diff --git a/.github/workflows/conda-cpp-build.yaml b/.github/workflows/conda-cpp-build.yaml index 4f8a4461..9dd4f4c9 100644 --- a/.github/workflows/conda-cpp-build.yaml +++ b/.github/workflows/conda-cpp-build.yaml @@ -44,6 +44,16 @@ on: default: true required: false description: "One of [true, false], true if artifacts should be uploaded to GitHub's artifact store" + release-build-output: + type: boolean + default: false + required: false + description: "Generate a release-build-output companion for each uploaded Conda bundle" + release-unit: + type: string + default: '' + required: false + description: "Stable release-platform unit ID; required when release-build-output is true" matrix_filter: description: | jq expression which modifies the matrix. @@ -226,6 +236,19 @@ jobs: if-no-files-found: 'error' name: ${{ steps.package-name.outputs.RAPIDS_PACKAGE_NAME }} path: ${{ steps.package-name.outputs.CONDA_OUTPUT_DIR }} + + - name: Create Conda release build-output companion + if: ${{ inputs.upload-artifacts && inputs.release-build-output }} + uses: rapidsai/shared-actions/release-build-output-dispatch@agent/release-build-output-dispatch # zizmor: ignore[unpinned-uses] + env: + SHARED_ACTIONS_REPO: rapidsai/shared-actions + SHARED_ACTIONS_REF: agent/release-build-output-dispatch + with: + artifact-type: conda + output-directory: ${{ steps.package-name.outputs.CONDA_OUTPUT_DIR }} + release-unit: ${{ inputs.release-unit }} + source-artifact-name: ${{ steps.package-name.outputs.RAPIDS_PACKAGE_NAME }} + source-sha: ${{ inputs.sha || github.sha }} - name: Upload additional artifacts if: "!cancelled()" run: rapids-upload-artifacts-dir "cuda${RAPIDS_CUDA_VERSION%%.*}_$(arch)" diff --git a/.github/workflows/conda-python-build.yaml b/.github/workflows/conda-python-build.yaml index 1a2bb291..5dcacd22 100644 --- a/.github/workflows/conda-python-build.yaml +++ b/.github/workflows/conda-python-build.yaml @@ -44,6 +44,16 @@ on: default: true required: false description: "One of [true, false], true if artifacts should be uploaded to GitHub's artifact store" + release-build-output: + type: boolean + default: false + required: false + description: "Generate a release-build-output companion for each uploaded Conda bundle" + release-unit: + type: string + default: '' + required: false + description: "Stable release-platform unit ID; required when release-build-output is true" matrix_filter: description: | jq expression which modifies the matrix. @@ -231,6 +241,19 @@ jobs: if-no-files-found: 'error' name: ${{ steps.package-name.outputs.RAPIDS_PACKAGE_NAME }} path: ${{ steps.package-name.outputs.CONDA_OUTPUT_DIR }} + + - name: Create Conda release build-output companion + if: ${{ inputs.upload-artifacts && inputs.release-build-output }} + uses: rapidsai/shared-actions/release-build-output-dispatch@agent/release-build-output-dispatch # zizmor: ignore[unpinned-uses] + env: + SHARED_ACTIONS_REPO: rapidsai/shared-actions + SHARED_ACTIONS_REF: agent/release-build-output-dispatch + with: + artifact-type: conda + output-directory: ${{ steps.package-name.outputs.CONDA_OUTPUT_DIR }} + release-unit: ${{ inputs.release-unit }} + source-artifact-name: ${{ steps.package-name.outputs.RAPIDS_PACKAGE_NAME }} + source-sha: ${{ inputs.sha || github.sha }} - name: Upload additional artifacts if: "!cancelled()" run: rapids-upload-artifacts-dir "cuda${RAPIDS_CUDA_VERSION%%.*}_$(arch)_py${RAPIDS_PY_VERSION//.}" diff --git a/.github/workflows/custom-job.yaml b/.github/workflows/custom-job.yaml index 7bc2560e..ead7c55d 100644 --- a/.github/workflows/custom-job.yaml +++ b/.github/workflows/custom-job.yaml @@ -105,6 +105,36 @@ on: default: false type: boolean required: false + release-build-output: + description: "Generate a release-build-output companion for the uploaded artifact bundle" + default: false + type: boolean + required: false + release-unit: + description: "Stable release-platform unit ID; required when release-build-output is true" + default: '' + type: string + required: false + release-package: + description: "JSON package identity shared by the bundle; mutually exclusive with release-package-file" + default: '' + type: string + required: false + release-package-file: + description: "Producer-created package JSON relative to release-output-directory" + default: '' + type: string + required: false + release-artifacts: + description: "JSON primary-artifact and evidence descriptors relative to release-output-directory" + default: '' + type: string + required: false + release-output-directory: + description: "Directory containing the primary artifact paths described by release-artifacts" + default: '.' + type: string + required: false defaults: run: @@ -228,6 +258,21 @@ jobs: name: ${{ inputs.artifact-name }} path: ${{ inputs.file_to_upload }} if-no-files-found: ignore + - name: Create release build-output companion + if: ${{ inputs.release-build-output }} + uses: rapidsai/shared-actions/release-build-output-dispatch@agent/release-build-output-dispatch # zizmor: ignore[unpinned-uses] + env: + SHARED_ACTIONS_REPO: rapidsai/shared-actions + SHARED_ACTIONS_REF: agent/release-build-output-dispatch + with: + artifact-type: custom + output-directory: ${{ inputs.release-output-directory }} + release-artifacts: ${{ inputs.release-artifacts }} + release-package: ${{ inputs.release-package }} + release-package-file: ${{ inputs.release-package-file }} + release-unit: ${{ inputs.release-unit }} + source-artifact-name: ${{ inputs.artifact-name }} + source-sha: ${{ inputs.sha || github.sha }} - name: Upload additional artifacts if: "!cancelled()" run: rapids-upload-artifacts-dir "custom-job-$(arch)" diff --git a/.github/workflows/wheels-build.yaml b/.github/workflows/wheels-build.yaml index c4050159..ca9b074d 100644 --- a/.github/workflows/wheels-build.yaml +++ b/.github/workflows/wheels-build.yaml @@ -75,6 +75,16 @@ on: default: true required: false description: "One of [true, false], true if artifacts should be uploaded to GitHub's artifact store" + release-build-output: + type: boolean + default: false + required: false + description: "Generate a release-build-output companion for each uploaded wheel bundle" + release-unit: + type: string + default: '' + required: false + description: "Stable release-platform unit ID; required when release-build-output is true" extra-repo: required: false type: string @@ -298,6 +308,19 @@ jobs: name: ${{ steps.package-name.outputs.RAPIDS_PACKAGE_NAME }} path: ${{ steps.package-name.outputs.WHEEL_OUTPUT_DIR }} + - name: Create wheel release build-output companion + if: ${{ inputs.upload-artifacts && inputs.release-build-output }} + uses: rapidsai/shared-actions/release-build-output-dispatch@agent/release-build-output-dispatch # zizmor: ignore[unpinned-uses] + env: + SHARED_ACTIONS_REPO: rapidsai/shared-actions + SHARED_ACTIONS_REF: agent/release-build-output-dispatch + with: + artifact-type: wheel + output-directory: ${{ steps.package-name.outputs.WHEEL_OUTPUT_DIR }} + release-unit: ${{ inputs.release-unit }} + source-artifact-name: ${{ steps.package-name.outputs.RAPIDS_PACKAGE_NAME }} + source-sha: ${{ inputs.sha || github.sha }} + - name: Upload additional artifacts if: "!cancelled()" run: rapids-upload-artifacts-dir "cuda${RAPIDS_CUDA_VERSION%%.*}_$(arch)_py${RAPIDS_PY_VERSION//.}" diff --git a/README.md b/README.md index 9752c524..e45cc851 100644 --- a/README.md +++ b/README.md @@ -20,6 +20,75 @@ Reusable workflows must be placed in the `.github/workflows` directory as mentio ## Usage +### release-build-output + +Release build-output companions are created inside the producer job by the +[`release-build-output-dispatch`](https://github.com/rapidsai/shared-actions/tree/main/release-build-output-dispatch) +shared action. Running beside the build keeps the producer's matrix, +source-artifact name, and original files authoritative and avoids a second +runner and artifact download. + +The standard wheel and Conda builders expose opt-in `release-build-output` and +`release-unit` inputs. The shared action reads exact package metadata from the +built files and uploads `release-build-output-`: + +```yaml +wheel-build-nx-cugraph: + uses: rapidsai/shared-workflows/.github/workflows/wheels-build.yaml@codex/release-build-output-manifests + with: + # existing build inputs omitted + release-build-output: true + release-unit: wheel:nx-cugraph +``` + +`custom-job.yaml` exposes the same opt-in plus `release-output-directory`, +`release-artifacts`, and either `release-package` or +`release-package-file`. Descriptors may name producer-supplied SBOM, +provenance, and signature sidecars relative to the output directory. Each path +or glob must resolve to exactly one file; the action never guesses a release +artifact. + +```yaml +cuvs-java-build: + uses: rapidsai/shared-workflows/.github/workflows/custom-job.yaml@codex/release-build-output-manifests + with: + # existing build inputs omitted + artifact-name: cuvs-java-cuda12.9.1 + file_to_upload: java/cuvs-java/target/ + release-build-output: true + release-output-directory: java/cuvs-java/target + release-unit: maven:cuvs-java + release-package-file: cuvs-java.release-package.json + release-artifacts: '[{"path":"cuvs-java-*-x86_64-cuda*.jar"}]' +``` + +The release coordinator downloads both artifacts into the same directory, for +example `release-build-outputs/cuvs-java/cuda12.9.1/`. The resulting tree has +one `release-build-output.json` per producer job and is consumed directly by +`rapids-release shadow file`. It does not require Artifactory. + +The companion artifact also carries `release-build-metadata.json`. It records +the artifact identity, manifest filename, GitHub build identity, and one +`metadata.artifacts` entry per primary artifact. Each entry explicitly sets +`sbom_kind` to `producer-dependency` or `generated-identity`. SBOM and +provenance paths remain authoritative in `release-build-output.json`; supplied +sidecars are copied under `release-evidence/` so the companion is independently +self-contained. + +When no SBOM is selected, the action generates an SPDX artifact-identity +envelope containing package identity and the primary artifact SHA-256. It is +classified as `generated-identity`, contains no dependency inventory, and must +not be reported as a producer-supplied dependency SBOM. A descriptor-selected +producer SBOM is instead classified as `producer-dependency`. + +The in-development branch ref above is intentional for rollout canaries. It +allows downstream validation before this contract is merged to +`shared-workflows/main`. + +The cross-repository enrollment inventory, blockers, and proposed PR sequence +are maintained in +[`rapidsai/build-infra#381`](https://github.com/rapidsai/build-infra/issues/381). + ### matrix_filter Several of the workflows in this project have matrices (combinations of workflow inputs) expressed in inline YAML/JSON.