Build pull request workflow (NVIDIA/NeMo-Agent-Toolkit)
The Build pull request workflow from NVIDIA/NeMo-Agent-Toolkit, explained and optimized by Latchkey.
A
CI health: A - excellent
Point runs-on at Latchkey and get job timeouts, self-healing for flaky steps, and up to 58% lower cost, applied automatically.
What it does
This is the Build pull request workflow from the NVIDIA/NeMo-Agent-Toolkit repository, a real project running GitHub Actions. It is shown here with attribution under its Apache-2.0 license.
Below, Latchkey shows a faster, safer version produced by its optimization engine.
The workflow
workflow (.yml)
# SPDX-FileCopyrightText: Copyright (c) 2025-2026, NVIDIA CORPORATION & AFFILIATES. All rights reserved.
# SPDX-License-Identifier: Apache-2.0
#
# Licensed under the Apache License, Version 2.0 (the "License");
# you may not use this file except in compliance with the License.
# You may obtain a copy of the License at
#
# http://www.apache.org/licenses/LICENSE-2.0
#
# Unless required by applicable law or agreed to in writing, software
# distributed under the License is distributed on an "AS IS" BASIS,
# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
# See the License for the specific language governing permissions and
# limitations under the License.
name: Build pull request
on:
push:
branches:
- 'pull-request/**'
- 'develop'
- 'main'
- 'release/**'
# This allows a subsequently queued workflow run to interrupt previous runs
concurrency:
group: '${{ github.workflow }} @ ${{ github.event.pull_request.head.label || github.head_ref || github.ref }}'
cancel-in-progress: true
permissions:
actions: none
checks: none
contents: read
deployments: none
discussions: none
id-token: write
issues: none
packages: read
pages: none
pull-requests: read
repository-projects: none
security-events: none
statuses: none
jobs:
pr-builder:
needs:
- prepare
- ci_pipe
secrets: inherit
uses: rapidsai/shared-workflows/.github/workflows/pr-builder.yaml@5fe52098676ca51435a73337131685e340658c51 # branch-25.04
prepare:
# Executes the get-pr-info action to determine if the PR has the skip-ci label, if the action fails we assume the
# PR does not have the label
name: Prepare
runs-on: ubuntu-latest
steps:
- name: Get PR Info
id: get-pr-info
uses: nv-gha-runners/get-pr-info@090577647b8ddc4e06e809e264f7881650ecdccf # main
if: ${{ startsWith(github.ref_name, 'pull-request/') }}
outputs:
is_pr: ${{ startsWith(github.ref_name, 'pull-request/') }}
is_main_branch: ${{ github.ref_name == 'main' }}
is_dev_branch: ${{ startsWith(github.ref_name, 'develop') }}
is_release_branch: ${{ startsWith(github.ref_name, 'release/') }}
has_skip_ci_label: ${{ steps.get-pr-info.outcome == 'success' && contains(fromJSON(steps.get-pr-info.outputs.pr-info).labels.*.name, 'skip-ci') || false }}
pr_info: ${{ steps.get-pr-info.outcome == 'success' && steps.get-pr-info.outputs.pr-info || '' }}
base_sha: ${{ steps.get-pr-info.outcome == 'success' && fromJSON(steps.get-pr-info.outputs.pr-info).base.sha || '' }}
ci_pipe:
name: CI Pipeline
needs: [prepare]
uses: ./.github/workflows/ci_pipe.yml
if: ${{ ! fromJSON(needs.prepare.outputs.has_skip_ci_label) }}
with:
# CI container
container: ghcr.io/astral-sh/uv:0.9.28-python3.13-bookworm
py_11_container: ghcr.io/astral-sh/uv:0.9.28-python3.11-bookworm
py_12_container: ghcr.io/astral-sh/uv:0.9.28-python3.12-bookworm
py_13_container: ghcr.io/astral-sh/uv:0.9.28-python3.13-bookworm
# Info about the PR. Empty for non PR branches. Useful for extracting PR number, title, etc.
pr_info: ${{ needs.prepare.outputs.pr_info }}
base_sha: ${{ needs.prepare.outputs.base_sha }}
secrets:
CODECOV_TOKEN: ${{ secrets.CODECOV_TOKEN }}
The same workflow, on Latchkey
Removes redundant runs and caps runaway jobs. Added and changed lines are highlighted.
# SPDX-FileCopyrightText: Copyright (c) 2025-2026, NVIDIA CORPORATION & AFFILIATES. All rights reserved. # SPDX-License-Identifier: Apache-2.0 # # Licensed under the Apache License, Version 2.0 (the "License"); # you may not use this file except in compliance with the License. # You may obtain a copy of the License at # # http://www.apache.org/licenses/LICENSE-2.0 # # Unless required by applicable law or agreed to in writing, software # distributed under the License is distributed on an "AS IS" BASIS, # WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. # See the License for the specific language governing permissions and # limitations under the License. name: Build pull request on: push: branches: - 'pull-request/**' - 'develop' - 'main' - 'release/**' # This allows a subsequently queued workflow run to interrupt previous runs concurrency: group: '${{ github.workflow }} @ ${{ github.event.pull_request.head.label || github.head_ref || github.ref }}' cancel-in-progress: true permissions: actions: none checks: none contents: read deployments: none discussions: none id-token: write issues: none packages: read pages: none pull-requests: read repository-projects: none security-events: none statuses: none jobs: pr-builder: timeout-minutes: 30 needs: - prepare - ci_pipe secrets: inherit uses: rapidsai/shared-workflows/.github/workflows/pr-builder.yaml@5fe52098676ca51435a73337131685e340658c51 # branch-25.04 prepare: timeout-minutes: 30 # Executes the get-pr-info action to determine if the PR has the skip-ci label, if the action fails we assume the # PR does not have the label name: Prepare runs-on: latchkey-small steps: - name: Get PR Info id: get-pr-info uses: nv-gha-runners/get-pr-info@090577647b8ddc4e06e809e264f7881650ecdccf # main if: ${{ startsWith(github.ref_name, 'pull-request/') }} outputs: is_pr: ${{ startsWith(github.ref_name, 'pull-request/') }} is_main_branch: ${{ github.ref_name == 'main' }} is_dev_branch: ${{ startsWith(github.ref_name, 'develop') }} is_release_branch: ${{ startsWith(github.ref_name, 'release/') }} has_skip_ci_label: ${{ steps.get-pr-info.outcome == 'success' && contains(fromJSON(steps.get-pr-info.outputs.pr-info).labels.*.name, 'skip-ci') || false }} pr_info: ${{ steps.get-pr-info.outcome == 'success' && steps.get-pr-info.outputs.pr-info || '' }} base_sha: ${{ steps.get-pr-info.outcome == 'success' && fromJSON(steps.get-pr-info.outputs.pr-info).base.sha || '' }} ci_pipe: timeout-minutes: 30 name: CI Pipeline needs: [prepare] uses: ./.github/workflows/ci_pipe.yml if: ${{ ! fromJSON(needs.prepare.outputs.has_skip_ci_label) }} with: # CI container container: ghcr.io/astral-sh/uv:0.9.28-python3.13-bookworm py_11_container: ghcr.io/astral-sh/uv:0.9.28-python3.11-bookworm py_12_container: ghcr.io/astral-sh/uv:0.9.28-python3.12-bookworm py_13_container: ghcr.io/astral-sh/uv:0.9.28-python3.13-bookworm # Info about the PR. Empty for non PR branches. Useful for extracting PR number, title, etc. pr_info: ${{ needs.prepare.outputs.pr_info }} base_sha: ${{ needs.prepare.outputs.base_sha }} secrets: CODECOV_TOKEN: ${{ secrets.CODECOV_TOKEN }}
What changed
- Run on Latchkey managed runners with one line (
runs-on), which apply the fixes below automatically and self-heal transient failures. This example useslatchkey-small; pick the runner size that fits the job. - Add a job timeout so a hung step cannot burn hours of runner time.
This workflow runs 3 jobs per trigger. On Latchkey the same minutes cost up to 58% less than GitHub-hosted, with zero queue time.