ci_pipe.yml

# SPDX-FileCopyrightText: Copyright (c) 2025-2026, NVIDIA CORPORATION & AFFILIATES. All rights reserved.
# SPDX-License-Identifier: Apache-2.0
#
# Licensed under the Apache License, Version 2.0 (the "License");
# you may not use this file except in compliance with the License.
# You may obtain a copy of the License at
#
# http://www.apache.org/licenses/LICENSE-2.0
#
# Unless required by applicable law or agreed to in writing, software
# distributed under the License is distributed on an "AS IS" BASIS,
# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
# See the License for the specific language governing permissions and
# limitations under the License.

name: CI Pipeline
run-name: CI Pipeline

on:
  workflow_call:
    inputs:
      container:
        description: 'The default container to use for most CI stages'
        required: true
        type: string
      py_11_container:
        description: 'The Python 3.11 container to use for the test stage'
        required: true
        type: string
      py_12_container:
        description: 'The Python 3.12 container to use for the test stage'
        required: true
        type: string
      py_13_container:
        description: 'The Python 3.13 container to use for the test stage'
        required: true
        type: string
      pr_info:
        description: 'The JSON string containing the PR information'
        required: true
        type: string
      base_sha:
        description: 'The base SHA of the PR'
        required: true
        type: string
    secrets:
      CODECOV_TOKEN:
        required: true

# We only support ubuntu, so bash is the default
defaults:
  run:
    shell: bash

env:
  GIT_COMMIT: "${{ github.sha }}"
  BASE_SHA: "${{ inputs.base_sha }}"
  IS_PULL_REQUEST: "${{ inputs.base_sha != '' }}"
  BUILD_NAT_COMPAT: "true"
  WORKSPACE: "${{ github.workspace }}/nat"
  WORKSPACE_TMP: "${{ github.workspace }}/tmp"
  UV_CACHE_DIR: .uv-cache

permissions:
  actions: none
  checks: none
  contents: read
  deployments: none
  discussions: none
  id-token: write
  issues: none
  packages: read
  pages: none
  pull-requests: read
  repository-projects: none
  security-events: none
  statuses: none

jobs:
  check:
    name: Check
    runs-on: linux-amd64-cpu4
    timeout-minutes: 30
    container:
      image: ${{ inputs.container }}
    strategy:
      fail-fast: true

    steps:
      - name: Checkout
        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
        with:
          fetch-depth: 0
          path: 'nat'
          submodules: recursive

      - name: Check
        shell: bash
        run: ./nat/ci/scripts/github/checks.sh

  test:
    name: Test
    needs: [check]
    runs-on:  linux-${{ matrix.arch }}-cpu4
    timeout-minutes: 60
    container:
      image: ${{ matrix.container }}
    strategy:
      fail-fast: true
      matrix:
        arch: ["amd64", "arm64"]
        python-version: ["3.11", "3.12", "3.13"]
        include:
          - python-version: "3.11"
            container: ${{ inputs.py_11_container }}
          - python-version: "3.12"
            container: ${{ inputs.py_12_container }}
          - python-version: "3.13"
            container: ${{ inputs.py_13_container }}

    env:
      CI_PYTHON_VERSION: ${{ matrix.python-version }}
      CI_ARCH: ${{ matrix.arch }}

    steps:
      - name: Checkout
        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
        with:
          fetch-depth: 0
          fetch-tags: true
          path: 'nat'
          submodules: recursive

      - name: Test:linux:${{ matrix.arch }}:py${{ matrix.python-version }}
        shell: bash
        run: ./nat/ci/scripts/github/tests.sh

      - name: Upload Test Results
        uses: actions/upload-artifact@b7c566a772e6b6bfb58ed0dc250532a479d7789f # v6
        # Upload test results even if the tests fail
        if: ${{ always() }}
        with:
          name: "test-results-${{ matrix.arch }}-py${{ matrix.python-version }}"
          path: "${{ github.workspace }}/tmp/reports/*.xml"
          if-no-files-found: error

      # For now disable codecode to work-around https://github.com/codecov/codecov-action/issues/1956
      # Will re-enable once we have some spare cycles to investigate the issue
      #
      # - name: Upload coverage to Codecov
      #   uses: codecov/codecov-action@75cd11691c0faa626561e295848008c8a7dddffe # v5
      #   # Upload test results even if the tests fail
      #   if: ${{ always() }}
      #   with:
      #     directory: "${{ github.workspace }}/tmp/reports"
      #     env_vars: CI_ARCH,CI_PYTHON_VERSION
      #     fail_ci_if_error: true
      #     flags: unittests
      #     name: nat-code-cov-${{ matrix.arch }}-py${{ matrix.python-version }}
      #     token: ${{ secrets.CODECOV_TOKEN }}
      #     verbose: true

  documentation:
    name: Documentation
    needs: [check]
    runs-on: linux-amd64-cpu4
    timeout-minutes: 15
    container:
      image: ${{ inputs.container }}
    strategy:
      fail-fast: true

    steps:
      - name: Checkout
        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
        with:
          fetch-tags: true
          path: 'nat'

      - name: build_docs
        shell: bash
        run: ./nat/ci/scripts/github/docs.sh

      - name: Upload Documentation
        uses: actions/upload-artifact@b7c566a772e6b6bfb58ed0dc250532a479d7789f # v6
        with:
          name: "docs"
          path: "${{ github.workspace }}/tmp/docs.tar.bz2"
          if-no-files-found: error
          compression-level: 0


  package:
    name: Build Wheels
    needs: [check]
    runs-on: linux-amd64-cpu4
    timeout-minutes: 60
    container:
      image: ${{ inputs.container }}
    strategy:
      fail-fast: true

    steps:
      - name: Checkout
        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
        with:
          fetch-depth: 0
          fetch-tags: true
          path: 'nat'

      - name: build_wheels
        shell: bash
        run: ./nat/ci/scripts/github/build_wheel.sh

      - name: Upload Package Reports
        uses: actions/upload-artifact@b7c566a772e6b6bfb58ed0dc250532a479d7789f # v6
        if: ${{ always() }}
        with:
          name: "package_listings"
          path: "${{ github.workspace }}/tmp/package_listings.tar.bz2"
          if-no-files-found: error
          compression-level: 0

      - name: Upload Wheels
        uses: actions/upload-artifact@b7c566a772e6b6bfb58ed0dc250532a479d7789f # v6
        with:
          name: "wheels"
          path: "${{ github.workspace }}/tmp/wheels/*.whl"
          if-no-files-found: error
          compression-level: 9