Skip to content
Merged
Changes from all commits
Commits
File filter

Filter by extension

Filter by extension


Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
121 changes: 121 additions & 0 deletions .github/workflows/release-docs.yml
Original file line number Diff line number Diff line change
@@ -0,0 +1,121 @@
# Copyright (c) 2026, NVIDIA CORPORATION.
#
# Licensed under the Apache License, Version 2.0 (the "License");
# you may not use this file except in compliance with the License.
# You may obtain a copy of the License at
#
# http://www.apache.org/licenses/LICENSE-2.0
#
# Unless required by applicable law or agreed to in writing, software
# distributed under the License is distributed on an "AS IS" BASIS,
# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
# See the License for the specific language governing permissions and
# limitations under the License.
name: Release docs
on:
workflow_dispatch:
inputs:
dry-run:
description: Whether to run the workflow in dry-run mode
required: true
type: boolean
default: true
publish-as-latest:
description: Publish as Latest stable version.
required: false
type: boolean
default: true
Comment on lines +23 to +27

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

P2 publish-as-latest defaults to true on a release branch

With dry-run defaulting to true this is safe during testing, but if a maintainer disables dry-run without also toggling publish-as-latest, a release-branch dispatch will overwrite the canonical "latest" docs pointer. Defaulting to false and requiring an explicit opt-in is safer for a branch workflow like this one.

Note: If this suggestion doesn't match your team's coding style, reply to this and let me know. I'll remember it for next time!

docs-version-override:
description: Docs version if commit is not tagged
required: false
type: string
default: ""
update-version-picker:
description: Update version picker.
required: false
type: boolean
default: true
notify-emails:
description: Email addresses to send the notification to. Format as "me@me.com,you@you.com".
required: false
type: string
github-ref:
description: Github ref to checkout
required: false
type: string
default: ""
workflow_call:
inputs:
dry-run:
description: Whether to run the workflow in dry-run mode
required: false
type: boolean
default: true
publish-as-latest:
description: Publish as Latest stable version.
required: false
type: boolean
default: true
docs-version-override:
description: Docs version if commit is not tagged
required: false
type: string
default: ""
update-version-picker:
description: Update version picker.
required: false
type: boolean
default: true
notify-emails:
description: Email addresses to send the notification to. Format as "me@me.com,you@you.com".
required: false
type: string
github-ref:
description: Github ref to checkout
required: false
type: string
default: ""

jobs:
build-docs:
uses: NVIDIA-NeMo/FW-CI-templates/.github/workflows/_build_docs.yml@v0.67.0
with:
ref: ${{ inputs.github-ref }}
sync-all: true
Comment on lines +80 to +84

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

P1 Missing secrets: inherit on build-docs workflow call

The build-docs job calls _build_docs.yml@v0.67.0 without forwarding secrets. Reusable workflow calls receive no secrets unless secrets: inherit (or explicit secrets: mapping) is specified. If _build_docs.yml needs any credentials — e.g., to pull from a private registry, authenticate with a sync endpoint, or access artifact storage — every run will silently fail or receive a permissions error at that step, while the calling workflow reports the overall job as failed without an obvious root cause.


publish-docs:
runs-on: ubuntu-latest
needs: [build-docs]
steps:
- uses: actions/checkout@v6
with:
repository: NVIDIA-NeMo/FW-CI-templates
ref: v0.74.0
path: FW-CI-templates
Comment on lines +81 to +94

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

P1 FW-CI-templates version mismatch between build and publish steps

build-docs pins FW-CI-templates at v0.67.0 while publish-docs checks out and uses the action at v0.74.0 — a gap of 7 minor releases. If the docs-html artifact schema, directory layout, or metadata format changed between these versions, the publish-docs action may fail to locate expected files or produce a corrupt deployment. Both jobs should pin to the same version of FW-CI-templates to guarantee a consistent contract between build output and publish input.


- uses: ./FW-CI-templates/.github/actions/publish-docs
# This workflow runs either on main, or on a version tag. Any other git ref will lead
# to an error.
# If its on main, it will publish to "latest" directory in Akamai.
# If its on a versioned tag, it will extract the version number from the tag (strip `v` prefix)
# and publish to the versioned directory in Akamai.
with:
dry-run: ${{ inputs.dry-run }}
artifacts-name: docs-html
artifacts-path: _build/html
emails-csv: ${{ inputs.notify-emails && format('{0},{1}', vars.docs_release_emails, inputs.notify-emails) || vars.docs_release_emails }}
overwrite-latest-on-tag: ${{ inputs.publish-as-latest }}
docs-version-override: ${{ inputs.docs-version-override }}
update-version-picker: ${{ inputs.update-version-picker }}
run-on-version-tag-only: ${{ github.ref_name != 'main' }}
request-name: emerging-optimizers-publish-docs-${{ github.run_id }}
aws-region: ${{ vars.DOCS_AWS_REGION }}
aws-role-to-assume: ${{ secrets.AWS_ASSUME_ROLE_ARN }}
aws-access-key-id: ${{ secrets.AWS_ACCESS_KEY_ID }}
aws-secret-access-key: ${{ secrets.AWS_SECRET_ACCESS_KEY }}
akamai-host: ${{ secrets.AKAMAI_HOST }}
akamai-client-token: ${{ secrets.AKAMAI_CLIENT_TOKEN }}
akamai-client-secret: ${{ secrets.AKAMAI_CLIENT_SECRET }}
akamai-access-token: ${{ secrets.AKAMAI_ACCESS_TOKEN }}
s3-target-root: ${{ secrets.S3_BUCKET_NAME }}
s3-target-path: nemo/emerging-optimizers
Loading