Skip to content

Nmailhot/release 1.4.0 rc1#1923

Open
nv-nmailhot wants to merge 13 commits into
release/1.4.0from
nmailhot/release-1.4.0-rc1
Open

Nmailhot/release 1.4.0 rc1#1923
nv-nmailhot wants to merge 13 commits into
release/1.4.0from
nmailhot/release-1.4.0-rc1

Conversation

@nv-nmailhot

@nv-nmailhot nv-nmailhot commented Jul 9, 2026

Copy link
Copy Markdown
Contributor

What?

Describe what this PR is doing.

Why?

Justification for the PR. If there is an existing issue/bug, please reference it. For
bug fixes, the 'Why?' and 'What?' can be merged into a single item.

How?

It is optional, but for complex PRs, please provide information about the design,
architecture, approach, etc.

nv-nmailhot and others added 13 commits July 9, 2026 15:15
@nv-nmailhot @claude
build(manylinux): bundle the INFINIA plugin into release wheels
519d896 
Re-apply only the INFINIA wheel-build changes from #1841 onto release/1.3.1
(the native GitHub Actions pipeline was reverted separately):

- contrib/Dockerfile.manylinux: build wheels on the public PyPA manylinux_2_28
  base + NGC CUDA (the internal GitLab base isn't reachable from the AWS
  runners), pull the DDN "red" libs from a mirrored ECR image into
  /opt/ddn/red so meson auto-detects red_client and builds the INFINIA plugin,
  and source-build the liburing 2.14 / OpenLDAP 2.6 transitive deps EL8 lacks
  at the right soname. INFINIA_VARIANT=none yields an empty stub for external
  builds without the private image.
- contrib/build-container.sh: --cuda-version (MAJOR.MINOR, validated for
  manylinux) and --no-infinia (INFINIA_VARIANT=none); disable buildx
  provenance/sbom attestations via env var.
- README: document the manylinux wheel build and the --no-infinia path.

Excludes the #1775-derived changes carried in #1841 (the contrib/Dockerfile
EP/torch-versions edit and the manylinux wheel-build EP_BUILD_FLAGS reformat),
since #1775 isn't on release/1.3.1 and its build-wheel.sh doesn't accept
--torch-versions.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
@nv-nmailhot @claude
ci: build blossom manylinux wheels without INFINIA (--no-infinia)
dd9b416 
The blossom nixl-ci-build-wheel runner authenticates only to
artifactory.nvidia.com and cannot pull the private INFINIA libs image
(AWS ECR 210086341041...), which was provisioned for the velonix AWS
runners. Pulling it aborts the build with "authentication required".

- build-wheel-matrix.yaml: pass --no-infinia (build the wheel without the
  INFINIA plugin; all other plugins unaffected) and --cuda-version 13.0 to
  match BASE_TAG (drives the cu13 torch index / meta-wheel split).
- build-container.sh: when --no-infinia is set, repoint INFINIA_LIBS_IMAGE
  at the already-pulled base image so the private-registry FROM is never a
  hard dependency even if the builder (podman/buildah) doesn't prune the
  unreferenced infinia-bundled stage the way BuildKit does.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
@nv-nmailhot @claude
ci: trigger build
3ddac44 
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
@nv-nmailhot @claude
ci: retrigger build
a2e9420 
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
@nv-nmailhot @claude
ci: add GitHub Actions release pipeline for RC builds
c7359b7 
Bring the native GHA release pipeline onto release/1.3.1 + INFINIA so an RC tag
(v1.3.1-rcN) builds the container/wheel variants on the velonix runners, pushes
them to ECR, publishes wheels + crates + the runtime container to Artifactory,
and triggers the GitLab nSpect/scan pipeline.

- ci.yml, actionlint.yaml, stg-nixl-*.yml; retire build_validation.yml + mirror_repo.sh.
- Wheels (upload-x86/arm-wheels) and crates (upload-crates) publish automatically
  to JFrog Artifactory on the RC tag (repo-level ARTIFACTORY_* secrets).
- Runtime container (contrib/Dockerfile variant) pushed to Artifactory
  sw-dynamo-nixl-docker-local/nixl:<tag>, reusing ARTIFACTORY_URL + ARTIFACTORY_PYPI_TOKEN
  (from nmailhot/nixl-artifactory-container-push).
- trigger-gitlab-nspect keeps environment: release (its GITLAB_NIXL_* secrets are
  scoped to that environment); fires on the RC tag.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
@nv-nmailhot @claude
ci: raise build timeout 120m -> 240m for ARM manylinux + INFINIA
4a5ed0a 
The ARM manylinux variants build UCX/abseil/gRPC/nixl plus the INFINIA
liburing/openldap deps from source; arm cu12.9 runs ~1h43m and arm cu13
exceeded the 2h cap. Match the legacy Jenkins container job's 240m budget.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
@nv-nmailhot @claude
ci: add script to publish wheels/crates to Artifactory from a build run
cd55ff4 
Mirrors the ci.yml upload-x86-wheels/upload-arm-wheels/upload-crates jobs so an
already-completed build (e.g. a PR run whose upload jobs were gated off) can be
published without a full rebuild. Downloads the run's dist-* artifacts via gh and
uploads via the jfrog-cli image; crates optionally via cargo from the built image.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
@nv-nmailhot @claude
ci: pass Artifactory token via env in upload script (no -x leak)
a2b5168 
Avoid echoing the access token: pass it to the jfrog-cli container via -e ART_TOKEN
and drop 'set -x' from the upload command.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
@nv-nmailhot @claude
ci: remove failing scan-wheels and test-cpp-no-gpu jobs
fe36b3b 
Both were failing the release pipeline without gating artifact publish:
- test-cpp-no-gpu: pre-existing C++ CPU test failure (also red on the PR build)
- scan-wheels: wheeltamer scan failing at pull/scan time
Neither is a dependency of the upload/nspect chain, so removing them unblocks the
pipeline. test-python-no-gpu (passing) and the deferred GPU jobs are kept.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
@nv-nmailhot @claude
ci: TODO to add cu13 + arm64 runtime-container variants
d6334d4 
Document that only the cu12.9 x86_64 runtime container ships today; the cu13 matrix
entries are wheel builders (Dockerfile.manylinux), not runtime containers.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
@nv-nmailhot @claude
ci: drop the cu13/arm container TODO comment (tracked in task list in…
4c4f231 
…stead)

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
@nv-nmailhot @claude
ci: remove stg-nixl staging pipelines
d44ea87 
Drop the stg-nixl-build / stg-nixl-smoke staging-validation workflows; not needed
for the release pipeline. (The stg-nixl-builder-* runner labels in actionlint.yaml
are kept — they back the NIXL_RUNNER_PREFIX=stg selection in ci.yml, not these files.)

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
@nv-nmailhot @claude
ci: add SPDX license header to upload-release-artifacts.sh
7f03e76 
Fixes the copyright-check failure on the PR (the script was missing the required
SPDX-FileCopyrightText / SPDX-License-Identifier header).

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
@nv-nmailhot nv-nmailhot requested review from a team as code owners July 9, 2026 22:17
@copy-pr-bot

copy-pr-bot Bot commented Jul 9, 2026

Copy link
Copy Markdown

This pull request requires additional validation before any workflows can run on NVIDIA's runners.

Pull request vetters can view their responsibilities here.

Contributors can view more details about this message here.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

size/XL

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

1 participant

@nv-nmailhot