docs: clarify caller cache inputs #2
Workflow file for this run
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| on: | ||
|
Check failure on line 1 in .github/workflows/conda-python-tests.yaml
|
||
| workflow_call: | ||
| inputs: | ||
| build_type: | ||
| description: "One of: [branch, nightly, pull-request]" | ||
| required: true | ||
| type: string | ||
| matrix_type: | ||
| description: "One of: [auto, nightly, pull-request]. 'auto' means 'choose a value based on what's provided via build_type'." | ||
| required: false | ||
| type: string | ||
| default: "auto" | ||
| branch: | ||
| description: | | ||
| Git branch the workflow run targets. | ||
| This is required even when 'sha' is provided because it is also used for organizing artifacts. | ||
| type: string | ||
| date: | ||
| description: "Date (YYYY-MM-DD) this run is for. Used to organize artifacts produced by nightly builds" | ||
| type: string | ||
| sha: | ||
| description: "Full git commit SHA to check out" | ||
| type: string | ||
| repo: | ||
| description: "Git repo to check out, in '{org}/{repo}' form, e.g. 'rapidsai/cudf'" | ||
| type: string | ||
| script: | ||
| type: string | ||
| required: true | ||
| description: "Shell code to be executed in a step. Ideally this should just invoke a script managed in the repo the workflow runs from, like 'ci/test_python.sh'." | ||
| run_codecov: | ||
| type: boolean | ||
| default: true | ||
| matrix_filter: | ||
| description: | | ||
| jq expression which modifies the matrix. | ||
| For example, 'map(select(.ARCH == "amd64"))' to achieve "only run amd64 jobs". | ||
| type: string | ||
| default: "." | ||
| continue-on-error: | ||
| description: | | ||
| If true, job failures do not result in workflow failures (useful for implementing | ||
| optional CI workflows). | ||
| See https://docs.github.com/en/actions/reference/workflow-syntax-for-github-actions#jobsjob_idcontinue-on-error | ||
| type: boolean | ||
| required: false | ||
| default: false | ||
| container-options: | ||
| description: | | ||
| Command-line arguments passed to 'docker run' when starting the container this workflow runs in. | ||
| This should be provided as a single string to be inlined into 'docker run', not an array. | ||
| For example, '--quiet --ulimit nofile=2048'. | ||
| required: false | ||
| type: string | ||
| default: "-e _NOOP" | ||
| build_workflow_name: | ||
| description: | | ||
| Name of a workflow file that produced artifacts to be downloaded in this run. | ||
| If not set (the default), artifact-handling scripts use RAPIDS-conventional defaults (like "build.yaml" when "build_type == nightly"). | ||
| required: false | ||
| type: string | ||
| sccache-dist-request-timeout: | ||
| type: string | ||
| default: 7140 | ||
| description: | | ||
| The maximum time (in seconds) the sccache client should wait for a distributed compilation to complete. | ||
| sccache-dist-token-secret-name: | ||
| type: string | ||
| required: false | ||
| description: | | ||
| The name of the secret that contains the token used to authenticate with the RAPIDS Build Engineering sccache-dist build cluster. | ||
| alternative-gh-token-secret-name: | ||
| type: string | ||
| required: false | ||
| description: | | ||
| If provided, should contain the name of a secret in the repo which holds a GitHub API token. | ||
| When this is non-empty, that secret's value is used in place of the default repo-level token | ||
| anywhere that environment variable GH_TOKEN is set. This is especially useful for downloading | ||
| artifacts from other private repos, which repo tokens do not have access to. | ||
| cache-paths: | ||
| type: string | ||
| required: false | ||
| default: "" | ||
| description: | | ||
| Newline-separated workspace-relative paths to persist with actions/cache. Workspace-relative | ||
| paths are required for cache saves from job containers. | ||
| cache-key-prefix: | ||
| type: string | ||
| required: false | ||
| default: "" | ||
| description: "Cache-key prefix; the workflow appends its matrix identity." | ||
| cache-key-files: | ||
| type: string | ||
| required: false | ||
| default: "" | ||
| description: "Newline-separated files or glob patterns to hash into the cache key." | ||
| cache-environment: | ||
| type: string | ||
| required: false | ||
| default: "" | ||
| description: | | ||
| Newline-separated literal NAME=VALUE pairs exported before the caller script runs. Use | ||
| ${{ github.workspace }}, not $GITHUB_WORKSPACE, for workspace paths. | ||
| secrets: | ||
| script-env-secret-1-key: | ||
| description: | | ||
| Name of an environment variable in the environment where 'inputs.script' is run. | ||
| Variable's value will be set to the value passed as 'secrets.script-env-secret-1-value'. | ||
| required: false | ||
| script-env-secret-1-value: | ||
| description: | | ||
| Secret value. | ||
| Will be available via an environment variable named by 'secrets.script-env-secret-1-key'. | ||
| required: false | ||
| script-env-secret-2-key: | ||
| description: | | ||
| Name of an environment variable in the environment where 'inputs.script' is run. | ||
| Variable's value will be set to the value passed as 'secrets.script-env-secret-2-value'. | ||
| required: false | ||
| script-env-secret-2-value: | ||
| description: | | ||
| Secret value. | ||
| Will be available via an environment variable named by 'secrets.script-env-secret-2-key'. | ||
| required: false | ||
| script-env-secret-3-key: | ||
| description: | | ||
| Name of an environment variable in the environment where 'inputs.script' is run. | ||
| Variable's value will be set to the value passed as 'secrets.script-env-secret-3-value'. | ||
| required: false | ||
| script-env-secret-3-value: | ||
| description: | | ||
| Secret value. | ||
| Will be available via an environment variable named by 'secrets.script-env-secret-3-key'. | ||
| required: false | ||
| script-env-secret-4-key: | ||
| description: | | ||
| Name of an environment variable in the environment where 'inputs.script' is run. | ||
| Variable's value will be set to the value passed as 'secrets.script-env-secret-4-value'. | ||
| required: false | ||
| script-env-secret-4-value: | ||
| description: | | ||
| Secret value. | ||
| Will be available via an environment variable named by 'secrets.script-env-secret-4-key'. | ||
| required: false | ||
| defaults: | ||
| run: | ||
| shell: bash | ||
| permissions: | ||
| actions: read | ||
| checks: none | ||
| contents: read | ||
| deployments: none | ||
| discussions: none | ||
| id-token: write | ||
| issues: none | ||
| packages: read | ||
| pages: none | ||
| pull-requests: read | ||
| repository-projects: none | ||
| security-events: none | ||
| statuses: none | ||
| jobs: | ||
| compute-matrix: | ||
| uses: ./.github/workflows/compute-matrix.yaml | ||
| with: | ||
| build_type: ${{ inputs.build_type }} | ||
| matrix_name: conda-python-tests | ||
| matrix_type: ${{ inputs.matrix_type }} | ||
| matrix_filter: ${{ inputs.matrix_filter }} | ||
| tests: | ||
| name: ${{ matrix.CUDA_VER }}, ${{ matrix.PY_VER }}, ${{ matrix.ARCH }}, ${{ matrix.LINUX_VER }}, ${{ matrix.GPU }}, ${{ matrix.DRIVER }}-driver, ${{ matrix.DEPENDENCIES }}-deps | ||
| needs: compute-matrix | ||
| strategy: | ||
| fail-fast: false | ||
| matrix: ${{ fromJSON(needs.compute-matrix.outputs.matrix) }} | ||
| runs-on: "linux-${{ matrix.ARCH }}-gpu-${{ matrix.GPU }}-${{ matrix.DRIVER }}-1" | ||
| continue-on-error: ${{ inputs.continue-on-error }} | ||
| env: | ||
| RAPIDS_ARTIFACTS_DIR: ${{ github.workspace }}/artifacts | ||
| RAPIDS_COVERAGE_DIR: ${{ github.workspace }}/coverage-results | ||
| RAPIDS_DEPENDENCIES: ${{ matrix.DEPENDENCIES }} | ||
| RAPIDS_TESTS_DIR: ${{ github.workspace }}/test-results | ||
| container: | ||
| image: rapidsai/ci-conda:26.10-cuda${{ matrix.CUDA_VER }}-${{ matrix.LINUX_VER }}-py${{ matrix.PY_VER }} | ||
| options: ${{ inputs.container-options }} | ||
| env: | ||
| RAPIDS_BUILD_TYPE: ${{ inputs.build_type }} | ||
| NVIDIA_VISIBLE_DEVICES: ${{ env.NVIDIA_VISIBLE_DEVICES }} | ||
| steps: | ||
| - uses: aws-actions/configure-aws-credentials@517a711dbcd0e402f90c77e7e2f81e849156e31d # v6.2.2 | ||
| with: | ||
| role-to-assume: ${{ vars.AWS_ROLE_ARN }} | ||
| aws-region: ${{ vars.AWS_REGION }} | ||
| role-duration-seconds: 43200 # 12h | ||
| - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 | ||
| with: | ||
| repository: ${{ inputs.repo }} | ||
| ref: ${{ inputs.sha }} | ||
| fetch-depth: 0 | ||
| persist-credentials: true | ||
| - name: Validate caller cache configuration | ||
| if: inputs.cache-paths != '' || inputs.cache-key-prefix != '' || inputs.cache-key-files != '' || inputs.cache-environment != '' | ||
| run: | | ||
| if test -z "${INPUTS_CACHE_PATHS}" || test -z "${INPUTS_CACHE_KEY_PREFIX}"; then | ||
| echo "ERROR: cache-paths and cache-key-prefix must be provided together." | ||
| exit 1 | ||
| fi | ||
| env: | ||
| INPUTS_CACHE_PATHS: ${{ inputs.cache-paths }} | ||
| INPUTS_CACHE_KEY_PREFIX: ${{ inputs.cache-key-prefix }} | ||
| - name: Cache caller paths | ||
| if: inputs.cache-paths != '' | ||
| uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0 | ||
| with: | ||
| path: ${{ inputs.cache-paths }} | ||
| key: ${{ inputs.cache-key-prefix }}-${{ matrix.CUDA_VER }}-${{ matrix.PY_VER }}-${{ matrix.ARCH }}-${{ matrix.LINUX_VER }}-${{ matrix.GPU }}-${{ matrix.DRIVER }}-${{ matrix.DEPENDENCIES }}-${{ hashFiles(inputs.cache-key-files) }} | ||
| restore-keys: | | ||
| ${{ inputs.cache-key-prefix }}-${{ matrix.CUDA_VER }}-${{ matrix.PY_VER }}-${{ matrix.ARCH }}-${{ matrix.LINUX_VER }}-${{ matrix.GPU }}-${{ matrix.DRIVER }}-${{ matrix.DEPENDENCIES }}- | ||
| - name: Configure caller cache environment | ||
| if: inputs.cache-environment != '' | ||
| run: printf '%s\n' "$INPUTS_CACHE_ENVIRONMENT" >> "$GITHUB_ENV" | ||
| env: | ||
| INPUTS_CACHE_ENVIRONMENT: ${{ inputs.cache-environment }} | ||
| - name: Standardize repository information | ||
| uses: rapidsai/shared-actions/rapids-github-info@main | ||
| with: | ||
| repo: ${{ inputs.repo }} | ||
| branch: ${{ inputs.branch }} | ||
| date: ${{ inputs.date }} | ||
| sha: ${{ inputs.sha }} | ||
| build_workflow_name: ${{ inputs.build_workflow_name }} | ||
| # This has to be AFTER the checkout step. It creates a telemetry-artifacts directory, | ||
| # and the checkout step would destroy it. | ||
| - name: Telemetry setup | ||
| uses: rapidsai/shared-actions/telemetry-dispatch-setup@main | ||
| continue-on-error: true | ||
| if: ${{ vars.TELEMETRY_ENABLED == 'true' }} | ||
| env: | ||
| # DOES NOT NEED alternative-gh-token-secret-name - github.token is enough and more limited | ||
| GH_TOKEN: ${{ github.token }} | ||
| with: | ||
| extra_attributes: "rapids.PACKAGER=conda,rapids.CUDA_VER=${{ matrix.CUDA_VER }},rapids.PY_VER=${{ matrix.PY_VER }},rapids.ARCH=${{ matrix.ARCH }},rapids.LINUX_VER=${{ matrix.LINUX_VER }},rapids.GPU=${{ matrix.GPU }},rapids.DRIVER=${{ matrix.DRIVER }},rapids.DEPENDENCIES=${{ matrix.DEPENDENCIES }}" | ||
| - name: Setup proxy cache | ||
| uses: nv-gha-runners/setup-proxy-cache@main | ||
| continue-on-error: true | ||
| with: | ||
| enable-apt: true | ||
| # Install latest rapidsai/sccache client and configure sccache-dist | ||
| - name: Setup sccache-dist | ||
| uses: rapidsai/shared-actions/setup-sccache-dist@main | ||
| env: | ||
| AWS_REGION: "${{env.AWS_REGION}}" | ||
| AWS_ACCESS_KEY_ID: "${{env.AWS_ACCESS_KEY_ID}}" | ||
| AWS_SECRET_ACCESS_KEY: "${{env.AWS_SECRET_ACCESS_KEY}}" | ||
| with: | ||
| log-file: "${{ env.RAPIDS_ARTIFACTS_DIR }}/sccache.log" | ||
| request-timeout: ${{ inputs.sccache-dist-request-timeout }} | ||
| # Per the docs at https://docs.github.com/en/rest/rate-limit/rate-limit?apiVersion=2022-11-28#get-rate-limit-status-for-the-authenticated-user, | ||
| # checking '/rate_limit | jq .' should not itself count against any rate limits. | ||
| # | ||
| # gh CLI is pre-installed on Github-hosted runners, but may not be on self-hosted runners. | ||
| - name: Check GitHub API rate limits | ||
| run: | | ||
| if ! type gh >/dev/null; then | ||
| echo "'gh' CLI is not installed... skipping rate-limits check" | ||
| else | ||
| gh api /rate_limit | jq . | ||
| fi | ||
| env: | ||
| # NEEDS alternative-gh-token-secret_name - API limits need to be for whatever token is used for upload/download. Repo token may be a different pool for rate limits. | ||
| GH_TOKEN: ${{ inputs.alternative-gh-token-secret-name && secrets[inputs.alternative-gh-token-secret-name] || github.token }} # zizmor: ignore[overprovisioned-secrets] | ||
| # cannot put possibly-null things as keys in the 'env:' mapping, so need to process these in a script | ||
| - name: Set secrets in script env | ||
| run: | | ||
| set_env_var() { | ||
| local input_prefix="script-env-secret-$1" | ||
| local key_str=$2 | ||
| local val_str=$3 | ||
| if test -n "${val_str}"; then | ||
| if ! test -n "${key_str}"; then | ||
| echo "ERROR: '${input_prefix}-value' non-empty but '${input_prefix}-key' is empty. Set '${input_prefix}-key'." | ||
| exit 1 | ||
| fi | ||
| echo "${key_str}=${val_str}" >> "${GITHUB_ENV}" | ||
| fi | ||
| } | ||
| set_env_var '1' '${{ secrets.script-env-secret-1-key }}' '${{ secrets.script-env-secret-1-value }}' | ||
| set_env_var '2' '${{ secrets.script-env-secret-2-key }}' '${{ secrets.script-env-secret-2-value }}' | ||
| set_env_var '3' '${{ secrets.script-env-secret-3-key }}' '${{ secrets.script-env-secret-3-value }}' | ||
| set_env_var '4' '${{ secrets.script-env-secret-4-key }}' '${{ secrets.script-env-secret-4-value }}' | ||
| - name: Python tests | ||
| run: | | ||
| ulimit -n "$(ulimit -Hn)" | ||
| $INPUTS_SCRIPT | ||
| env: | ||
| INPUTS_SCRIPT: "${{ inputs.script }}" | ||
| # NEEDS alternative-gh-token-secret-name - may require a token with more permissions | ||
| GH_TOKEN: ${{ inputs.alternative-gh-token-secret-name && secrets[inputs.alternative-gh-token-secret-name] || github.token }} # zizmor: ignore[overprovisioned-secrets] | ||
| # opt out of conda sharded repodata | ||
| # | ||
| # TODO: remove these when this is resolved: https://github.com/conda/infrastructure/issues/1286#issuecomment-4628580232 | ||
| CONDA_PLUGINS_USE_SHARDED_REPODATA: false | ||
| MAMBA_USE_SHARDED_REPODATA: false | ||
| RATTLER_SHARDED: false | ||
| - name: Generate test report | ||
| uses: test-summary/action@37b508cfee6d4d080eedd00b5bb240a6a784a6a5 # v2.6 | ||
| with: | ||
| paths: "${{ env.RAPIDS_TESTS_DIR }}/*.xml" | ||
| if: always() | ||
| - name: Run codecov | ||
| if: inputs.run_codecov | ||
| env: | ||
| CODECOV_TOKEN: ${{ env.CODECOV_TOKEN || secrets.CODECOV_TOKEN }} | ||
| run: | | ||
| codecovcli \ | ||
| -v \ | ||
| upload-process \ | ||
| -C ${{ github.sha }} \ | ||
| -s "${RAPIDS_COVERAGE_DIR}" \ | ||
| --handle-no-reports-found | ||
| - name: Upload additional artifacts | ||
| if: "!cancelled()" | ||
| run: rapids-upload-artifacts-dir "cuda${RAPIDS_CUDA_VERSION%%.*}_$(arch)_py${RAPIDS_PY_VERSION//.}" | ||
| - name: Telemetry upload attributes | ||
| uses: rapidsai/shared-actions/telemetry-dispatch-stash-job-artifacts@main | ||
| continue-on-error: true | ||
| if: ${{ vars.TELEMETRY_ENABLED == 'true' }} | ||
| env: | ||
| # DOES NOT NEED alternative-gh-token-secret-name - github.token is enough and more limited | ||
| GH_TOKEN: ${{ github.token }} | ||
