Pull Request Validation workflow (NVIDIA/NeMo-Retriever)

name: Pull Request Validation
 
on:
  pull_request:
    types:
      - opened
      - synchronize
      - reopened
      - labeled
 
concurrency:
  group: ${{ github.workflow }}-pr-${{ github.event.pull_request.number }}
  cancel-in-progress: true
 
jobs:
  # Fast pre-commit checks (runs first)
  pre-commit:
    timeout-minutes: 30
    name: Pre-commit Checks
    uses: ./.github/workflows/reusable-pre-commit.yml
 
  # Core install must not require tritonclient (remote NIM / slim API); see tests/test_slim_imports_no_triton.py
  slim-import-contract:
    timeout-minutes: 30
    name: Slim import contract (core deps, no tritonclient)
    runs-on: latchkey-small
    steps:
      - name: Check out repository code
        uses: actions/checkout@v4
 
      - uses: actions/setup-python@v5
        with:
          cache: 'pip'
          python-version: "3.12"
 
      - uses: astral-sh/setup-uv@v6
 
      - name: Install nemo-retriever without local extra and assert slim imports
        working-directory: nemo_retriever
        run: |
          set -euo pipefail
          uv venv .venv-slim
          source .venv-slim/bin/activate
          uv pip install -e ".[dev]"
          uv pip uninstall tritonclient 2>/dev/null || true
          python -c "import importlib.util; import sys; sys.exit(0 if importlib.util.find_spec('tritonclient') is None else 1)"
          python -m pytest tests/test_slim_imports_no_triton.py -q
 
  # Keep Windows/macOS library-mode installation covered in PRs without running secret-backed ingest.
  library-mode-install:
    name: Library mode install (${{ matrix.os-label }})
    runs-on: ${{ matrix.runner }}
    timeout-minutes: 60
    strategy:
      fail-fast: false
      matrix:
        include:
          - runner: windows-latest
            os-label: windows-x64
          - runner: macos-26
            os-label: macos-arm64
          - runner: macos-26-intel
            os-label: macos-x64
    steps:
      - name: Check out repository code
        uses: actions/checkout@v4
 
      - name: Set up Python 3.12
        uses: actions/setup-python@v5
        with:
          cache: 'pip'
          python-version: "3.12"
 
      - uses: astral-sh/setup-uv@v6
 
      - name: Install nemo-retriever and dependencies
        shell: bash
        run: |
          set -euo pipefail
          uv pip install --system -e "nemo_retriever"
 
      - name: Smoke-test installed package
        shell: bash
        run: |
          set -euo pipefail
          python -m pip check
          python -c "import importlib.metadata as metadata; print('nemo-retriever', metadata.version('nemo-retriever'))"
          retriever --help
 
  # Docker build + test for x86_64 (single job so built image is available locally)
  docker-build-and-test:
    timeout-minutes: 30
    name: Build & Test Docker (amd64)
    uses: ./.github/workflows/reusable-docker-build-and-test.yml
    with:
      platform: 'linux/amd64'
      target: 'service'
      tags: 'nrl-service:pr-${{ github.event.pull_request.number }}'
      base-image: 'ubuntu'
      base-image-tag: 'jammy-20250415.1'
      test-selection: 'full'
      pytest-markers: 'not integration'
      coverage: true
      runner: 'linux-large-disk'
 
  # Summary job
  pr-validation-complete:
    timeout-minutes: 30
    name: PR Validation Complete
    needs:
      - pre-commit
      - slim-import-contract
      - library-mode-install
      - docker-build-and-test
    runs-on: latchkey-small
    if: always()
    steps:
      - name: Check job results
        run: |
          if [[ "${{ needs.pre-commit.result }}" != "success" ]] || \
             [[ "${{ needs.slim-import-contract.result }}" != "success" ]] || \
             [[ "${{ needs.library-mode-install.result }}" != "success" ]] || \
             [[ "${{ needs.docker-build-and-test.result }}" != "success" ]]; then
            echo "One or more required jobs failed"
            exit 1
          fi
          echo "All required PR checks passed!"