Skip to content

Commit 1833626

Browse files
sallyseoksallyseok
authored
chore(huggingface-vllm): re-enable PR workflow; add transformers_version to release spec; rename framework (#6287)
* Add transformers_version to release spec; rename huggingface-vllm Signed-off-by: Sally Seok <sallyseo@amazon.com> * re-enable PR workflow Signed-off-by: Sally Seok <sallyseo@amazon.com> * fix base image URI Signed-off-by: Sally Seok <sallyseo@amazon.com> * fix Signed-off-by: Sally Seok <sallyseo@amazon.com> * address cves Signed-off-by: Sally Seok <sallyseo@amazon.com> * force build sglang Signed-off-by: Sally Seok <sallyseo@amazon.com> --------- Signed-off-by: Sally Seok <sallyseo@amazon.com>
1 parent d71bae3 commit 1833626

7 files changed

Lines changed: 36 additions & 25 deletions

File tree

‎.github/actions/generate-release-spec/generate_release_spec.sh‎

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -59,6 +59,8 @@ else
5959
CUDA_VERSION=""
6060
fi
6161

62+
TRANSFORMERS_VERSION=$(yq '.build.transformers_version // ""' "$CONFIG_FILE")
63+
6264
# Release flags
6365
FORCE_RELEASE=$(yq '.release.force_release // ""' "$CONFIG_FILE")
6466
PUBLIC_REGISTRY=$(yq '.release.public_registry // ""' "$CONFIG_FILE")
@@ -80,6 +82,7 @@ SPEC+="version: \"${VERSION}\""$'\n'
8082
[[ -n "$OS_VERSION" ]] && SPEC+="os_version: \"${OS_VERSION}\""$'\n'
8183
[[ -n "$CUSTOMER_TYPE" ]] && SPEC+="customer_type: \"${CUSTOMER_TYPE}\""$'\n'
8284
[[ -n "$CUDA_VERSION" ]] && SPEC+="cuda_version: \"${CUDA_VERSION}\""$'\n'
85+
[[ -n "$TRANSFORMERS_VERSION" ]] && SPEC+="transformers_version: \"${TRANSFORMERS_VERSION}\""$'\n'
8386
[[ -n "$PLATFORM" ]] && SPEC+="platform: \"${PLATFORM}\""$'\n'
8487
[[ -n "$FORCE_RELEASE" ]] && SPEC+="force_release: ${FORCE_RELEASE}"$'\n'
8588
[[ -n "$PUBLIC_REGISTRY" ]] && SPEC+="public_registry: ${PUBLIC_REGISTRY}"$'\n'

‎.github/config/image/huggingface-vllm/sagemaker.yml‎

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -3,7 +3,7 @@ image:
33
description: "Hugging Face vLLM for SageMaker (layered on the AWS vLLM DLC)"
44

55
metadata:
6-
framework: "huggingface_vllm"
6+
framework: "huggingface-vllm"
77
framework_version: "0.22.1"
88
os_version: "ubuntu22.04"
99
customer_type: "sagemaker"
@@ -17,7 +17,7 @@ metadata:
1717
build:
1818
dockerfile: "docker/huggingface/vllm/Dockerfile"
1919
target: "huggingface-vllm-sagemaker"
20-
base_image: "public.ecr.aws/deep-learning-containers/vllm:0.22.1-gpu-py312-cu130-ubuntu22.04-sagemaker-v1"
20+
base_image: "public.ecr.aws/deep-learning-containers/vllm:0.22.1-gpu-py312-cu130-ubuntu22.04-sagemaker-v1.0"
2121
python_version: "3.12"
2222
cuda_version: "13.0.2"
2323
transformers_version: "5.10.2"
@@ -33,4 +33,4 @@ release:
3333
public_registry: false
3434
private_registry: true
3535
enable_soci: true
36-
environment: "production"
36+
environment: "gamma"

‎.github/workflows/huggingface-vllm.pr.yml‎

Lines changed: 16 additions & 18 deletions
Original file line numberDiff line numberDiff line change
@@ -1,23 +1,21 @@
11
name: "PR - Hugging Face vLLM"
22

33
on:
4-
# TEMP: Enable after all frameworks are refactored
5-
workflow_dispatch:
6-
# pull_request:
7-
# branches: [main]
8-
# types: [opened, reopened, synchronize]
9-
# paths:
10-
# - ".github/config/image/huggingface-vllm/*.yml"
11-
# - ".github/workflows/huggingface-vllm.pipeline.yml"
12-
# - ".github/workflows/huggingface-vllm.pr.yml"
13-
# - "docker/huggingface/vllm/**"
14-
# - "scripts/docker/huggingface/vllm/**"
15-
# - "scripts/docker/telemetry/**"
16-
# - "test/sanity/**"
17-
# - "test/security/data/ecr_scan_allowlist/huggingface_vllm/**"
18-
# - "test/telemetry/**"
19-
# - "test/vllm/sagemaker/**"
20-
# - "!docs/**"
4+
pull_request:
5+
branches: [main]
6+
types: [opened, reopened, synchronize]
7+
paths:
8+
- ".github/config/image/huggingface-vllm/*.yml"
9+
- ".github/workflows/huggingface-vllm.pipeline.yml"
10+
- ".github/workflows/huggingface-vllm.pr.yml"
11+
- "docker/huggingface/vllm/**"
12+
- "scripts/docker/huggingface/vllm/**"
13+
- "scripts/docker/telemetry/**"
14+
- "test/sanity/**"
15+
- "test/security/data/ecr_scan_allowlist/huggingface-vllm/**"
16+
- "test/telemetry/**"
17+
- "test/vllm/sagemaker/**"
18+
- "!docs/**"
2119

2220
permissions:
2321
contents: read
@@ -51,7 +49,7 @@ jobs:
5149
- ".github/config/image/huggingface-vllm/*.yml"
5250
- "docker/huggingface/vllm/**"
5351
- "scripts/docker/huggingface/vllm/**"
54-
- "test/security/data/ecr_scan_allowlist/huggingface_vllm/**"
52+
- "test/security/data/ecr_scan_allowlist/huggingface-vllm/**"
5553
sanity-test-change:
5654
- "test/sanity/**"
5755
sagemaker-test-change:

‎docker/huggingface/vllm/Dockerfile‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -1,8 +1,8 @@
1-
ARG BASE_IMAGE=public.ecr.aws/deep-learning-containers/vllm:0.22.1-gpu-py312-cu130-ubuntu22.04-sagemaker-v1
1+
ARG BASE_IMAGE=public.ecr.aws/deep-learning-containers/vllm:0.22.1-gpu-py312-cu130-ubuntu22.04-sagemaker-v1.0
22

33
FROM ${BASE_IMAGE} AS base
44

5-
ARG FRAMEWORK=huggingface_vllm
5+
ARG FRAMEWORK=huggingface-vllm
66
ARG FRAMEWORK_VERSION=0.22.1
77
ARG CONTAINER_TYPE=general
88
ARG DLC_MAJOR_VERSION=1

‎docker/sglang/Dockerfile.amzn2023‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -111,7 +111,7 @@ RUN cd sglang \
111111
&& FLASHINFER_CUBIN_DOWNLOAD_THREADS=${BUILD_PARALLEL} FLASHINFER_LOGGING_LEVEL=warning \
112112
python3 -m flashinfer --download-cubin
113113

114-
# Persist nvidia pip lib paths for subsequent build steps that import torch
114+
# Persist nvidia pip lib paths for subsequent build steps that import torch.
115115
RUN echo $(python3 -c "import glob; print(':'.join(glob.glob('/usr/local/lib*/python${PYTHON_VERSION}/site-packages/nvidia/*/lib')))") > /tmp/nvidia_lib_paths
116116

117117
# CUDA 13 moved CCCL headers from include/cuda/std/ to include/cccl/cuda/std/.

‎scripts/docker/telemetry/deep_learning_container.py‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -242,7 +242,7 @@ def parse_args():
242242
"lambda",
243243
"ray",
244244
"vllm_omni",
245-
"huggingface_vllm",
245+
"huggingface-vllm",
246246
],
247247
help="framework of container image.",
248248
required=True,

test/security/data/ecr_scan_allowlist/huggingface_vllm/framework_allowlist.json renamed to test/security/data/ecr_scan_allowlist/huggingface-vllm/framework_allowlist.json

Lines changed: 10 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -78,5 +78,15 @@
7878
"vulnerability_id": "CVE-2026-42504",
7979
"reason": "go/stdlib 1.24.11 statically linked inside mooncake libetcd_wrapper.so, cannot be patched independently of mooncake-transfer-engine rebuild",
8080
"review_by": "2026-08-30"
81+
},
82+
{
83+
"vulnerability_id": "RUSTSEC-2026-0185",
84+
"reason": "quinn-proto 0.11.14 statically linked inside the uv binary (/usr/local/bin/uv); no uv release through 0.11.24 has bumped quinn-proto to the fixed 0.11.15, so it cannot be patched independently. DoS only and uv is a build-time installer, not network-facing at runtime",
85+
"review_by": "2026-09-25"
86+
},
87+
{
88+
"vulnerability_id": "CVE-2026-53923",
89+
"reason": "vllm 0.22.1 GGUF dequantize kernel integer truncation; fixed only in 0.23.1rc0 (release candidate), no stable fixed version available to pin to; vllm version cannot be changed",
90+
"review_by": "2026-09-25"
8191
}
8292
]

0 commit comments

Comments
 (0)