modal-torch-latest.yml

name: modal-torch-latest

# This Required workflow selects tests on a no-secret GitHub runner, then tests
# the exact candidate SHA inside a no-secret Modal Sandbox. Under
# pull_request_target, every GitHub-side checkout and Python entrypoint comes
# from the trusted base commit. See .github/workflows/TEST_SELECTION.md.

on:
  workflow_dispatch:
    inputs:
      torch_preset:
        description: Modal PyTorch/CUDA image preset for manual runs
        required: false
        default: '2.10.0-cuda12.8'
        type: choice
        options:
          - '2.7.1-cuda12.8'
          - '2.8.0-cuda12.8'
          - '2.9.1-cuda12.8'
          - '2.10.0-cuda12.8'
          - '2.11.0-cuda12.8'
      transformers_source:
        description: Hugging Face Transformers source for manual runs
        required: false
        default: 'git'
        type: choice
        options:
          - 'requirements'
          - 'git'
      transformers_ref:
        description: Hugging Face Transformers git ref to install when source is git
        required: false
        default: 'main'
        type: string

  push:
    branches:
      - master

  pull_request_target:
    types: [review_requested, ready_for_review, synchronize]
    branches:
      - master

permissions:
  contents: read

concurrency:
  group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.ref }}
  cancel-in-progress: true

jobs:
  collect-tests:
    name: modal-torch-latest / collect tests
    runs-on: ubuntu-latest
    timeout-minutes: 20
    permissions:
      contents: read
    outputs:
      mode: ${{ steps.select.outputs.mode }}

    steps:
      - name: Checkout trusted workflow code
        uses: actions/checkout@v7
        with:
          ref: ${{ github.event.pull_request.base.sha || github.sha }}
          fetch-depth: 1
          persist-credentials: false
          lfs: false
          submodules: false

      - name: Fetch candidate tree as data
        if: github.event_name == 'pull_request_target'
        env:
          HEAD_REPOSITORY: ${{ github.event.pull_request.head.repo.full_name }}
          HEAD_SHA: ${{ github.event.pull_request.head.sha }}
          BASE_REPOSITORY: ${{ github.event.pull_request.base.repo.full_name }}
          BASE_SHA: ${{ github.event.pull_request.base.sha }}
          CANDIDATE_ROOT: ${{ runner.temp }}/deepspeed-candidate
        run: |
          python3 ci/torch_latest.py checkout-candidate \
            --head-repository "$HEAD_REPOSITORY" \
            --head-sha "$HEAD_SHA" \
            --base-repository "$BASE_REPOSITORY" \
            --base-sha "$BASE_SHA" \
            --destination "$CANDIDATE_ROOT"

      - name: Self-test the trusted selector
        run: python3 ci/test_tests_fetcher.py

      - name: Select impacted tests
        id: select
        env:
          EVENT_NAME: ${{ github.event_name }}
          CANDIDATE_ROOT: ${{ runner.temp }}/deepspeed-candidate
        run: |
          if [ "$EVENT_NAME" = "pull_request_target" ]; then
            python3 ci/tests_fetcher.py \
              --workflow modal-torch-latest \
              --repo-root "$CANDIDATE_ROOT" \
              --base refs/ci/base
          else
            python3 ci/tests_fetcher.py \
              --workflow modal-torch-latest \
              --repo-root "$GITHUB_WORKSPACE" \
              --base ""
          fi

      - name: Validate test selection
        env:
          SELECTION_MODE: ${{ steps.select.outputs.mode }}
        run: |
          python3 ci/torch_latest.py validate-selection \
            --mode "$SELECTION_MODE" \
            --path ci/.test_selection/test_list.txt

      - name: Upload test selection
        uses: actions/upload-artifact@v4
        with:
          name: modal-torch-latest-test-selection
          path: ci/.test_selection/test_list.txt
          include-hidden-files: true
          retention-days: 3

  deploy:
    name: modal-torch-latest / DeepSpeedAI CI
    runs-on: ubuntu-latest
    timeout-minutes: 90
    permissions:
      contents: read
    needs: collect-tests

    # Preserve the Required check on failures and no-test selections. A selector
    # failure enters this job and fails explicitly; mode=none skips the Sandbox.
    if: ${{ !cancelled() && (needs.collect-tests.result != 'success' || needs.collect-tests.outputs.mode != 'none') }}
    steps:
      - name: Fail if test selection failed
        if: needs.collect-tests.result != 'success'
        run: exit 1

      - name: Checkout trusted controller code
        uses: actions/checkout@v7
        with:
          ref: ${{ github.event.pull_request.base.sha || github.sha }}
          fetch-depth: 1
          persist-credentials: false
          lfs: false
          submodules: false

      - name: Install Python
        uses: actions/setup-python@v7
        with:
          python-version: "3.10"
          cache: 'pip'

      - name: Download test selection
        uses: actions/download-artifact@v4
        with:
          name: modal-torch-latest-test-selection
          path: ci/.test_selection

      - name: Install trusted controller dependency
        run: |
          pip install uv
          uv pip install --system modal==1.2.6

      - name: Run tests in isolated Modal Sandbox
        env:
          DS_CI_REPOSITORY: ${{ github.event.pull_request.head.repo.full_name || github.repository }}
          DS_CI_SHA: ${{ github.event.pull_request.head.sha || github.sha }}
          DS_TEST_SELECTION_MODE: ${{ needs.collect-tests.outputs.mode }}
          DS_TEST_LIST_FILE: ci/.test_selection/test_list.txt
          MODAL_TORCH_PRESET: ${{ github.event.inputs.torch_preset || '2.10.0-cuda12.8' }}
          MODAL_TRANSFORMERS_SOURCE: ${{ github.event.inputs.transformers_source || 'git' }}
          MODAL_TRANSFORMERS_REF: ${{ github.event.inputs.transformers_ref || 'main' }}
          MODAL_TOKEN_ID: ${{ secrets.MODAL_TOKEN_ID }}
          MODAL_TOKEN_SECRET: ${{ secrets.MODAL_TOKEN_SECRET }}
        run: python3 ci/torch_latest.py controller