ci: enable ATIF S3 storage tests (NVIDIA#168)

#### Overview

Enable CI coverage for the ATIF S3 storage integration test by running it against an ephemeral S3-compatible service.

- [x] I confirm this contribution is my own work, or I have the right to submit it under this project's license.
- [x] I searched existing issues and open pull requests, and this does not duplicate existing work.

#### Details

- Add an `adobe/s3mock:5.0.0` service to the Linux Rust CI lane.
- Pre-create the ATIF test bucket in S3Mock and enable `NEMO_RELAY_RUN_S3_TESTS` for `linux-amd64`.
- Export local S3 endpoint, region, dummy credentials, HTTP allowance, and path-style addressing for the existing ATIF S3 integration test.

Validation run locally:

- `ruby -e 'require "yaml"; YAML.load_file(".github/workflows/ci_rust.yml"); puts "yaml-ok"'`
- `cargo test -p nemo-relay --test atif_storage_integration`
- `uv run pre-commit run --files .github/workflows/ci_rust.yml`
- `git diff --check`

Note: local Docker is not installed in this environment, so the live S3Mock container path is expected to be validated by CI.

#### Where should the reviewer start?

Start with `.github/workflows/ci_rust.yml`, especially the new `s3` service and the environment exported when `matrix.run_s3_tests` is true.

#### Related Issues: (use one of the action keywords Closes / Fixes / Resolves / Relates to)

- Relates to: none



## Summary by CodeRabbit

* **Chores**
  * CI enhanced to run S3 integration tests on supported Linux AMD64 runners with S3 mock service; environment variables for S3 access are now provided during those tests.

* **Tests**
  * Integration test expectation updated: uploaded trajectory metadata now reports schema version "ATIF-v1.7".



[![Review Change Stack](https://storage.googleapis.com/coderabbit_public_assets/review-stack-in-coderabbit-ui.svg)](https://app.coderabbit.ai/change-stack/NVIDIA/NeMo-Relay/pull/168?utm_source=github_walkthrough&utm_medium=github&utm_campaign=change_stack)

Authors:
  - Will Killian (https://github.com/willkill07)

Approvers:
  - David Gardner (https://github.com/dagardner-nv)

URL: NVIDIA#168

Author: willkill07

.github/workflows/ci_rust.yml

@@ -44,34 +44,50 @@ jobs:
           --health-interval 5s
           --health-timeout 3s
           --health-retries 10
+      s3:
+        image: ${{ matrix.s3_service_image }}
+        env:
+          COM_ADOBE_TESTING_S3MOCK_STORE_INITIAL_BUCKETS: nemo-relay-atif-ci
+        ports:
+          - 9090:9090
+        options: >-
+          --health-cmd "wget --spider -q http://localhost:9090/favicon.ico || exit 1"
+          --health-interval 5s
+          --health-timeout 3s
+          --health-retries 20
     strategy:
       fail-fast: false
       matrix:
         include:
           - platform: linux-amd64
             runner: ubuntu-latest
             run_redis_tests: true
-            redis_service_image: redis:7.4.7-alpine
-            run_s3_tests: false
+            redis_service_image: redis:7.4.7-alpine@sha256:02f2cc4882f8bf87c79a220ac958f58c700bdec0dfb9b9ea61b62fb0e8f1bfcf
+            run_s3_tests: true
+            s3_service_image: adobe/s3mock:5.0.0@sha256:c461c8f4234bd63540d2f3a3cabce69d814c78dc890a5af08727525a028e23da
           - platform: linux-arm64
             runner: ubuntu-24.04-arm
             run_redis_tests: false
             redis_service_image: ''
+            s3_service_image: ''
             run_s3_tests: false
           - platform: macos-arm64
             runner: macos-15
             run_redis_tests: false
             redis_service_image: ''
+            s3_service_image: ''
             run_s3_tests: false
           - platform: windows-amd64
             runner: windows-2022
             run_redis_tests: false
             redis_service_image: ''
+            s3_service_image: ''
             run_s3_tests: false
           - platform: windows-arm64
             runner: windows-11-arm
             run_redis_tests: false
             redis_service_image: ''
+            s3_service_image: ''
             run_s3_tests: false
 
     steps:
@@ -145,11 +161,15 @@ jobs:
           if [ "${{ matrix.run_redis_tests }}" = "true" ]; then
             export NEMO_RELAY_RUN_REDIS_TESTS=1
           fi
-          # ATIF S3 storage integration tests stay disabled by default. Toggle a
-          # matrix entry's `run_s3_tests` to `true` once a CI-managed bucket and
-          # the AWS_*/NEMO_RELAY_S3_TEST_BUCKET secrets are wired through.
           if [ "${{ matrix.run_s3_tests }}" = "true" ]; then
             export NEMO_RELAY_RUN_S3_TESTS=1
+            export NEMO_RELAY_S3_TEST_BUCKET=nemo-relay-atif-ci
+            export AWS_ACCESS_KEY_ID=nemo-relay
+            export AWS_SECRET_ACCESS_KEY=nemo-relay
+            export AWS_REGION=us-east-1
+            export AWS_ENDPOINT_URL=http://127.0.0.1:9090
+            export AWS_ALLOW_HTTP=true
+            export AWS_VIRTUAL_HOSTED_STYLE_REQUEST=false
           fi
           just "${args[@]}" test-rust
 

crates/core/tests/integration/atif_storage_tests.rs

@@ -200,7 +200,7 @@ fn atif_storage_uploads_trajectory_to_s3() {
     let value: Json = serde_json::from_slice(&body).expect("uploaded payload should be JSON");
     assert_eq!(
         value["schema_version"].as_str(),
-        Some("ATIF-v1.6"),
+        Some("ATIF-v1.7"),
         "uploaded artifact should be an ATIF trajectory"
     );
     let expected_session_id = session_id.to_string();