chore(deps): bump the github-actions group across 1 directory with 6 … #250
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: CI | |
| # Trusted triggers only. We deliberately avoid `pull_request`, which would execute an | |
| # untrusted PR's build scripts and test code on the runner. PRs are instead validated in | |
| # the merge queue (`merge_group`), which runs the trusted, about-to-merge content. | |
| on: | |
| push: | |
| branches: ['**'] | |
| merge_group: | |
| workflow_dispatch: | |
| # Cancel superseded runs on the same ref so pushes don't pile up. | |
| concurrency: | |
| group: ci-${{ github.workflow }}-${{ github.ref }} | |
| cancel-in-progress: true | |
| # Least privilege by default. | |
| permissions: | |
| contents: read | |
| env: | |
| CARGO_TERM_COLOR: always | |
| # Incremental compilation is a loss in CI (no warm incremental dir); turning it | |
| # off shrinks the cached target/ and speeds cold builds. | |
| CARGO_INCREMENTAL: "0" | |
| RUST_BACKTRACE: "1" | |
| # Harden cargo against flaky crates.io fetches. HTTP/2 multiplexing is what | |
| # throws the intermittent "curl [16] Error in the HTTP2 framing layer" during | |
| # crate downloads; force HTTP/1.1 to dodge that class entirely, and retry the | |
| # other transient blips instead of failing the (non-blocking) nightly line. | |
| CARGO_HTTP_MULTIPLEXING: "false" | |
| CARGO_NET_RETRY: "10" | |
| jobs: | |
| # One job, ordered fail-fast: fmt is instant, then the compile-heavy steps share a | |
| # single warm target/ and the cached git deps (vllm-engine-core-client, nixl-sys), | |
| # which dominate build time. The default build is pure-Rust (no libnixl/UCX), so it | |
| # needs nothing beyond the toolchain. | |
| build-and-test: | |
| runs-on: ubuntu-latest | |
| permissions: | |
| contents: read | |
| id-token: write | |
| steps: | |
| - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 | |
| with: | |
| persist-credentials: false | |
| # Toolchain plus coarse Cargo cache; sccache adds compiler object caching. | |
| - uses: actions-rust-lang/setup-rust-toolchain@ecabd13d1c56bd1345c230e542e9144811ad706f # v2.0.0 | |
| with: | |
| components: rustfmt, clippy | |
| - uses: ./.github/actions/setup-sccache | |
| if: ${{ vars.SCCACHE_ROLE_ARN != '' }} | |
| with: | |
| role-arn: ${{ vars.SCCACHE_ROLE_ARN }} | |
| bucket: ${{ vars.SCCACHE_BUCKET }} | |
| region: ${{ vars.SCCACHE_REGION }} | |
| key-prefix: ${{ vars.SCCACHE_S3_KEY_PREFIX }} | |
| - name: Format | |
| run: cargo fmt --all --check | |
| - name: Clippy (default features) | |
| run: cargo clippy --workspace --all-targets --locked --no-deps -- -D warnings | |
| - name: Test (default features) | |
| run: cargo test --workspace --locked | |
| # Keep the trace tooling crate free of the vLLM engine-core git dependency, | |
| # so trace/calibration work builds without compiling the protocol stack. | |
| - name: sim-trace stays vLLM-free | |
| run: "! cargo tree -p sim-trace -e normal -i vllm-engine-core-client" | |
| # Typecheck the NIXL data-plane code (incl. the loopback test + examples) against | |
| # the stub bindings. The real transfer needs libnixl/UCX and runs on Linux with | |
| # the `nixl` feature (out of this fast lane); `check` doesn't link, so it's quick. | |
| # The nixl features live on the root package, so this stays root-scoped. | |
| - name: Check (nixl-stub) | |
| run: cargo check --all-targets --locked --features nixl-stub | |
| # Synthetic E2E engine tests - validates engine behavior against programmatically | |
| # generated traces covering all schema variants and edge cases. Fast (no real GPU | |
| # captures), deterministic (seeded RNG), parallel-safe (unique IPC per test). | |
| synthetic-e2e: | |
| runs-on: ubuntu-latest | |
| needs: build-and-test # Run after main build passes | |
| permissions: | |
| contents: read | |
| # Mint a GitHub OIDC token so setup-sccache can assume the AWS role. | |
| id-token: write | |
| steps: | |
| - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 | |
| with: | |
| persist-credentials: false | |
| - uses: actions-rust-lang/setup-rust-toolchain@ecabd13d1c56bd1345c230e542e9144811ad706f # v2.0.0 | |
| - uses: ./.github/actions/setup-sccache | |
| if: ${{ vars.SCCACHE_ROLE_ARN != '' }} | |
| with: | |
| role-arn: ${{ vars.SCCACHE_ROLE_ARN }} | |
| bucket: ${{ vars.SCCACHE_BUCKET }} | |
| region: ${{ vars.SCCACHE_REGION }} | |
| key-prefix: ${{ vars.SCCACHE_S3_KEY_PREFIX }} | |
| - name: Run synthetic E2E tests | |
| run: cargo test --test engine_synthetic_e2e --locked -- --nocapture --test-threads=4 | |
| env: | |
| RUST_BACKTRACE: "1" | |
| # Use faster synthetic traces in CI | |
| SYNTHETIC_E2E_FAST_MODE: "1" | |
| # Supply-chain gate: RUSTSEC advisories, license compatibility, and source | |
| # allowlisting over the whole dependency graph (config in deny.toml). The | |
| # advisories check is time-sensitive, so a newly published CVE can turn this red | |
| # on an unrelated push; that's the gate working (address or ignore-with-reason). | |
| deny: | |
| runs-on: ubuntu-latest | |
| steps: | |
| - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 | |
| with: | |
| persist-credentials: false | |
| - uses: EmbarkStudios/cargo-deny-action@3c6349835b2b7b196a839186cb8b78e02f7b5f25 # v2.1.1 | |
| with: | |
| command: check | |
| # Read compat.toml and emit the N-2 support window as a JSON matrix. Keeping the | |
| # parse in its own tiny job means the heavy per-line build job can `needs:` a | |
| # ready-made list instead of re-parsing the manifest per matrix leg. | |
| # | |
| # compat.toml is the source of truth (see docs/versioning.md). Each row carries | |
| # line, tag, protocol_rev, default, plus two fields derived from | |
| # conformance/manifest.toml: has_goldens and fidelity_validated (enough fidelity | |
| # goldens registered for the line). The build job gates per leg on the latter. | |
| compat-matrix: | |
| runs-on: ubuntu-latest | |
| outputs: | |
| include: ${{ steps.parse.outputs.include }} | |
| steps: | |
| - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 | |
| with: | |
| persist-credentials: false | |
| - uses: actions-rust-lang/setup-rust-toolchain@ecabd13d1c56bd1345c230e542e9144811ad706f # v2.0.0 | |
| # `cargo xtask ci-matrix` reads compat.toml + conformance/manifest.toml via | |
| # sim-compat and emits one row per [[vllm]] line (compact JSON on stdout). | |
| - name: Build matrix from compat.toml | |
| id: parse | |
| run: echo "include=$(cargo xtask ci-matrix)" >> "$GITHUB_OUTPUT" | |
| # Per-line build + conformance. One leg per compat.toml line, each compiling the | |
| # protocol crate against that line's rev (pinned into Cargo.toml by cargo xtask pin-vllm; | |
| # see that script for why --config can't do it). fmt/clippy stay in build-and-test | |
| # above: they don't depend on the vLLM rev, so running them once is enough. | |
| # | |
| # CPU-only throughout. The conformance step fetches that line's golden captures from | |
| # a private bucket by sha and replays them; see docs/conformance.md for the capture | |
| # side. fail-fast off so one drifting line doesn't cancel the others' signal. | |
| # | |
| # Gating: a leg is a hard gate ONLY for fidelity_validated lines, which is | |
| # derived: a stable line with the full golden set registered in | |
| # conformance/manifest.toml. On other lines every step below is | |
| # continue-on-error, so their failures surface as annotations and the leg (and | |
| # the conformance-gate check) stays green. The default line's build safety does | |
| # not depend on this: the build-and-test job above already hard-gates the default | |
| # pin (fmt/clippy/build/test). A line becomes a hard per-line gate the moment its | |
| # goldens land (the roll PR carries them, see golden-capture.yml). | |
| conformance: | |
| needs: compat-matrix | |
| runs-on: ubuntu-latest | |
| permissions: | |
| # Mint a GitHub OIDC token so the runner can assume the AWS golden-fetch | |
| # role; contents:read for the checkout. | |
| id-token: write | |
| contents: read | |
| strategy: | |
| fail-fast: false | |
| matrix: | |
| include: ${{ fromJSON(needs.compat-matrix.outputs.include) }} | |
| env: | |
| # Stamp this leg's line into the binary so build.rs doesn't fall back to the | |
| # compat.toml default for every leg. Drives the advertised vllm_version and the | |
| # conformance line check; build.rs reads this env first (see build.rs / src/lib.rs). | |
| VLLM_TARGET_VERSION: ${{ matrix.tag }} | |
| # Object-store bucket holding the golden captures (NOT in the repo). The | |
| # conformance runner reads each manifest bucket_path straight from here via | |
| # sim-s3 (it joins this bucket onto the key); the fetch role is scoped to | |
| # the conformance/ prefix. | |
| CONFORMANCE_BUCKET: "s3://llm-d-artifacts-783952637884" | |
| AWS_REGION: us-east-1 | |
| steps: | |
| - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 | |
| with: | |
| persist-credentials: false | |
| - uses: actions-rust-lang/setup-rust-toolchain@ecabd13d1c56bd1345c230e542e9144811ad706f # v2.0.0 | |
| - uses: ./.github/actions/setup-sccache | |
| if: ${{ vars.SCCACHE_ROLE_ARN != '' }} | |
| with: | |
| role-arn: ${{ vars.SCCACHE_ROLE_ARN }} | |
| bucket: ${{ vars.SCCACHE_BUCKET }} | |
| region: ${{ vars.SCCACHE_REGION }} | |
| key-prefix: ${{ vars.SCCACHE_S3_KEY_PREFIX }} | |
| # Pin Cargo.toml to this line's rev + fork patch. Cargo rejects patching a git | |
| # dep to a different rev of the same source, so the rev is swapped in | |
| # [workspace.dependencies] (not via --config); the per-line fork [patch] is | |
| # rewritten or removed. Refresh Cargo.lock so Rust compiles against that pin. | |
| - name: Pin vLLM rev (line ${{ matrix.line }}) | |
| continue-on-error: ${{ !matrix.fidelity_validated }} | |
| run: | | |
| cargo xtask pin-vllm "${{ matrix.line }}" | |
| cargo update -p vllm-engine-core-client | |
| - name: Build (vLLM ${{ matrix.line }} @ ${{ matrix.tag }}) | |
| continue-on-error: ${{ !matrix.fidelity_validated }} | |
| run: cargo build --workspace | |
| # Unit tests (--lib) only. The full-stack e2e integration tests (tests/) drive | |
| # the real EngineCoreClient, whose API is incomplete on older lines, so they're | |
| # HEAD-client-targeted and run on the default line via build-and-test. Per-line | |
| # behavioral coverage is the conformance replay below, not the e2e suite. | |
| - name: Unit tests (vLLM ${{ matrix.line }} @ ${{ matrix.tag }}) | |
| continue-on-error: ${{ !matrix.fidelity_validated }} | |
| run: cargo test --workspace --lib | |
| # Assume the least-privilege golden-fetch role via GitHub OIDC. The role | |
| # (llm-d-conformance-ci) trusts repo:neuralmagic/vllm-vcr:* and grants only | |
| # s3:GetObject on the conformance/ prefix. Skipped when the line has no | |
| # goldens, so the no-capture state needs no AWS. NOTE: the IAM trust policy's | |
| # sub condition must be updated to the new repo path on the GitHub rename. | |
| - name: Configure AWS credentials (golden fetch, vLLM ${{ matrix.line }}) | |
| if: ${{ matrix.has_goldens }} | |
| continue-on-error: ${{ !matrix.fidelity_validated }} | |
| uses: aws-actions/configure-aws-credentials@cbe3b392738ccf3f987d68400dafcf4b0624a56c # v6.2.4 | |
| with: | |
| role-to-assume: arn:aws:iam::783952637884:role/llm-d-conformance-ci | |
| aws-region: us-east-1 | |
| # The runner is tests/conformance.rs: manifest-driven, CPU-only. It reads | |
| # conformance/manifest.toml, fetches each golden for this build's line | |
| # straight from $CONFORMANCE_BUCKET via sim-s3 (using the AWS creds the OIDC | |
| # step exported), verifies the integrity sha256, and asserts line + | |
| # provenance (config_hash) + schema + fidelity (see docs/conformance.md). It | |
| # skips cleanly when no golden is listed for the line, so the step is safe | |
| # before captures exist. The hard-gate-vs-informational distinction is the | |
| # per-step continue-on-error (fidelity_validated lines block; others | |
| # annotate only). | |
| - name: Conformance replay (vLLM ${{ matrix.line }}) | |
| continue-on-error: ${{ !matrix.fidelity_validated }} | |
| run: | | |
| set -euo pipefail | |
| cargo test --test conformance -- --nocapture | |
| # One stable status context over the whole per-line matrix, for the branch | |
| # ruleset's required checks (matrix leg names carry the line and rev, so they | |
| # can't be required by name). Green iff every gated leg is green. | |
| conformance-gate: | |
| needs: conformance | |
| if: ${{ always() }} | |
| runs-on: ubuntu-latest | |
| steps: | |
| - run: test "${{ needs.conformance.result }}" = "success" |