Misc CI improvements (NVIDIA#1867)

* Don't install jfrog on the fly, instead use a container that already has it.
* Install a specific version of `slack-sdk` validated with a sha.

## By Submitting this PR I confirm:
- I am familiar with the [Contributing Guidelines](https://github.com/NVIDIA/NeMo-Agent-Toolkit/blob/develop/docs/source/resources/contributing/index.md).
- We require that all contributors "sign-off" on their commits. This certifies that the contribution is your original work, or you have rights to submit it under the same license, or a compatible license.
  - Any contribution which contains commits that are not Signed-Off will not be accepted.
- When the PR is ready for review, new or existing tests cover these changes.
- When the PR is ready for review, the documentation is up to date with these changes.




## Summary by CodeRabbit

* **Chores**
  * Updated CI/CD infrastructure with containerized dependency management for improved reproducibility and reliability
  * Pinned Slack SDK version for consistent builds

Authors:
  - David Gardner (https://github.com/dagardner-nv)

Approvers:
  - Will Killian (https://github.com/willkill07)

URL: NVIDIA#1867

Author: dagardner-nv

.gitlab-ci.yml

@@ -325,6 +325,8 @@ package:wheel:
     - if: $CI_COMMIT_BRANCH =~ /^release\/.*$/
 
 upload:artifactory:
+  # Container defined in ci/scripts/gitlab/artifactory/Dockerfile
+  image: $CI_REGISTRY_IMAGE/artifactory:20260413
   stage: upload
   script:
     - echo "Uploading wheel to artifactory"

ci/scripts/gitlab/artifactory/Dockerfile

@@ -0,0 +1,18 @@
+# SPDX-FileCopyrightText: Copyright (c) 2026, NVIDIA CORPORATION & AFFILIATES. All rights reserved.
+# SPDX-License-Identifier: Apache-2.0
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+# http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+FROM ghcr.io/astral-sh/uv:0.9.28-python3.13-bookworm
+
+RUN VERSION=2.99.0 curl -fL https://install-cli.jfrog.io | sh

ci/scripts/gitlab/artifactory_upload.sh

@@ -81,15 +81,6 @@ if [[ ! -d "$WHEELS_BASE_DIR" || -z "$(find "$WHEELS_BASE_DIR" -type f -name "*.
     exit 1
 fi
 
-# Function to install JFrog CLI if needed
-function install_jfrog_cli() {
-    if ! command -v jf &> /dev/null; then
-        echo "Installing JFrog CLI..."
-        curl -fL https://install-cli.jfrog.io | sh || { echo "JFrog CLI installation failed"; exit 1; }
-    fi
-}
-install_jfrog_cli
-
 # Upload wheels if enabled
 if [[ "${UPLOAD_TO_ARTIFACTORY}" == "true" ]]; then
     for NAT_COMPONENT_NAME  in ${NAT_COMPONENTS[@]}; do

ci/scripts/gitlab/common.sh

@@ -65,8 +65,6 @@ function is_current_commit_release_tagged() {
 
 function install_slack_sdk() {
     echo "Installing slack-sdk"
-    uv pip install "slack-sdk~=3.36"
+    echo "slack-sdk==3.40.1 --hash=sha256:cd8902252979aa248092b0d77f3a9ea3cc605bc5d53663ad728e892e26e14a65" | \
+      uv pip install --require-hashes -r -
 }
-
-echo "Environment Variables"
-printenv | sort