml
    with:
      framework: trtllm
      target: runtime
      cuda_version: '["13.1"]'
      platform: 'linux/amd64,linux/arm64'
      make_efa: true
      builder_name: ${{ needs.changed-files.outputs.builder_name }}
      inline_compliance: true
      artifact_retention_days: '7'
      build_timeout_minutes: 60
      # OSRB CSV diff baseline: the target branch selects the rule, while the
      # merge-base pins PR->main diffs to the PR's fork point.
      diff_event_context: pr
      diff_current_branch: ${{ github.ref_name }}
      diff_base_branch: ${{ needs.changed-files.outputs.base_ref }}
      diff_merge_base_sha: ${{ needs.changed-files.outputs.merge_base_sha }}
    # actions: read lets the build download a prior run's baseline compliance
    # artifact to diff against (a reusable workflow's token can't exceed the
    # caller's). Missing -> the diff soft-degrades, build stays green.
    permissions:
      contents: read
      actions: read
    secrets: inherit

  planner-build:
    name: planner # This name overlaps with other planner jobs to group them in the UI
    needs: [changed-files]
    if: needs.changed-files.outputs.core == 'true' || needs.changed-files.outputs.planner == 'true'
    uses: ./.github/workflows/shared-build-image.yml
    with:
      framework: dynamo
      target: planner
      cuda_version: '[""]'
      platform: 'linux/amd64,linux/arm64'
      builder_name: ${{ needs.changed-files.outputs.builder_name }}
      inline_compliance: true
      artifact_retention_days: '7'
      build_timeout_minutes: 45
      # OSRB CSV diff baseline: the target branch selects the rule, while the
      # merge-base pins PR->main diffs to the PR's fork point.
      diff_event_context: pr
      diff_current_branch: ${{ github.ref_name }}
      diff_base_branch: ${{ needs.changed-files.outputs.base_ref }}
      diff_merge_base_sha: ${{ needs.changed-files.outputs.merge_base_sha }}
    # actions: read lets the build download a prior run's baseline compliance
    # artifact to diff against (a reusable workflow's token can't exceed the
    # caller's). Missing -> the diff soft-degrades, build stays green.
    permissions:
      contents: read
      actions: read
    secrets: inherit

  frontend-build:
    name: frontend
    needs: [changed-files]
    if: |
      needs.changed-files.outputs.frontend == 'true' ||
      needs.changed-files.outputs.operator == 'true' ||
      needs.changed-files.outputs.snapshot == 'true' ||
      needs.changed-files.outputs.deploy == 'true'
    uses: ./.github/workflows/shared-build-image.yml
    with:
      framework: dynamo
      target: frontend
      cuda_version: '[""]'
      platform: 'linux/amd64,linux/arm64'
      builder_name: ${{ needs.changed-files.outputs.builder_name }}
      inline_compliance: true
      artifact_retention_days: '7'
      build_timeout_minutes: 45
      # OSRB CSV diff baseline: the target branch selects the rule, while the
      # merge-base pins PR->main diffs to the PR's fork point.
      diff_event_context: pr
      diff_current_branch: ${{ github.ref_name }}
      diff_base_branch: ${{ needs.changed-files.outputs.base_ref }}
      diff_merge_base_sha: ${{ needs.changed-files.outputs.merge_base_sha }}
    # actions: read lets the build download a prior run's baseline compliance
    # artifact to diff against (a reusable workflow's token can't exceed the
    # caller's). Missing -> the diff soft-degrades, build stays green.
    permissions:
      contents: read
      actions: read
    secrets: inherit

  # ============================================================================
  # TEST PIPELINES
  # ============================================================================

  vllm-test:
    name: vllm-runtime # This name overlaps with other vllm jobs to group them in the UI
    needs: [changed-files, vllm-build]
    if: needs.changed-files.outputs.core == 'true' || needs.changed-files.outputs.vllm == 'true' || needs.changed-files.outputs.deploy == 'true' || needs.changed-files.outputs.sample == 'true'
    uses: ./.github/workflows/shared-test.yml
    with:
      test_suite_name: vllm
      test_type: Test
      amd_runner: prod-tester-amd-gpu-v2 # This runner is overridden for ARM platform
      target_tag_plain: ${{ needs.vllm-build.outputs.target_tag_plain }}
      cuda_version: '["13.0"]'
      platform: '["amd64", "arm64"]' # arm64 for CPU tests, single GPU tests are skipped
      run_cpu_only_tests: true
      cpu_only_test_markers: pre_merge and vllm and gpu_0
      gpu_test_markers: pre_merge and vllm and gpu_1
      gpu_test_timeout_minutes: 45
      # Profiled tests run in the parallel stage; unprofiled fall through to sequential.
      # 24 GiB admits all currently profiled vLLM tests (max is ~20.4 GiB) on a 48 GiB GPU.
      run_gpu_parallel_tests: true
      gpu_parallel_max_vram_gib: '24'
    secrets: inherit

  vllm-multi-gpu-test:
    name: vllm-runtime # This name overlaps with other vllm jobs to group them in the UI
    needs: [changed-files, vllm-build]
    if: needs.changed-files.outputs.core == 'true' || needs.changed-files.outputs.vllm == 'true' || needs.changed-files.outputs.deploy == 'true'
    uses: ./.github/workflows/shared-test.yml
    with:
      test_suite_name: vllm
      test_type: Multi-GPU Test
      amd_runner: prod-tester-amd-gpu-4-v2
      target_tag_plain: ${{ needs.vllm-build.outputs.target_tag_plain }}
      cuda_version: '["13.0"]'
      platform: '["amd64"]' # No ARM GPUs available
      run_sanity_check: false
      gpu_test_markers: pre_merge and vllm and (gpu_2 or gpu_4)
      gpu_test_timeout_minutes: 60
    secrets: inherit

  sglang-test:
    name: sglang-runtime # This name overlaps with other sglang jobs to group them in the UI
    needs: [changed-files, sglang-build]
    if: needs.changed-files.outputs.core == 'true' || needs.changed-files.outputs.sglang == 'true' || needs.changed-files.outputs.deploy == 'true'
    uses: ./.github/workflows/shared-test.yml
    with:
      test_suite_name: sglang
      test_type: Test
      amd_runner: prod-tester-amd-gpu-v2 # This runner is overridden for ARM platform
      target_tag_plain: ${{ needs.sglang-build.outputs.target_tag_plain }}
      cuda_version: '["13.0"]'
      platform: '["amd64", "arm64"]' # arm64 for CPU tests, single GPU tests are skipped
      run_cpu_only_tests: true
      cpu_only_test_markers: pre_merge and sglang and gpu_0
      gpu_test_markers: pre_merge and sglang and gpu_1
      # Profiled tests run in the VRAM-aware GPU stage; unprofiled fall through to sequential.
      # Current single-GPU runners are 24 GiB, so this cap admits the profiled SGLang pool
      # while yielding one auto slot today. Larger runners will get more slots from the same markers.
      run_gpu_parallel_tests: true
      gpu_parallel_max_vram_gib: '24'
    secrets: inherit

  sglang-multi-gpu-test:
    name: sglang-runtime # This name overlaps with other sglang jobs to group them in the UI
    needs: [changed-files, sglang-build]
    if: needs.changed-files.outputs.core == 'true' || needs.changed-files.outputs.sglang == 'true' || needs.changed-files.outputs.deploy == 'true'
    uses: ./.github/workflows/shared-test.yml
    with:
      test_suite_name: sglang
      test_type: Multi-GPU Test
      amd_runner: prod-tester-amd-gpu-4-v2
      target_tag_plain: ${{ needs.sglang-build.outputs.target_tag_plain }}
      cuda_version: '["13.0"]'
      platform: '["amd64"]' # No ARM GPUs available
      run_sanity_check: false
      gpu_test_markers: pre_merge and sglang and (gpu_2 or gpu_4)
      gpu_test_timeout_minutes: 60
    secrets: inherit

  trtllm-test:
    name: trtllm-runtime # This name overlaps with other trtllm jobs to group them in the UI
    needs: [changed-files, trtllm-build]
    if: needs.changed-files.outputs.core == 'true' || needs.changed-files.outputs.trtllm == 'true' || needs.changed-files.outputs.deploy == 'true'
    uses: ./.github/workflows/shared-test.yml
    with:
      test_suite_name: trtllm
      test_type: Test
      amd_runner: prod-tester-amd-gpu-v2 # This runner is overridden for ARM platform
      target_tag_plain: ${{ needs.trtllm-build.outputs.target_tag_plain }}
      cuda_version: '["13.1"]'
      platform: '["amd64", "arm64"]' # arm64 for CPU tests, single GPU tests are skipped
      run_cpu_only_tests: true
      cpu_only_test_markers: pre_merge and trtllm and gpu_0
      gpu_test_markers: pre_merge and trtllm and gpu_1
      # Profiled tests run in the VRAM-aware GPU stage; unprofiled fall through to sequential.
      # Current single-GPU runners are 24 GiB, so this cap admits the profiled TRT-LLM pool
      # while yielding one auto slot today. Larger runners will get more slots from the same markers.
      run_gpu_parallel_tests: true
      gpu_parallel_max_vram_gib: '24'
    secrets: inherit

  trtllm-multi-gpu-test:
    name: trtllm-runtime # This name overlaps with other trtllm jobs to group them in the UI
    needs: [changed-files, trtllm-build]
    if: needs.changed-files.outputs.core == 'true' || needs.changed-files.outputs.trtllm == 'true' || needs.changed-files.outputs.deploy == 'true'
    uses: ./.github/workflows/shared-test.yml
    with:
      test_suite_name: trtllm
      test_type: Multi-GPU Test
      amd_runner: prod-tester-amd-gpu-4-v2
      target_tag_plain: ${{ needs.trtllm-build.outputs.target_tag_plain }}
      cuda_version: '["13.1"]'
      platform: '["amd64"]' # No ARM GPUs available
      run_sanity_check: false
      gpu_test_markers: pre_merge and trtllm and (gpu_2 or gpu_4)
      gpu_test_timeout_minutes: 60
    secrets: inherit

  planner-test:
    name: planner # This name overlaps with other planner jobs to group them in the UI
    needs: [changed-files, planner-build]
    if: needs.changed-files.outputs.core == 'true' || needs.changed-files.outputs.planner == 'true'
    uses: ./.github/workflows/shared-test.yml
    with:
      test_suite_name: planner
      test_type: CPU Test
      amd_runner: prod-tester-amd-v2
      target_tag_plain: ${{ needs.planner-build.outputs.target_tag_plain }}
      cuda_version: '[""]'
      platform: '["amd64", "arm64"]'
      run_sanity_check: false
      run_cpu_only_tests: true
      cpu_only_test_markers: 'pre_merge and planner and gpu_0'
      cpu_only_test_timeout_minutes: 30
      cpu_parallel_mode: '2'
      run_gpu_tests: false
    secrets: inherit

  # ============================================================================
  # DYNAMO RUNTIME PIPELINE
  # ============================================================================

  dynamo-pipeline:
    name: dynamo-runtime
    needs: [changed-files]
    if: |
      needs.changed-files.outputs.core == 'true' ||
      needs.changed-files.outputs.planner == 'true' ||
      needs.changed-files.outputs.frontend == 'true' ||
      needs.changed-files.outputs.vllm == 'true' ||
      needs.changed-files.outputs.sglang == 'true' ||
      needs.changed-files.outputs.trtllm == 'true' ||
      needs.changed-files.outputs.benchmarks == 'true'
    uses: ./.github/workflows/dynamo-pipeline.yml
    with:
      builder_name: ${{ needs.changed-files.outputs.builder_name }}
      cpu_parallel_test_markers: 'pre_merge and parallel and not (vllm or sglang or trtllm) and (gpu_0)'
      cpu_sequential_test_markers: 'pre_merge and not parallel and not (vllm or sglang or trtllm) and (gpu_0)'
      gpu_test_markers: 'pre_merge and none and gpu_1'
    secrets: inherit

  # ============================================================================
  # IMAGE COMPLIANCE
  # ============================================================================
  # Compliance extract (unified /legal NOTICES + osrb-deps.csv + osrb.cdx.json)
  # runs as an inline step INSIDE each shipped framework build job
  # (inline_compliance: true above) — same job, same warm builder, so it's a
  # cache hit + small scratch export rather than a cold full-image rebuild.
  # License-policy enforcement also happens in the licenses Dockerfile stage; a
  # compliance failure fails the build and (via needs:) preempts dependent tests.
  #
  # The *-compliance-audit jobs below are the INDEPENDENT completeness check:
  # they syft-scan the pushed image and diff it against the build's osrb-deps.csv
  # to surface anything shipped-but-unattributed. They need:[<fw>-build] and run
  # in PARALLEL with the test jobs (the slow syft pull+scan stays off the test
  # critical path). Soft gate: report-only, non-required. EFA-image audits are a
  # follow-up (same caller pattern).

  vllm-compliance-audit:
    name: vllm-runtime # grouped in the UI with other vllm jobs
    needs: [changed-files, vllm-build]
    if: needs.changed-files.outputs.core == 'true' || needs.changed-files.outputs.vllm == 'true' || needs.changed-files.outputs.deploy == 'true'
    uses: ./.github/workflows/shared-compliance-audit.yml
    with:
      framework: vllm
      target: runtime
      cuda_version: '13.0'
      target_tag_plain: ${{ needs.vllm-build.outputs.target_tag_plain }}
      baseline_sbom_file: ${{ needs.vllm-build.outputs.baseline_sbom_file }}
    # No secrets: the audit scans the container's own filesystem (no registry
    # auth / aws) — don't inherit repo secrets into a report-only job.

  sglang-compliance-audit:
    name: sglang-runtime # grouped in the UI with other sglang jobs
    needs: [changed-files, sglang-build]
    if: needs.changed-files.outputs.core == 'true' || needs.changed-files.outputs.sglang == 'true' || needs.changed-files.outputs.deploy == 'true'
    uses: ./.github/workflows/shared-compliance-audit.yml
    with:
      framework: sglang
      target: runtime
      cuda_version: '13.0'
      target_tag_plain: ${{ needs.sglang-build.outputs.target_tag_plain }}
      baseline_sbom_file: ${{ needs.sglang-build.outputs.baseline_sbom_file }}

  trtllm-compliance-audit:
    name: trtllm-runtime # grouped in the UI with other trtllm jobs
    needs: [changed-files, trtllm-build]
    if: needs.changed-files.outputs.core == 'true' || needs.changed-files.outputs.trtllm == 'true' || needs.changed-files.outputs.deploy == 'true'
    uses: ./.github/workflows/shared-compliance-audit.yml
    with:
      framework: trtllm
      target: runtime
      cuda_version: '13.1'
      target_tag_plain: ${{ needs.trtllm-build.outputs.target_tag_plain }}
      baseline_sbom_file: ${{ needs.trtllm-build.outputs.baseline_sbom_file }}

  frontend-compliance-audit:
    name: frontend # grouped in the UI with other frontend jobs
    needs: [changed-files, frontend-build]
    # Mirror frontend-build's trigger so every rebuilt frontend image gets an
    # audit report, including operator/snapshot/deploy-driven rebuilds.
    if: |
      needs.changed-files.outputs.frontend == 'true' ||
      needs.changed-files.outputs.operator == 'true' ||
      needs.changed-files.outputs.snapshot == 'true' ||
      needs.changed-files.outputs.deploy == 'true'
    uses: ./.github/workflows/shared-compliance-audit.yml
    with:
      framework: dynamo
      target: frontend
      # frontend ships amd64+arm64; the audit scans the amd64 image only,
      # matching the single-arch framework audits above. Report-only.
      cuda_version: ''
      target_tag_plain: ${{ needs.frontend-build.outputs.target_tag_plain }}
      baseline_sbom_file: ${{ needs.frontend-build.outputs.baseline_sbom_file }}

  # planner stays on the legacy shared-compliance scan until it migrates to
  # the inline system that vllm/sglang/trtllm/frontend use above.
  planner-compliance:
    name: planner # This name overlaps with other planner jobs to group them in the UI
    needs: [changed-files, planner-build]
    if: needs.changed-files.outputs.core == 'true' || needs.changed-files.outputs.planner == 'true'
    uses: ./.github/workflows/shared-compliance.yml
    with:
      framework: dynamo
      target: planner
      target_tag_plain: ${{ needs.planner-build.outputs.target_tag_plain }}
      cuda_version: '[""]'
      platform: '["amd64", "arm64"]'
    secrets: inherit

  # ============================================================================
  # IMAGE COPY PIPELINES
  # ============================================================================

  vllm-copy-to-acr:
    name: vllm-runtime # This name overlaps with other vllm jobs to group them in the UI
    needs: [changed-files, vllm-build]
    if: |
      always() && !cancelled() &&
      (needs.changed-files.outputs.core == 'true' ||
       needs.changed-files.outputs.vllm == 'true' ||
       needs.changed-files.outputs.deploy == 'true' ||
       needs.changed-files.outputs.operator == 'true' ||
       needs.changed-files.outputs.snapshot == 'true') &&
      needs.vllm-build.result == 'success'
    uses: ./.github/workflows/shared-copy.yml
    with:
      target_tag_plain: ${{ needs.vllm-build.outputs.target_tag_plain }}
      cuda_version: '["13.0"]' # Deploy tests only use CUDA 13
      override_arch: amd64 # We are using AMD64 images only on the rest of the clusters.
      copy_timeout_minutes: 10
    secrets: inherit

  frontend-copy-to-acr:
    name: frontend
    needs: [changed-files, frontend-build]
    if: |
      always() && !cancelled() &&
      (needs.changed-files.outputs.snapshot == 'true') &&
      needs.frontend-build.result == 'success'
    uses: ./.github/workflows/shared-copy.yml
    with:
      target_tag_plain: ${{ needs.frontend-build.outputs.target_tag_plain }}
      cuda_version: '[""]'
      override_arch: amd64 # We are using AMD64 images only on the rest of the clusters.
      copy_timeout_minutes: 10
    secrets: inherit

  snapshot-placeholder-vllm:
    name: vLLM Snapshot Placeholder
    needs: [changed-files, vllm-copy-to-acr]
    if: |
      always() && !cancelled() &&
      (needs.changed-files.outputs.snapshot == 'true')
    runs-on: prod-default-v2
    steps:
      - name: Checkout code
        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd  # v6.0.2
        with:
          persist-credentials: false
      - name: Build and push snapshot placeholder
        uses: ./.github/actions/build-deploy-component
        with:
          component: snapshot
          target: placeholder
          image_tag: ${{ github.sha }}-vllm-placeholder
          builder_name: ${{ needs.changed-files.outputs.builder_name }}
          aws_default_region: ${{ secrets.AWS_DEFAULT_REGION }}
          aws_account_id: ${{ secrets.AWS_ACCOUNT_ID }}
          azure_acr_hostname: ${{ secrets.AZURE_ACR_HOSTNAME }}
          azure_acr_user: ${{ secrets.AZURE_ACR_USER }}
          azure_acr_password: ${{ secrets.AZURE_ACR_PASSWORD }}
          extra_tags: |
            ${{ secrets.AZURE_ACR_HOSTNAME }}/ai-dynamo/dynamo:${{ github.sha }}-vllm-placeholder
          extra_build_args: |
            BASE_IMAGE=${{ secrets.AZURE_ACR_HOSTNAME }}/ai-dynamo/dynamo:${{ github.sha }}-vllm-runtime

  sglang-copy-to-acr:
    name: sglang-runtime # This name overlaps with other sglang jobs to group them in the UI
    needs: [changed-files, sglang-build]
    if: |
      always() && !cancelled() &&
      (needs.changed-files.outputs.core == 'true' ||
       needs.changed-files.outputs.sglang == 'true' ||
       needs.changed-files.outputs.deploy == 'true' ||
       needs.changed-files.outputs.operator == 'true' ||
       needs.changed-files.outputs.snapshot == 'true') &&
      needs.sglang-build.result == 'success'
    uses: ./.github/workflows/shared-copy.yml
    with:
      target_tag_plain: ${{ needs.sglang-build.outputs.target_tag_plain }}
      cuda_version: '["13.0"]' # Deploy tests only use CUDA 13
      override_arch: amd64 # We are using AMD64 images only on the rest of the clusters.
      copy_timeout_minutes: 10
    secrets: inherit

  snapshot-placeholder-sglang:
    name: SGLang Snapshot Placeholder
    needs: [changed-files, sglang-copy-to-acr]
    if: |
      always() && !cancelled() &&
      (needs.changed-files.outputs.snapshot == 'true')
    runs-on: prod-default-v2
    steps:
      - name: Checkout code
        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd  # v6.0.2
        with:
          persist-credentials: false
      - name: Build and push snapshot placeholder
        uses: ./.github/actions/build-deploy-component
        with:
          component: snapshot
          target: placeholder
          image_tag: ${{ github.sha }}-sglang-placeholder
          builder_name: ${{ needs.changed-files.outputs.builder_name }}
          aws_default_region: ${{ secrets.AWS_DEFAULT_REGION }}
          aws_account_id: ${{ secrets.AWS_ACCOUNT_ID }}
          azure_acr_hostname: ${{ secrets.AZURE_ACR_HOSTNAME }}
          azure_acr_user: ${{ secrets.AZURE_ACR_USER }}
          azure_acr_password: ${{ secrets.AZURE_ACR_PASSWORD }}
          extra_tags: |
            ${{ secrets.AZURE_ACR_HOSTNAME }}/ai-dynamo/dynamo:${{ github.sha }}-sglang-placeholder
          extra_build_args: |
            BASE_IMAGE=${{ secrets.AZURE_ACR_HOSTNAME }}/ai-dynamo/dynamo:${{ github.sha }}-sglang-runtime

  trtllm-copy-to-acr:
    name: trtllm-runtime # This name overlaps with other trtllm jobs to group them in the UI
    needs: [changed-files, trtllm-build]
    if: |
      always() && !cancelled() &&
      (needs.changed-files.outputs.core == 'true' ||
       needs.changed-files.outputs.trtllm == 'true' ||
       needs.changed-files.outputs.deploy == 'true' ||
       needs.changed-files.outputs.operator == 'true' ||
       needs.changed-files.outputs.snapshot == 'true') &&
      needs.trtllm-build.result == 'success'
    uses: ./.github/workflows/shared-copy.yml
    with:
      target_tag_plain: ${{ needs.trtllm-build.outputs.target_tag_plain }}
      cuda_version: '["13.1"]'
      override_arch: amd64 # We are using AMD64 images only on the rest of the clusters.
      copy_timeout_minutes: 10
    secrets: inherit

  snapshot-placeholder-trtllm:
    name: TRTLLM Snapshot Placeholder
    needs: [changed-files, trtllm-copy-to-acr]
    if: |
      always() && !cancelled() &&
      (needs.changed-files.outputs.snapshot == 'true')
    runs-on: prod-default-v2
    steps:
      - name: Checkout code
        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd  # v6.0.2
        with:
          persist-credentials: false
      - name: Build and push snapshot placeholder
        uses: ./.github/actions/build-deploy-component
        with:
          component: snapshot
          target: placeholder
          image_tag: ${{ github.sha }}-trtllm-placeholder
          builder_name: ${{ needs.changed-files.outputs.builder_name }}
          aws_default_region: ${{ secrets.AWS_DEFAULT_REGION }}
          aws_account_id: ${{ secrets.AWS_ACCOUNT_ID }}
          azure_acr_hostname: ${{ secrets.AZURE_ACR_HOSTNAME }}
          azure_acr_user: ${{ secrets.AZURE_ACR_USER }}
          azure_acr_password: ${{ secrets.AZURE_ACR_PASSWORD }}
          extra_tags: |
            ${{ secrets.AZURE_ACR_HOSTNAME }}/ai-dynamo/dynamo:${{ github.sha }}-trtllm-placeholder
          extra_build_args: |
            BASE_IMAGE=${{ secrets.AZURE_ACR_HOSTNAME }}/ai-dynamo/dynamo:${{ github.sha }}-trtllm-runtime

  # ============================================================================
  # DEPLOY TEST PIPELINES
  # ============================================================================

  deploy-operator:
    if: |
      !cancelled() && !failure() &&
      (needs.changed-files.outputs.operator == 'true' ||
       needs.changed-files.outputs.vllm == 'true' ||
       needs.changed-files.outputs.sglang == 'true' ||
       needs.changed-files.outputs.trtllm == 'true' ||
       needs.changed-files.outputs.deploy == 'true') &&
      needs.operator.result == 'success'
    needs: [changed-files, operator]
    runs-on: prod-deploy-tester-v1
    permissions:
      contents: read
    outputs:
      namespace: ${{ steps.setup.outputs.namespace }}
      vcluster_name: ${{ steps.setup.outputs.vcluster_name }}
      operator_tag: ${{ steps.setup.outputs.operator_tag }}
    steps:
      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd  # v6.0.2
        with:
          persist-credentials: false
      - name: Setup vCluster and operator
        id: setup
        uses: ./.github/actions/setup-dynamo-operator
        with:
          registry: ${{ secrets.AZURE_ACR_HOSTNAME }}
          operator_tag: ${{ needs.operator.outputs.operator_default_tag }}
          hf_token: ${{ secrets.HF_TOKEN }}
          dockerhub_username: ${{ secrets.DOCKERHUB_LOGIN_USER }}
          dockerhub_password: ${{ secrets.DOCKERHUB_ACCESS_TOKEN }}

  deploy-test-vllm:
    name: vllm Deploy Test
    needs: [changed-files, deploy-operator, vllm-copy-to-acr]
    if: |
      !cancelled() && !failure() &&
      (needs.changed-files.outputs.vllm == 'true' ||
       needs.changed-files.outputs.deploy == 'true' ||
       needs.changed-files.outputs.operator == 'true')
    uses: ./.github/workflows/shared-deploy-test.yml
    with:
      framework: vllm
      profiles: '["agg", "agg_router", "disagg", "disagg_router"]'
      image_suffix: vllm-runtime
      namespace: ${{ needs.deploy-operator.outputs.namespace }}
      vcluster_name: ${{ needs.deploy-operator.outputs.vcluster_name }}
      operator_tag: ${{ needs.deploy-operator.outputs.operator_tag }}
    secrets: inherit

  deploy-test-sglang:
    name: sglang Deploy Test
    needs: [changed-files, deploy-operator, sglang-copy-to-acr]
    if: |
      !cancelled() && !failure() &&
      (needs.changed-files.outputs.sglang == 'true' ||
       needs.changed-files.outputs.deploy == 'true' ||
       needs.changed-files.outputs.operator == 'true')
    uses: ./.github/workflows/shared-deploy-test.yml
    with:
      framework: sglang
      profiles: '["agg", "agg_router"]'
      image_suffix: sglang-runtime
      namespace: ${{ needs.deploy-operator.outputs.namespace }}
      vcluster_name: ${{ needs.deploy-operator.outputs.vcluster_name }}
      operator_tag: ${{ needs.deploy-operator.outputs.operator_tag }}
    secrets: inherit

  deploy-test-trtllm:
    name: trtllm Deploy Test
    needs: [changed-files, deploy-operator, trtllm-copy-to-acr]
    if: |
      !cancelled() && !failure() &&
      (needs.changed-files.outputs.trtllm == 'true' ||
       needs.changed-files.outputs.deploy == 'true' ||
       needs.changed-files.outputs.operator == 'true')
    uses: ./.github/workflows/shared-deploy-test.yml
    with:
      framework: trtllm
      profiles: '["agg", "agg_router"]'
      image_suffix: trtllm-runtime
      namespace: ${{ needs.deploy-operator.outputs.namespace }}
      vcluster_name: ${{ needs.deploy-operator.outputs.vcluster_name }}
      operator_tag: ${{ needs.deploy-operator.outputs.operator_tag }}
    secrets: inherit

  deploy-operator-checkpoint-vllm:
    name: vLLM DynamoCheckpoint Operator Setup
    if: |
      always() && !cancelled() &&
      (needs.changed-files.outputs.snapshot == 'true') &&
      needs.operator.result == 'success'
    needs: [changed-files, operator]
    runs-on: prod-deploy-tester-v1
    permissions:
      contents: read
    outputs:
      namespace: ${{ steps.setup.outputs.namespace }}
      vcluster_name: ${{ steps.setup.outputs.vcluster_name }}
      operator_tag: ${{ steps.setup.outputs.operator_tag }}
    steps:
      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd  # v6.0.2
      - name: Setup vCluster and operator
        id: setup
        uses: ./.github/actions/setup-dynamo-operator
        with:
          vcluster_name: ci-${{ github.run_id }}-checkpoint-vllm
          vcluster_namespace: gh-id-${{ github.run_id }}-checkpoint-vllm-dt
          registry: ${{ secrets.AZURE_ACR_HOSTNAME }}
          operator_tag: ${{ needs.operator.outputs.operator_default_tag }}
          hf_token: ${{ secrets.HF_TOKEN }}
          dockerhub_username: ${{ secrets.DOCKERHUB_LOGIN_USER }}
          dockerhub_password: ${{ secrets.DOCKERHUB_ACCESS_TOKEN }}
          checkpoint_enabled: 'true'
          checkpoint_storage_size: 64Gi

  deploy-operator-checkpoint-sglang:
    name: SGLang DynamoCheckpoint Operator Setup
    if: |
      always() && !cancelled() &&
      (needs.changed-files.outputs.snapshot == 'true') &&
      needs.operator.result == 'success'
    needs: [changed-files, operator]
    runs-on: prod-deploy-tester-v1
    permissions:
      contents: read
    outputs:
      namespace: ${{ steps.setup.outputs.namespace }}
      vcluster_name: ${{ steps.setup.outputs.vcluster_name }}
      operator_tag: ${{ steps.setup.outputs.operator_tag }}
    steps:
      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd  # v6.0.2
      - name: Setup vCluster and operator
        id: setup
        uses: ./.github/actions/setup-dynamo-operator
        with:
          vcluster_name: ci-${{ github.run_id }}-checkpoint-sglang
          vcluster_namespace: gh-id-${{ github.run_id }}-checkpoint-sglang-dt
          registry: ${{ secrets.AZURE_ACR_HOSTNAME }}
          operator_tag: ${{ needs.operator.outputs.operator_default_tag }}
          hf_token: ${{ secrets.HF_TOKEN }}
          dockerhub_username: ${{ secrets.DOCKERHUB_LOGIN_USER }}
          dockerhub_password: ${{ secrets.DOCKERHUB_ACCESS_TOKEN }}
          checkpoint_enabled: 'true'
          checkpoint_storage_size: 64Gi

  deploy-operator-checkpoint-trtllm:
    name: TRTLLM DynamoCheckpoint Operator Setup
    if: |
      always() && !cancelled() &&
      (needs.changed-files.outputs.snapshot == 'true') &&
      needs.operator.result == 'success'
    needs: [changed-files, operator]
    runs-on: prod-deploy-tester-v1
    permissions:
      contents: read
    outputs:
      namespace: ${{ steps.setup.outputs.namespace }}
      vcluster_name: ${{ steps.setup.outputs.vcluster_name }}
      operator_tag: ${{ steps.setup.outputs.operator_tag }}
    steps:
      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd  # v6.0.2
      - name: Setup vCluster and operator
        id: setup
        uses: ./.github/actions/setup-dynamo-operator
        with:
          vcluster_name: ci-${{ github.run_id }}-checkpoint-trtllm
          vcluster_namespace: gh-id-${{ github.run_id }}-checkpoint-trtllm-dt
          registry: ${{ secrets.AZURE_ACR_HOSTNAME }}
          operator_tag: ${{ needs.operator.outputs.operator_default_tag }}
          hf_token: ${{ secrets.HF_TOKEN }}
          dockerhub_username: ${{ secrets.DOCKERHUB_LOGIN_USER }}
          dockerhub_password: ${{ secrets.DOCKERHUB_ACCESS_TOKEN }}
          checkpoint_enabled: 'true'
          checkpoint_storage_size: 64Gi

  deploy-snapshot-agent-checkpoint-vllm:
    name: vLLM DynamoCheckpoint Snapshot Agent Setup
    needs: [changed-files, deploy-operator-checkpoint-vllm, snapshot-agent]
    if: |
      always() && !cancelled() &&
      (needs.changed-files.outputs.snapshot == 'true') &&
      needs.deploy-operator-checkpoint-vllm.result == 'success' &&
      needs.snapshot-agent.result == 'success'
    runs-on: prod-deploy-tester-v1
    timeout-minutes: 15
    permissions:
      contents: read
    steps:
      - name: Checkout code
        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd  # v6.0.2
      - name: Check if vCluster exists
        id: vcluster-check
        uses: ./.github/actions/check-vcluster-exists
        with:
          vcluster_name: ${{ needs.deploy-operator-checkpoint-vllm.outputs.vcluster_name }}
          vcluster_namespace: ${{ needs.deploy-operator-checkpoint-vllm.outputs.namespace }}
      - name: Self-bootstrap vCluster (rerun)
        if: steps.vcluster-check.outputs.exists != 'true'
        uses: ./.github/actions/setup-dynamo-operator
        with:
          vcluster_name: ${{ needs.deploy-operator-checkpoint-vllm.outputs.vcluster_name }}
          vcluster_namespace: ${{ needs.deploy-operator-checkpoint-vllm.outputs.namespace }}
          registry: ${{ secrets.AZURE_ACR_HOSTNAME }}
          operator_tag: ${{ needs.deploy-operator-checkpoint-vllm.outputs.operator_tag }}
          hf_token: ${{ secrets.HF_TOKEN }}
          dockerhub_username: ${{ secrets.DOCKERHUB_LOGIN_USER }}
          dockerhub_password: ${{ secrets.DOCKERHUB_ACCESS_TOKEN }}
          checkpoint_enabled: 'true'
          checkpoint_storage_size: 64Gi
      - name: Connect to vCluster
        id: connect-vcluster
        uses: ./.github/actions/connect-vcluster
        with:
          vcluster_name: ${{ needs.deploy-operator-checkpoint-vllm.outputs.vcluster_name }}
          vcluster_namespace: ${{ needs.deploy-operator-checkpoint-vllm.outputs.namespace }}
      - name: Install snapshot-agent
        uses: ./.github/actions/setup-snapshot-agent
        with:
          kubeconfig_base64: ${{ steps.connect-vcluster.outputs.kubeconfig_base64 }}
          namespace: default
          snapshot_agent_image: ${{ secrets.AZURE_ACR_HOSTNAME }}/ai-dynamo/dynamo:${{ github.sha }}-snapshot-agent

  deploy-snapshot-agent-checkpoint-sglang:
    name: SGLang DynamoCheckpoint Snapshot Agent Setup
    needs: [changed-files, deploy-operator-checkpoint-sglang, snapshot-agent]
    if: |
      always() && !cancelled() &&
      (needs.changed-files.outputs.snapshot == 'true') &&
      needs.deploy-operator-checkpoint-sglang.result == 'success' &&
      needs.snapshot-agent.result == 'success'
    runs-on: prod-deploy-tester-v1
    timeout-minutes: 15
    permissions:
      contents: read
    steps:
      - name: Checkout code
        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd  # v6.0.2
      - name: Check if vCluster exists
        id: vcluster-check
        uses: ./.github/actions/check-vcluster-exists
        with:
          vcluster_name: ${{ needs.deploy-operator-checkpoint-sglang.outputs.vcluster_name }}
          vcluster_namespace: ${{ needs.deploy-operator-checkpoint-sglang.outputs.namespace }}
      - name: Self-bootstrap vCluster (rerun)
        if: steps.vcluster-check.outputs.exists != 'true'
        uses: ./.github/actions/setup-dynamo-operator
        with:
          vcluster_name: ${{ needs.deploy-operator-checkpoint-sglang.outputs.vcluster_name }}
          vcluster_namespace: ${{ needs.deploy-operator-checkpoint-sglang.outputs.namespace }}
          registry: ${{ secrets.AZURE_ACR_HOSTNAME }}
          operator_tag: ${{ needs.deploy-operator-checkpoint-sglang.outputs.operator_tag }}
          hf_token: ${{ secrets.HF_TOKEN }}
          dockerhub_username: ${{ secrets.DOCKERHUB_LOGIN_USER }}
          dockerhub_password: ${{ secrets.DOCKERHUB_ACCESS_TOKEN }}
          checkpoint_enabled: 'true'
          checkpoint_storage_size: 64Gi
      - name: Connect to vCluster
        id: connect-vcluster
        uses: ./.github/actions/connect-vcluster
        with:
          vcluster_name: ${{ needs.deploy-operator-checkpoint-sglang.outputs.vcluster_name }}
          vcluster_namespace: ${{ needs.deploy-operator-checkpoint-sglang.outputs.namespace }}
      - name: Install snapshot-agent
        uses: ./.github/actions/setup-snapshot-agent
        with:
          kubeconfig_base64: ${{ steps.connect-vcluster.outputs.kubeconfig_base64 }}
          namespace: default
          snapshot_agent_image: ${{ secrets.AZURE_ACR_HOSTNAME }}/ai-dynamo/dynamo:${{ github.sha }}-snapshot-agent

  deploy-snapshot-agent-checkpoint-trtllm:
    name: TRTLLM DynamoCheckpoint Snapshot Agent Setup
    needs: [changed-files, deploy-operator-checkpoint-trtllm, snapshot-agent]
    if: |
      always() && !cancelled() &&
      (needs.changed-files.outputs.snapshot == 'true') &&
      needs.deploy-operator-checkpoint-trtllm.result == 'success' &&
      needs.snapshot-agent.result == 'success'
    runs-on: prod-deploy-tester-v1
    timeout-minutes: 15
    permissions:
      contents: read
    steps:
      - name: Checkout code
        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd  # v6.0.2
      - name: Check if vCluster exists
        id: vcluster-check
        uses: ./.github/actions/check-vcluster-exists
        with:
          vcluster_name: ${{ needs.deploy-operator-checkpoint-trtllm.outputs.vcluster_name }}
          vcluster_namespace: ${{ needs.deploy-operator-checkpoint-trtllm.outputs.namespace }}
      - name: Self-bootstrap vCluster (rerun)
        if: steps.vcluster-check.outputs.exists != 'true'
        uses: ./.github/actions/setup-dynamo-operator
        with:
          vcluster_name: ${{ needs.deploy-operator-checkpoint-trtllm.outputs.vcluster_name }}
          vcluster_namespace: ${{ needs.deploy-operator-checkpoint-trtllm.outputs.namespace }}
          registry: ${{ secrets.AZURE_ACR_HOSTNAME }}
          operator_tag: ${{ needs.deploy-operator-checkpoint-trtllm.outputs.operator_tag }}
          hf_token: ${{ secrets.HF_TOKEN }}
          dockerhub_username: ${{ secrets.DOCKERHUB_LOGIN_USER }}
          dockerhub_password: ${{ secrets.DOCKERHUB_ACCESS_TOKEN }}
          checkpoint_enabled: 'true'
          checkpoint_storage_size: 64Gi
      - name: Connect to vCluster
        id: connect-vcluster
        uses: ./.github/actions/connect-vcluster
        with:
          vcluster_name: ${{ needs.deploy-operator-checkpoint-trtllm.outputs.vcluster_name }}
          vcluster_namespace: ${{ needs.deploy-operator-checkpoint-trtllm.outputs.namespace }}
      - name: Install snapshot-agent
        uses: ./.github/actions/setup-snapshot-agent
        with:
          kubeconfig_base64: ${{ steps.connect-vcluster.outputs.kubeconfig_base64 }}
          namespace: default
          snapshot_agent_image: ${{ secrets.AZURE_ACR_HOSTNAME }}/ai-dynamo/dynamo:${{ github.sha }}-snapshot-agent

  deploy-test-checkpoint-vllm:
    name: vLLM DynamoCheckpoint Deploy Test
    needs: [changed-files, deploy-operator-checkpoint-vllm, deploy-snapshot-agent-checkpoint-vllm, snapshot-placeholder-vllm, frontend-copy-to-acr]
    if: |
      always() && !cancelled() &&
      (needs.changed-files.outputs.snapshot == 'true') &&
      needs.deploy-snapshot-agent-checkpoint-vllm.result == 'success' &&
      needs.snapshot-placeholder-vllm.result == 'success' &&
      needs.frontend-copy-to-acr.result == 'success'
    runs-on: prod-deploy-tester-v1
    timeout-minutes: 30
    permissions:
      contents: read
    steps:
      - name: Checkout code
        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd  # v6.0.2
      - name: Check if vCluster exists
        id: vcluster-check
        uses: ./.github/actions/check-vcluster-exists
        with:
          vcluster_name: ${{ needs.deploy-operator-checkpoint-vllm.outputs.vcluster_name }}
          vcluster_namespace: ${{ needs.deploy-operator-checkpoint-vllm.outputs.namespace }}
      - name: Self-bootstrap vCluster (rerun)
        if: steps.vcluster-check.outputs.exists != 'true'
        uses: ./.github/actions/setup-dynamo-operator
        with:
          vcluster_name: ${{ needs.deploy-operator-checkpoint-vllm.outputs.vcluster_name }}
          vcluster_namespace: ${{ needs.deploy-operator-checkpoint-vllm.outputs.namespace }}
          registry: ${{ secrets.AZURE_ACR_HOSTNAME }}
          operator_tag: ${{ needs.deploy-operator-checkpoint-vllm.outputs.operator_tag }}
          hf_token: ${{ secrets.HF_TOKEN }}
          dockerhub_username: ${{ secrets.DOCKERHUB_LOGIN_USER }}
          dockerhub_password: ${{ secrets.DOCKERHUB_ACCESS_TOKEN }}
          checkpoint_enabled: 'true'
          checkpoint_storage_size: 64Gi
      - name: Connect to vCluster
        id: connect-vcluster
        uses: ./.github/actions/connect-vcluster
        with:
          vcluster_name: ${{ needs.deploy-operator-checkpoint-vllm.outputs.vcluster_name }}
          vcluster_namespace: ${{ needs.deploy-operator-checkpoint-vllm.outputs.namespace }}
      - name: Install snapshot-agent (rerun bootstrap)
        if: steps.vcluster-check.outputs.exists != 'true'
        uses: ./.github/actions/setup-snapshot-agent
        with:
          kubeconfig_base64: ${{ steps.connect-vcluster.outputs.kubeconfig_base64 }}
          namespace: default
          snapshot_agent_image: ${{ secrets.AZURE_ACR_HOSTNAME }}/ai-dynamo/dynamo:${{ github.sha }}-snapshot-agent
      - name: Run DynamoCheckpoint Deploy Test
        uses: ./.github/actions/dynamo-deploy-test
        with:
          kubeconfig_base64: ${{ steps.connect-vcluster.outputs.kubeconfig_base64 }}
          namespace: default
          registry: ${{ secrets.AZURE_ACR_HOSTNAME }}
          operator_tag: ${{ needs.deploy-operator-checkpoint-vllm.outputs.operator_tag }}
          framework: checkpoint
          profile: dgd_restore
          image: ${{ secrets.AZURE_ACR_HOSTNAME }}/ai-dynamo/dynamo:${{ github.sha }}-vllm-placeholder
          test_name: checkpoint_dgd_restore_vllm
          test_file: tests/deploy/test_dynamocheckpoint.py
          extra_pytest_args: >-
            -m dynamocheckpoint
            --checkpoint-backend=vllm
            --frontend-image=${{ secrets.AZURE_ACR_HOSTNAME }}/ai-dynamo/dynamo:${{ github.sha }}-dynamo-frontend

  deploy-test-checkpoint-sglang:
    name: SGLang DynamoCheckpoint Deploy Test
    needs: [changed-files, deploy-operator-checkpoint-sglang, deploy-snapshot-agent-checkpoint-sglang, snapshot-placeholder-sglang, frontend-copy-to-acr]
    if: |
      always() && !cancelled() &&
      (needs.changed-files.outputs.snapshot == 'true') &&
      needs.deploy-snapshot-agent-checkpoint-sglang.result == 'success' &&
      needs.snapshot-placeholder-sglang.result == 'success' &&
      needs.frontend-copy-to-acr.result == 'success'
    runs-on: prod-deploy-tester-v1
    timeout-minutes: 30
    permissions:
      contents: read
    steps:
      - name: Checkout code
        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd  # v6.0.2
      - name: Check if vCluster exists
        id: vcluster-check
        uses: ./.github/actions/check-vcluster-exists
        with:
          vcluster_name: ${{ needs.deploy-operator-checkpoint-sglang.outputs.vcluster_name }}
          vcluster_namespace: ${{ needs.deploy-operator-checkpoint-sglang.outputs.namespace }}
      - name: Self-bootstrap vCluster (rerun)
        if: steps.vcluster-check.outputs.exists != 'true'
        uses: ./.github/actions/setup-dynamo-operator
        with:
          vcluster_name: ${{ needs.deploy-operator-checkpoint-sglang.outputs.vcluster_name }}
          vcluster_namespace: ${{ needs.deploy-operator-checkpoint-sglang.outputs.namespace }}
          registry: ${{ secrets.AZURE_ACR_HOSTNAME }}
          operator_tag: ${{ needs.deploy-operator-checkpoint-sglang.outputs.operator_tag }}
          hf_token: ${{ secrets.HF_TOKEN }}
          dockerhub_username: ${{ secrets.DOCKERHUB_LOGIN_USER }}
          dockerhub_password: ${{ secrets.DOCKERHUB_ACCESS_TOKEN }}
          checkpoint_enabled: 'true'
          checkpoint_storage_size: 64Gi
      - name: Connect to vCluster
        id: connect-vcluster
        uses: ./.github/actions/connect-vcluster
        with:
          vcluster_name: ${{ needs.deploy-operator-checkpoint-sglang.outputs.vcluster_name }}
          vcluster_namespace: ${{ needs.deploy-operator-checkpoint-sglang.outputs.namespace }}
      - name: Install snapshot-agent (rerun bootstrap)
        if: steps.vcluster-check.outputs.exists != 'true'
        uses: ./.github/actions/setup-snapshot-agent
        with:
          kubeconfig_base64: ${{ steps.connect-vcluster.outputs.kubeconfig_base64 }}
          namespace: default
          snapshot_agent_image: ${{ secrets.AZURE_ACR_HOSTNAME }}/ai-dynamo/dynamo:${{ github.sha }}-snapshot-agent
      - name: Run DynamoCheckpoint Deploy Test
        uses: ./.github/actions/dynamo-deploy-test
        with:
          kubeconfig_base64: ${{ steps.connect-vcluster.outputs.kubeconfig_base64 }}
          namespace: default
          registry: ${{ secrets.AZURE_ACR_HOSTNAME }}
          operator_tag: ${{ needs.deploy-operator-checkpoint-sglang.outputs.operator_tag }}
          framework: checkpoint
          profile: dgd_restore
          image: ${{ secrets.AZURE_ACR_HOSTNAME }}/ai-dynamo/dynamo:${{ github.sha }}-sglang-placeholder
          test_name: checkpoint_dgd_restore_sglang
          test_file: tests/deploy/test_dynamocheckpoint.py
          extra_pytest_args: >-
            -m dynamocheckpoint
            --checkpoint-backend=sglang
            --frontend-image=${{ secrets.AZURE_ACR_HOSTNAME }}/ai-dynamo/dynamo:${{ github.sha }}-dynamo-frontend

  deploy-test-checkpoint-trtllm:
    name: TRTLLM DynamoCheckpoint Deploy Test
    needs: [changed-files, deploy-operator-checkpoint-trtllm, deploy-snapshot-agent-checkpoint-trtllm, snapshot-placeholder-trtllm, frontend-copy-to-acr]
    if: |
      always() && !cancelled() &&
      (needs.changed-files.outputs.snapshot == 'true') &&
      needs.deploy-snapshot-agent-checkpoint-trtllm.result == 'success' &&
      needs.snapshot-placeholder-trtllm.result == 'success' &&
      needs.frontend-copy-to-acr.result == 'success'
    runs-on: prod-deploy-tester-v1
    timeout-minutes: 30
    permissions:
      contents: read
    steps:
      - name: Checkout code
        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd  # v6.0.2
      - name: Check if vCluster exists
        id: vcluster-check
        uses: ./.github/actions/check-vcluster-exists
        with:
          vcluster_name: ${{ needs.deploy-operator-checkpoint-trtllm.outputs.vcluster_name }}
          vcluster_namespace: ${{ needs.deploy-operator-checkpoint-trtllm.outputs.namespace }}
      - name: Self-bootstrap vCluster (rerun)
        if: steps.vcluster-check.outputs.exists != 'true'
        uses: ./.github/actions/setup-dynamo-operator
        with:
          vcluster_name: ${{ needs.deploy-operator-checkpoint-trtllm.outputs.vcluster_name }}
          vcluster_namespace: ${{ needs.deploy-operator-checkpoint-trtllm.outputs.namespace }}
          registry: ${{ secrets.AZURE_ACR_HOSTNAME }}
          operator_tag: ${{ needs.deploy-operator-checkpoint-trtllm.outputs.operator_tag }}
          hf_token: ${{ secrets.HF_TOKEN }}
          dockerhub_username: ${{ secrets.DOCKERHUB_LOGIN_USER }}
          dockerhub_password: ${{ secrets.DOCKERHUB_ACCESS_TOKEN }}
          checkpoint_enabled: 'true'
          checkpoint_storage_size: 64Gi
      - name: Connect to vCluster
        id: connect-vcluster
        uses: ./.github/actions/connect-vcluster
        with:
          vcluster_name: ${{ needs.deploy-operator-checkpoint-trtllm.outputs.vcluster_name }}
          vcluster_namespace: ${{ needs.deploy-operator-checkpoint-trtllm.outputs.namespace }}
      - name: Install snapshot-agent (rerun bootstrap)
        if: steps.vcluster-check.outputs.exists != 'true'
        uses: ./.github/actions/setup-snapshot-agent
        with:
          kubeconfig_base64: ${{ steps.connect-vcluster.outputs.kubeconfig_base64 }}
          namespace: default
          snapshot_agent_image: ${{ secrets.AZURE_ACR_HOSTNAME }}/ai-dynamo/dynamo:${{ github.sha }}-snapshot-agent
      - name: Run DynamoCheckpoint Deploy Test
        uses: ./.github/actions/dynamo-deploy-test
        with:
          kubeconfig_base64: ${{ steps.connect-vcluster.outputs.kubeconfig_base64 }}
          namespace: default
          registry: ${{ secrets.AZURE_ACR_HOSTNAME }}
          operator_tag: ${{ needs.deploy-operator-checkpoint-trtllm.outputs.operator_tag }}
          framework: checkpoint
          profile: dgd_restore
          image: ${{ secrets.AZURE_ACR_HOSTNAME }}/ai-dynamo/dynamo:${{ github.sha }}-trtllm-placeholder
          test_name: checkpoint_dgd_restore_trtllm
          test_file: tests/deploy/test_dynamocheckpoint.py
          extra_pytest_args: >-
            -m dynamocheckpoint
            --checkpoint-backend=trtllm
            --frontend-image=${{ secrets.AZURE_ACR_HOSTNAME }}/ai-dynamo/dynamo:${{ github.sha }}-dynamo-frontend

  deploy-cleanup:
    if: always()
    needs: [deploy-operator, deploy-test-vllm, deploy-test-sglang, deploy-test-trtllm]
    runs-on: prod-deploy-tester-v1
    steps:
      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd  # v6.0.2
        with:
          persist-credentials: false
      - name: Teardown vCluster
        if: needs.deploy-operator.outputs.namespace != '' && needs.deploy-operator.outputs.vcluster_name != ''
        uses: ./.github/actions/teardown-dynamo-operator
        with:
          vcluster_name: ${{ needs.deploy-operator.outputs.vcluster_name }}
          vcluster_namespace: ${{ needs.deploy-operator.outputs.namespace }}

  deploy-cleanup-checkpoint-vllm:
    name: vLLM DynamoCheckpoint Cleanup
    if: |
      always() &&
      (needs.changed-files.outputs.snapshot == 'true')
    needs: [changed-files, deploy-operator-checkpoint-vllm, deploy-snapshot-agent-checkpoint-vllm, deploy-test-checkpoint-vllm]
    runs-on: prod-deploy-tester-v1
    steps:
      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd  # v6.0.2
      - name: Teardown vCluster
        uses: ./.github/actions/teardown-dynamo-operator
        with:
          vcluster_name: ci-${{ github.run_id }}-checkpoint-vllm
          vcluster_namespace: gh-id-${{ github.run_id }}-checkpoint-vllm-dt

  deploy-cleanup-checkpoint-sglang:
    name: SGLang DynamoCheckpoint Cleanup
    if: |
      always() &&
      (needs.changed-files.outputs.snapshot == 'true')
    needs: [changed-files, deploy-operator-checkpoint-sglang, deploy-snapshot-agent-checkpoint-sglang, deploy-test-checkpoint-sglang]
    runs-on: prod-deploy-tester-v1
    steps:
      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd  # v6.0.2
      - name: Teardown vCluster
        uses: ./.github/actions/teardown-dynamo-operator
        with:
          vcluster_name: ci-${{ github.run_id }}-checkpoint-sglang
          vcluster_namespace: gh-id-${{ github.run_id }}-checkpoint-sglang-dt

  deploy-cleanup-checkpoint-trtllm:
    name: TRTLLM DynamoCheckpoint Cleanup
    if: |
      always() &&
      (needs.changed-files.outputs.snapshot == 'true')
    needs: [changed-files, deploy-operator-checkpoint-trtllm, deploy-snapshot-agent-checkpoint-trtllm, deploy-test-checkpoint-trtllm]
    runs-on: prod-deploy-tester-v1
    steps:
      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd  # v6.0.2
      - name: Teardown vCluster
        uses: ./.github/actions/teardown-dynamo-operator
        with:
          vcluster_name: ci-${{ github.run_id }}-checkpoint-trtllm
          vcluster_namespace: gh-id-${{ github.run_id }}-checkpoint-trtllm-dt

  clean-k8s-builder:
    name: Clean K8s builder if exists
    runs-on: prod-default-small-v2
    if: always()
    needs:
      - changed-files
      - operator
      - snapshot-agent
      - snapshot-placeholder-vllm
      - snapshot-placeholder-sglang
      - snapshot-placeholder-trtllm
      - power-agent
      - planner-test
      - vllm-copy-to-acr
      - vllm-multi-gpu-test
      - vllm-efa-build
      - sglang-copy-to-acr
      - sglang-multi-gpu-test
      - sglang-efa-build
      - trtllm-copy-to-acr
      - trtllm-multi-gpu-test
      - trtllm-efa-build
      - dynamo-pipeline
    steps:
      - name: Checkout repository
        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd  # v6.0.2
        with:
          persist-credentials: false
      - name: Create K8s builders (skip bootstrap)
        uses: ./.github/actions/bootstrap-buildkit
        continue-on-error: true
        with:
          builder_name: ${{ needs.changed-files.outputs.builder_name }}
          buildkit_worker_addresses: ''
          skip_bootstrap: true
      - name: Builder Cleanup in case of k8s builder
        shell: bash
        run: |
          docker buildx rm ${{ needs.changed-files.outputs.builder_name }} || true

  # ============================================================================
  # ALLURE REPORT
  # Generate Allure test report and deploy to GitHub Pages
  # ============================================================================

  allure-report:
    needs:
      - changed-files
      - operator
      - vllm-build
      - vllm-test
      - vllm-multi-gpu-test
      - vllm-copy-to-acr
      - sglang-build
      - sglang-test
      - sglang-multi-gpu-test
      - sglang-copy-to-acr
      - trtllm-build
      - trtllm-test
      - trtllm-multi-gpu-test
      - trtllm-copy-to-acr
      - deploy-test-vllm
      - deploy-test-sglang
      - deploy-test-trtllm
      - deploy-test-checkpoint-vllm
      - deploy-test-checkpoint-sglang
      - deploy-test-checkpoint-trtllm
    if: false
    # Disabled: gh-pages branch bloated to ~1GB after 72 commits of Allure reports
    # if: ${{ !cancelled() }}
    uses: ./.github/workflows/generate-allure-report.yml
    with:
      run_id: ${{ github.run_id }}
      subdir: pr
      workflow_label: PR
    permissions:
      contents: write
      actions: read