Containerize vLLM CI test + profiling workflows for OSDC runners

OSDC/ARC runners are ephemeral pods with no Docker daemon, so the old
'docker run --gpus all + docker exec' pattern cannot work on them. Run the
vLLM CI image via the job-level container: key with options '--gpus all'
instead (the GPU is injected by the runner pod), matching pytorch/pytorch
_linux-test.yml (test-osdc) and pytorch/helion.

- vllm-ci-test.yml / vllm-profiling.yml: add an ubuntu-latest 'resolve-image'
  pre-job that runs 'docker manifest inspect' (needs a daemon the pod lacks)
  to pick the latest available vLLM CI image and pass it down as the
  container image. Drop the GPU_FLAG/docker run/docker exec wrapper and the
  /tmp/workspace bind-mount; run the scripts directly in the container.
- vllm-profiling.yml: assume the upload IAM role via OIDC before the S3
  upload (ephemeral pods have no host instance role); pass the resolved
  vLLM commit through as S3_HEAD_SHA.
- run_vllm_profiling.sh: use $GITHUB_WORKSPACE instead of the hardcoded
  /tmp/workspace bind-mount path.

Author: huydhn

.github/scripts/run_vllm_profiling.sh

@@ -12,7 +12,9 @@ print_configuration() {
 }
 
 setup_workspace() {
-    WORKSPACE_DIR="/tmp/workspace"
+    # On OSDC/ARC the job runs inside a container and the repo is checked out at
+    # $GITHUB_WORKSPACE rather than the old docker-run bind mount at /tmp/workspace.
+    WORKSPACE_DIR="${GITHUB_WORKSPACE:-/tmp/workspace}"
     cd "${WORKSPACE_DIR}"
 
     echo "Creating profiling directory: ${VLLM_TORCH_PROFILER_DIR}"

.github/workflows/vllm-ci-test.yml

@@ -25,25 +25,17 @@ concurrency:
   cancel-in-progress: true
 
 jobs:
-  test:
-    name: Run vLLM tests
+  # OSDC/ARC runners are ephemeral pods with no Docker daemon, so the vLLM CI
+  # image is run via the job-level container: key (see the test job) and must be
+  # resolved up front. docker manifest inspect needs a daemon, so do it here on a
+  # GitHub-hosted runner and pass the resolved image down.
+  resolve-image:
+    name: Resolve vLLM CI image
+    runs-on: ubuntu-latest
     if: ${{ !github.event.pull_request.head.repo.fork && github.repository_owner == 'pytorch' }}
-    strategy:
-      fail-fast: false
-      matrix:
-        include:
-          # TODO (huydhn): Figure out later if we need to scale this up to multiple runners
-          - runs-on: mt-l-x86iamx-88-900-h100-4
-            device-name: cuda
-    permissions:
-      id-token: write
-      contents: read
-    runs-on: ${{ matrix.runs-on }}
-    environment: pytorch-x-vllm
+    outputs:
+      docker-image: ${{ steps.resolve.outputs.docker-image }}
     steps:
-      - name: Checkout repository
-        uses: actions/checkout@v4
-
       - name: Checkout vLLM repository
         uses: actions/checkout@v4
         with:
@@ -52,11 +44,12 @@ jobs:
           ref: ${{ inputs.vllm_branch || 'main' }}
           fetch-depth: 0
 
-      - name: Set Docker registry
-        shell: bash
+      - name: Resolve the latest available vLLM CI image
+        id: resolve
+        working-directory: vllm
         env:
           HEAD_BRANCH: ${{ inputs.vllm_branch || 'main' }}
-          DEVICE_NAME: ${{ matrix.device-name }}
+          HEAD_SHA: ${{ inputs.vllm_commit || '' }}
         run: |
           set -eux
 
@@ -67,67 +60,59 @@ jobs:
             DOCKER_IMAGE_PREFIX=public.ecr.aws/q9t5s3a7/vllm-ci-test-repo
           fi
 
-          DOCKER_IMAGE_SUFFIX=""
-          if [[ "${DEVICE_NAME}" == "rocm" ]]; then
-            DOCKER_IMAGE_PREFIX=docker.io/rocm/vllm-ci
-          elif [[ "${DEVICE_NAME}" == "cpu" ]]; then
-            DOCKER_IMAGE_SUFFIX=-cpu
-          fi
-          echo "DOCKER_IMAGE_PREFIX=$DOCKER_IMAGE_PREFIX" >> $GITHUB_ENV
-          echo "DOCKER_IMAGE_SUFFIX=$DOCKER_IMAGE_SUFFIX" >> $GITHUB_ENV
-
-      - name: Check for available Docker image
-        working-directory: vllm
-        env:
-          HEAD_BRANCH: ${{ inputs.vllm_branch || 'main' }}
-          HEAD_SHA: ${{ inputs.vllm_commit || '' }}
-        run: |
-          set -eux
-
           if [[ -z "${HEAD_SHA}" ]]; then
             # Looking back the latest 100 commits is enough
-            for i in {0..99}
-            do
+            for i in {0..99}; do
               # Check if the image is there, if it doesn't then check an older one
               # because the commit is too recent
               HEAD_SHA=$(git rev-parse --verify HEAD~${i})
-              DOCKER_IMAGE="${DOCKER_IMAGE_PREFIX}:${HEAD_SHA}${DOCKER_IMAGE_SUFFIX}"
-
-              # No Docker image available yet because the commit is too recent
+              DOCKER_IMAGE="${DOCKER_IMAGE_PREFIX}:${HEAD_SHA}"
               if docker manifest inspect "${DOCKER_IMAGE}"; then
                 break
               fi
             done
           fi
 
-          echo "HEAD_SHA=$HEAD_SHA" >> $GITHUB_ENV
+          echo "docker-image=${DOCKER_IMAGE_PREFIX}:${HEAD_SHA}" >> "${GITHUB_OUTPUT}"
+
+  test:
+    name: Run vLLM tests
+    needs: resolve-image
+    if: ${{ !github.event.pull_request.head.repo.fork && github.repository_owner == 'pytorch' }}
+    strategy:
+      fail-fast: false
+      matrix:
+        include:
+          # TODO (huydhn): Figure out later if we need to scale this up to multiple runners
+          - runs-on: mt-l-x86iamx-88-900-h100-4
+            device-name: cuda
+    permissions:
+      id-token: write
+      contents: read
+    runs-on: ${{ matrix.runs-on }}
+    environment: pytorch-x-vllm
+    # OSDC/ARC runners run the workload inside this container; the GPU is exposed
+    # by the runner pod, the same pattern as pytorch/pytorch _linux-test.yml
+    # (test-osdc) and pytorch/helion.
+    container:
+      image: ${{ needs.resolve-image.outputs.docker-image }}
+      options: --gpus all
+    steps:
+      - name: GPU health check
+        run: nvidia-smi || true
 
-      - name: Setup CUDA GPU_FLAG for docker run
-        if: matrix.device-name == 'cuda'
+      - name: Install git
         run: |
-          echo "GPU_FLAG=--gpus all -e NVIDIA_DRIVER_CAPABILITIES=all" >> "${GITHUB_ENV}"
+          # The vLLM CI image may not ship git, which actions/checkout needs
+          (command -v git || (apt-get update && apt-get install -y git)) || true
+          git config --global --add safe.directory '*' || true
 
-      - name: Setup ROCm
-        if: matrix.device-name == 'rocm'
-        uses: pytorch/pytorch/./.github/actions/setup-rocm@main
+      - name: Checkout repository
+        uses: actions/checkout@v4
 
       - name: Run vLLM tests
         env:
           HF_TOKEN: ${{ secrets.HF_TOKEN }}
-          DOCKER_IMAGE: ${{ env.DOCKER_IMAGE_PREFIX }}:${{ env.HEAD_SHA }}${{ env.DOCKER_IMAGE_SUFFIX }}
         run: |
           set -eux
-
-          container_name=$(docker run \
-            ${GPU_FLAG:-} \
-            -e HF_TOKEN \
-            --ipc=host \
-            --tty \
-            --detach \
-            --security-opt seccomp=unconfined \
-            --shm-size=4g \
-            -v "${GITHUB_WORKSPACE}:/tmp/workspace" \
-            -w /tmp/workspace \
-            "${DOCKER_IMAGE}"
-          )
-          docker exec -t "${container_name}" bash -c "bash .github/scripts/run_vllm_tests.sh"
+          bash .github/scripts/run_vllm_tests.sh