ci: shard tests to run more in parallel

.github/actions/test-template/action.yml

@@ -41,19 +41,6 @@ inputs:
     description: "Run tests on CPU only"
     required: false
     default: "false"
-  azure-client-id:
-    description: "Azure Client ID"
-    required: true
-  azure-tenant-id:
-    description: "Azure Tenant ID"
-    required: true
-  azure-subscription-id:
-    description: "Azure Subscription ID"
-    required: true
-  has-azure-credentials:
-    description: "Has Azure credentials"
-    required: false
-    default: "false"
   is_fork_pr:
     description: "Whether this is a pull request from a fork"
     required: false
@@ -77,31 +64,16 @@ inputs:
 runs:
   using: "composite"
   steps:
-    - name: Install Azure CLI
-      if: ${{ inputs.has-azure-credentials == 'true' }}
-      shell: bash
-      run: |
-        for i in 1 2 3; do
-          curl -sL https://aka.ms/InstallAzureCLIDeb | sudo bash && break
-          echo "Attempt $i failed, retrying in 10s..."
-          sleep 10
-        done
-
     - name: Install uuidgen
       shell: bash -x -e -u -o pipefail {0}
-      if: ${{ contains(inputs.runner, 'gcp') }}
+      if: ${{ contains(inputs.runner, 'aws') || contains(inputs.runner, 'gcp') }}
       run: |
         for i in 1 2 3; do
           apt-get update && apt-get install -y uuid-runtime && break
           echo "Attempt $i failed, retrying in 10s..."
           sleep 10
         done
 
-    - name: Docker system cleanup
-      shell: bash
-      run: |
-        docker system prune -af --filter "until=48h" --force || true
-
     - name: Docker pull image
       shell: bash
       run: |
@@ -138,6 +110,7 @@ runs:
         docker run --rm -u root --runtime=nvidia --gpus all \
           --shm-size=64g \
           --env TRANSFORMERS_OFFLINE=0 \
+          --env GHA_RUNNER=${{ inputs.runner }} \
           --env HYDRA_FULL_ERROR=1 \
           --env HF_HOME=/home/TestData/nemo-rl/hf_home \
           --env HF_DATASETS_CACHE=/home/TestData/nemo-rl/hf_datasets_cache \

.github/workflows/_build_container.yml

@@ -0,0 +1,172 @@
+# Copyright (c) 2026, NVIDIA CORPORATION.  All rights reserved.
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#     http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+name: Build container
+
+on:
+  workflow_call:
+    inputs:
+      build-ref:
+        required: false
+        default: ${{ github.sha }}
+        description: Ref, branch, or SHA to build.
+        type: string
+      image-name:
+        required: true
+        description: Name of the image to build and push.
+        type: string
+      build-args:
+        required: false
+        default: ""
+        description: Additional Docker build args.
+        type: string
+      build-contexts:
+        required: false
+        default: ""
+        description: Additional Docker build contexts.
+        type: string
+      dockerfile:
+        required: true
+        description: Path to the Dockerfile.
+        type: string
+      platform:
+        required: true
+        description: Docker build platform.
+        type: string
+      runner:
+        required: true
+        description: Runner to use for the build.
+        type: string
+      registry:
+        required: true
+        description: Container registry to push to.
+        type: string
+      target:
+        required: false
+        default: ""
+        description: Dockerfile stage to build.
+        type: string
+
+permissions:
+  contents: read
+  pull-requests: read
+
+defaults:
+  run:
+    shell: bash -x -e -u -o pipefail {0}
+
+jobs:
+  build:
+    runs-on: ${{ inputs.runner }}
+    env:
+      REGISTRY: ${{ inputs.registry }}
+      IMAGE_NAME: ${{ inputs.image-name }}
+      GH_REF: ${{ github.ref }}
+      RUN_ID: ${{ github.run_id }}
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@v6
+        with:
+          ref: ${{ inputs.build-ref }}
+          submodules: recursive
+
+      - name: Set up Docker Buildx
+        uses: docker/setup-buildx-action@v3
+
+      - name: Get recently merged PR cache refs
+        id: recent_pr_cache_refs
+        uses: actions/github-script@v8
+        env:
+          REGISTRY: ${{ inputs.registry }}
+          IMAGE_NAME: ${{ inputs.image-name }}
+        with:
+          script: |
+            const [owner, repo] = process.env.GITHUB_REPOSITORY.split("/");
+            const result = await github.graphql(`
+              query($owner: String!, $repo: String!) {
+                repository(owner: $owner, name: $repo) {
+                  pullRequests(states: MERGED, first: 100, orderBy: {field: UPDATED_AT, direction: DESC}) {
+                    nodes {
+                      number
+                    }
+                  }
+                }
+              }
+            `, { owner, repo });
+
+            const refs = result.repository.pullRequests.nodes
+              .map(({ number }) => `type=registry,ref=${process.env.REGISTRY}/${process.env.IMAGE_NAME}:${number}-buildcache,mode=max`)
+              .join("\n");
+
+            core.setOutput("cache-from", refs);
+            core.info(`Found ${result.repository.pullRequests.nodes.length} recently merged PR cache refs.`);
+
+      - name: Compute build metadata
+        id: build_meta
+        shell: bash
+        run: |
+          set -euo pipefail
+
+          PR_NUMBER=""
+          if [[ "$GH_REF" =~ refs/heads/pull-request/([0-9]+) ]]; then
+            PR_NUMBER="${BASH_REMATCH[1]}"
+          fi
+
+          TAGS=("$REGISTRY/$IMAGE_NAME:$RUN_ID")
+          if [[ "$GH_REF" == "refs/heads/main" ]]; then
+            CACHE_KEY="main"
+            TAGS+=("$REGISTRY/$IMAGE_NAME:main")
+          elif [[ -n "$PR_NUMBER" ]]; then
+            CACHE_KEY="$PR_NUMBER"
+            TAGS+=("$REGISTRY/$IMAGE_NAME:$PR_NUMBER")
+          else
+            CACHE_KEY=$(printf '%s' "${GITHUB_REF_NAME:-$RUN_ID}" | tr '/' '-' | tr -cd '[:alnum:]._-')
+            if [[ -z "$CACHE_KEY" ]]; then
+              CACHE_KEY="$RUN_ID"
+            fi
+          fi
+
+          CACHE_FROM=(
+            "type=registry,ref=$REGISTRY/$IMAGE_NAME:main-buildcache,mode=max"
+          )
+          if [[ "$CACHE_KEY" != "main" ]]; then
+            CACHE_FROM+=("type=registry,ref=$REGISTRY/$IMAGE_NAME:$CACHE_KEY-buildcache,mode=max")
+          fi
+
+          {
+            echo "tags<<EOF"
+            printf '%s\n' "${TAGS[@]}"
+            echo "EOF"
+            echo "cache-from<<EOF"
+            printf '%s\n' "${CACHE_FROM[@]}"
+            echo "EOF"
+            echo "cache-to=type=registry,ref=$REGISTRY/$IMAGE_NAME:$CACHE_KEY-buildcache,mode=max"
+          } >> "$GITHUB_OUTPUT"
+
+      - name: Build and push
+        uses: docker/build-push-action@v5
+        with:
+          file: ${{ inputs.dockerfile }}
+          push: true
+          context: .
+          platforms: ${{ inputs.platform }}
+          build-contexts: ${{ inputs.build-contexts }}
+          build-args: ${{ inputs.build-args }}
+          cache-from: |
+            ${{ steps.build_meta.outputs.cache-from }}
+            ${{ steps.recent_pr_cache_refs.outputs.cache-from }}
+          cache-to: ${{ steps.build_meta.outputs.cache-to }}
+          no-cache: false
+          tags: |
+            ${{ steps.build_meta.outputs.tags }}
+          target: ${{ inputs.target }}

.github/workflows/cicd-approve-test-queue.yml

@@ -0,0 +1,34 @@
+# Copyright (c) 2026, NVIDIA CORPORATION.  All rights reserved.
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#     http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+name: Approve Test Queue
+
+on:
+  schedule:
+    - cron: "*/5 * * * *"
+  workflow_dispatch:
+
+jobs:
+  approve-test-queue:
+    if: github.repository == 'NVIDIA-NeMo/RL'
+    uses: NVIDIA-NeMo/FW-CI-templates/.github/workflows/_test_approval_queue.yml@v1.3.0
+    with:
+      workflow_name: CICD NeMo RL
+      max_concurrency_internal: ${{ fromJSON(vars.MAX_CONCURRENCY || '3') }}
+      max_concurrency_external: ${{ fromJSON(vars.MAX_CONCURRENCY_EXTERNAL || '3') }}
+    secrets:
+      PAT: ${{ secrets.PAT }}
+      NVIDIA_MANAGEMENT_ORG_PAT: ${{ secrets.NVIDIA_MANAGEMENT_ORG_PAT }}
+      SLACK_CI_CHANNEL_WEBHOOK: ${{ secrets.SLACK_GITHUB_CI_WEBHOOK }}
+      SLACK_TEAM_GROUP_ID: ${{ secrets.SLACK_TEAM_GROUP_ID }}