build-in-devcontainer.yaml

on:
  workflow_call:
    inputs:
      env:
        description: |
          Additional environment variables to be set inside the devcontainer.
          Should be a space-delimited string in the form "KEY=value".
        type: string
      sha:
        description: "Full git commit SHA to check out"
        type: string
      arch:
        description: "One of [amd64, arm64]. CPU architecture to run on."
        type: string
        default: '["amd64"]'
      cuda:
        description: |
          Stringified JSON array of CUDA versions to run this workflow for.
          This is used to select .devcontainer/ directories local to wherever this workflow is invoked from.
          For example, if a repository has directories '.devcontainer/cuda12.9-pip/' and '.devcontainer/cuda13.0-pip/',
          '["12.9", "13.0"]' could be passed here to build both of those devcontainers in CI.
        type: string
        default: '["13.0"]'
      python_package_manager:
        description: |
          Stringified JSON array of Python package managers to run devcontainer builds for.
          One of: '["conda"]', '["pip"]', '["conda", "pip"]'.
        type: string
        default: '["conda", "pip"]'
      repo:
        description: "Git repo to check out, in '{org}/{repo}' form, e.g. 'rapidsai/cudf'"
        type: string
      timeout-minutes:
        description: "Maximum time (in minutes) allowed for a run of this workflow."
        type: number
        default: 360
      node_type:
        description: |
          Suffix, without leading '-', indicating the type of machine to run jobs on (e.g., 'cpu4' or 'gpu-l4-latest-1').
          Runner labels are of the form '{operating_system}-{arch}-{node_type}'.
          See https://github.com/nv-gha-runners/enterprise-runner-configuration/blob/main/docs/runner-groups.md for a list
          of valid values.
        type: string
        default: "cpu8"
      build_command:
        description: |
          Shell commands to run inside the devcontainer after it's built and started.
          This is almost always some form of 'build-all --verbose;'.
          See https://github.com/rapidsai/devcontainers for details.
        type: string
        required: true
      extra-repo-deploy-key:
        description: |
          The NAME (not value) of a GitHub secret in the calling repo, containing a repo deploy key.
          This is here to allow the use of additional private repos in runs of this workflow.
        required: false
        type: string
        default: ''
      extra-repo-deploy-key-2:
        description: |
          The NAME (not value) of a GitHub secret in the calling repo, containing a repo deploy key.
          This is here to allow the use of additional private repos in runs of this workflow.
        required: false
        type: string
        default: ''
      rapids-aux-secret-1:
        description: |
          The NAME (not value) of a GitHub secret in the calling repo.
          This allows callers of the workflow to make a single secret available in the devcontainer's
          environment, via environment variable `RAPIDS_AUX_SECRET_1`.
        required: false
        type: string
        default: ''

permissions:
  actions: read
  checks: none
  contents: read
  deployments: none
  discussions: none
  id-token: write
  issues: none
  packages: read
  pages: none
  pull-requests: read
  repository-projects: none
  security-events: none
  statuses: none

jobs:
  build:
    timeout-minutes: ${{ inputs.timeout-minutes }}
    strategy:
      fail-fast: false
      matrix:
        ARCH: ${{ fromJSON(inputs.arch) }}
        CUDA_VER: ${{ fromJSON(inputs.cuda) }}
        PACKAGER: ${{ fromJSON(inputs.python_package_manager) }}
    runs-on: "linux-${{ matrix.ARCH }}-${{ inputs.node_type }}"
    name: "${{ matrix.ARCH }}, ${{ matrix.CUDA_VER }}, ${{ matrix.PACKAGER }}"
    steps:
      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
        with:
          repository: ${{ inputs.repo }}
          ref: ${{ inputs.sha }}
          fetch-depth: 0
          path: repo
          persist-credentials: true

      # This provides an initial set of metadata tags. Jobs are free to add to the RAPIDS_JOB_ATTRIBUTES
      # environment variable as they see fit - but remember to export the variable to ${GITHUB_ENV}
      - name: Telemetry setup
        uses: rapidsai/shared-actions/telemetry-dispatch-setup@main
        continue-on-error: true
        if: ${{ vars.TELEMETRY_ENABLED == 'true' }}
        env:
          GH_TOKEN: ${{ github.token }}
        with:
          extra_attributes: "rapids.PACKAGER=${{ matrix.PACKAGER }},rapids.CUDA_VER=${{ matrix.CUDA_VER }},rapids.ARCH=${{ matrix.ARCH }}"

      - name: Setup job env
        env:
          ARCH: ${{ matrix.ARCH }}
          CUDA_VER: ${{ matrix.CUDA_VER }}
          PACKAGER: ${{ matrix.PACKAGER }}
          RUN_ID: ${{ github.run_id }}
          RUN_ATTEMPT: ${{ github.run_attempt }}
        run: |
          cat <<EOF | tee -a "${GITHUB_ENV}"
          ARTIFACT_SLUG=${RUN_ID}-${RUN_ATTEMPT}-$RANDOM
          BUILD_SLUG=cuda${CUDA_VER}-${PACKAGER}-${ARCH}
          REPOSITORY=$(basename "$(pwd)")
          SCCACHE_DIST_AUTH_TOKEN=$(
            curl -fsSL -H "Authorization: Bearer $(
              curl -fsSL -H "Authorization: bearer $ACTIONS_ID_TOKEN_REQUEST_TOKEN" \
                "${ACTIONS_ID_TOKEN_REQUEST_URL}&audience=token.rapids.nvidia.com" \
            | jq -r '.value'
            )" https://token.rapids.nvidia.com/gh/token/exchange \
          | jq -r '.token')
          EOF

      - uses: aws-actions/configure-aws-credentials@e7f100cf4c008499ea8adda475de1042d6975c7b # v6.2.0
        with:
          role-to-assume: ${{ vars.AWS_ROLE_ARN }}
          aws-region: ${{ vars.AWS_REGION }}
          role-duration-seconds: 43200 # 12h

      - name: Setup Node.js
        uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
        with:
          node-version: '24'

      - name: Setup proxy cache
        uses: nv-gha-runners/setup-proxy-cache@main
        continue-on-error: true
        with:
          enable-apt: true

      - name: Run build in devcontainer
        uses: devcontainers/ci@513af61f4de4f75d37e4438f184ba4358f0fc1ca # v0.3.1900000450
        with:
          push: never
          checkoutPath: repo
          imageTag: "cuda${{ matrix.CUDA_VER }}-${{ matrix.PACKAGER }}"
          imageName: "docker.io/rapidsai/${{ env.REPOSITORY }}-devcontainer"
          configFile: .devcontainer/cuda${{ matrix.CUDA_VER }}-${{ matrix.PACKAGER }}/devcontainer.json
          # Env vars are NOT automatically passed from our current env into the devcontainer.
          # We have to pass them in explicitly.
          env: |
            REPOSITORY=${{ env.REPOSITORY }}
            SCCACHE_DIST_AUTH_TOKEN=${{ env.SCCACHE_DIST_AUTH_TOKEN }}
            SCCACHE_IDLE_TIMEOUT=0
            SCCACHE_REGION=${{ vars.AWS_REGION }}
            SCCACHE_ERROR_LOG=/home/coder/${{ env.REPOSITORY }}/sccache.log
            AWS_ACCESS_KEY_ID=${{ env.AWS_ACCESS_KEY_ID }}
            AWS_SESSION_TOKEN=${{ env.AWS_SESSION_TOKEN }}
            AWS_SECRET_ACCESS_KEY=${{ env.AWS_SECRET_ACCESS_KEY }}
            RAPIDS_AUX_SECRET_1=${{ inputs.rapids-aux-secret-1 != '' && secrets[inputs.rapids-aux-secret-1] || '' }}
            TRACEPARENT=${{ env.TRACEPARENT }}
            OTEL_SERVICE_NAME=${{ env.OTEL_SERVICE_NAME }}
            OTEL_EXPORTER_OTLP_ENDPOINT=${{ env.OTEL_EXPORTER_OTLP_ENDPOINT }}
            OTEL_EXPORTER_OTLP_PROTOCOL=${{ env.OTEL_EXPORTER_OTLP_PROTOCOL }}
            OTEL_RESOURCE_ATTRIBUTES=${{ env.OTEL_RESOURCE_ATTRIBUTES }}
            ${{ inputs.env }}
          runCmd: |
            set -euo pipefail;

            if test -n '${{ inputs.extra-repo-deploy-key }}' \
            || test -n '${{ inputs.extra-repo-deploy-key-2 }}'; then
              if ! pgrep ssh-agent >/dev/null 2>&1; then eval "$(ssh-agent -s)"; fi;
              if test -n '${{ inputs.extra-repo-deploy-key }}'; then
                ssh-add - <<< '${{ secrets[inputs.extra-repo-deploy-key] }}';
              fi
              if test -n '${{ inputs.extra-repo-deploy-key-2 }}'; then
                ssh-add - <<< '${{ secrets[inputs.extra-repo-deploy-key-2] }}';
              fi
              devcontainer-utils-init-ssh-deploy-keys || true;
            fi

            mkdir -p ~/.config/pip/;
            cat <<EOF >> ~/.config/pip/pip.conf
            [global]
            extra-index-url = https://pypi.anaconda.org/rapidsai-wheels-nightly/simple
            EOF

            # TODO: Remove this and call it in each repository's build commands
            rapids-make-${PYTHON_PACKAGE_MANAGER}-env || :;

            cd ~/"${REPOSITORY}";
            mkdir -p telemetry-artifacts;
            ${{ inputs.build_command }}

      - if: ${{ !cancelled() }}
        name: Upload sccache logs
        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
        with:
          name: sccache-client-logs-${{ env.BUILD_SLUG }}-${{ env.ARTIFACT_SLUG }}
          path: repo/sccache*.log
          compression-level: 9

      - if: ${{ always() && vars.TELEMETRY_ENABLED == 'true' }}
        name: Telemetry upload attributes
        uses: rapidsai/shared-actions/telemetry-dispatch-stash-job-artifacts@main
        continue-on-error: true
        env:
          GH_TOKEN: ${{ github.token }}