ci: require conditional GPU validation for the v0.2.0 roadmap

Merged
RM
1mo ago
+1079-44

User description

Summary

Documentation-only PRs previously skipped the entire GPU workflow, preventing its checks from being required reliably. Add an always-reported hosted GPU validation result: known documentation/CPU changes skip the GPU, while device/build/binding/GPU-policy changes require successful GPU execution. Detection failures and skipped/canceled/failed required work fail closed. Hosted policy comes from the default branch via pull_request_target; fork data cannot change its classification or reach its self-hosted job. The single-use delivery-branch push bootstraps this check before merge and always requires real GPU success.

Align the repository with v0.2.0 — First Agoge CUDA operator: MiniCPM5 + Granite, including versioned-release policy, the approved historical-track exception, and the Linear-only issue intake and measured dual-model delivery sequence. This PR does not implement a training operator or claim either model's performance gate.

Fixes RM-1770.
Parent: RM-175.
Follow-through: RM-1771 → RM-1772 → RM-1773 → RM-1774.

Validation

  • 22 CPU-only gate tests using real temporary Git histories and job-result scenarios.
  • Existing F0 correlation, six clock-skew scenarios, 21 efficiency checks, seven NVML capability scenarios, GPU CI policy, and sanitizer-wrapper tests pass.
  • CUDA-disabled CMake configure, actionlint + shellcheck, and git diff checks pass.
  • Exact head 8d559af975a31804d4bf6de6a9baea954eaf960e passed CPU, lint, real RTX 5080 smoke, and hosted GPU validation before rule activation. Independent review has no remaining findings.

Deployment

The Linear project/issues and historical GitHub milestones are already reconciled. Main ruleset 23800987 is active: PRs, current-base checks, resolved conversations, no bypass/force-push/deletion, and zero fixed human approvals. All three required contexts are bound to GitHub Actions. Actions policy 5187 allows the trusted GPU workflow's events, and external-contributor workflow approval is required. GPU CI retains the ≥2 GiB headroom wait; full model comparisons remain release evidence.

Summary by cubic

Makes GPU validation a stable hosted check so required-check enforcement works for documentation/CPU-only PRs instead of skipping the entire workflow.

  • Known markdown/CPU-only changes skip the self-hosted GPU; CUDA, build, bindings, GPU-policy, and unknown tool paths require successful GPU execution.
  • Detection and verification run the trusted default-branch policy; PR trees are fetched as diff data only, so fork code cannot alter the gate or reach the self-hosted runner, and canceled or failed required work fails closed.
  • A hosted publisher creates the required GPU validation check on the candidate SHA via the HTTPS-only GitHub Checks API — pull_request_target jobs belong to the base SHA, so the context stays available after the delivery branch retires.
  • Aligns the repo with the v0.2.0 roadmap (MiniCPM5 + Granite training-gate operator), Linear-only issue intake, and the retired historical milestone exception.
  • Adds tools/gpu_ci_gate.py, tools/check_gpu_ci_gate.py, tools/publish_gpu_validation.py, tools/check_gpu_ci_policy.py, and their test suites; a CPU-only behavior suite covers real Git histories, renames, job-result matrices, and continue-on-error rejection.
  • Runs the GPU workflow for every PR to main and pushes to main/codex/v020-delivery; delivery-branch pushes always demand full GPU validation, replaces the old markdown paths-ignore skip with pull_request_target, and skips publication when a bootstrap branch is deleted.
  • Shared helpers tools/host_cli.py (fixed-argv subprocesses with timeouts), tools/gpu_ci_gate_harness.py, and tools/script_runner.py (in-process test execution) cut cyclomatic complexity, deduplicate tests, and satisfy analyzer subprocess rules.

CodeAnt-AI Description

Enforce trusted, always-reported GPU validation for pull requests

What Changed

  • Every pull request now receives a GPU validation check on its own commit, including documentation-only and CPU-only changes.
  • CUDA, binding, build, workflow, policy, and unknown changes require successful GPU validation; known documentation and CPU-only changes skip the GPU host but still pass through the required check.
  • Fork GPU changes cannot satisfy validation by skipping execution, and fork code is never run on the self-hosted GPU runner.
  • Failed, canceled, skipped, or incomplete detection and GPU work fail the required check instead of being treated as successful.
  • Added CPU-only tests covering change detection, trust boundaries, commit ranges, result handling, and publication behavior.
  • Documented the v0.2.0 MiniCPM5 and Granite training-operator release gates and delivery sequence.

Impact

✅ Reliable GPU checks on every pull request
✅ Fewer unsafe fork executions on the GPU host
✅ GPU-required changes cannot merge after skipped or failed validation

💡 Usage Guide

Checking Your Pull Request

Every time you make a pull request, our system automatically looks through it. We check for security issues, mistakes in how you're setting up your infrastructure, and common code problems. We do this to make sure your changes are solid and won't cause any trouble later.

Talking to CodeAnt AI

Got a question or need a hand with something in your pull request? You can easily get in touch with CodeAnt AI right here. Just type the following in a comment on your pull request, and replace "Your question here" with whatever you want to ask:

@codeant-ai ask: Your question here

This lets you have a chat with CodeAnt AI about your pull request, making it easier to understand and improve your code.

Example

@codeant-ai ask: Can you suggest a safer alternative to storing this secret?

Preserve Org Learnings with CodeAnt

You can record team preferences so CodeAnt AI applies them in future reviews. Reply directly to the specific CodeAnt AI suggestion (in the same thread) and replace "Your feedback here" with your input:

@codeant-ai: Your feedback here

This helps CodeAnt AI learn and adapt to your team's coding style and standards.

Example

@codeant-ai: Do not flag unused imports.

Retrigger review

Ask CodeAnt AI to review the PR again, by typing:

@codeant-ai: review

Check Your Repository Health

To analyze the health of your code repository, visit our dashboard at https://app.codeant.ai. This tool helps you identify potential issues and areas for improvement in your codebase, ensuring your repository maintains high standards of code health.