fix: tokenreview caching improvements #2100

Workflow file for this run

	# SPDX-FileCopyrightText: Copyright (c) 2025-2026 NVIDIA CORPORATION & AFFILIATES. All rights reserved.
	# SPDX-License-Identifier: Apache-2.0

	name: CI/CD Pipeline

	on:
	push:
	branches: [ main, develop ]
	pull_request:
	branches:
	- main
	- 'release/*'

	env:
	CARGO_TERM_COLOR: always
	RUST_BACKTRACE: 1

	# Cancel any previous check runs for the same pull request to avoid redundant workflows.
	concurrency:
	group: ${{ github.event_name == 'pull_request' && format('{0}-{1}', github.workflow, github.event.pull_request.number) \|\| format('{0}-{1}', github.workflow, github.run_id) }}
	cancel-in-progress: ${{ github.event_name == 'pull_request' }}

	jobs:
	test:
	name: Test Suite
	runs-on: ubuntu-latest
	strategy:
	matrix:
	rust:
	- stable
	- beta
	- nightly
	include:
	- rust: stable
	can-fail: false
	- rust: beta
	can-fail: false
	- rust: nightly
	can-fail: true
	continue-on-error: ${{ matrix.can-fail }}

	steps:
	- name: Checkout repository
	uses: actions/checkout@v4

	- name: Install Rust toolchain
	run: \|
	curl --proto '=https' --tlsv1.2 -sSf https://sh.rustup.rs \| sh -s -- -y --default-toolchain stable
	echo "$HOME/.cargo/bin" >> $GITHUB_PATH

	- name: Check Rust version
	run: rustc --version

	- name: Cache dependencies
	uses: actions/cache@v4
	with:
	path: \|
	~/.cargo/registry
	~/.cargo/git
	target/
	key: ${{ runner.os }}-cargo-${{ matrix.rust }}-${{ hashFiles('**/Cargo.lock') }}
	restore-keys: \|
	${{ runner.os }}-cargo-${{ matrix.rust }}-
	${{ runner.os }}-cargo-

	- name: Install system dependencies
	run: \|
	sudo apt-get update
	sudo apt-get install -y protobuf-compiler

	- name: Check formatting
	if: matrix.rust == 'stable'
	run: cargo fmt --all -- --check

	- name: Lint with clippy
	if: matrix.rust == 'stable'
	run: cargo clippy --all-targets --all-features -- -D warnings

	- name: Build debug
	run: cargo build --verbose

	- name: Run unit tests
	run: cargo test --verbose --lib

	- name: Run server memory-backend unit tests
	run: cargo test -p modelexpress-server --features memory-backend --lib

	- name: Run integration tests
	if: matrix.rust == 'stable'
	run: cargo test -p modelexpress-server --features integration-tests --tests

	- name: Build release
	run: cargo build --release --verbose

	- name: Run doc tests
	run: cargo test --doc

	python-test:
	name: Python Tests (protobuf ${{ matrix.protobuf_major }})
	runs-on: ubuntu-latest
	strategy:
	fail-fast: false
	matrix:
	include:
	- protobuf_major: 5
	protobuf_spec: "protobuf==5.27.2"
	- protobuf_major: 6
	protobuf_spec: "protobuf>=6.30.2,<7.0.0"

	steps:
	- name: Checkout repository
	uses: actions/checkout@v4

	- name: Set up Python
	uses: actions/setup-python@v5
	with:
	python-version: "3.12"

	- name: Install uv
	run: pip install uv

	- name: Install dependencies
	working-directory: modelexpress_client/python
	run: \|
	uv venv .venv --python 3.12
	uv pip install -e ".[dev]" '${{ matrix.protobuf_spec }}'

	- name: Run tests
	working-directory: modelexpress_client/python
	run: \|
	.venv/bin/python -m pytest tests/ -v

	go-test:
	name: Go Bindings
	runs-on: ubuntu-latest

	steps:
	- name: Checkout repository
	uses: actions/checkout@v4

	- name: Set up Go
	uses: actions/setup-go@v5
	with:
	go-version: "1.24.x"
	cache-dependency-path: modelexpress_client/go/go.sum

	- name: Install system dependencies
	run: \|
	sudo apt-get update
	sudo apt-get install -y protobuf-compiler

	- name: Install protoc plugins
	run: \|
	go install google.golang.org/protobuf/cmd/protoc-gen-go@v1.36.11
	go install google.golang.org/grpc/cmd/protoc-gen-go-grpc@v1.6.0
	echo "$(go env GOPATH)/bin" >> "$GITHUB_PATH"

	- name: Validate generated bindings
	run: \|
	modelexpress_client/go/generate_proto.sh
	if [ -n "$(git status --porcelain -- modelexpress_client/go)" ]; then
	git status --porcelain -- modelexpress_client/go
	git diff -- modelexpress_client/go
	exit 1
	fi

	- name: Run Go tests
	working-directory: modelexpress_client/go
	run: go test ./...

	artifact-transfer-contract:
	name: Artifact Transfer Contract
	runs-on: ubuntu-latest
	permissions:
	contents: read

	steps:
	- name: Checkout repository
	uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5
	with:
	persist-credentials: false

	- name: Install Rust toolchain
	run: \|
	curl --proto '=https' --tlsv1.2 -sSf https://sh.rustup.rs \| sh -s -- -y --default-toolchain stable
	echo "$HOME/.cargo/bin" >> $GITHUB_PATH

	- name: Cache dependencies
	uses: actions/cache@0057852bfaa89a56745cba8c7296529d2fc39830
	with:
	path: \|
	~/.cargo/registry
	~/.cargo/git
	target/
	key: ${{ runner.os }}-cargo-artifact-transfer-${{ hashFiles('**/Cargo.lock') }}
	restore-keys: \|
	${{ runner.os }}-cargo-artifact-transfer-
	${{ runner.os }}-cargo-

	- name: Install system dependencies
	run: \|
	sudo apt-get update
	sudo apt-get install -y protobuf-compiler

	- name: Run artifact transfer contract tests
	run: \|
	cargo test -p model-express-workspace-tests --test artifact_transfer_contract

	integration-test:
	name: Integration Tests
	runs-on: ubuntu-latest
	needs: test

	services:
	redis:
	image: redis:7-alpine
	ports:
	- 6379:6379
	options: >-
	--health-cmd "redis-cli ping"
	--health-interval 5s
	--health-timeout 3s
	--health-retries 10

	steps:
	- name: Checkout repository
	uses: actions/checkout@v4

	- name: Install Rust toolchain
	run: \|
	curl --proto '=https' --tlsv1.2 -sSf https://sh.rustup.rs \| sh -s -- -y --default-toolchain stable
	echo "$HOME/.cargo/bin" >> $GITHUB_PATH

	- name: Check Rust version
	run: rustc --version

	- name: Cache dependencies
	uses: actions/cache@v4
	with:
	path: \|
	~/.cargo/registry
	~/.cargo/git
	target/
	key: ${{ runner.os }}-cargo-stable-${{ hashFiles('**/Cargo.lock') }}

	- name: Install system dependencies
	run: \|
	sudo apt-get update
	sudo apt-get install -y protobuf-compiler

	- name: Build release
	run: cargo build --release

	- name: Run registry backend Redis integration tests
	env:
	REDIS_URL: redis://localhost:6379
	run: \|
	cargo test -p model-express-workspace-tests \
	--test registry_backend_redis \
	-- --include-ignored --test-threads=1

	- name: Run integration test script
	env:
	MX_METADATA_BACKEND: redis
	REDIS_URL: redis://localhost:6379
	run: \|
	if [ -f run_integration_tests.sh ]; then
	chmod +x run_integration_tests.sh
	./run_integration_tests.sh \|\| echo "Integration test script failed (expected in CI)"
	fi

	security-audit:
	name: Security Audit
	runs-on: ubuntu-latest

	steps:
	- name: Checkout repository
	uses: actions/checkout@v4

	- name: Install Rust toolchain
	run: \|
	curl --proto '=https' --tlsv1.2 -sSf https://sh.rustup.rs \| sh -s -- -y --default-toolchain stable
	echo "$HOME/.cargo/bin" >> $GITHUB_PATH

	- name: Check Rust version
	run: rustc --version

	- name: Install cargo-audit
	run: cargo install cargo-audit

	- name: Run security audit
	run: cargo audit

	- name: Install and Run cargo-deny
	run: \|
	cargo-deny --version \|\| cargo install cargo-deny@0.16.4
	cargo-deny --no-default-features check --hide-inclusion-graph licenses bans --config ${{ github.workspace }}/deny.toml

	code-coverage:
	name: Code Coverage
	runs-on: ubuntu-latest
	needs: test

	steps:
	- name: Checkout repository
	uses: actions/checkout@v4

	- name: Install Rust toolchain
	run: \|
	curl --proto '=https' --tlsv1.2 -sSf https://sh.rustup.rs \| sh -s -- -y --default-toolchain stable
	echo "$HOME/.cargo/bin" >> $GITHUB_PATH

	- name: Check Rust version
	run: rustc --version

	- name: Install LLVM tools
	run: \|
	rustup component add llvm-tools-preview

	- name: Install system dependencies
	run: \|
	sudo apt-get update
	sudo apt-get install -y protobuf-compiler

	- name: Install cargo-llvm-cov
	run: cargo install cargo-llvm-cov

	- name: Generate code coverage
	run: cargo llvm-cov --all-features --workspace --lcov --output-path lcov.info

	- name: Upload coverage to Codecov
	uses: codecov/codecov-action@v3
	with:
	files: lcov.info
	fail_ci_if_error: false

	docker-build:
	name: Docker Build
	runs-on: ubuntu-latest
	needs: test

	steps:
	- name: Checkout repository
	uses: actions/checkout@v4

	- name: Build Docker image
	run: \|
	docker build -f docker/Dockerfile -t model-express:latest .

	- name: Test Docker image
	run: \|
	docker run --rm --detach --name test-server -p 8001:8001 model-express:latest
	sleep 10
	# Test that the server is responding (basic health check)
	timeout 30 bash -c 'until curl -s http://localhost:8001/health; do sleep 1; done' \|\| echo "Health check failed (expected for gRPC)"
	docker stop test-server \|\| true

	k8s-grpc-test:
	name: Kubernetes gRPC Transfer Test
	runs-on: ubuntu-latest
	needs: test

	steps:
	- name: Checkout repository
	uses: actions/checkout@v4

	- name: Install kubectl
	run: \|
	curl -LO "https://dl.k8s.io/release/$(curl -L -s https://dl.k8s.io/release/stable.txt)/bin/linux/amd64/kubectl"
	chmod +x kubectl
	sudo mv kubectl /usr/local/bin/

	- name: Install Helm
	run: \|
	curl https://raw.githubusercontent.com/helm/helm/main/scripts/get-helm-3 \| bash

	- name: Run gRPC transfer K8s test
	run: \|
	chmod +x test_grpc_transfer_k8s.sh
	./test_grpc_transfer_k8s.sh

Navigation Menu

Uh oh!

fix: tokenreview caching improvements #2100

Workflow file

fix: tokenreview caching improvements #2100

Uh oh!

Workflow file for this run