Derive the MCP proxy configuration and share OSMO's Redis #3919

Workflow file for this run

.github/workflows/pr-checks.yaml at 26bfd8e

	# SPDX-FileCopyrightText: Copyright (c) 2025-2026 NVIDIA CORPORATION & AFFILIATES. All rights reserved.
	#
	# Licensed under the Apache License, Version 2.0 (the "License");
	# you may not use this file except in compliance with the License.
	# You may obtain a copy of the License at
	#
	# http://www.apache.org/licenses/LICENSE-2.0
	#
	# Unless required by applicable law or agreed to in writing, software
	# distributed under the License is distributed on an "AS IS" BASIS,
	# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
	# See the License for the specific language governing permissions and
	# limitations under the License.
	#
	# SPDX-License-Identifier: Apache-2.0

	name: PR Checks

	on:
	workflow_dispatch:
	pull_request:
	types: [opened, synchronize, reopened]
	branches: [ main, 'feature/', 'release/' ]

	concurrency:
	group: ${{ github.workflow }}-${{ github.event.pull_request.number }}
	cancel-in-progress: true

	jobs:
	#######################
	# Path Filters #
	#######################
	check-paths:
	runs-on: ubuntu-latest
	outputs:
	ci: ${{ steps.filter.outputs.ci }}
	docs: ${{ steps.filter.outputs.docs }}
	ui: ${{ steps.filter.outputs.ui }}
	steps:
	- name: Checkout
	uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1
	with:
	fetch-depth: 0 # Fetch all history for accurate diffing

	- name: Check which paths changed
	uses: dorny/paths-filter@de90cc6fb38fc0963ad72b210f1f284cd68cea36 # v3.0.2
	id: filter
	with:
	# Use empty token to force git-based detection
	token: ''
	filters: \|
	ci:
	- '.github/workflows/pr-checks.yaml'
	- 'BUILD'
	- 'MODULE.bazel'
	- 'bzl/**'
	- 'src/**'
	- 'run/**'
	docs:
	- '.github/workflows/pr-checks.yaml'
	- 'docs/**'
	- 'cookbook/**'
	ui:
	- '.github/workflows/pr-checks.yaml'
	- 'src/ui/**'

	#######################
	# CI Tests #
	#######################
	ci-public:
	needs: [check-paths]
	if: \|
	(needs.check-paths.outputs.ci == 'true') &&
	(github.event_name == 'pull_request' && github.event.pull_request.head.repo.fork == true)
	runs-on: ubuntu-latest
	steps:
	- name: Free disk space
	run: \|
	echo "Disk space before cleanup:"
	df -h

	echo "Freeing disk space..."
	echo "Removing .NET..."
	sudo rm -rf /usr/share/dotnet \|\| true
	echo "Removing Android..."
	sudo rm -rf /usr/local/lib/android \|\| true
	echo "Removing GHC..."
	sudo rm -rf /opt/ghc \|\| true
	sudo rm -rf /usr/local/.ghcup \|\| true
	echo "Removing CodeQL..."
	sudo rm -rf /opt/hostedtoolcache/CodeQL \|\| true
	echo "Pruning Docker images..."
	sudo docker image prune --all --force \|\| true

	echo "Disk space after cleanup:"
	df -h

	- name: Checkout
	uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1
	with:
	lfs: true

	- name: Setup Bazel
	uses: bazel-contrib/setup-bazel@4fd964a13a440a8aeb0be47350db2fc640f19ca8
	with:
	bazelisk-cache: true
	bazelisk-version: 1.27.0
	disk-cache: ${{ github.workflow }}
	repository-cache: true
	external-cache: \|
	manifest:
	# Python dependencies
	osmo_python_deps: src/locked_requirements.txt
	osmo_tests_python_deps: src/tests/locked_requirements.txt
	osmo_mypy_deps: bzl/mypy/locked_requirements.txt
	pylint_python_deps: bzl/linting/locked_requirements.txt

	# Go dependencies
	io_bazel_rules_go: src/runtime/go.mod
	bazel_gazelle: src/runtime/go.sum

	- name: Run Tests
	run: \|
	bazel test --test_output=errors -- //...

	ci-internal:
	timeout-minutes: 30
	needs: [check-paths]
	if: \|
	(github.event_name == 'workflow_dispatch') \|\|
	(
	needs.check-paths.outputs.ci == 'true' &&
	github.event_name == 'pull_request' &&
	github.event.pull_request.head.repo.fork == false
	)
	# Serialize across PRs on the self-hosted runner: 16 GB main + 4 GB DinD
	# leaves no room for two concurrent runs on a 24 GB host.
	concurrency:
	group: ci-internal-self-hosted
	cancel-in-progress: false
	runs-on: self-hosted
	environment:
	name: internal-ci
	env:
	# Unique identifiers for Docker resources to prevent collisions
	COMPOSE_PROJECT_NAME: ci-${{ github.run_id }}
	DOCKER_BUILDKIT: "1"
	container:
	# python:3.14.2-bookworm pinned to digest for security (amd64)
	image: python:3.14.2-bookworm@sha256:bee107ebb973b658218ed57303beb7a8fd9f187dd574a740bc62bc88ea39b629
	env:
	DOCKER_HOST: "tcp://docker:2375"
	DOCKER_TLS_CERTDIR: ""
	options: --memory=16g --cpus=4 --memory-swap=16g --pids-limit=4096 -v /var/run/docker.sock:/var/run/docker.sock
	services:
	docker:
	# docker:29.2.1-dind pinned to digest for security
	image: docker:29.2.1-dind@sha256:2658fda9e8779b94ea1581f4d25214dac9ed144b407902842e5328cce8f861f5
	env:
	DOCKER_TLS_CERTDIR: ""
	DOCKER_DRIVER: overlay2
	options: --privileged --memory=4g --cpus=2
	ports:
	- 2375:2375
	steps:
	- name: Install Node.js, Docker CLI, kubectl, and dependencies
	run: \|
	apt-get update
	apt-get install -y ca-certificates curl gnupg git-lfs

	# Add Docker's official GPG key and repository
	install -m 0755 -d /etc/apt/keyrings
	curl -fsSL https://download.docker.com/linux/debian/gpg -o /etc/apt/keyrings/docker.asc
	chmod a+r /etc/apt/keyrings/docker.asc
	echo "deb [arch=$(dpkg --print-architecture) signed-by=/etc/apt/keyrings/docker.asc] https://download.docker.com/linux/debian $(. /etc/os-release && echo "$VERSION_CODENAME") stable" \| tee /etc/apt/sources.list.d/docker.list > /dev/null

	# Add Node.js 20.x from NodeSource
	curl -fsSL https://deb.nodesource.com/gpgkey/nodesource-repo.gpg.key \| gpg --dearmor -o /etc/apt/keyrings/nodesource.gpg
	echo "deb [signed-by=/etc/apt/keyrings/nodesource.gpg] https://deb.nodesource.com/node_20.x nodistro main" \| tee /etc/apt/sources.list.d/nodesource.list > /dev/null

	apt-get update

	# Install Docker CLI (client only, connects to DinD service)
	apt-get install -y docker-ce-cli

	# Install kubectl for deployment-script tests that render Secrets.
	KUBECTL_VERSION=v1.31.0
	curl -fsSLo /tmp/kubectl \
	"https://dl.k8s.io/release/${KUBECTL_VERSION}/bin/linux/amd64/kubectl"
	curl -fsSL "https://dl.k8s.io/release/${KUBECTL_VERSION}/bin/linux/amd64/kubectl.sha256" \
	\| awk '{print $1" /tmp/kubectl"}' \| sha256sum -c -
	install -m 0755 /tmp/kubectl /usr/local/bin/kubectl
	rm -f /tmp/kubectl

	# Remove Debian's nodejs package if present and install from NodeSource
	apt-get remove -y nodejs \|\| true
	apt-get install -y nodejs=20.*

	# Verify installations
	echo "Node.js version: $(node --version)"
	echo "npm version: $(npm --version)"
	echo "Docker version: $(docker --version)"
	kubectl version --client --output=yaml
	echo "Git LFS version: $(git-lfs --version)"

	- name: Clean up stale LFS hooks
	run: rm -f .git/hooks/pre-push .git/hooks/post-checkout .git/hooks/post-commit .git/hooks/post-merge \|\| true

	- name: Checkout
	uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1
	with:
	lfs: true

	- name: Setup Bazel
	uses: bazel-contrib/setup-bazel@4fd964a13a440a8aeb0be47350db2fc640f19ca8
	with:
	bazelisk-cache: true
	bazelisk-version: 1.27.0

	- name: Run Tests with Coverage
	run: \|
	bazel coverage --config=ci \
	--remote_cache=${{ secrets.BAZEL_REMOTE_CACHE_URL }} \
	--test_env=DOCKER_HOST=tcp://docker:2375 \
	--test_env=TESTCONTAINERS_HOST_OVERRIDE=docker \
	--test_output=errors \
	-- \
	//...

	- name: Upload coverage to Codecov
	if: always() && !cancelled()
	continue-on-error: true
	uses: codecov/codecov-action@1af58845a975a7985b0beb0cbe6fbbb71a41dbad # v5.5.3
	with:
	token: ${{ secrets.CODECOV_TOKEN }}
	files: bazel-out/_coverage/_coverage_report.dat
	flags: backend
	fail_ci_if_error: false

	- name: Docker cleanup
	if: always()
	run: \|
	echo "=== Docker Cleanup ==="

	# Stop all running containers
	docker ps -q \| xargs -r docker stop --time=5 \|\| true

	# Remove all containers
	docker ps -aq \| xargs -r docker rm -f \|\| true

	# Remove all volumes
	docker volume ls -q \| xargs -r docker volume rm -f \|\| true

	# Remove custom networks
	docker network ls --filter type=custom -q \| xargs -r docker network rm \|\| true

	echo "Docker disk usage after cleanup:"
	docker system df \|\| true

	- name: Workspace cleanup
	if: always()
	run: \|
	echo "=== Workspace Cleanup ==="

	# Remove test outputs and temporary files
	rm -rf /tmp/pytest-* /tmp/tmp* \|\| true

	# Show remaining disk usage
	echo "Disk usage summary:"
	df -h / \|\| true

	# Clean host Docker (same runner) so small VMs don't fill up — uses mounted socket
	- name: Host cleanup
	if: always()
	env:
	DOCKER_HOST: ""
	run: \|
	echo "=== Host cleanup (runner node) ==="
	docker ps -aq -f status=exited -f status=dead --filter "until=5m" 2>/dev/null \| xargs -r docker rm -f \|\| true
	docker volume prune -f 2>/dev/null \|\| true
	docker network prune -f 2>/dev/null \|\| true
	docker image prune -f 2>/dev/null \|\| true
	echo "Host Docker disk:"
	docker system df 2>/dev/null \|\| true

	#######################
	# Docs Build #
	#######################
	docs-build:
	needs: [check-paths]
	if: needs.check-paths.outputs.docs == 'true' \|\| github.event_name == 'workflow_dispatch'
	runs-on: ubuntu-latest
	steps:
	- name: Checkout
	uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1
	with:
	lfs: true

	- name: Setup Python
	uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6.2.0
	with:
	python-version: '3.14.6'

	- name: Install dependencies
	run: \|
	pip install -U -r docs/locked_requirements.txt
	pip install -U -r src/locked_requirements.txt

	- name: Build Sphinx documentation
	run: \|
	make -C docs build ERR_DIR=build_error_logs OUT_DIR=public
	rm -rf docs/public/.doctrees
	if [ -d "docs/build_error_logs" ] && [ "$(find docs/build_error_logs -name '*.log' -size +0c)" ]; then
	echo "Build errors found:"
	find docs/build_error_logs -name '*.log' -size +0c -exec echo "Error in {}: " \; -exec cat {} \;
	exit 1
	fi

	- name: Run spelling check
	id: spelling
	continue-on-error: true
	run: \|
	make -C docs spelling ERR_DIR=spelling_error_logs OUT_DIR=public
	if [ -d "docs/spelling_error_logs" ] && [ "$(find docs/spelling_error_logs -name '*.log' -size +0c)" ]; then
	echo "Spelling errors found:"
	find docs/spelling_error_logs -name '*.log' -size +0c -exec echo "Error in {}: " \; -exec cat {} \;
	exit 1
	fi

	- name: Restore lychee cache
	uses: actions/cache/restore@cdf6c1fa76f9f475f3d7449005a359c84ca0f306 # v5.0.3
	with:
	path: .lycheecache
	key: cache-lychee-pr-${{ github.event.pull_request.number }}
	restore-keys: cache-lychee-

	- name: Link Checker
	id: link-checker
	uses: lycheeverse/lychee-action@a8c4c7cb88f0c7386610c35eb25108e448569cb0 # v2.7.0
	with:
	args: --config docs/lychee.toml --no-progress '*/.html' docs/public
	output: docs/link_check_error_logs/lychee-report.md

	- name: Save lychee cache
	uses: actions/cache/save@cdf6c1fa76f9f475f3d7449005a359c84ca0f306 # v5.0.3
	if: steps.link-checker.outcome == 'success'
	with:
	path: .lycheecache
	key: cache-lychee-pr-${{ github.event.pull_request.number }}

	- name: Check spelling and link results
	run: \|
	if [ "${{ steps.spelling.outcome }}" == "failure" ] \|\| [ "${{ steps.link-checker.outcome }}" == "failure" ]; then
	echo "::error::One or more checks failed:"
	[ "${{ steps.spelling.outcome }}" == "failure" ] && echo " - Spelling check failed"
	[ "${{ steps.link-checker.outcome }}" == "failure" ] && echo " - Link check failed"
	exit 1
	fi
	echo "All checks passed"

	- name: Upload build artifacts
	if: always()
	uses: actions/upload-artifact@bbbca2ddaa5d8feaa63e36b76fdaad77386f024f # v7.0.0
	with:
	name: documentation-build
	path: \|
	docs/public/
	docs/build_error_logs/
	docs/spelling_error_logs/
	docs/link_check_error_logs/
	retention-days: 3


	docs-deploy:
	needs: [docs-build]
	if: needs.check-paths.outputs.docs == 'true' && github.event_name == 'pull_request' && github.event.pull_request.head.repo.fork == false
	runs-on: ubuntu-latest
	environment:
	name: pr-preview
	url: ${{ vars.PR_PREVIEW_BASEURL }}${{ github.event.pull_request.number }}/index.html
	steps:
	- name: Download artifact
	uses: actions/download-artifact@70fc10c6e5e1ce46ad2ea6f2b72d43f7d47b13c3 # v8.0.0
	with:
	name: documentation-build

	- name: Configure AWS credentials
	uses: aws-actions/configure-aws-credentials@8df5847569e6427dd6c4fb1cf565c83acfa8afa7 # v6.0.0
	with:
	aws-access-key-id: ${{ secrets.PR_PREVIEW_AWS_ACCESS_KEY }}
	aws-secret-access-key: ${{ secrets.PR_PREVIEW_AWS_SECRET_KEY }}
	aws-region: us-west-2

	- name: Deploy docs to S3
	run: \|
	aws s3 sync public/ s3://osmo-pr-preview/${{ github.event.pull_request.number }}/ --delete

	- name: Comment preview URL on PR
	uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8.0.0
	with:
	script: \|
	const previewUrl = `${{ vars.PR_PREVIEW_BASEURL }}${{ github.event.pull_request.number }}/index.html`;
	const marker = '<!-- docs-preview-comment -->';
	const body = `${marker}\n📖 Docs preview: ${previewUrl}`;

	const { data: comments } = await github.rest.issues.listComments({
	owner: context.repo.owner,
	repo: context.repo.repo,
	issue_number: context.issue.number,
	});

	const existing = comments.find(c => c.body.includes(marker));
	if (existing) {
	await github.rest.issues.updateComment({
	owner: context.repo.owner,
	repo: context.repo.repo,
	comment_id: existing.id,
	body,
	});
	} else {
	await github.rest.issues.createComment({
	owner: context.repo.owner,
	repo: context.repo.repo,
	issue_number: context.issue.number,
	body,
	});
	}


	#######################
	# UI Build #
	#######################
	ui-build:
	needs: [check-paths]
	if: \|
	(needs.check-paths.outputs.ui == 'true') \|\|
	github.event_name == 'workflow_dispatch'
	runs-on: ubuntu-latest
	steps:
	- name: Checkout
	uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1
	with:
	lfs: true

	- name: Setup pnpm
	uses: pnpm/action-setup@v4
	with:
	package_json_file: src/ui/package.json

	- name: Setup Node.js
	uses: actions/setup-node@6044e13b5dc448c55e2357c09f80417699197238 # v6.2.0
	with:
	node-version-file: src/ui/.nvmrc
	cache: pnpm
	cache-dependency-path: src/ui/pnpm-lock.yaml

	- name: Cache Next.js build
	uses: actions/cache@5a3ec84eff668545956fd18022155c47e93e2684 # v4.2.3
	with:
	path: src/ui/.next/cache
	key: nextjs-${{ hashFiles('src/ui/pnpm-lock.yaml') }}-${{ hashFiles('src/ui/src/**') }}
	restore-keys: \|
	nextjs-${{ hashFiles('src/ui/pnpm-lock.yaml') }}-

	- name: Install dependencies
	working-directory: src/ui
	run: pnpm install --frozen-lockfile

	- name: Install Playwright browsers
	timeout-minutes: 5
	working-directory: src/ui
	run: pnpm exec playwright install chromium

	- name: Validate UI with Coverage
	working-directory: src/ui
	run: pnpm validate:coverage

	- name: Upload UI coverage to Codecov
	if: always() && !cancelled()
	continue-on-error: true
	uses: codecov/codecov-action@1af58845a975a7985b0beb0cbe6fbbb71a41dbad # v5.5.3
	with:
	token: ${{ secrets.CODECOV_TOKEN }}
	files: src/ui/coverage/lcov.info
	flags: ui
	fail_ci_if_error: false

Navigation Menu

Uh oh!

Derive the MCP proxy configuration and share OSMO's Redis #3919

Workflow file

Derive the MCP proxy configuration and share OSMO's Redis #3919

Uh oh!

Workflow file for this run