feat(ci): onboard GB200 AWS UAT reservation #2139
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| # Copyright (c) 2026, NVIDIA CORPORATION & AFFILIATES. All rights reserved. | |
| # | |
| # Licensed under the Apache License, Version 2.0 (the "License"); | |
| # you may not use this file except in compliance with the License. | |
| # You may obtain a copy of the License at | |
| # | |
| # http://www.apache.org/licenses/LICENSE-2.0 | |
| # | |
| # Unless required by applicable law or agreed to in writing, software | |
| # distributed under the License is distributed on an "AS IS" BASIS, | |
| # WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. | |
| # See the License for the specific language governing permissions and | |
| # limitations under the License. | |
| # Allows maintainers to run the full qualification suite on fork PRs | |
| # by commenting "/ok-to-test" on the PR. This runs in the base repo | |
| # context. The called qualification workflow checks out and runs | |
| # fork-controlled local actions (`./.github/actions/*`), so the | |
| # privileged jobs (cli-e2e with id-token: write, security-scan with | |
| # security-events: write) are gated by `if: inputs.privileged_ci` in | |
| # qualification.yaml and we pass `privileged_ci: false` below. Those | |
| # jobs are skipped before any step runs, so no fork-controlled code | |
| # ever executes with elevated tokens. | |
| # | |
| # We must still declare id-token: write and security-events: write on | |
| # the reusable-workflow call: GitHub validates the union of permissions | |
| # requested by every job in the called workflow at startup — before | |
| # `if:` conditions evaluate — and rejects the run with startup_failure | |
| # if any declared permission is missing here. The grants are declarative | |
| # only; the gated jobs never consume them on the fork path. | |
| name: OK to Test | |
| on: | |
| issue_comment: | |
| types: [created] | |
| permissions: | |
| contents: read | |
| concurrency: | |
| group: ${{ github.workflow }}-${{ github.event.issue.number || github.ref }} | |
| cancel-in-progress: true | |
| jobs: | |
| authorize: | |
| name: Authorize | |
| if: >- | |
| github.event.issue.pull_request && | |
| github.event.comment.body == '/ok-to-test' | |
| runs-on: ubuntu-latest | |
| timeout-minutes: 5 | |
| outputs: | |
| ref: ${{ steps.pr.outputs.ref }} | |
| steps: | |
| - name: Check maintainer permission | |
| uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0 | |
| with: | |
| script: | | |
| const { data } = await github.rest.repos.getCollaboratorPermissionLevel({ | |
| owner: context.repo.owner, | |
| repo: context.repo.repo, | |
| username: context.payload.comment.user.login, | |
| }); | |
| const allowed = ['admin', 'write', 'maintain']; | |
| if (!allowed.includes(data.permission)) { | |
| core.setFailed(`User ${context.payload.comment.user.login} does not have write permission`); | |
| } | |
| - name: Get PR head ref | |
| id: pr | |
| uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0 | |
| with: | |
| script: | | |
| const { data: pr } = await github.rest.pulls.get({ | |
| owner: context.repo.owner, | |
| repo: context.repo.repo, | |
| pull_number: context.issue.number, | |
| }); | |
| core.setOutput('ref', pr.head.sha); | |
| core.info(`PR #${context.issue.number} head SHA: ${pr.head.sha}`); | |
| tests: | |
| needs: authorize | |
| uses: ./.github/workflows/qualification.yaml | |
| permissions: | |
| actions: read | |
| contents: read | |
| # Declarative-only: required because qualification.yaml's cli-e2e and | |
| # security-scan jobs declare these permissions and GitHub validates the | |
| # union at startup. Those jobs are skipped via `if: inputs.privileged_ci` | |
| # when privileged_ci=false (set below), so the grants are never consumed. | |
| id-token: write | |
| security-events: write | |
| with: | |
| privileged_ci: false | |
| ref: ${{ needs.authorize.outputs.ref }} |