From 2d813c95c173e3d2bce02642a6997ac7c8f59e3c Mon Sep 17 00:00:00 2001 From: ballaji Date: Fri, 15 May 2026 18:14:48 -0700 Subject: [PATCH 01/12] ci(gha): add Bazel build + test workflow Mirrors the workflows from the GitLab nvcf/nvcf MR !192. Pushing directly to NVIDIA/nvcf as a PR so the workflows can be validated in their target environment before the upstream merge. Co-authored-by: Balaji Ganesan Co-authored-by: Claude Opus 4.7 (1M context) --- .github/workflows/bazel-ci-image.yml | 59 +++++++++++++++ .github/workflows/bazel.yml | 106 +++++++++++++++++++++++++++ 2 files changed, 165 insertions(+) create mode 100644 .github/workflows/bazel-ci-image.yml create mode 100644 .github/workflows/bazel.yml diff --git a/.github/workflows/bazel-ci-image.yml b/.github/workflows/bazel-ci-image.yml new file mode 100644 index 000000000..ffaea7bdf --- /dev/null +++ b/.github/workflows/bazel-ci-image.yml @@ -0,0 +1,59 @@ +# SPDX-FileCopyrightText: Copyright (c) NVIDIA CORPORATION & AFFILIATES. All rights reserved. +# SPDX-License-Identifier: Apache-2.0 +# +# Builds ci/Dockerfile.bazel and pushes it to ghcr.io/NVIDIA/nvcf/bazel-ci +# so GitHub Actions runners on this public mirror can pull the same +# toolchain image the internal GitLab CI uses. Versioned by the +# BAZEL_CI_VERSION env below; bump in lockstep with the umbrella's +# .gitlab-ci.yml BAZEL_CI_VERSION when ci/Dockerfile.bazel changes. + +name: bazel-ci-image + +on: + push: + branches: [main] + paths: + - ci/Dockerfile.bazel + - .github/workflows/bazel-ci-image.yml + pull_request: + paths: + - ci/Dockerfile.bazel + - .github/workflows/bazel-ci-image.yml + workflow_dispatch: + +permissions: + contents: read + packages: write + +env: + BAZEL_CI_VERSION: "0.3.0" + IMAGE: ghcr.io/${{ github.repository }}/bazel-ci + +jobs: + build-and-push: + runs-on: ubuntu-latest + steps: + - uses: actions/checkout@v4 + + - name: Log in to GHCR + uses: docker/login-action@v3 + with: + registry: ghcr.io + username: ${{ github.actor }} + password: ${{ secrets.GITHUB_TOKEN }} + + - name: Set up Docker Buildx + uses: docker/setup-buildx-action@v3 + + - name: Build and push + uses: docker/build-push-action@v6 + with: + context: . + file: ci/Dockerfile.bazel + platforms: linux/amd64 + push: ${{ github.event_name != 'pull_request' }} + tags: | + ${{ env.IMAGE }}:${{ env.BAZEL_CI_VERSION }} + ${{ env.IMAGE }}:latest + cache-from: type=gha + cache-to: type=gha,mode=max diff --git a/.github/workflows/bazel.yml b/.github/workflows/bazel.yml new file mode 100644 index 000000000..1aea72091 --- /dev/null +++ b/.github/workflows/bazel.yml @@ -0,0 +1,106 @@ +# SPDX-FileCopyrightText: Copyright (c) NVIDIA CORPORATION & AFFILIATES. All rights reserved. +# SPDX-License-Identifier: Apache-2.0 +# +# Bazel build + test on the public NVIDIA/nvcf mirror. +# +# Matrix entries reference subtrees that have their Bazel scaffold +# mirrored to GitHub (each subtree's upstream .oss-allowlist controls +# whether BUILD.bazel files reach this mirror). Add a row when a new +# subtree's OSS-flip MR merges upstream. +# +# Image push targets, internal NGC registry pulls, and the nvcfbarn +# remote cache are all internal-only; this workflow runs build + test +# only. It pulls the same bazel-ci toolchain image the GitLab pipeline +# uses, mirrored to ghcr.io by the bazel-ci-image workflow. + +name: bazel + +on: + push: + branches: [main] + pull_request: + branches: [main] + workflow_dispatch: + +permissions: + contents: read + packages: read + +concurrency: + group: bazel-${{ github.ref }} + cancel-in-progress: true + +env: + BAZEL_CI_IMAGE: ghcr.io/${{ github.repository }}/bazel-ci:0.3.0 + +jobs: + bazel: + name: bazel (${{ matrix.subtree.id }}) + runs-on: ubuntu-latest + container: + image: ghcr.io/${{ github.repository }}/bazel-ci:0.3.0 + credentials: + username: ${{ github.actor }} + password: ${{ secrets.GITHUB_TOKEN }} + strategy: + fail-fast: false + matrix: + subtree: + # Umbrella's own Phase 1 targets (native subtrees wired into + # the root MODULE.bazel: nvcf-cli + nvcf-go-lib). + - id: umbrella-phase1 + path: . + # Synthetic-import subtrees whose Bazel scaffold is on the + # public mirror. Add new entries here as their OSS-flip MRs + # merge upstream and the next sync brings them in. + - id: grpc-proxy + path: src/invocation-plane-services/grpc-proxy + - id: nats-auth-callout + path: src/invocation-plane-services/nats-auth-callout + - id: nvca + path: src/compute-plane-services/nvca + - id: image-credential-helper + path: src/compute-plane-services/image-credential-helper + - id: function-autoscaler + path: src/control-plane-services/function-autoscaler + - id: helm-reval + path: src/control-plane-services/helm-reval + steps: + - uses: actions/checkout@v4 + + - name: Skip if subtree has no MODULE.bazel yet + id: precheck + run: | + if [ ! -f "${{ matrix.subtree.path }}/MODULE.bazel" ]; then + echo "no MODULE.bazel at ${{ matrix.subtree.path }} -- skipping" + echo "skip=true" >> "$GITHUB_OUTPUT" + else + echo "skip=false" >> "$GITHUB_OUTPUT" + fi + + # bazelisk is preinstalled in the bazel-ci image as `bazel`. + - name: bazel version + if: steps.precheck.outputs.skip == 'false' + working-directory: ${{ matrix.subtree.path }} + run: bazel version + + - name: Cache Bazel repository + disk caches + if: steps.precheck.outputs.skip == 'false' + uses: actions/cache@v4 + with: + path: | + ~/.cache/bazel/_bazel_${{ env.USER || 'root' }}/install + ~/.cache/bazel/_bazel_${{ env.USER || 'root' }}/cache + key: bazel-${{ matrix.subtree.id }}-${{ hashFiles(format('{0}/MODULE.bazel.lock', matrix.subtree.path), format('{0}/.bazelversion', matrix.subtree.path)) }} + restore-keys: | + bazel-${{ matrix.subtree.id }}- + + - name: bazel build //... + if: steps.precheck.outputs.skip == 'false' + working-directory: ${{ matrix.subtree.path }} + run: bazel build //... + + - name: bazel test //... + if: steps.precheck.outputs.skip == 'false' + working-directory: ${{ matrix.subtree.path }} + run: bazel test --flaky_test_attempts=3 //... From 84ca9a9a38d4600d6e21820e6fb2e3e94bd6b399 Mon Sep 17 00:00:00 2001 From: ballaji Date: Fri, 15 May 2026 18:25:21 -0700 Subject: [PATCH 02/12] ci: rerun against linked ghcr.io image From cfd0b092363c1dbba0154ca3de981ba0027d0b8d Mon Sep 17 00:00:00 2001 From: ballaji Date: Fri, 15 May 2026 18:28:01 -0700 Subject: [PATCH 03/12] ci(gha): use lowercase ghcr.io path Docker registry refs must be lowercase. github.repository expanded to NVIDIA/nvcf and rejected both at docker pull (bazel.yml container) and at docker build/push (bazel-ci-image.yml). Hardcode the lowercase 'nvidia/nvcf' form. Co-authored-by: Balaji Ganesan Co-authored-by: Claude Opus 4.7 (1M context) --- .github/workflows/bazel-ci-image.yml | 2 +- .github/workflows/bazel.yml | 4 ++-- 2 files changed, 3 insertions(+), 3 deletions(-) diff --git a/.github/workflows/bazel-ci-image.yml b/.github/workflows/bazel-ci-image.yml index ffaea7bdf..b829ce6fa 100644 --- a/.github/workflows/bazel-ci-image.yml +++ b/.github/workflows/bazel-ci-image.yml @@ -27,7 +27,7 @@ permissions: env: BAZEL_CI_VERSION: "0.3.0" - IMAGE: ghcr.io/${{ github.repository }}/bazel-ci + IMAGE: ghcr.io/nvidia/nvcf/bazel-ci jobs: build-and-push: diff --git a/.github/workflows/bazel.yml b/.github/workflows/bazel.yml index 1aea72091..c4a9b134b 100644 --- a/.github/workflows/bazel.yml +++ b/.github/workflows/bazel.yml @@ -31,14 +31,14 @@ concurrency: cancel-in-progress: true env: - BAZEL_CI_IMAGE: ghcr.io/${{ github.repository }}/bazel-ci:0.3.0 + BAZEL_CI_IMAGE: ghcr.io/nvidia/nvcf/bazel-ci:0.3.0 jobs: bazel: name: bazel (${{ matrix.subtree.id }}) runs-on: ubuntu-latest container: - image: ghcr.io/${{ github.repository }}/bazel-ci:0.3.0 + image: ghcr.io/nvidia/nvcf/bazel-ci:0.3.0 credentials: username: ${{ github.actor }} password: ${{ secrets.GITHUB_TOKEN }} From 8fdd420e3b9d912272bb7c808967d42c6c77e359 Mon Sep 17 00:00:00 2001 From: ballaji Date: Fri, 15 May 2026 18:54:07 -0700 Subject: [PATCH 04/12] ci(gha): trim matrix to entries currently on the mirror The mirror's view of subtrees is keyed off the umbrella's imports.yaml pin; several subtrees have merged Bazel scaffold upstream but the pin hasn't been bumped yet, so their root BUILD.bazel / per-package BUILDs aren't on the mirror. Trim the matrix to entries known good today (grpc-proxy, nats-auth-callout) and document the rest with a note for re-adding as syncs catch up. Co-authored-by: Balaji Ganesan --- .github/workflows/bazel.yml | 30 +++++++++++++++--------------- 1 file changed, 15 insertions(+), 15 deletions(-) diff --git a/.github/workflows/bazel.yml b/.github/workflows/bazel.yml index c4a9b134b..dd7c012a2 100644 --- a/.github/workflows/bazel.yml +++ b/.github/workflows/bazel.yml @@ -46,25 +46,25 @@ jobs: fail-fast: false matrix: subtree: - # Umbrella's own Phase 1 targets (native subtrees wired into - # the root MODULE.bazel: nvcf-cli + nvcf-go-lib). - - id: umbrella-phase1 - path: . - # Synthetic-import subtrees whose Bazel scaffold is on the - # public mirror. Add new entries here as their OSS-flip MRs - # merge upstream and the next sync brings them in. + # Synthetic-import subtrees whose Bazel scaffold is fully on + # the public mirror today (root + per-package BUILD.bazel + # files). Add entries as the umbrella's imports.yaml pin is + # bumped to bring in the rest: + # - umbrella-phase1 (.): needs src/clis/nvcf-cli/BUILD.bazel + # and src/libraries/go/lib/BUILD.bazel on the mirror via + # their own subtree .oss-allowlist (the umbrella MR + # ci/github-actions-bazel adds these entries; the sync + # that follows will surface them). + # - nvca, helm-reval, function-autoscaler: their root and + # per-package BUILD.bazel files are merged upstream but + # the umbrella's imports.yaml hasn't been bumped to pull + # the new commits. + # - image-credential-helper: OSS-flip MR !82 still open; + # no MODULE.bazel on the mirror yet. - id: grpc-proxy path: src/invocation-plane-services/grpc-proxy - id: nats-auth-callout path: src/invocation-plane-services/nats-auth-callout - - id: nvca - path: src/compute-plane-services/nvca - - id: image-credential-helper - path: src/compute-plane-services/image-credential-helper - - id: function-autoscaler - path: src/control-plane-services/function-autoscaler - - id: helm-reval - path: src/control-plane-services/helm-reval steps: - uses: actions/checkout@v4 From 0e30c2dec30d9ab0be23202607c4a35a51725d5d Mon Sep 17 00:00:00 2001 From: ballaji Date: Sat, 16 May 2026 06:42:57 -0700 Subject: [PATCH 05/12] ci(gha): expand matrix back to full set after sync landed Sync MR nvcf/nvcf!193 merged and landed on NVIDIA/nvcf main. Six of eight Phase B subtrees now have their Bazel scaffold on the mirror; the rest still skip via precheck. Re-running this PR will exercise actual builds instead of all-skips. Co-authored-by: Balaji Ganesan --- .github/workflows/bazel.yml | 40 +++++++++++++++++++++++-------------- 1 file changed, 25 insertions(+), 15 deletions(-) diff --git a/.github/workflows/bazel.yml b/.github/workflows/bazel.yml index dd7c012a2..233842cc6 100644 --- a/.github/workflows/bazel.yml +++ b/.github/workflows/bazel.yml @@ -46,25 +46,35 @@ jobs: fail-fast: false matrix: subtree: - # Synthetic-import subtrees whose Bazel scaffold is fully on - # the public mirror today (root + per-package BUILD.bazel - # files). Add entries as the umbrella's imports.yaml pin is - # bumped to bring in the rest: - # - umbrella-phase1 (.): needs src/clis/nvcf-cli/BUILD.bazel - # and src/libraries/go/lib/BUILD.bazel on the mirror via - # their own subtree .oss-allowlist (the umbrella MR - # ci/github-actions-bazel adds these entries; the sync - # that follows will surface them). - # - nvca, helm-reval, function-autoscaler: their root and - # per-package BUILD.bazel files are merged upstream but - # the umbrella's imports.yaml hasn't been bumped to pull - # the new commits. - # - image-credential-helper: OSS-flip MR !82 still open; - # no MODULE.bazel on the mirror yet. + # Full matrix. The precheck step skips entries that don't + # have a MODULE.bazel on the mirror yet (their upstream + # OSS-flip MR is still open, or the umbrella's imports.yaml + # pin hasn't been bumped past that flip). Entries fill in + # automatically as the underlying syncs land. + - id: umbrella-phase1 + path: . - id: grpc-proxy path: src/invocation-plane-services/grpc-proxy - id: nats-auth-callout path: src/invocation-plane-services/nats-auth-callout + - id: ratelimiter + path: src/invocation-plane-services/ratelimiter + - id: http-invocation + path: src/invocation-plane-services/http-invocation + - id: llm-gateway + path: src/invocation-plane-services/llm-gateway + - id: nvca + path: src/compute-plane-services/nvca + - id: dns-cache + path: src/compute-plane-services/dns-cache + - id: ess-agent + path: src/compute-plane-services/ess-agent + - id: image-credential-helper + path: src/compute-plane-services/image-credential-helper + - id: function-autoscaler + path: src/control-plane-services/function-autoscaler + - id: helm-reval + path: src/control-plane-services/helm-reval steps: - uses: actions/checkout@v4 From ccd199a926fd49e463c7eae04d2b7238910b6aa6 Mon Sep 17 00:00:00 2001 From: Balaji Ganesan Date: Mon, 18 May 2026 20:29:09 -0700 Subject: [PATCH 06/12] ci(gha): bump bazel-ci image 0.3.0 -> 0.4.0 Picks up kubebuilder-tools envtest binaries added in umbrella !212 so nvca's //pkg/storage:storage_test and //internal/miniservice: miniservice_test run on the public matrix without the KUBEBUILDER_ASSETS panic. --- .github/workflows/bazel.yml | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/.github/workflows/bazel.yml b/.github/workflows/bazel.yml index 233842cc6..33d62ac80 100644 --- a/.github/workflows/bazel.yml +++ b/.github/workflows/bazel.yml @@ -31,14 +31,14 @@ concurrency: cancel-in-progress: true env: - BAZEL_CI_IMAGE: ghcr.io/nvidia/nvcf/bazel-ci:0.3.0 + BAZEL_CI_IMAGE: ghcr.io/nvidia/nvcf/bazel-ci:0.4.0 jobs: bazel: name: bazel (${{ matrix.subtree.id }}) runs-on: ubuntu-latest container: - image: ghcr.io/nvidia/nvcf/bazel-ci:0.3.0 + image: ghcr.io/nvidia/nvcf/bazel-ci:0.4.0 credentials: username: ${{ github.actor }} password: ${{ secrets.GITHUB_TOKEN }} From bf33a98f521ef04b34752191d4574e0c016139c8 Mon Sep 17 00:00:00 2001 From: Balaji Ganesan Date: Tue, 19 May 2026 16:54:25 -0700 Subject: [PATCH 07/12] ci(gha): flip nvca matrix row to build-only (tests pass on GitLab, fail on GHA env) Applies the documented build-only policy for the nvca matrix row. GitLab pipeline 51843044 (post-nvca!1718, sha ddd942a) ran the four external-tagged test targets fresh and passed all of them. GHA matrix run 26131753006 on the same bazel-ci:0.4.0 image (digest-identical to GitLab's via the ghcr.io mirror) fails fresh on: //pkg/nvca:nvca_test FAILED 3/3 (27s) //pkg/operator/reconcile:reconcile_test FAILED 3/3 (53s) //pkg/storage:storage_test FAILED 3/3 (7s) Failing assertions: TestGetNetworkPoliciesDataEmptyDDCSIPList, TestGetNetworkPoliciesDataWithDDCSIPList, TestGetMiniServiceRBACCmData/* -- environment-sensitive tests that depend on something host-side (kernel, libc, Go runtime defaults) that differs between the GitLab CDS runner pool and the GHA ubuntu-latest runner under the same container image. Follow-up (NVCF-10347): identify the host-side delta and re-enable. Adds a field on the matrix entry shape; the test step is gated on . Default is true for all other rows. Refs: NVCF-10337, NVCF-10347 --- .github/workflows/bazel.yml | 8 +++++++- 1 file changed, 7 insertions(+), 1 deletion(-) diff --git a/.github/workflows/bazel.yml b/.github/workflows/bazel.yml index 33d62ac80..d9584a540 100644 --- a/.github/workflows/bazel.yml +++ b/.github/workflows/bazel.yml @@ -65,6 +65,7 @@ jobs: path: src/invocation-plane-services/llm-gateway - id: nvca path: src/compute-plane-services/nvca + tests_enabled: false # GitLab passes fresh; GHA fails on TestGetNetworkPoliciesData* / TestGetMiniServiceRBACCmData. Containment until env-diff diagnosed (NVCF-10347). - id: dns-cache path: src/compute-plane-services/dns-cache - id: ess-agent @@ -111,6 +112,11 @@ jobs: run: bazel build //... - name: bazel test //... - if: steps.precheck.outputs.skip == 'false' + # `tests_enabled: false` on the matrix row keeps the subtree in the + # matrix for build-coverage but skips this test step. Used when the + # build passes but tests fail with an environment delta from GitLab + # CI (per the documented build-only policy). Re-enable once the + # underlying drift is fixed. + if: steps.precheck.outputs.skip == 'false' && matrix.subtree.tests_enabled != false working-directory: ${{ matrix.subtree.path }} run: bazel test --flaky_test_attempts=3 //... From 0f59c3509f3a3ad7cbed7872719bdf16435835c0 Mon Sep 17 00:00:00 2001 From: Balaji Ganesan Date: Wed, 20 May 2026 07:33:12 -0700 Subject: [PATCH 08/12] ci(gha): wire NV_GITHUB_TOKEN for llm-gateway private modules llm-gateway pulls github.com/nvidia-lpu/{harmony,minijinja,parsec} as Go modules via Gazelle's go_deps extension. The GitLab pipeline uses a fine-grained PAT (NV_GITHUB_TOKEN) and `git config --global url.insteadOf` to authenticate the fetch; replicate that on GHA. The secret is read only on the llm-gateway matrix row (the other subtrees do not need github.com auth) and the step is a no-op when the secret is unset, with a warning so the failure mode is obvious. Add the secret on NVIDIA/nvcf at Settings -> Secrets and variables -> Actions -> Repository secrets, named NV_GITHUB_TOKEN, scoped read-only to the three nvidia-lpu repos. Refs: NVCF-10337 --- .github/workflows/bazel.yml | 20 ++++++++++++++++++++ 1 file changed, 20 insertions(+) diff --git a/.github/workflows/bazel.yml b/.github/workflows/bazel.yml index d9584a540..0541deccf 100644 --- a/.github/workflows/bazel.yml +++ b/.github/workflows/bazel.yml @@ -89,6 +89,26 @@ jobs: echo "skip=false" >> "$GITHUB_OUTPUT" fi + # llm-gateway pulls private github.com/nvidia-lpu/{harmony,minijinja,parsec} + # modules via Gazelle's go_deps extension. The GitLab pipeline + # configures `git config url.insteadOf` against an NV_GITHUB_TOKEN + # PAT scoped to read on those three repos; mirror that behavior + # on GHA. The secret is added at the NVIDIA/nvcf repo level and + # only surfaced into the llm-gateway matrix row. + - name: Configure git for private NVIDIA GitHub modules + if: steps.precheck.outputs.skip == 'false' && matrix.subtree.id == 'llm-gateway' + env: + NV_GITHUB_TOKEN: ${{ secrets.NV_GITHUB_TOKEN }} + run: | + if [ -n "${NV_GITHUB_TOKEN:-}" ]; then + git config --global \ + url."https://oauth2:${NV_GITHUB_TOKEN}@github.com/".insteadOf \ + "https://github.com/" + echo "[github-auth] insteadOf rewrite configured for github.com" + else + echo "[github-auth] WARNING: NV_GITHUB_TOKEN secret unset; nvidia-lpu module fetch will fail" + fi + # bazelisk is preinstalled in the bazel-ci image as `bazel`. - name: bazel version if: steps.precheck.outputs.skip == 'false' From e468b7501c515d58849fce949330846641fded0d Mon Sep 17 00:00:00 2001 From: Balaji Ganesan Date: Wed, 20 May 2026 07:47:10 -0700 Subject: [PATCH 09/12] ci(gha): re-trigger after NV_GITHUB_TOKEN secret added Empty commit to retrigger the bazel workflow against the now-populated NV_GITHUB_TOKEN secret. The prior run (26169489160) saw NV_GITHUB_TOKEN as empty and printed the unset-warning before bazel failed to fetch github.com/nvidia-lpu/minijinja. Refs: NVCF-10337 From 2481122d2728285804fda67f51047f8fa4d791a7 Mon Sep 17 00:00:00 2001 From: Balaji Ganesan Date: Wed, 20 May 2026 09:51:25 -0700 Subject: [PATCH 10/12] ci(gha): disable internal nvcfbarn remote cache (umbrella-phase1) The umbrella's root .bazelrc sets `build --config=remote` by default, routing through nvcfbarn.nvidia.com:8980. GitHub-hosted runners cannot resolve that hostname; umbrella-phase1 was failing with: UNAVAILABLE: Unable to resolve host nvcfbarn.nvidia.com Pass `--remote_cache=` to the bazel build / bazel test steps so the .bazelrc default is overridden with an empty endpoint. Local disk and repo caches still apply. Refs: NVCF-10337 --- .github/workflows/bazel.yml | 13 +++++++++++-- 1 file changed, 11 insertions(+), 2 deletions(-) diff --git a/.github/workflows/bazel.yml b/.github/workflows/bazel.yml index 0541deccf..a7f9a10bf 100644 --- a/.github/workflows/bazel.yml +++ b/.github/workflows/bazel.yml @@ -126,10 +126,19 @@ jobs: restore-keys: | bazel-${{ matrix.subtree.id }}- + # Disable the internal nvcfbarn Buildbarn remote cache for GHA. + # The umbrella's root .bazelrc sets `build --config=remote` by + # default, which on GitLab CDS runners routes through the + # nvcfbarn.nvidia.com:8980 cache. GHA's GitHub-hosted runners + # have no DNS path to that host, so leaving the default in place + # produces: + # UNAVAILABLE: Unable to resolve host nvcfbarn.nvidia.com + # Passing `--remote_cache=` overrides the .bazelrc default with + # an empty value, falling back to local action/repo caches only. - name: bazel build //... if: steps.precheck.outputs.skip == 'false' working-directory: ${{ matrix.subtree.path }} - run: bazel build //... + run: bazel build --remote_cache= //... - name: bazel test //... # `tests_enabled: false` on the matrix row keeps the subtree in the @@ -139,4 +148,4 @@ jobs: # underlying drift is fixed. if: steps.precheck.outputs.skip == 'false' && matrix.subtree.tests_enabled != false working-directory: ${{ matrix.subtree.path }} - run: bazel test --flaky_test_attempts=3 //... + run: bazel test --remote_cache= --flaky_test_attempts=3 //... From b941ba1ce3ff67873236ec6aa360fddaccf99322 Mon Sep 17 00:00:00 2001 From: Balaji Ganesan Date: Wed, 20 May 2026 10:13:34 -0700 Subject: [PATCH 11/12] ci(gha): fix test-step gate (was silently skipping every subtree) The previous gate `matrix.subtree.tests_enabled != false` evaluated to false on every matrix row that did not set tests_enabled explicitly, because GitHub Actions expressions coerce a missing matrix key to null which compares loose-equal to false. Net effect: the bazel test step was being skipped for every subtree this whole time (umbrella was getting build-only coverage, not the test coverage we believed). Switch to a positive-skip field: `tests_skip: true` on the matrix row opts out of the test step; default is to run. nvca is the only current opt-out (envtest >= 1.30 JobSuccessCriteriaMet failure, NVCF-10347). Refresh the comment to reference the current failure mode instead of the older TestGetNetworkPoliciesData* one. Refs: NVCF-10337 --- .github/workflows/bazel.yml | 22 +++++++++++++++------- 1 file changed, 15 insertions(+), 7 deletions(-) diff --git a/.github/workflows/bazel.yml b/.github/workflows/bazel.yml index a7f9a10bf..39e20a4c4 100644 --- a/.github/workflows/bazel.yml +++ b/.github/workflows/bazel.yml @@ -65,7 +65,12 @@ jobs: path: src/invocation-plane-services/llm-gateway - id: nvca path: src/compute-plane-services/nvca - tests_enabled: false # GitLab passes fresh; GHA fails on TestGetNetworkPoliciesData* / TestGetMiniServiceRBACCmData. Containment until env-diff diagnosed (NVCF-10347). + # Build-only on GHA: TestReconcile_ModelCache (pkg/storage) fails + # under envtest >= 1.30 because the test fakes JobSuccessCriteriaMet + # on a NonIndexed Job without a SuccessPolicy, which the apiserver + # now rejects. Tracked under NVCF-10347 for a test-layer fix by the + # nvca team; do not change reconciler logic to satisfy this. + tests_skip: true - id: dns-cache path: src/compute-plane-services/dns-cache - id: ess-agent @@ -141,11 +146,14 @@ jobs: run: bazel build --remote_cache= //... - name: bazel test //... - # `tests_enabled: false` on the matrix row keeps the subtree in the - # matrix for build-coverage but skips this test step. Used when the - # build passes but tests fail with an environment delta from GitLab - # CI (per the documented build-only policy). Re-enable once the - # underlying drift is fixed. - if: steps.precheck.outputs.skip == 'false' && matrix.subtree.tests_enabled != false + # `tests_skip: true` on the matrix row keeps the subtree in the matrix + # for build coverage but skips this step. Used when the build passes + # but tests fail with an environment delta from GitLab CI (per the + # documented build-only policy). Default is to run tests. NOTE: the + # gate uses a positive-skip field (negated below). The previous form + # `tests_enabled != false` silently skipped tests for every row that + # did not set the key explicitly, because GitHub Actions expressions + # coerce missing matrix keys to null which compares equal to false. + if: steps.precheck.outputs.skip == 'false' && !matrix.subtree.tests_skip working-directory: ${{ matrix.subtree.path }} run: bazel test --remote_cache= --flaky_test_attempts=3 //... From 51ab2c02128041af4dde462b2d6bd0befb5501bf Mon Sep 17 00:00:00 2001 From: Balaji Ganesan Date: Wed, 20 May 2026 13:44:17 -0700 Subject: [PATCH 12/12] ci(gha): flip umbrella-phase1 to build-only per build-only policy Two pre-existing go-lib test bugs were masked by the matrix gate that was silently skipping tests for every row before b941ba1c: //src/libraries/go/lib/cmd/icms-translate:icms-translate_test //src/libraries/go/lib/pkg/core:core_test (TestKubeConfiguratorToken goroutine leak) Both are pre-existing in the nvcf-go library and unrelated to the Bazel-CI rollout work. Per the documented build-only policy for GHA test-step failures, flip umbrella-phase1 to tests_skip: true (keep build coverage, skip tests) and let the nvcf-go owners clean up the test layer separately. This is the same containment pattern already applied to nvca. Refs: NVCF-10337 --- .github/workflows/bazel.yml | 12 ++++++++++++ 1 file changed, 12 insertions(+) diff --git a/.github/workflows/bazel.yml b/.github/workflows/bazel.yml index 39e20a4c4..d590c45af 100644 --- a/.github/workflows/bazel.yml +++ b/.github/workflows/bazel.yml @@ -53,6 +53,18 @@ jobs: # automatically as the underlying syncs land. - id: umbrella-phase1 path: . + # Build-only on GHA. Phase 1 native subtrees compile fine, but + # //src/libraries/go/lib has pre-existing test issues that were + # masked while the matrix test step was silently skipping for + # every row (fixed in b941ba1c). Now-visible failures: + # //src/libraries/go/lib/cmd/icms-translate:icms-translate_test + # -- passes locally, env-flaky on GHA (testdata IS in + # runfiles per the //src/libraries/go/lib/testdata/ + # icms-translate:testdata filegroup added in !234) + # //src/libraries/go/lib/pkg/core:core_test + # -- TestKubeConfiguratorToken leaks goroutines; pre-existing + # Track under NVCF-10337; nvcf-go team owns the test cleanup. + tests_skip: true - id: grpc-proxy path: src/invocation-plane-services/grpc-proxy - id: nats-auth-callout