Misc CI improvements (NVIDIA#1866)

* Use commit sha for versioning GitHub Actions instead of version tags
* Remove unused environment variables and functions
* Remove dependency on Rapids GHA Tools, we were only using `rapids-logger`

## By Submitting this PR I confirm:
- I am familiar with the [Contributing Guidelines](https://github.com/NVIDIA/NeMo-Agent-Toolkit/blob/develop/docs/source/resources/contributing/index.md).
- We require that all contributors "sign-off" on their commits. This certifies that the contribution is your original work, or you have rights to submit it under the same license, or a compatible license.
  - Any contribution which contains commits that are not Signed-Off will not be accepted.
- When the PR is ready for review, new or existing tests cover these changes.
- When the PR is ready for review, the documentation is up to date with these changes.




## Summary by CodeRabbit

## Release Notes

* **Chores**
  * Pinned external GitHub Actions to specific commit SHAs across workflows for improved stability and reproducibility
  * Removed unused CI environment variables (`GH_TOKEN`, `RAPIDS_CONDA_RETRY_MAX`)
  * Simplified CI script logging mechanisms throughout the pipeline
  * Removed deprecated helper functions from CI infrastructure

Authors:
  - David Gardner (https://github.com/dagardner-nv)

Approvers:
  - Will Killian (https://github.com/willkill07)

URL: NVIDIA#1866

Author: dagardner-nv

.github/workflows/ci_pipe.yml

@@ -53,11 +53,9 @@ defaults:
     shell: bash
 
 env:
-  GH_TOKEN: "${{ github.token }}"
   GIT_COMMIT: "${{ github.sha }}"
   BASE_SHA: "${{ inputs.base_sha }}"
   BUILD_NAT_COMPAT: "true"
-  RAPIDS_CONDA_RETRY_MAX: "5"
   WORKSPACE: "${{ github.workspace }}/nat"
   WORKSPACE_TMP: "${{ github.workspace }}/tmp"
   UV_CACHE_DIR: .uv-cache
@@ -89,7 +87,7 @@ jobs:
 
     steps:
       - name: Checkout
-        uses: actions/checkout@v6
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
         with:
           fetch-depth: 0
           path: 'nat'
@@ -125,7 +123,7 @@ jobs:
 
     steps:
       - name: Checkout
-        uses: actions/checkout@v6
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
         with:
           fetch-depth: 0
           fetch-tags: true
@@ -137,15 +135,15 @@ jobs:
         run: ./nat/ci/scripts/github/tests.sh
 
       - name: Upload Test Results
-        uses: actions/upload-artifact@v6
+        uses: actions/upload-artifact@b7c566a772e6b6bfb58ed0dc250532a479d7789f # v6
         # Upload test results even if the tests fail
         if: ${{ always() }}
         with:
           name: "test-results-${{ matrix.arch }}-py${{ matrix.python-version }}"
           path: "${{ github.workspace }}/tmp/reports/*.xml"
           if-no-files-found: error
       - name: Upload coverage to Codecov
-        uses: codecov/codecov-action@v5
+        uses: codecov/codecov-action@75cd11691c0faa626561e295848008c8a7dddffe # v5
         # Upload test results even if the tests fail
         if: ${{ always() }}
         with:
@@ -169,7 +167,7 @@ jobs:
 
     steps:
       - name: Checkout
-        uses: actions/checkout@v6
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
         with:
           fetch-tags: true
           path: 'nat'
@@ -179,7 +177,7 @@ jobs:
         run: ./nat/ci/scripts/github/docs.sh
 
       - name: Upload Documentation
-        uses: actions/upload-artifact@v6
+        uses: actions/upload-artifact@b7c566a772e6b6bfb58ed0dc250532a479d7789f # v6
         with:
           name: "docs"
           path: "${{ github.workspace }}/tmp/docs.tar.bz2"
@@ -199,7 +197,7 @@ jobs:
 
     steps:
       - name: Checkout
-        uses: actions/checkout@v6
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
         with:
           fetch-depth: 0
           fetch-tags: true
@@ -210,7 +208,7 @@ jobs:
         run: ./nat/ci/scripts/github/build_wheel.sh
 
       - name: Upload Package Reports
-        uses: actions/upload-artifact@v6
+        uses: actions/upload-artifact@b7c566a772e6b6bfb58ed0dc250532a479d7789f # v6
         if: ${{ always() }}
         with:
           name: "package_listings"
@@ -219,7 +217,7 @@ jobs:
           compression-level: 0
 
       - name: Upload Wheels
-        uses: actions/upload-artifact@v6
+        uses: actions/upload-artifact@b7c566a772e6b6bfb58ed0dc250532a479d7789f # v6
         with:
           name: "wheels"
           path: "${{ github.workspace }}/tmp/wheels/*.whl"

.github/workflows/pr.yaml

@@ -50,7 +50,7 @@ jobs:
       - prepare
       - ci_pipe
     secrets: inherit
-    uses: rapidsai/shared-workflows/.github/workflows/pr-builder.yaml@branch-25.04
+    uses: rapidsai/shared-workflows/.github/workflows/pr-builder.yaml@5fe52098676ca51435a73337131685e340658c51 # branch-25.04
 
   prepare:
     # Executes the get-pr-info action to determine if the PR has the skip-ci label, if the action fails we assume the
@@ -60,7 +60,7 @@ jobs:
     steps:
       - name: Get PR Info
         id: get-pr-info
-        uses: nv-gha-runners/get-pr-info@main
+        uses: nv-gha-runners/get-pr-info@090577647b8ddc4e06e809e264f7881650ecdccf # main
         if: ${{ startsWith(github.ref_name, 'pull-request/') }}
     outputs:
       is_pr: ${{ startsWith(github.ref_name, 'pull-request/') }}

ci/scripts/common.sh

@@ -44,62 +44,6 @@ export PYTHON_FILE_REGEX='^(\.\/)?(?!\.|build|external).*\.(py|pyx|pxd)$'
 # Use these options to skip any of the checks
 export SKIP_COPYRIGHT=${SKIP_COPYRIGHT:-""}
 
-
-# Determine the merge base as the root to compare against. Optionally pass in a
-# result variable otherwise the output is printed to stdout
-function get_merge_base() {
-   local __resultvar=$1
-   local result=$(git merge-base ${BASE_SHA} ${COMMIT_SHA:-HEAD})
-
-   if [[ "$__resultvar" ]]; then
-      eval $__resultvar="'${result}'"
-   else
-      echo "${result}"
-   fi
-}
-
-# Determine the changed files. First argument is the (optional) regex filter on
-# the results. Second argument is the (optional) variable with the returned
-# results. Otherwise the output is printed to stdout. Result is an array
-function get_modified_files() {
-   local  __resultvar=$2
-
-   local GIT_DIFF_ARGS=${GIT_DIFF_ARGS:-"--name-only"}
-   local GIT_DIFF_BASE=${GIT_DIFF_BASE:-$(get_merge_base)}
-
-   # If invoked by a git-commit-hook, this will be populated
-   local result=( $(git diff ${GIT_DIFF_ARGS} ${GIT_DIFF_BASE} | grep -P ${1:-'.*'}) )
-
-   local files=()
-
-   for i in "${result[@]}"; do
-      if [[ -e "${i}" ]]; then
-         files+=(${i})
-      fi
-   done
-
-   if [[ "$__resultvar" ]]; then
-      eval $__resultvar="( ${files[@]} )"
-   else
-      echo "${files[@]}"
-   fi
-}
-
-# Determine a unified diff useful for clang-XXX-diff commands. First arg is
-# optional file regex. Second argument is the (optional) variable with the
-# returned results. Otherwise the output is printed to stdout
-function get_unified_diff() {
-   local  __resultvar=$2
-
-   local result=$(git diff --no-color --relative -U0 $(get_merge_base) -- $(get_modified_files $1))
-
-   if [[ "$__resultvar" ]]; then
-      eval $__resultvar="'${result}'"
-   else
-      echo "${result}"
-   fi
-}
-
 function get_num_proc() {
    NPROC_TOOL=`which nproc`
    NUM_PROC=${NUM_PROC:-`${NPROC_TOOL}`}
@@ -119,7 +63,7 @@ function set_versions() {
       set -e
 
       if [[ ${SETUPTOOLS_SCM_RESULT} -ne 0 ]]; then
-         rapids-logger "Error, setuptools_scm failed to determine the version: ${NAT_VERSION}"
+         echo "Error, setuptools_scm failed to determine the version: ${NAT_VERSION}"
          exit ${SETUPTOOLS_SCM_RESULT}
       fi
    fi
@@ -129,7 +73,7 @@ function set_versions() {
 }
 
 function build_wheel() {
-    rapids-logger "Building Wheel for $1"
+    echo "Building Wheel for $1"
     uv build --wheel --no-progress --out-dir "${WHEELS_DIR}/$2" --directory $1
 }
 
@@ -143,7 +87,7 @@ function build_package_wheel()
 
 function create_env() {
 
-    rapids-logger "Creating uv env"
+    echo "Creating uv env"
     VENV_DIR="${WORKSPACE_TMP}/.venv"
     uv venv --python=${PYTHON_VERSION} --seed ${VENV_DIR}
     source ${VENV_DIR}/bin/activate
@@ -172,31 +116,25 @@ function create_env() {
         exit 1
     fi
 
-    rapids-logger "Final Environment"
+    echo "Final Environment"
     uv pip list
 }
 
-function install_rapids_gha_tools()
-{
-   echo "Installing Rapids GHA tools"
-   wget https://github.com/rapidsai/gha-tools/releases/latest/download/tools.tar.gz -O - | tar -xz -C /usr/local/bin
-}
-
 function get_lfs_files() {
-    rapids-logger "Installing git-lfs from apt"
+    echo "Installing git-lfs from apt"
     apt update
     apt install --no-install-recommends -y git-lfs
 
     if [[ "${USE_HOST_GIT}" == "1" ]]; then
-        rapids-logger "Using host git, skipping git-lfs install"
+        echo "Using host git, skipping git-lfs install"
     else
-        rapids-logger "Calling git lfs fetch"
+        echo "Calling git lfs fetch"
         git lfs fetch
-        rapids-logger "Calling git lfs pull"
+        echo "Calling git lfs pull"
         git lfs pull
     fi
 
-    rapids-logger "git lfs ls-files"
+    echo "git lfs ls-files"
     git lfs ls-files
 }
 
@@ -218,11 +156,11 @@ function install_python_versions() {
       PYTHON_FIND_RESULT=$?
       set -e
       if [[ ${PYTHON_FIND_RESULT} -ne 0 ]]; then
-         rapids-logger "Downloading Python version ${pyver}"
+         echo "Downloading Python version ${pyver}"
 
          # In common.sh we set this to never, we want to override that here
          UV_PYTHON_DOWNLOADS="manual" uv python install --managed-python ${pyver}
-         rapids-logger "✓ Successfully installed Python ${pyver}"
+         echo "✓ Successfully installed Python ${pyver}"
       fi
    done
 }

ci/scripts/github/build_wheel.sh

@@ -25,7 +25,7 @@ PIP_REPORTS_DIR="${WORKSPACE_TMP}/pip_reports"
 mkdir -p "${PIP_REPORTS_DIR}"
 
 GIT_TAG=$(get_git_tag)
-rapids-logger "Git Version: ${GIT_TAG}"
+echo "Git Version: ${GIT_TAG}"
 
 create_env
 
@@ -37,12 +37,12 @@ for NAT_PACKAGE in "${NAT_PACKAGES[@]}"; do
 done
 
 # Build all examples with a pyproject.toml in the first directory below examples
-for NAT_EXAMPLE in ${NAT_EXAMPLES[@]}; do
+for NAT_EXAMPLE in "${NAT_EXAMPLES[@]}"; do
     # places all wheels flat under example
     build_wheel ${NAT_EXAMPLE} "examples"
 done
 
-rapids-logger "Removing built examples wheels"
+echo "Removing built examples wheels"
 rm -rf "${WHEELS_BASE_DIR}/examples"
 
 # Flatten out the wheels into a single directory for upload
@@ -74,12 +74,12 @@ trap create_package_report_tarball EXIT
 for whl in "${MOVED_WHEELS[@]}"; do
 
     for pyver in "${SUPPORTED_PYTHON_VERSIONS[@]}"; do
-        rapids-logger "Testing wheel: ${whl} with Python ${pyver}"
+        echo "Testing wheel: ${whl} with Python ${pyver}"
         UV_VENV_OUT=$(uv venv -q -p ${pyver} --seed "${TEMP_INSTALL_LOCATION}" 2>&1)
         UV_VENV_RESULT=$?
 
         if [[ ${UV_VENV_RESULT} -ne 0 ]]; then
-            rapids-logger "Error, failed to create uv venv with Python ${pyver} for wheel ${whl}"
+            echo "Error, failed to create uv venv with Python ${pyver} for wheel ${whl}"
             echo "${UV_VENV_OUT}"
             exit ${UV_VENV_RESULT}
         fi
@@ -91,11 +91,11 @@ for whl in "${MOVED_WHEELS[@]}"; do
         INSTALL_RESULT=$?
 
         # Report the packages in the environment regardless of install success
-        rapids-logger "Installed wheel ${whl} with Python ${pyver}, pip install exit code ${INSTALL_RESULT}"
+        echo "Installed wheel ${whl} with Python ${pyver}, pip install exit code ${INSTALL_RESULT}"
         uv pip list --format json > "${PIP_REPORTS_DIR}/$(basename "${whl}" .whl)_py${pyver}_packages.json"
 
         if [[ ${INSTALL_RESULT} -ne 0 ]]; then
-            rapids-logger "Error, failed to install wheel ${whl} with Python ${pyver}"
+            echo "Error, failed to install wheel ${whl} with Python ${pyver}"
             echo "${UV_PIP_OUT}"
             exit ${INSTALL_RESULT}
         fi
@@ -106,9 +106,9 @@ for whl in "${MOVED_WHEELS[@]}"; do
             IMPORT_TEST_RESULT=$?
 
             if [[ ${IMPORT_TEST_RESULT} -ne 0 ]]; then
-                rapids-logger "Error, failed to import nat from wheel ${whl} with Python ${pyver}"
-                rapids-logger "This may indicate missing dependencies, Python version incompatibility, or build issues"
-                rapids-logger "Check if the wheel includes all necessary binary extensions for this Python version"
+                echo "Error, failed to import nat from wheel ${whl} with Python ${pyver}"
+                echo "This may indicate missing dependencies, Python version incompatibility, or build issues"
+                echo "Check if the wheel includes all necessary binary extensions for this Python version"
                 echo "${PYTHON_IMPORT_OUT}"
                 exit ${IMPORT_TEST_RESULT}
             fi
@@ -118,19 +118,19 @@ for whl in "${MOVED_WHEELS[@]}"; do
                 NAT_CMD_EXIT_CODE=$?
 
                 if [[ ${NAT_CMD_EXIT_CODE} -ne 0 ]]; then
-                    rapids-logger "Error 'nat --version' command failed exit code ${NAT_CMD_EXIT_CODE} from wheel ${whl} with Python ${pyver}"
+                    echo "Error 'nat --version' command failed exit code ${NAT_CMD_EXIT_CODE} from wheel ${whl} with Python ${pyver}"
                     echo "${REPORTED_VERSION}"
                     exit ${NAT_CMD_EXIT_CODE}
                 fi
             else
-                rapids-logger "Skipping nat CLI test; 'nat' command not installed by wheel ${whl}"
+                echo "Skipping nat CLI test; 'nat' command not installed by wheel ${whl}"
             fi
         else
-            rapids-logger "Skipping nat CLI test for nvidia_nat_app (framework-agnostic package); verifying nat_app import"
+            echo "Skipping nat CLI test for nvidia_nat_app (framework-agnostic package); verifying nat_app import"
             PYTHON_IMPORT_OUT=$(python -c "import nat_app" 2>&1)
             IMPORT_TEST_RESULT=$?
             if [[ ${IMPORT_TEST_RESULT} -ne 0 ]]; then
-                rapids-logger "Error, failed to import nat_app from wheel ${whl} with Python ${pyver}"
+                echo "Error, failed to import nat_app from wheel ${whl} with Python ${pyver}"
                 echo "${PYTHON_IMPORT_OUT}"
                 exit ${IMPORT_TEST_RESULT}
             fi

ci/scripts/github/checks.sh

@@ -23,5 +23,5 @@ get_lfs_files
 
 create_env
 
-rapids-logger "Running checks"
+echo "Running checks"
 ${SCRIPT_DIR}/checks.sh

ci/scripts/github/common.sh

@@ -18,14 +18,9 @@ SCRIPT_DIR=$( dirname ${GITHUB_SCRIPT_DIR} )
 
 source ${SCRIPT_DIR}/common.sh
 
-install_rapids_gha_tools
-
 # Ensure the workspace tmp directory exists
 mkdir -p ${WORKSPACE_TMP}
 
-rapids-logger "Environment Variables"
-printenv | sort
-
 function get_git_tag() {
     # Get the latest Git tag, sorted by version, excluding lightweight tags
     git describe --first-parent --tags --abbrev=0 2>/dev/null || echo "no-tag"

ci/scripts/github/docs.sh

@@ -20,18 +20,18 @@ GITHUB_SCRIPT_DIR="$( cd "$( dirname "${BASH_SOURCE[0]}" )" &> /dev/null && pwd
 
 source ${GITHUB_SCRIPT_DIR}/common.sh
 
-rapids-logger "Installing non-pip deps"
+echo "Installing non-pip deps"
 get_lfs_files
 
 create_env
 
-rapids-logger "Building documentation"
+echo "Building documentation"
 pushd ${PROJECT_ROOT}/docs
 make html
 
 DOCS_TAR=${WORKSPACE_TMP}/docs.tar.bz2
-rapids-logger "Archiving documentation to ${DOCS_TAR}"
+echo "Archiving documentation to ${DOCS_TAR}"
 tar cvfj ${DOCS_TAR} build/html
 popd
 
-rapids-logger "Documentation build completed"
+echo "Documentation build completed"

ci/scripts/github/tests.sh

@@ -24,9 +24,9 @@ mkdir -p ${REPORTS_DIR}
 get_lfs_files
 
 create_env
-rapids-logger "Git Version: $(get_git_tag)"
+echo "Git Version: $(get_git_tag)"
 
-rapids-logger "Running tests with Python version $(python --version) and pytest version $(pytest --version) on $(arch)"
+echo "Running tests with Python version $(python --version) and pytest version $(pytest --version) on $(arch)"
 set +e
 
 REPORT_IDENT_SLUG="$(arch)-py${PYTHON_VERSION}"