# SPDX-FileCopyrightText: Copyright (c) 2023 NVIDIA CORPORATION & AFFILIATES. All rights reserved.

# SPDX-License-Identifier: Apache-2.0

#

# Licensed under the Apache License, Version 2.0 (the "License");

# you may not use this file except in compliance with the License.

# You may obtain a copy of the License at

#

# http://www.apache.org/licenses/LICENSE-2.0

#

# Unless required by applicable law or agreed to in writing, software

# distributed under the License is distributed on an "AS IS" BASIS,

# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.

# See the License for the specific language governing permissions and

# limitations under the License.

# This is the main workflow that runs on every PR and push to main

name: pull_request

defaults:

run:

shell: bash --noprofile --norc -euo pipefail {0}

on:

push:

branches:

- "pull-request/[0-9]+"

concurrency:

group: ${{ github.workflow }}-on-${{ github.event_name }}-from-${{ github.ref_name }}

cancel-in-progress: true

jobs:

build-workflow:

name: Build workflow from matrix

runs-on: ubuntu-latest

permissions:

contents: read

pull-requests: write

outputs:

base_sha: ${{ steps.export-pr-info.outputs.base_sha }}

merge_base_sha: ${{ steps.export-pr-info.outputs.merge_base_sha }}

pr_number: ${{ steps.export-pr-info.outputs.pr_number }}

workflow: ${{ steps.build-workflow.outputs.workflow }}

matrix_enabled: ${{ steps.export-flags.outputs.matrix_enabled }}

bench_enabled: ${{ steps.build-bench-matrix.outputs.bench_enabled }}

bench_matrix: ${{ steps.build-bench-matrix.outputs.bench_matrix }}

compile_time_enabled: ${{ steps.build-compile-time-matrix.outputs.compile_time_enabled }}

compile_time_matrix: ${{ steps.build-compile-time-matrix.outputs.compile_time_matrix }}

sass_enabled: ${{ steps.build-sass-matrix.outputs.sass_enabled }}

sass_matrix: ${{ steps.build-sass-matrix.outputs.sass_matrix }}

vdc_enabled: ${{ steps.export-flags.outputs.vdc_enabled }}

docs_enabled: ${{ steps.export-flags.outputs.docs_enabled }}

steps:

- name: Export workflow flags

id: export-flags

run: |

output() { echo "$1=$2" | tee -a "${GITHUB_OUTPUT}"; }

output matrix_enabled "${{ !contains(github.event.head_commit.message, '[bench-only]') && !contains(github.event.head_commit.message, '[skip-matrix]') }}"

output vdc_enabled "${{ !contains(github.event.head_commit.message, '[bench-only]') && !contains(github.event.head_commit.message, '[skip-vdc]') }}"

output docs_enabled "${{ !contains(github.event.head_commit.message, '[bench-only]') && !contains(github.event.head_commit.message, '[skip-docs]') }}"

- name: Checkout repo

uses: actions/checkout@v6

with:

# `git merge-base` below needs the history of both sides.

fetch-depth: 0

persist-credentials: false

- name: Lookup PR info

id: get-pr-info

uses: nv-gha-runners/get-pr-info@main

- name: Export PR info

id: export-pr-info

env:

BASE_SHA: ${{ fromJSON(steps.get-pr-info.outputs.pr-info).base.sha }}

run: |

echo "base_sha=${BASE_SHA}" | tee -a "${GITHUB_OUTPUT}"

echo "pr_number=${{ fromJSON(steps.get-pr-info.outputs.pr-info).number }}" | tee -a "${GITHUB_OUTPUT}"

git fetch origin "${BASE_SHA}" -q

echo "merge_base_sha=$(git merge-base "${BASE_SHA}" "${GITHUB_SHA}")" | tee -a "${GITHUB_OUTPUT}"

- name: Build benchmark dispatch matrix

id: build-bench-matrix

run: |

{ # Defaults:

echo "bench_enabled=false"

echo 'bench_matrix={"include":[]}'

} >> "${GITHUB_OUTPUT}"

# Compare ci/bench.yaml against its template. If they match, no benchmarks requested.

if diff -q "ci/bench.template.yaml" "ci/bench.yaml" > /dev/null 2>&1; then

echo "ci/bench.yaml matches template; skipping benchmark dispatch."

exit 0

fi

bench_matrix_json="$(./ci/bench/parse_bench_matrix.sh "ci/bench.yaml")"

{

echo "bench_enabled=true"

echo "bench_matrix=${bench_matrix_json}"

} >> "${GITHUB_OUTPUT}"

- name: Build compile-time benchmark dispatch matrix

id: build-compile-time-matrix

run: |

if [[ "${{ contains(github.event.head_commit.message, '[skip-compile-time-bench]') }}" == "true" ]]; then

echo "Commit message contains [skip-compile-time-bench]; skipping compile-time benchmark dispatch."

{

echo "compile_time_enabled=false"

echo 'compile_time_matrix={"include":[]}'

} >> "${GITHUB_OUTPUT}"

exit 0

fi

compile_time_matrix_json="$(./ci/compile_time/parse_matrix.py "ci/matrix.yaml" --workflow pull_request)"

compile_time_enabled="$(

jq -r 'if (.include // []) == [] then "false" else "true" end' \

<<< "${compile_time_matrix_json}"

)"

{

echo "compile_time_enabled=${compile_time_enabled}"

echo "compile_time_matrix=${compile_time_matrix_json}"

} >> "${GITHUB_OUTPUT}"

- name: Build SASS diff dispatch matrix

id: build-sass-matrix

env:

BASE_SHA: ${{ steps.export-pr-info.outputs.base_sha }}

run: |

set -u

if [[ "${{ contains(github.event.head_commit.message, '[skip-sass-diff]') }}" == "true" ]]; then

echo "Commit message contains [skip-sass-diff]; skipping SASS diff dispatch."

{

echo "sass_enabled=false"

echo 'sass_matrix={"include":[]}'

} >> "${GITHUB_OUTPUT}"

exit 0

fi

# Only compare SASS for the projects that changed, or that are built from

# something that changed.

#

# Redirect GITHUB_OUTPUT to our file so that the outputs do not land in this

# step's outputs, where they would collide with the ones `build-workflow` writes

# later.

echo "::group::Inspect changes for SASS"

dirty_report="${RUNNER_TEMP}/sass-inspect-changes.txt"

GITHUB_OUTPUT="${dirty_report}" ./ci/inspect_changes.py \

--refs "${BASE_SHA}" "${GITHUB_SHA}"

echo "::endgroup::"

echo "SASS job changes"

cat "${dirty_report}"

mapfile -t projects < <(

sed -n -E 's/^(FULL|LITE)_BUILD=//p' "${dirty_report}" | grep -oE '[^ ]+'

)

sass_matrix_json="$(

./ci/sass/parse_matrix.py "ci/matrix.yaml" \

--workflow pull_request \

--projects "${projects[@]}"

)"

sass_enabled="$(

jq -r 'if (.include // []) == [] then "false" else "true" end' \

<<< "${sass_matrix_json}"

)"

echo "SASS enabled: ${sass_enabled}"

{

echo "sass_enabled=${sass_enabled}"

echo "sass_matrix=${sass_matrix_json}"

} >> "${GITHUB_OUTPUT}"

- name: Build workflow

# Skip building the matrix when disabled, but still gather PR info for downstream jobs

if: steps.export-flags.outputs.matrix_enabled == 'true'

id: build-workflow

uses: ./.github/actions/workflow-build

with:

github_token: ${{ secrets.GITHUB_TOKEN }}

pr_number: ${{ steps.export-pr-info.outputs.pr_number }}

allow_override: "true"

inspect_changes_script: 'ci/inspect_changes.py'

inspect_changes_base_sha: ${{ steps.export-pr-info.outputs.base_sha }}

workflows: |-

${{ case(

github.event.repository.fork, 'pull_request_fork',

contains(fromJSON('["NVIDIA", "NVIDIA-dev"]'), github.repository_owner), 'pull_request',

'pull_request_fork'

) }}

dispatch-groups-linux-two-stage:

name: ${{ matrix.name }}

if: >-

${{

needs.build-workflow.outputs.matrix_enabled == 'true' &&

toJSON(fromJSON(needs.build-workflow.outputs.workflow)['linux_two_stage']['keys']) != '[]'

}}

needs: build-workflow

permissions:

id-token: write

contents: read

strategy:

fail-fast: false

matrix:

name: ${{ fromJSON(needs.build-workflow.outputs.workflow)['linux_two_stage']['keys'] }}

uses: ./.github/workflows/workflow-dispatch-two-stage-group-linux.yml

with:

pc-array: ${{ toJSON(fromJSON(needs.build-workflow.outputs.workflow)['linux_two_stage']['jobs'][matrix.name]) }}

dispatch-groups-windows-two-stage:

name: ${{ matrix.name }}

if: >-

${{

needs.build-workflow.outputs.matrix_enabled == 'true' &&

toJSON(fromJSON(needs.build-workflow.outputs.workflow)['windows_two_stage']['keys']) != '[]'

}}

needs: build-workflow

permissions:

id-token: write

contents: read

strategy:

fail-fast: false

matrix:

name: ${{ fromJSON(needs.build-workflow.outputs.workflow)['windows_two_stage']['keys'] }}

uses: ./.github/workflows/workflow-dispatch-two-stage-group-windows.yml

with:

pc-array: ${{ toJSON(fromJSON(needs.build-workflow.outputs.workflow)['windows_two_stage']['jobs'][matrix.name]) }}

dispatch-groups-linux-standalone:

name: ${{ matrix.name }}

if: >-

${{

needs.build-workflow.outputs.matrix_enabled == 'true' &&

toJSON(fromJSON(needs.build-workflow.outputs.workflow)['linux_standalone']['keys']) != '[]'

}}

needs: build-workflow

permissions:

id-token: write

contents: read

strategy:

fail-fast: false

matrix:

name: ${{ fromJSON(needs.build-workflow.outputs.workflow)['linux_standalone']['keys'] }}

uses: ./.github/workflows/workflow-dispatch-standalone-group-linux.yml

with:

job-array: ${{ toJSON(fromJSON(needs.build-workflow.outputs.workflow)['linux_standalone']['jobs'][matrix.name]) }}

dispatch-groups-windows-standalone:

name: ${{ matrix.name }}

if: >-

${{

needs.build-workflow.outputs.matrix_enabled == 'true' &&

toJSON(fromJSON(needs.build-workflow.outputs.workflow)['windows_standalone']['keys']) != '[]'

}}

needs: build-workflow

permissions:

id-token: write

contents: read

strategy:

fail-fast: false

matrix:

name: ${{ fromJSON(needs.build-workflow.outputs.workflow)['windows_standalone']['keys'] }}

uses: ./.github/workflows/workflow-dispatch-standalone-group-windows.yml

with:

job-array: ${{ toJSON(fromJSON(needs.build-workflow.outputs.workflow)['windows_standalone']['jobs'][matrix.name]) }}

verify-workflow:

name: Verify and summarize workflow results

outputs:

pr_comment: ${{ steps.check-workflow.outputs.pr_comment }}

if: >-

${{

always() &&

!cancelled() &&

needs.build-workflow.outputs.matrix_enabled == 'true'

}}

needs:

- build-workflow

- dispatch-groups-linux-two-stage

- dispatch-groups-windows-two-stage

- dispatch-groups-linux-standalone

- dispatch-groups-windows-standalone

permissions:

actions: read

contents: read

runs-on: linux-amd64-cpu4

steps:

- name: Checkout repo

uses: actions/checkout@v6

with:

persist-credentials: false

- name: Check workflow success

id: check-workflow

uses: ./.github/actions/workflow-results

with:

github_token: ${{ secrets.GITHUB_TOKEN }}

verify-devcontainers:

name: Verify Dev Containers

needs: build-workflow

if: ${{ needs.build-workflow.outputs.vdc_enabled == 'true' }}

permissions:

id-token: write

contents: read

uses: ./.github/workflows/verify-devcontainers.yml

with:

base_sha: ${{ needs.build-workflow.outputs.base_sha }}

docs-build:

name: Build documentation

needs: build-workflow

if: >-

${{

needs.build-workflow.outputs.pr_number &&

needs.build-workflow.outputs.docs_enabled == 'true'

}}

runs-on: |-

${{ contains(fromJSON('["NVIDIA", "NVIDIA-dev"]'), github.repository_owner) &&

'linux-amd64-cpu32' || 'ubuntu-latest' }}

permissions:

contents: read

steps:

- name: Checkout

uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6

with:

persist-credentials: false

- name: Build docs

uses: ./.github/actions/docs-build

with:

upload_workflow_artifact: "false"

# Test that cuda.compute can be imported on a CPU-only machine (no CUDA drivers).

test-cpu-import:

name: Test CPU-only import

runs-on: ubuntu-latest

needs:

- dispatch-groups-linux-two-stage

- dispatch-groups-linux-standalone

if: ${{ !cancelled() }}

permissions:

contents: read

steps:

- name: Download wheel artifact

id: download

uses: actions/download-artifact@37930b1c2abaa49bbe596cd826c3c89aef350131 # v7

continue-on-error: true

with:

name: wheel-cccl-linux-amd64-py3.14

path: artifact

- name: Check if wheel exists

id: check-wheel

run: |

if [[ "${{ steps.download.outcome }}" != "success" ]]; then

echo "No wheel artifact found (Python jobs likely didn't run). Skipping test."

echo "skip=true" >> "$GITHUB_OUTPUT"

else

echo "Wheel artifact found."

echo "skip=false" >> "$GITHUB_OUTPUT"

fi

- name: Set up Python

if: steps.check-wheel.outputs.skip != 'true'

uses: actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1 # v6

with:

python-version: '3.14'

- name: Install wheel

if: steps.check-wheel.outputs.skip != 'true'

run: |

echo "Artifact contents:"

find artifact -name "*.whl" -type f

wheel=$(find artifact -name "*.whl" -type f | head -1)

pip install "${wheel}[cu13]"

- name: Test CPU-only import

if: steps.check-wheel.outputs.skip != 'true'

run: |

python -c "

import cuda.compute

print('cuda.compute imported successfully!')

print(f'_BINDINGS_AVAILABLE: {cuda.compute._BINDINGS_AVAILABLE}')

# Verify that accessing missing attributes gives a helpful error

try:

_ = cuda.compute.reduce_into

print('ERROR: Should have raised AttributeError')

exit(1)

except AttributeError as e:

print(f'Got expected AttributeError: {e}')

if 'CUDA bindings are not available' not in str(e):

print('ERROR: AttributeError message is not helpful')

exit(1)

print('All CPU-only import tests passed!')

"

dispatch-bench:

name: Bench Compare (${{ matrix.gpu }})

if: >-

${{

needs.build-workflow.outputs.bench_enabled == 'true' &&

toJSON(fromJSON(needs.build-workflow.outputs.bench_matrix).include) != '[]'

}}

needs: build-workflow

permissions:

id-token: write

contents: read

strategy:

fail-fast: false

matrix: ${{ fromJSON(needs.build-workflow.outputs.bench_matrix) }}

uses: ./.github/workflows/bench.yml

with:

gpu: ${{ matrix.gpu }}

launch_args: ${{ matrix.launch_args }}

arch: ${{ matrix.arch }}

base_ref: ${{ matrix.base_ref }}

test_ref: ${{ matrix.test_ref }}

cpp_filters: ${{ matrix.cpp_filters }}

python_filters: ${{ matrix.python_filters }}

nvbench_args: ${{ matrix.nvbench_args }}

nvbench_compare_args: ${{ matrix.nvbench_compare_args }}

nvbench_compare_legacy_args: ${{ matrix.nvbench_compare_legacy_args }}

dispatch-compile-time-bench:

name: Compile-time Bench (${{ matrix.id }})

# Compile-time benchmarks are informational PR telemetry. They are launched

# by this CI workflow, but intentionally omitted from the aggregate `ci`

# branch-protection job so benchmark regressions or script failures do not

# block merging a PR.

if: >-

${{

needs.build-workflow.outputs.compile_time_enabled == 'true' &&

toJSON(fromJSON(needs.build-workflow.outputs.compile_time_matrix).include) != '[]'

}}

needs: build-workflow

permissions:

actions: read

id-token: write

contents: read

pull-requests: write

strategy:

fail-fast: false

matrix: ${{ fromJSON(needs.build-workflow.outputs.compile_time_matrix) }}

uses: ./.github/workflows/compile-time-bench.yml

with:

id: ${{ matrix.id }}

name: ${{ matrix.name }}

gpu: ${{ matrix.gpu }}

launch_args: ${{ matrix.launch_args }}

baseline_ref: ${{ matrix.baseline_ref }}

preset: ${{ matrix.preset }}

targets_json: ${{ matrix.targets_json }}

args: ${{ matrix.args }}

slices_json: ${{ matrix.slices_json }}

comment: ${{ matrix.comment }}

comment_header: ${{ matrix.comment_header }}

artifact_retention_days: ${{ matrix.artifact_retention_days }}

pr_number: ${{ needs.build-workflow.outputs.pr_number }}

dispatch-sass-diff:

name: SASS Diff (${{ matrix.id }})

# A SASS difference does not fail this job. Only an infrastructure or script failure

# does, and that failure blocks the merge through the aggregate `ci` job.

if: >-

${{

needs.build-workflow.outputs.sass_enabled == 'true' &&

toJSON(fromJSON(needs.build-workflow.outputs.sass_matrix).include) != '[]'

}}

needs: build-workflow

permissions:

actions: read

id-token: write

contents: read

strategy:

fail-fast: false

matrix: ${{ fromJSON(needs.build-workflow.outputs.sass_matrix) }}

uses: ./.github/workflows/sass-diff.yml

with:

id: ${{ matrix.id }}

project: ${{ matrix.project }}

launch_args: ${{ matrix.launch_args }}

preset: ${{ matrix.preset }}

archs: ${{ matrix.archs }}

target_filters_json: ${{ matrix.target_filters_json }}

base_ref: ${{ needs.build-workflow.outputs.merge_base_sha }}

secrets:

inference_api_key: ${{ secrets.NVINFERENCE_API_KEY }}

bench-results:

name: Post benchmark results

if: >-

${{

always() && !cancelled() &&

needs.build-workflow.outputs.bench_enabled == 'true' &&

needs.build-workflow.outputs.pr_number != ''

}}

needs: [build-workflow, dispatch-bench]

permissions:

pull-requests: write

runs-on: ubuntu-slim

steps:

- name: Determine outcome

id: outcome

run: |

result="${{ needs.dispatch-bench.result }}"

case "${result}" in

success) icon=":white_check_mark:"; status="completed successfully" ;;

failure) icon=":x:"; status="had failures" ;;

*) icon=":warning:"; status="${result}" ;;

esac

{ echo "icon=${icon}"; echo "status=${status}"; } >> "${GITHUB_OUTPUT}"

- name: Comment on PR

uses: marocchino/sticky-pull-request-comment@67d0dec7b07ed060a405f9b2a64b8ab319fdd7db # v2.9.2

with:

github_token: ${{ secrets.GITHUB_TOKEN }}

header: bench-results

number: ${{ needs.build-workflow.outputs.pr_number }}

message: |

## ${{ steps.outcome.outputs.icon }} Benchmark Results

Benchmark comparison ${{ steps.outcome.outputs.status }}.

**[Results](${{ github.server_url }}/${{ github.repository }}/actions/runs/${{ github.run_id }})**

**[Artifacts](${{ github.server_url }}/${{ github.repository }}/actions/runs/${{ github.run_id }}#artifacts)**

hide_and_recreate: true

hide_classify: "OUTDATED"

sass-results:

name: Post SASS comparison results

if: needs.build-workflow.outputs.sass_enabled == 'true'

needs: [build-workflow, dispatch-sass-diff]

permissions:

actions: read

pull-requests: write

runs-on: ubuntu-slim

outputs:

outcome: ${{ steps.compose.outputs.outcome }}

steps:

- name: Checkout the SASS scripts

uses: actions/checkout@v6

with:

sparse-checkout: |

ci/sass

ci/matrix.yaml

sparse-checkout-cone-mode: false

persist-credentials: false

# Needed for render_report.py

- name: Set up Python

uses: actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1 # v6

with:

python-version: '3.14'

# Needed for render_report.py

- name: Install the SASS script dependencies

run: pip install pyyaml

- name: Download the SASS comment artifacts

uses: actions/download-artifact@v4

with:

pattern: sass-*-comment

path: sass-comment

- name: Render the comment

id: compose

run: |

# download-artifact puts the artifact of each matrix job into its own

# directory under sass-comment, named after the artifact:

#

# sass-comment/

# sass-cub-benchmarks-comment/

# report.json

# meta.json

# analysis.json

# sass-thrust-benchmarks-comment/

# ...

mapfile -t entries < <(find sass-comment -mindepth 1 -maxdepth 1 -type d | sort)

if [[ "${#entries[@]}" -eq 0 ]]; then

# The artifacts are not in the format we expect them to be.

echo "::error::The SASS comment artifacts are empty."

exit 1

fi

comment_path="${RUNNER_TEMP}/sass-results-comment.md"

outcome=NO_CHANGE

inputs=()

for entry in "${entries[@]}"; do

if jq -e '[.targets[].changed] | any' "${entry}/report.json" > /dev/null; then

outcome=CHANGE

fi

inputs+=(--input "${entry}")

done

python3 ci/sass/render_report.py "${inputs[@]}" --output "${comment_path}"

echo "<!-- sass-diff-GITHUB_SHA:${GITHUB_SHA} -->" >> "${comment_path}"

cat "${comment_path}" >> "${GITHUB_STEP_SUMMARY}"

echo "SASS outcome: ${outcome}."

{

echo "outcome=${outcome}"

echo "path=${comment_path}"

} >> "${GITHUB_OUTPUT}"

- name: Comment on PR

if: ${{ steps.compose.outputs.outcome == 'CHANGE' }}

uses: marocchino/sticky-pull-request-comment@67d0dec7b07ed060a405f9b2a64b8ab319fdd7db # v2.9.2

with:

github_token: ${{ secrets.GITHUB_TOKEN }}

header: sass-results

number: ${{ needs.build-workflow.outputs.pr_number }}

path: ${{ steps.compose.outputs.path }}

hide_and_recreate: true

hide_classify: "OUTDATED"

- name: Hide a previous PR comment when the SASS is unchanged

if: ${{ steps.compose.outputs.outcome == 'NO_CHANGE' }}

uses: marocchino/sticky-pull-request-comment@67d0dec7b07ed060a405f9b2a64b8ab319fdd7db # v2.9.2

with:

github_token: ${{ secrets.GITHUB_TOKEN }}

header: sass-results

number: ${{ needs.build-workflow.outputs.pr_number }}

hide: true

hide_classify: "OUTDATED"

# Keep the report intact when a comment triggers an approval retry.

sass-approval:

# sass-diff-approve.yml locates this job by name.

name: Require SASS approval

if: needs.build-workflow.outputs.sass_enabled == 'true'

needs: [build-workflow, sass-results]

permissions:

actions: read

runs-on: ubuntu-slim

env:

PR_NUMBER: ${{ needs.build-workflow.outputs.pr_number }}

steps:

- name: Require SASS approval

if: needs.sass-results.outputs.outcome == 'CHANGE'

uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8

with:

script: |

const name = `sass-approval-pr-${process.env.PR_NUMBER}-${context.sha}`;

core.info(`Find approval artifact ${name}.`);

const { data: { artifacts } } = await github.rest.actions.listArtifactsForRepo({

...context.repo,

name,

per_page: 1,

});

// The mere existence of the artifact is taken as proof that the approval comment was accepted.

// We could do further verification here (like checking that the artifact was in fact uploaded

// by our workflow) but this seems overly defensive.

//

// We also don't care whether the artifact has expired or not. An approval given 10 days

// ago--so long as the branch didn't change--should still count as an approval today.

if (artifacts.length === 0) {

core.setFailed(`SASS changes require approval with /sass diff ok ${context.sha}`);

return;

}

core.info(`Found approval artifact ${artifacts[0].id}.`);

# Check all other job statuses. This job gates branch protection checks.

ci:

name: CI

# !! Important: This job is used for branch protection checks.

# !! Need to use always() instead of !cancelled() because skipped jobs count as success

# !! for Github branch protection checks. Yes, really: by default, branch protections

# !! can be bypassed by cancelling CI. See NVIDIA/cccl#605.

if: ${{ always() }}

needs:

- build-workflow

- verify-workflow

- verify-devcontainers

- docs-build

- test-cpu-import

- dispatch-bench

- dispatch-sass-diff

- sass-results

- sass-approval

runs-on: ubuntu-slim

steps:

- name: Check results

run: |

status="success"

check_result() {

name=$1

expected=$2

result=$3

echo "Checking if $name job result ('$result') is '$expected'..."

if [[ "$result" != "$expected" ]]; then

echo "$name job failed"

status="failed"

fi

}

check_result "verify-workflow" "success" "${{needs.verify-workflow.result}}"

check_result "verify-devcontainers" "success" "${{needs.verify-devcontainers.result}}"

check_result "docs-build" "success" "${{needs.docs-build.result}}"

check_result "test-cpu-import" "success" "${{needs.test-cpu-import.result}}"

expected_bench_result="skipped"

if [[ "${{ needs.build-workflow.outputs.bench_enabled }}" == "true" ]] \

&& [[ "${{ toJSON(fromJSON(needs.build-workflow.outputs.bench_matrix).include) }}" != "[]" ]]; then

expected_bench_result="success"

fi

check_result "dispatch-bench" "${expected_bench_result}" "${{needs.dispatch-bench.result}}"

if [[ "${{ needs.build-workflow.outputs.sass_enabled }}" == "true" ]]; then

# sass-results can only succeed after dispatch-sass-diff succeeds.

check_result "sass-results" "success" "${{needs.sass-results.result}}"

check_result "sass-approval" "success" "${{needs.sass-approval.result}}"

else

check_result "dispatch-sass-diff" "skipped" "${{needs.dispatch-sass-diff.result}}"

check_result "sass-results" "skipped" "${{needs.sass-results.result}}"

check_result "sass-approval" "skipped" "${{needs.sass-approval.result}}"

fi

bench_enabled="${{ needs.build-workflow.outputs.bench_enabled }}"

if [[ "${bench_enabled}" == "true" ]]; then

echo "::error::ci/bench.yaml differs from ci/bench.template.yaml. Benchmark requests are temporary — reset ci/bench.yaml to match the template before merging."

status="failed"

fi

if [[ "$status" != "success" ]]; then

exit 1

fi

# This analyzes the current run. Keep every job whose failures should be included in

# this job's direct or transitive `needs` so log collection starts after they finish.

analyze-failures:

name: Analyze CI failures

if: >-

${{

always() &&

!cancelled() &&

github.repository == 'NVIDIA/cccl' &&

(

needs.build-workflow.result == 'failure' ||

needs.ci.result == 'failure' ||

needs.bench-results.result == 'failure'

)

}}

needs:

- build-workflow

- ci

- bench-results

permissions:

actions: read

checks: read

contents: read

pull-requests: read

runs-on: ubuntu-latest

timeout-minutes: 30

outputs:

github_comment: ${{ steps.render-github-comment.outputs.content }}

steps:

- name: Check out CCCL

uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1

with:

persist-credentials: false

- name: Resolve pull request number

id: pull-request

run: |

if [[ "${GITHUB_REF_NAME}" =~ ^pull-request/([0-9]+)$ ]]; then

echo "pr_number=${BASH_REMATCH[1]}" >> "${GITHUB_OUTPUT}"

else

echo "Expected a pull-request/<number> branch, got ${GITHUB_REF_NAME}" >&2

exit 1

fi

- name: Analyze failures

id: analyze

uses: ./.github/actions/ci-failure-analysis

with:

inference_api_key: ${{ secrets.NVINFERENCE_API_KEY }}

run_id: ${{ github.run_id }}

pr_number: ${{ steps.pull-request.outputs.pr_number }}

- name: Render GitHub failure analysis comment

if: ${{ !cancelled() && steps.analyze.outcome == 'success' }}

id: render-github-comment

uses: ./.github/actions/ci-failure-analysis-render

with:

analysis_file: ${{ steps.analyze.outputs.analysis_file }}

format: github-comment

- name: Render GitHub verbose failure analysis summary

if: ${{ !cancelled() && steps.analyze.outcome == 'success' }}

id: render-github-verbose-summary

uses: ./.github/actions/ci-failure-analysis-render

with:

analysis_file: ${{ steps.analyze.outputs.analysis_file }}

format: github-verbose-summary

- name: Add failure analysis to workflow summary

if: ${{ !cancelled() && steps.render-github-verbose-summary.outcome == 'success' }}

env:

SUMMARY_FILE: ${{ steps.render-github-verbose-summary.outputs.rendered_file }}

run: |

test -s "${SUMMARY_FILE}"

cat "${SUMMARY_FILE}" >> "${GITHUB_STEP_SUMMARY}"

publish-ci-results:

name: Publish CI results

if: >-

${{

always() &&

!cancelled() &&

github.repository == 'NVIDIA/cccl' &&

needs.build-workflow.outputs.pr_number != ''

}}

needs:

- build-workflow

- verify-workflow

- analyze-failures

permissions:

pull-requests: write

runs-on: ubuntu-slim

continue-on-error: true # Reporting failures must not fail otherwise successful CI.

steps:

# This is the sole owner of the PR comment. Publish even without analysis

# so successful partial reruns clear the previous failure report.

- name: Update CI Workflow Results

uses: marocchino/sticky-pull-request-comment@5770ad5eb8f42dd2c4f34da00c94c5381e49af88 # v3.0.5

with:

github_token: ${{ secrets.GITHUB_TOKEN }}

header: ci-results

number: ${{ needs.build-workflow.outputs.pr_number }}

message: |

${{ needs.verify-workflow.outputs.pr_comment || format('## [CI Workflow Results](https://github.com/{0}/actions/runs/{1}/attempts/{2})', github.repository, github.run_id, github.run_attempt) }}

${{ needs.analyze-failures.result != 'skipped' && (needs.analyze-failures.outputs.github_comment || '**AI failure analysis unavailable.** See the workflow run for details.') || '' }}

hide_and_recreate: true

hide_classify: "OUTDATED"