Add automation to reconcile release runner groups (#8332)

On-demand (and go-live-triggered) job that keeps the prod release runner
groups (name matching `-prod-.*-release-runners`, e.g.
`lf-prod-aws-ue1-release-runners`; staging clusters excluded) in sync,
so we stop hand-editing their allowed-workflows and repo-access lists at
each release milestone.

`tools/scripts/release_manage_runner_groups.py` computes the desired
state from pytorch/pytorch:
- **Refs:** `main`, `nightly`, and the release branches around the
release candidate version. The `release/X.Y` anchor is read from
`generate_binary_build_matrix.py` (`CURRENT_CANDIDATE_VERSION`, the
version used for release builds, advanced deliberately at go-live)
rather than inferred from a branch-name scan; the preceding protected
release branch is included too.
- **Workflows (discovered by runner label, not hardcoded):** an entry
workflow references a release runner label (the `rel-` marker, e.g.
`rel-l-x86iavx512-44-340`); from there it follows `uses:` only into
reusables invoked on a release label, so the build reusable
(`_binary-build-linux`) is included while non-build/non-linux workflows
are excluded. Content is fetched in a single GraphQL request (avoids
raw.githubusercontent.com 429s). The full desired allow-list is logged.
- Allowed-workflows are full-synced (stale branch pins pruned); repo
access is add-only (`pytorch/pytorch`).

**Triggers:** `workflow_dispatch`, and a `push` to `main` touching
`generate_binary_build_matrix.py` (the go-live bump). No cron. The token
is gated behind the `runner-group` environment (main only); PRs/dispatch
default to dry-run, apply runs only on main via the push bump or
`apply=true`.

**Before applying:** create the `runner-group` environment (protected to
main) with secret `RUNNER_GROUP_TOKEN`.

## Validation

- Dry-run (this PR):
https://github.com/pytorch/test-infra/actions/runs/29858710718/job/88729548933
— 7 workflows x 4 refs = 28 references.
- Apply (temporary env/apply override, since removed):
https://github.com/pytorch/test-infra/actions/runs/29858037095/job/88727234617
— reconciled the 5 prod groups to 28 references each.

Test plan: `python3 -m unittest -v
tools.tests.test_release_manage_runner_groups` (Ran 12 tests OK).

_Authored with an AI assistant (Claude)._

Author: huydhn

.github/workflows/release-manage-runner-groups.yml

@@ -0,0 +1,62 @@
+name: Release manage runner groups
+
+on:
+  # The desired state only changes at release milestones, so run on demand and
+  # when the test-channel version is advanced (the go-live bump), rather than on
+  # a cron.
+  workflow_dispatch:
+    inputs:
+      apply:
+        description: "Apply changes (otherwise dry-run)"
+        type: boolean
+        default: false
+  push:
+    branches:
+      - main
+    paths:
+      - tools/scripts/generate_binary_build_matrix.py
+  pull_request:
+    paths:
+      - .github/workflows/release-manage-runner-groups.yml
+      - tools/scripts/release_manage_runner_groups.py
+      - tools/scripts/generate_binary_build_matrix.py
+      - tools/tests/test_release_manage_runner_groups.py
+
+permissions:
+  contents: read
+
+concurrency:
+  group: release-manage-runner-groups
+  cancel-in-progress: true
+
+jobs:
+  reconcile:
+    runs-on: ubuntu-latest
+    # The token lives in the protected environment and is only selected on
+    # main, so PRs and forks never see it and run discovery-only.
+    environment: ${{ github.ref == 'refs/heads/main' && 'runner-group' || '' }}
+    steps:
+      - name: Checkout
+        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
+
+      - name: Install dependencies
+        run: python3 -m pip install requests==2.32.3 PyYAML==6.0.2
+
+      - name: Reconcile release runner groups
+        env:
+          # Token for managing runner groups, only present in the runner-group
+          # environment (i.e. on main). Falls back to the default token for
+          # read-only discovery on PRs.
+          RUNNER_GROUP_TOKEN: ${{ secrets.RUNNER_GROUP_TOKEN }}
+          GITHUB_TOKEN: ${{ github.token }}
+          # Apply only from main, and only for the go-live push (matrix version
+          # bump) or an explicit dispatch with apply=true. Everything else is a
+          # dry-run.
+          SHOULD_APPLY: ${{ github.ref == 'refs/heads/main' && (github.event_name == 'push' || inputs.apply) }}
+        run: |
+          SCRIPT=tools/scripts/release_manage_runner_groups.py
+          if [ "${SHOULD_APPLY}" = "true" ]; then
+            python3 "${SCRIPT}" --apply
+          else
+            python3 "${SCRIPT}"
+          fi

.github/workflows/tests.yml

@@ -26,7 +26,7 @@ jobs:
         echo ::group::setup Python environment
         python -m venv .venv/
         source .venv/bin/activate
-        pip install pip==23.0.1 pytest==7.2.0 jsonschema==4.17.3 clickhouse-connect==0.8.14 requests==2.32.2
+        pip install pip==23.0.1 pytest==7.2.0 jsonschema==4.17.3 clickhouse-connect==0.8.14 requests==2.32.2 PyYAML==6.0.2
         echo ::endgroup::
 
         # Test tools

mypy.ini

@@ -51,6 +51,12 @@ disable_error_code = no-any-return, no-untyped-def, no-untyped-call, import-not-
 [mypy-tools.self_hosted_runner_utils.check_runners_state_org]
 disable_error_code = no-any-return, no-untyped-def, no-untyped-call, import-not-found, import-untyped
 
+[mypy-tools.scripts.release_manage_runner_groups]
+disable_error_code = no-any-return, no-untyped-def, no-untyped-call, import-not-found, import-untyped
+
+[mypy-tools.tests.test_release_manage_runner_groups]
+disable_error_code = no-any-return, no-untyped-def, no-untyped-call, import-not-found, import-untyped
+
 [mypy-tools.scripts.*]
 disable_error_code = var-annotated, import-untyped