ci-workflow-pull-request.yml

# SPDX-FileCopyrightText: Copyright (c) 2023 NVIDIA CORPORATION & AFFILIATES. All rights reserved.
# SPDX-License-Identifier: Apache-2.0
#
# Licensed under the Apache License, Version 2.0 (the "License");
# you may not use this file except in compliance with the License.
# You may obtain a copy of the License at
#
# http://www.apache.org/licenses/LICENSE-2.0
#
# Unless required by applicable law or agreed to in writing, software
# distributed under the License is distributed on an "AS IS" BASIS,
# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
# See the License for the specific language governing permissions and
# limitations under the License.

# This is the main workflow that runs on every PR and push to main
name: pull_request

defaults:
  run:
    shell: bash --noprofile --norc -euo pipefail {0}

on:
  push:
    branches:
      - "pull-request/[0-9]+"

concurrency:
  group: ${{ github.workflow }}-on-${{ github.event_name }}-from-${{ github.ref_name }}
  cancel-in-progress: true

jobs:
  build-workflow:
    name: Build workflow from matrix
    runs-on: ubuntu-latest
    if: ${{ github.repository == 'NVIDIA/cccl' }}
    permissions:
      contents: read
      pull-requests: write
    outputs:
      base_sha: ${{ steps.export-pr-info.outputs.base_sha }}
      pr_number: ${{ steps.export-pr-info.outputs.pr_number }}
      workflow: ${{ steps.build-workflow.outputs.workflow }}
      matrix_enabled: ${{ steps.export-flags.outputs.matrix_enabled }}
      bench_enabled: ${{ steps.build-bench-matrix.outputs.bench_enabled }}
      bench_matrix: ${{ steps.build-bench-matrix.outputs.bench_matrix }}
      vdc_enabled: ${{ steps.export-flags.outputs.vdc_enabled }}
      docs_enabled: ${{ steps.export-flags.outputs.docs_enabled }}
      rapids_enabled: ${{ steps.export-flags.outputs.rapids_enabled }}
      matx_enabled: ${{ steps.export-flags.outputs.matx_enabled }}
      pytorch_enabled: ${{ steps.export-flags.outputs.pytorch_enabled }}
      branch_notes_dirt: ${{ steps.branch-notes-dirt.outputs.branch_notes_dirt }}
    steps:
      - name: Export workflow flags
        id: export-flags
        env:
          skip_tpt: ${{ contains(github.event.head_commit.message, '[bench-only]') || contains(github.event.head_commit.message, '[skip-tpt]') || contains(github.event.head_commit.message, '[skip-third-party-testing]') }}
        run: |
          output() { echo "$1=$2" | tee -a "${GITHUB_OUTPUT}"; }

          output matrix_enabled  "${{ !contains(github.event.head_commit.message, '[bench-only]') && !contains(github.event.head_commit.message, '[skip-matrix]') }}"
          output vdc_enabled     "${{ !contains(github.event.head_commit.message, '[bench-only]') && !contains(github.event.head_commit.message, '[skip-vdc]') }}"
          output docs_enabled    "${{ !contains(github.event.head_commit.message, '[bench-only]') && !contains(github.event.head_commit.message, '[skip-docs]') }}"
          output rapids_enabled  "${{ !contains(github.event.head_commit.message, '[skip-rapids]')  && !fromJSON(env.skip_tpt) }}"
          output matx_enabled    "${{ !contains(github.event.head_commit.message, '[skip-matx]')    && !fromJSON(env.skip_tpt) }}"
          output pytorch_enabled "${{ !contains(github.event.head_commit.message, '[skip-pytorch]') && !fromJSON(env.skip_tpt) }}"
      - name: Checkout repo
        uses: actions/checkout@v6
        with:
          persist-credentials: false
      - name: Lookup PR info
        id: get-pr-info
        uses: nv-gha-runners/get-pr-info@main
      - name: Export PR info
        id: export-pr-info
        run: |
          echo "base_sha=${{ fromJSON(steps.get-pr-info.outputs.pr-info).base.sha }}" | tee -a "${GITHUB_OUTPUT}"
          echo "pr_number=${{ fromJSON(steps.get-pr-info.outputs.pr-info).number }}" | tee -a "${GITHUB_OUTPUT}"
      - name: Build CUB benchmark dispatch matrix
        id: build-bench-matrix
        run: |
          { # Defaults:
            echo "bench_enabled=false"
            echo 'bench_matrix={"include":[]}'
          } >> "${GITHUB_OUTPUT}"

          # Compare ci/bench.yaml against its template. If they match, no benchmarks requested.
          if diff -q "ci/bench.template.yaml" "ci/bench.yaml" > /dev/null 2>&1; then
            echo "ci/bench.yaml matches template; skipping CUB benchmark dispatch matrix."
            exit 0
          fi

          bench_matrix_json="$(./ci/bench/parse_bench_matrix.sh "ci/bench.yaml")"

          {
            echo "bench_enabled=true"
            echo "bench_matrix=${bench_matrix_json}"
          } >> "${GITHUB_OUTPUT}"
      - name: Detect .branch_notes changes
        id: branch-notes-dirt
        env:
          BASE_SHA: ${{ steps.export-pr-info.outputs.base_sha }}
        run: |
          if [[ -z "${BASE_SHA}" ]]; then
            echo "branch_notes_dirt=" >> "${GITHUB_OUTPUT}"
            exit 0
          fi

          echo "Fetch history and determine merge base..."
          git fetch origin --unshallow -q || true
          git fetch origin "${BASE_SHA}" -q
          merge_base_sha=$(git merge-base "${GITHUB_SHA}" "${BASE_SHA}")

          echo "Head SHA: ${GITHUB_SHA}"
          echo "PR Base SHA: ${BASE_SHA}"
          echo "Merge Base SHA: ${merge_base_sha}"

          # Only diff .branch_notes if it already exists at the merge base.
          if git cat-file -e "${merge_base_sha}:.branch_notes" 2>/dev/null; then
            branch_notes_dirt=$(git diff --name-only "${merge_base_sha}" "${GITHUB_SHA}" -- ".branch_notes")
          else
            branch_notes_dirt=""
          fi

          {
            echo "branch_notes_dirt<<EOF"
            echo "${branch_notes_dirt}"
            echo "EOF"
          } >> "${GITHUB_OUTPUT}"
      - name: Build workflow
        # Skip building the matrix when disabled, but still gather PR info for downstream jobs
        if: steps.export-flags.outputs.matrix_enabled == 'true'
        id: build-workflow
        uses: ./.github/actions/workflow-build
        with:
          github_token: ${{ secrets.GITHUB_TOKEN }}
          pr_number: ${{ steps.export-pr-info.outputs.pr_number }}
          allow_override: "true"
          inspect_changes_script: 'ci/inspect_changes.py'
          inspect_changes_base_sha: ${{ steps.export-pr-info.outputs.base_sha }}
          workflows: ${{ github.repository == 'NVIDIA/cccl' && 'pull_request' || 'pull_request_fork' }}

  dispatch-groups-linux-two-stage:
    name: ${{ matrix.name }}
    if: >-
      ${{
        needs.build-workflow.outputs.matrix_enabled == 'true' &&
        toJSON(fromJSON(needs.build-workflow.outputs.workflow)['linux_two_stage']['keys']) != '[]'
      }}
    needs: build-workflow
    permissions:
      id-token: write
      contents: read
    strategy:
      fail-fast: false
      matrix:
        name: ${{ fromJSON(needs.build-workflow.outputs.workflow)['linux_two_stage']['keys'] }}
    uses: ./.github/workflows/workflow-dispatch-two-stage-group-linux.yml
    with:
      pc-array: ${{ toJSON(fromJSON(needs.build-workflow.outputs.workflow)['linux_two_stage']['jobs'][matrix.name]) }}

  dispatch-groups-windows-two-stage:
    name: ${{ matrix.name }}
    if: >-
      ${{
        needs.build-workflow.outputs.matrix_enabled == 'true' &&
        toJSON(fromJSON(needs.build-workflow.outputs.workflow)['windows_two_stage']['keys']) != '[]'
      }}
    needs: build-workflow
    permissions:
      id-token: write
      contents: read
    strategy:
      fail-fast: false
      matrix:
        name: ${{ fromJSON(needs.build-workflow.outputs.workflow)['windows_two_stage']['keys'] }}
    uses: ./.github/workflows/workflow-dispatch-two-stage-group-windows.yml
    with:
      pc-array: ${{ toJSON(fromJSON(needs.build-workflow.outputs.workflow)['windows_two_stage']['jobs'][matrix.name]) }}

  dispatch-groups-linux-standalone:
    name: ${{ matrix.name }}
    if: >-
      ${{
        needs.build-workflow.outputs.matrix_enabled == 'true' &&
        toJSON(fromJSON(needs.build-workflow.outputs.workflow)['linux_standalone']['keys']) != '[]'
      }}
    needs: build-workflow
    permissions:
      id-token: write
      contents: read
    strategy:
      fail-fast: false
      matrix:
        name: ${{ fromJSON(needs.build-workflow.outputs.workflow)['linux_standalone']['keys'] }}
    uses: ./.github/workflows/workflow-dispatch-standalone-group-linux.yml
    with:
      job-array: ${{ toJSON(fromJSON(needs.build-workflow.outputs.workflow)['linux_standalone']['jobs'][matrix.name]) }}

  dispatch-groups-windows-standalone:
    name: ${{ matrix.name }}
    if: >-
      ${{
        needs.build-workflow.outputs.matrix_enabled == 'true' &&
        toJSON(fromJSON(needs.build-workflow.outputs.workflow)['windows_standalone']['keys']) != '[]'
      }}
    needs: build-workflow
    permissions:
      id-token: write
      contents: read
    strategy:
      fail-fast: false
      matrix:
        name: ${{ fromJSON(needs.build-workflow.outputs.workflow)['windows_standalone']['keys'] }}
    uses: ./.github/workflows/workflow-dispatch-standalone-group-windows.yml
    with:
      job-array: ${{ toJSON(fromJSON(needs.build-workflow.outputs.workflow)['windows_standalone']['jobs'][matrix.name]) }}

  verify-workflow:
    name: Verify and summarize workflow results
    if: >-
      ${{
        always() &&
        !cancelled() &&
        needs.build-workflow.outputs.matrix_enabled == 'true'
      }}
    needs:
      - build-workflow
      - dispatch-groups-linux-two-stage
      - dispatch-groups-windows-two-stage
      - dispatch-groups-linux-standalone
      - dispatch-groups-windows-standalone
    permissions:
      contents: read
      pull-requests: write # Posts a comment back to the PR.
    runs-on: ubuntu-latest
    steps:
      - name: Checkout repo
        uses: actions/checkout@v6
        with:
          persist-credentials: false

      - name: Check workflow success
        id: check-workflow
        uses: ./.github/actions/workflow-results
        with:
          github_token: ${{ secrets.GITHUB_TOKEN }}
          pr_number: ${{ needs.build-workflow.outputs.pr_number }}

  verify-devcontainers:
    name: Verify Dev Containers
    needs: build-workflow
    if: >-
      ${{
           needs.build-workflow.outputs.vdc_enabled == 'true' &&
           github.repository == 'NVIDIA/cccl'
      }}
    permissions:
      id-token: write
      contents: read
    uses: ./.github/workflows/verify-devcontainers.yml
    with:
      base_sha: ${{ needs.build-workflow.outputs.base_sha }}

  docs-build:
    name: Build documentation
    needs: build-workflow
    if: >-
      ${{
        needs.build-workflow.outputs.pr_number &&
        needs.build-workflow.outputs.docs_enabled == 'true' &&
        github.repository == 'NVIDIA/cccl'
      }}
    runs-on: ${{ github.repository == 'NVIDIA/cccl' && 'linux-amd64-cpu32' || 'ubuntu-latest' }}
    permissions:
      contents: read
    steps:
      - name: Checkout
        uses: actions/checkout@v4
        with:
          persist-credentials: false

      - name: Build docs
        uses: ./.github/actions/docs-build
        with:
          upload_workflow_artifact: "false"

  build-rapids:
    name: Build RAPIDS (optional)
    needs: build-workflow
    if: >-
      ${{
        needs.build-workflow.outputs.rapids_enabled == 'true' &&
        github.repository == 'NVIDIA/cccl'
      }}
    secrets: inherit
    permissions:
      actions: read
      packages: read
      id-token: write
      contents: read
      pull-requests: read
    uses: ./.github/workflows/build-rapids.yml

  build-matx:
    name: Build MatX (optional)
    needs: build-workflow
    if: >-
      ${{
        needs.build-workflow.outputs.matx_enabled == 'true' &&
        github.repository == 'NVIDIA/cccl'
      }}
    secrets: inherit
    permissions:
      id-token: write
      contents: read
    uses: ./.github/workflows/build-matx.yml

  build-pytorch:
    name: Build PyTorch (optional)
    needs: build-workflow
    if: >-
      ${{
        needs.build-workflow.outputs.pytorch_enabled == 'true' &&
        github.repository == 'NVIDIA/cccl'
      }}
    secrets: inherit
    permissions:
      id-token: write
      contents: read
    uses: ./.github/workflows/build-pytorch.yml

  # Test that cuda.compute can be imported on a CPU-only machine (no CUDA drivers).
  test-cpu-import:
    name: Test CPU-only import
    runs-on: ubuntu-latest
    needs:
      - dispatch-groups-linux-two-stage
      - dispatch-groups-linux-standalone
    if: ${{ !cancelled() && github.repository == 'NVIDIA/cccl' }}
    permissions:
      contents: read
    steps:
      - name: Download wheel artifact
        id: download
        uses: actions/download-artifact@v4
        continue-on-error: true
        with:
          name: wheel-cccl-linux-amd64-py3.13
          path: artifact

      - name: Check if wheel exists
        id: check-wheel
        run: |
          if [[ "${{ steps.download.outcome }}" != "success" ]]; then
            echo "No wheel artifact found (Python jobs likely didn't run). Skipping test."
            echo "skip=true" >> "$GITHUB_OUTPUT"
          else
            echo "Wheel artifact found."
            echo "skip=false" >> "$GITHUB_OUTPUT"
          fi

      - name: Set up Python
        if: steps.check-wheel.outputs.skip != 'true'
        uses: actions/setup-python@v5
        with:
          python-version: '3.13'

      - name: Install wheel
        if: steps.check-wheel.outputs.skip != 'true'
        run: |
          echo "Artifact contents:"
          find artifact -name "*.whl" -type f
          pip install $(find artifact -name "*.whl" -type f | head -1)[cu13]

      - name: Test CPU-only import
        if: steps.check-wheel.outputs.skip != 'true'
        run: |
          python -c "
          import cuda.compute
          print('cuda.compute imported successfully!')
          print(f'_BINDINGS_AVAILABLE: {cuda.compute._BINDINGS_AVAILABLE}')

          # Verify that accessing missing attributes gives a helpful error
          try:
              _ = cuda.compute.reduce_into
              print('ERROR: Should have raised AttributeError')
              exit(1)
          except AttributeError as e:
              print(f'Got expected AttributeError: {e}')
              if 'CUDA bindings are not available' not in str(e):
                  print('ERROR: AttributeError message is not helpful')
                  exit(1)

          print('All CPU-only import tests passed!')
          "

  dispatch-cub-bench:
    name: CUB Bench Compare (${{ matrix.gpu }})
    if: >-
      ${{
        needs.build-workflow.outputs.bench_enabled == 'true' &&
        toJSON(fromJSON(needs.build-workflow.outputs.bench_matrix).include) != '[]'
      }}
    needs: build-workflow
    permissions:
      id-token: write
      contents: read
    strategy:
      fail-fast: false
      matrix: ${{ fromJSON(needs.build-workflow.outputs.bench_matrix) }}
    uses: ./.github/workflows/bench_cub.yml
    with:
      gpu: ${{ matrix.gpu }}
      launch_args: ${{ matrix.launch_args }}
      arch: ${{ matrix.arch }}
      base_ref: ${{ matrix.base_ref }}
      test_ref: ${{ matrix.test_ref }}
      filters: ${{ matrix.filters }}
      nvbench_args: ${{ matrix.nvbench_args }}
      nvbench_compare_args: ${{ matrix.nvbench_compare_args }}

  bench-results:
    name: Post benchmark results
    if: >-
      ${{
        always() && !cancelled() &&
        needs.build-workflow.outputs.bench_enabled == 'true' &&
        needs.build-workflow.outputs.pr_number != ''
      }}
    needs: [build-workflow, dispatch-cub-bench]
    permissions:
      pull-requests: write
    runs-on: ubuntu-latest
    steps:
      - name: Determine outcome
        id: outcome
        run: |
          result="${{ needs.dispatch-cub-bench.result }}"
          case "${result}" in
            success)  icon=":white_check_mark:"; status="completed successfully" ;;
            failure)  icon=":x:";                status="had failures" ;;
            *)        icon=":warning:";          status="${result}" ;;
          esac
          { echo "icon=${icon}"; echo "status=${status}"; } >> "${GITHUB_OUTPUT}"
      - name: Comment on PR
        uses: marocchino/sticky-pull-request-comment@67d0dec7b07ed060a405f9b2a64b8ab319fdd7db  # v2.9.2
        with:
          github_token: ${{ secrets.GITHUB_TOKEN }}
          header: bench-results
          number: ${{ needs.build-workflow.outputs.pr_number }}
          message: |
            ## ${{ steps.outcome.outputs.icon }} Benchmark Results

            CUB benchmark comparison ${{ steps.outcome.outputs.status }}.

            **[Results](${{ github.server_url }}/${{ github.repository }}/actions/runs/${{ github.run_id }})**
            **[Artifacts](${{ github.server_url }}/${{ github.repository }}/actions/runs/${{ github.run_id }}#artifacts)**
          hide_and_recreate: true
          hide_classify: "OUTDATED"

  # Check all other job statuses. This job gates branch protection checks.
  ci:
    name: CI
    # !! Important: This job is used for branch protection checks.
    # !! Need to use always() instead of !cancelled() because skipped jobs count as success
    # !! for Github branch protection checks. Yes, really: by default, branch protections
    # !! can be bypassed by cancelling CI. See NVIDIA/cccl#605.
    if: ${{ always() }}
    needs:
      - build-workflow
      - verify-workflow
      - verify-devcontainers
      - docs-build
      - test-cpu-import
      - dispatch-cub-bench
    runs-on: ubuntu-latest
    steps:
      - name: Check results
        run: |
          status="success"

          check_result() {
            name=$1
            expected=$2
            result=$3

            echo "Checking if $name job result ('$result') is '$expected'..."
            if [[ "$result" != "$expected" ]]; then
              echo "$name job failed"

              status="failed"
            fi
          }

          check_result "verify-workflow"      "success" "${{needs.verify-workflow.result}}"
          check_result "verify-devcontainers" "success" "${{needs.verify-devcontainers.result}}"
          check_result "docs-build"           "success" "${{needs.docs-build.result}}"
          check_result "test-cpu-import"      "success" "${{needs.test-cpu-import.result}}"

          expected_cub_bench_result="skipped"
          if [[ "${{ needs.build-workflow.outputs.bench_enabled }}" == "true" ]] \
            && [[ "${{ toJSON(fromJSON(needs.build-workflow.outputs.bench_matrix).include) }}" != "[]" ]]; then
            expected_cub_bench_result="success"
          fi
          check_result "dispatch-cub-bench" "${expected_cub_bench_result}" "${{needs.dispatch-cub-bench.result}}"

          bench_enabled="${{ needs.build-workflow.outputs.bench_enabled }}"
          if [[ "${bench_enabled}" == "true" ]]; then
            echo "::error::ci/bench.yaml differs from ci/bench.template.yaml. Benchmark requests are temporary — reset ci/bench.yaml to match the template before merging."
            status="failed"
          fi

          branch_notes_dirt="${{ needs.build-workflow.outputs.branch_notes_dirt }}"
          branch_notes_dirt_trimmed=$(printf '%s' "${branch_notes_dirt}" | tr -d '\n' | tr -d ' ')
          if [[ -n "${branch_notes_dirt_trimmed}" ]]; then
            echo "::error::The .branch_notes directory was modified in this PR. Keep local notes there only; reset it before merging by running './.branch_notes/reset.sh'."
            echo "Changed files:"
            printf '%s\n' "${branch_notes_dirt}"
            status="failed"
          fi

          if [[ "$status" != "success" ]]; then
            exit 1
          fi