task(RHOAIENG-59028): Bump CUDA and ROCm images to Ray 2.54.1#797
task(RHOAIENG-59028): Bump CUDA and ROCm images to Ray 2.54.1#797chipspeak wants to merge 1 commit intoopendatahub-io:mainfrom
Conversation
|
[APPROVALNOTIFIER] This PR is NOT APPROVED This pull-request has been approved by: The full list of commands accepted by this bot can be found here. DetailsNeeds approval from an approver in each of these files:Approvers can indicate their approval by writing |
|
Warning Rate limit exceeded
Your organization is not enrolled in usage-based pricing. Contact your admin to enable usage-based pricing to continue reviews beyond the rate limit, or try again in 5 minutes and 45 seconds. ⌛ How to resolve this issue?After the wait time has elapsed, a review can be triggered using the We recommend that you space out your commits to avoid hitting the rate limit. 🚦 How do rate limits work?CodeRabbit enforces hourly rate limits for each developer per organization. Our paid plans have higher rate limits than the trial, open-source and free plans. In all cases, we re-allow further reviews after a brief timeout. Please see our FAQ for further information. ℹ️ Review info⚙️ Run configurationConfiguration used: Central YAML (base), Organization UI (inherited) Review profile: CHILL Plan: Pro Plus Run ID: ⛔ Files ignored due to path filters (2)
📒 Files selected for processing (11)
📝 WalkthroughWalkthroughSix files are updated to increment Ray runtime version from 2.53.0 to 2.54.1 across CUDA and ROCm image variants. Changes include Tekton pipeline metadata names, path-change triggers, output-image parameters, and Pipfile/README version constraints. No behavioral logic modifications are present. Estimated code review effort🎯 1 (Trivial) | ⏱️ ~3 minutes Security AssessmentNo actionable security findings. Version bump alone does not introduce risk without examining upstream Ray 2.54.1 changelog for CVEs. Ensure dependency pinning with exact versions or SHAs if supply-chain risk is a concern— 🚥 Pre-merge checks | ✅ 4✅ Passed checks (4 passed)
✏️ Tip: You can configure your own custom pre-merge checks in the settings. Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 1
🤖 Prompt for all review comments with AI agents
Verify each finding against the current code and only fix it if needed.
Inline comments:
In `@images/runtime/ray/cuda/2.54.1-py312-cu128/Pipfile`:
- Line 8: Update the Pipfile dependency for "ray[all]" to pin the version
exactly: replace the version specifier "~=2.54.1" with "==2.54.1" in the line
that defines "ray[all]" so the Pipfile reflects an exact 2.54.1 pin (matches the
Pipfile.lock and prevents future 2.54.x drift).
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Central YAML (base), Organization UI (inherited)
Review profile: CHILL
Plan: Pro Plus
Run ID: 737b94de-ee6a-46b6-b578-8a9a8bf78bc7
⛔ Files ignored due to path filters (2)
images/runtime/ray/cuda/2.54.1-py312-cu128/Pipfile.lockis excluded by!**/*.lockimages/runtime/ray/rocm/2.54.1-py312-rocm64/Pipfile.lockis excluded by!**/*.lock
📒 Files selected for processing (11)
.tekton/ray-2.54.1-py312-cu128-push.yaml.tekton/ray-2.54.1-py312-rocm64-push.yamlimages/runtime/ray/cuda/2.54.1-py312-cu128/Dockerfileimages/runtime/ray/cuda/2.54.1-py312-cu128/NGC-DL-CONTAINER-LICENSEimages/runtime/ray/cuda/2.54.1-py312-cu128/Pipfileimages/runtime/ray/cuda/2.54.1-py312-cu128/README.mdimages/runtime/ray/cuda/2.54.1-py312-cu128/cuda.repo-arm64images/runtime/ray/cuda/2.54.1-py312-cu128/cuda.repo-x86_64images/runtime/ray/rocm/2.54.1-py312-rocm64/Dockerfileimages/runtime/ray/rocm/2.54.1-py312-rocm64/Pipfileimages/runtime/ray/rocm/2.54.1-py312-rocm64/README.md
| [packages] | ||
| numpy = {version = "<2.0.0" } | ||
| "ray[all]" = {version = "~=2.53.0" } | ||
| "ray[all]" = {version = "~=2.54.1" } |
There was a problem hiding this comment.
🧩 Analysis chain
🏁 Script executed:
#!/bin/bash
# Verify whether Ray runtime Pipfile.lock files pin Ray exactly for the new 2.54.1 images.
# Expected: either lockfiles exist and pin Ray to 2.54.1, or the Pipfile uses an exact ==2.54.1 pin.
set -u
echo "Pipfile constraints:"
rg -n '"ray\[all\]"\s*=\s*\{version\s*=\s*"(~=|==)2\.54\.1"' images/runtime/ray -C 1 || true
echo
echo "Pipfile.lock Ray entries, if present:"
fd '^Pipfile.lock$' images/runtime/ray | while read -r lockfile; do
printf '\n== %s ==\n' "$lockfile"
rg -n '"ray"|"ray\[all\]"|2\.54\.1' "$lockfile" -C 3 || true
doneRepository: opendatahub-io/distributed-workloads
Length of output: 2256
Pin ray[all] exactly in the 2.54.1 CUDA image Pipfile.
The Pipfile currently uses ~=2.54.1, which admits future 2.54.x releases under PEP 440. Although the committed Pipfile.lock pins Ray exactly to 2.54.1 and mitigates the immediate risk of silent version drift on rebuild, pinning exactly in the Pipfile itself follows supply-chain best practice (defense-in-depth) and closes the attack surface if the lockfile is ever bypassed or regenerated. Change to ==2.54.1.
Remediation diff
-"ray[all]" = {version = "~=2.54.1" }
+"ray[all]" = {version = "==2.54.1" }📝 Committable suggestion
‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.
| "ray[all]" = {version = "~=2.54.1" } | |
| "ray[all]" = {version = "==2.54.1" } |
🤖 Prompt for AI Agents
Verify each finding against the current code and only fix it if needed.
In `@images/runtime/ray/cuda/2.54.1-py312-cu128/Pipfile` at line 8, Update the
Pipfile dependency for "ray[all]" to pin the version exactly: replace the
version specifier "~=2.54.1" with "==2.54.1" in the line that defines "ray[all]"
so the Pipfile reflects an exact 2.54.1 pin (matches the Pipfile.lock and
prevents future 2.54.x drift).
Signed-off-by: Pat O'Connor <paoconno@redhat.com>
chipspeak
force-pushed
the
RHOAIENG-59028
branch
from
bf4b7b1 to
84553de
Compare
|
rocm part verified (details shared in slack) |
2 participants
Description
Bumped Ray version to 2.54.1 in both CUDA and ROCm runtime images.
How Has This Been Tested?
Merge criteria:
Summary by CodeRabbit