feat: container builds on release - #553
Conversation
|
Note Reviews pausedIt looks like this branch is under active development. To avoid overwhelming you with review comments due to an influx of new commits, CodeRabbit has automatically paused this review. You can configure this behavior by changing the Use the following commands to manage reviews:
Use the checkboxes below for quick actions:
WalkthroughThis PR refactors the GPU Docker container build from CUDA-base image selection to a Python-slim-based, uv-centric multistage architecture where CUDA support is selected via dependency extras. It introduces parameterized builds via ChangesGPU Container Build Refactor
Estimated code review effort🎯 3 (Moderate) | ⏱️ ~25 minutes Possibly related PRs
Suggested labels
Suggested reviewers
🚥 Pre-merge checks | ✅ 4 | ❌ 1❌ Failed checks (1 inconclusive)
✅ Passed checks (4 passed)
✏️ Tip: You can configure your own custom pre-merge checks in the settings. ✨ Finishing Touches🧪 Generate unit tests (beta)
Warning Review ran into problems🔥 ProblemsStopped waiting for pipeline failures after 30000ms. One of your pipelines takes longer than our 30000ms fetch window to run, so review may not consider pipeline-failure results for inline comments if any failures occurred after the fetch window. Increase the timeout if you want to wait longer or run a Comment |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 3
🧹 Nitpick comments (3)
docs/developer-guide/docker.md (2)
4-20: ⚡ Quick winAdd a
## Prerequisitessection near the top of the page.This page currently starts directly with architecture details, but docs guidelines require prerequisites before main content. Add a short prerequisites block (for example: Docker/Buildx, Make targets, registry auth expectations) right after the intro.
As per coding guidelines, docs pages must list prerequisites at the top before main content.
197-209: ⚡ Quick winFinish the page with a
## Next stepssection.The document currently ends without the required
Next stepslinks. Please add a final## Next stepssection with related docs links to keep navigation consistent.As per coding guidelines, documentation pages should end with a
Next stepssection containing links to related content.containers/Dockerfile.cuda (1)
143-143: 💤 Low valueConsider documenting the intentional root user for dev stage.
Trivy flags
USER rootwithout a subsequent switch to non-root. This is appropriate for interactive development but adding a brief comment clarifies intent and addresses static analysis noise.📝 Suggested comment
+# Dev stage runs as root for interactive development (bind-mount at runtime). USER root
ℹ️ Review info
⚙️ Run configuration
Configuration used: Path: .coderabbit.yaml
Review profile: CHILL
Plan: Enterprise
Run ID: 39133ab4-b8b3-4333-a587-1ede3f42079a
📒 Files selected for processing (9)
.dockerignore.github/workflows/README.md.github/workflows/container-build.ymlMakefileSTYLE_GUIDE.mdcontainers/Dockerfile.cudacontainers/README.mddocs/developer-guide/docker.mddocs/user-guide/docker.md
💤 Files with no reviewable changes (1)
- .dockerignore
📜 Review details
⏰ Context from checks skipped due to timeout of 90000ms. You can increase the timeout in your CodeRabbit configuration to a maximum of 15 minutes (900000ms). (3)
- GitHub Check: Unit Tests (3.11)
- GitHub Check: Unit Tests (3.13)
- GitHub Check: Unit Tests (3.12)
🧰 Additional context used
📓 Path-based instructions (11)
**/*.{md,markdown,py}
📄 CodeRabbit inference engine (.cursor/rules/agent-markdown-style.mdc)
**/*.{md,markdown,py}: Avoid decorative bold (**text**) in list items, body text, and docstrings; use structural cues (headers, list markers, colons, backticks) for emphasis instead
Use backticks for code identifiers, paths, and CLI commands in markdown and docstrings
Files:
STYLE_GUIDE.mddocs/user-guide/docker.mddocs/developer-guide/docker.mdcontainers/README.md
**/*.{md,markdown}
📄 CodeRabbit inference engine (.cursor/rules/agent-markdown-style.mdc)
**/*.{md,markdown}: Bold is acceptable only in markdown tables where it's the conventional way to mark header-like cells in the body
Use##headers to segment markdown sections instead of bold text
Use--(em-dash) instead of-(hyphen) for asides in markdown
Files:
STYLE_GUIDE.mddocs/user-guide/docker.mddocs/developer-guide/docker.mdcontainers/README.md
**/*.md
📄 CodeRabbit inference engine (CONTRIBUTING.md)
All Markdown files require SPDX copyright headers, automatically added by
make formatUse American English spelling: 'initialize' not 'initialise', 'recognize' not 'recognise', 'color' not 'colour'.
Avoid decorative
**bold**in body text, list items, or docstrings. Use headers, list markers, colons, and backticks for structure. Bold is acceptable in table header-like cells and MkDocs Material card grid titles.Use
--(em-dash) for asides, not-(hyphen).Use single backticks for code identifiers, paths, and CLI commands in markdown.
Ensure newline at end of file with no trailing whitespace.
Files:
STYLE_GUIDE.mddocs/user-guide/docker.mddocs/developer-guide/docker.mdcontainers/README.md
**/*
⚙️ CodeRabbit configuration file
**/*: Review as a senior maintainer for NeMo Safe Synthesizer. Prioritize issues that can change behavior, break user workflows, weaken privacy guarantees, hide failures, make tests unreliable, or create maintenance risk. Avoid generic style commentary unless it points to a concrete project convention that automated tools will not catch.
Comment only when the finding is actionable and tied to changed code. For each finding, state the impact, the condition that triggers it, and the smallest practical fix. Prefer one precise comment over broad advice. Do not ask for refactors outside the PR scope unless the changed code creates the problem.
Review type guidance: - Potential issue: use for correctness bugs, data loss, privacy leaks,
security risks, broken public APIs, invalid config behavior, missing
validation, hidden failures, nondeterministic tests, or CI breakage.
- Refactor suggestion: use for local maintainability problems introduced
by the diff when they have clear future cost, such as duplicated setup,
unclear boundaries, over-mocking, avoidable complexity, or opaque test
helpers.- Nitpick: avoid in chill mode. Do not emit formatting, import-order,
wording, or style-only comments unless automated tools cannot catch the
issue and it affects maintainability.Severity guidance: - Critical: security/privacy leaks, data loss, training/test/holdout
contamination, or broken release/package/core pipeline execution.
- Major: incorrect generation/training/evaluation behavior, broken
CLI/SDK public API, invalid config defaults or validators, or GPU/vLLM
cleanup and process-isolation bugs likely to fail CI or production
runs.- Minor: localized bugs, missing focused tests for changed behavior, or
bad test patterns that weaken regression coverage.- Trivial: small cleanup with no behavior impact. Usually suppress in
chill mode.- Info: context only. Avoid unless it helps reviewers understand risk.
Safe-Synthesizer-specific review focus: - Data ...
Files:
STYLE_GUIDE.mddocs/user-guide/docker.mddocs/developer-guide/docker.mdcontainers/README.mdMakefilecontainers/Dockerfile.cuda
.github/**
⚙️ CodeRabbit configuration file
Review GitHub configuration for branch protection expectations, CODEOWNERS alignment, least privilege permissions, pinned actions where practical, and consistency with CONTRIBUTING.md.
Files:
.github/workflows/README.md.github/workflows/container-build.yml
docs/**/*.md
📄 CodeRabbit inference engine (.cursor/rules/writing-docs.mdc)
docs/**/*.md: Classify documentation content using the Diataxis framework (TUTORIAL, HOW-TO, EXPLANATION, or REFERENCE) and ensure each page fits ONE type only
Use MkDocs Material admonition syntax (!!! note, !!! warning, ??? tip) for callouts and collapsible content
Use MkDocs Material tab syntax (=== "Tab Name") to present multiple variations or language-specific examples
Include code block metadata in MkDocs Material format: use title attribute for filenames and hl_lines for syntax highlighting of specific lines
Use Mermaid diagram syntax for flowcharts and visual representations in documentation
List prerequisites at the top of each documentation page before main content
End documentation pages with 'Next steps' section containing links to related content
docs/**/*.md: Documentation pages must follow Diataxis framework organization: getting-started/ for tutorials, user-guide/ for how-tos and reference, architecture/ for explanations, reference/ for API docs (auto-generated), dev-notes/ for release notes
Add new documentation pages to thenav:section ofmkdocs.ymlfor sidebar appearance
Use MkDocs Material Markdown extensions including admonitions (!!! note, !!! warning), content tabs (===), code blocks with syntax highlighting, mermaid diagrams, task lists, footnotes, and definition listsClassify documentation pages as tutorial, how-to, explanation, or reference per the Diataxis framework. Use MkDocs Material syntax: admonitions (
!!! note), tabs (===), code blocks with titles and highlights.Use Mermaid diagrams with no spaces in node IDs, quote labels with special characters, and no explicit colors or styles.
Files:
docs/user-guide/docker.mddocs/developer-guide/docker.md
docs/**
⚙️ CodeRabbit configuration file
Review documentation as MkDocs Material content. Check Diataxis fit, accurate commands, internal links, code fences, and markdown style from STYLE_GUIDE.md.
Files:
docs/user-guide/docker.mddocs/developer-guide/docker.md
.github/workflows/**/*.{yaml,yml}
📄 CodeRabbit inference engine (CONTRIBUTING.md)
CI/CD workflows must enforce required approvals (1), code owner review, signed commits, required status checks, linear history, and block force pushes and deletions on main branch
Files:
.github/workflows/container-build.yml
containers/**
⚙️ CodeRabbit configuration file
Review container changes against STYLE_GUIDE.md and containers/README.md. Check cache mounts, uv usage, non-root runtime behavior, CUDA settings, and copy order.
Files:
containers/README.mdcontainers/Dockerfile.cuda
Makefile
📄 CodeRabbit inference engine (CONTRIBUTING.md)
The Makefile is the single source of truth for how CI checks run; use
maketargets instead of running ruff, ty, or other tools directlyUse target help format
target-name: ## Descriptionto enablemake helpauto-generation in Makefiles.Use tab indentation (standard Makefile requirement) in Makefiles.
Place
.PHONYdeclaration directly above each target it applies to in Makefiles.Include a
### CONFIGURATION ###section in Makefiles for variable definitions.
Files:
Makefile
⚙️ CodeRabbit configuration file
Treat Makefile targets as the validation source of truth. Check that new targets are documented with target-name: ## Description, declared .PHONY where appropriate, and use uv/mise conventions.
Files:
Makefile
containers/Dockerfile*
📄 CodeRabbit inference engine (STYLE_GUIDE.md)
Use multi-stage builds for production images.
Copy
uvfromghcr.io/astral-sh/uv:<version>in Dockerfiles.Use
--mount=type=cachefor pip/uv caches and APT (/var/cache/apt,/var/lib/apt/lists) in Dockerfiles. Prefer cache mounts overrm -rf /var/lib/apt/lists/*.Set
ENV UV_LINK_MODE=copywhen using cache mounts in Dockerfiles (hardlinks into cache layers vanish after unmount).Use
--no-install-recommendson allapt-get installinvocations in Dockerfiles.Use a non-root user (
appuser) withNVIDIA_VISIBLE_DEVICES=allfor GPU access in production Dockerfiles.Use
tinior--initfor proper PID 1 signal handling in batch containers.Order
COPYdirectives in Dockerfiles for cache efficiency (deps before source code).Include comments in Dockerfiles explaining cache invalidation points.
Files:
containers/Dockerfile.cuda
🧠 Learnings (19)
📓 Common learnings
Learnt from: binaryaaron
Repo: NVIDIA-NeMo/Safe-Synthesizer PR: 481
File: containers/Dockerfile.cuda:100-106
Timestamp: 2026-06-01T18:47:21.036Z
Learning: In `containers/Dockerfile.cuda` (tools stage), `uv`/`uvx` are installed via `mise run setup` with the version pinned in `mise.lock`, and then copied to `/usr/local/bin/` via `cp "$(mise which uv)" /usr/local/bin/uv`. This is the intentional and reproducible approach — there is no need for a separate `FROM ghcr.io/astral-sh/uv:<version>` stage. The `PATH="/usr/local/bin:/mise/shims:${PATH}"` addition is required (not a noop) because `tools/install-mise.sh` installs the `mise` binary at `/usr/local/bin/mise`, so it must be on PATH before the shims are available for subsequent `mise trust` and `mise run setup` calls.
Learnt from: CR
Repo: NVIDIA-NeMo/Safe-Synthesizer PR: 0
File: CONTRIBUTING.md:0-0
Timestamp: 2026-05-20T22:25:01.000Z
Learning: GPU tests run on NVIDIA self-hosted A100 runners via `gpu-tests.yml` workflow with smoke tests and end-to-end tests; manual dispatch available with `gh workflow run` command
Learnt from: CR
Repo: NVIDIA-NeMo/Safe-Synthesizer
Timestamp: 2026-06-03T18:29:10.729Z
Learning: Be consistent with local code conventions. If the code around you follows a convention, follow it too -- even if the style guide says otherwise. Local consistency matters more than global rules.
Learnt from: CR
Repo: NVIDIA-NeMo/Safe-Synthesizer
Timestamp: 2026-06-03T18:29:10.729Z
Learning: When touching legacy code, migrate toward these conventions where practical rather than perpetuating old patterns.
Learnt from: CR
Repo: NVIDIA-NeMo/Safe-Synthesizer
Timestamp: 2026-06-03T18:29:10.729Z
Learning: Tools enforce what they can (ruff, ty, pre-commit). This guide covers what tools cannot enforce.
Learnt from: CR
Repo: NVIDIA-NeMo/Safe-Synthesizer
Timestamp: 2026-06-03T18:29:10.729Z
Learning: Some rules are aspirational -- legacy code is being migrated. New code must follow these conventions; existing deviations are tolerated during migration.
📚 Learning: 2026-05-14T17:03:10.291Z
Learnt from: CR
Repo: NVIDIA-NeMo/Safe-Synthesizer PR: 0
File: STYLE_GUIDE.md:0-0
Timestamp: 2026-05-14T17:03:10.291Z
Learning: Applies to containers/Dockerfile* : Use multi-stage builds for production images.
Applied to files:
STYLE_GUIDE.mddocs/user-guide/docker.mddocs/developer-guide/docker.mdcontainers/README.mdcontainers/Dockerfile.cuda
📚 Learning: 2026-06-01T18:47:21.036Z
Learnt from: binaryaaron
Repo: NVIDIA-NeMo/Safe-Synthesizer PR: 481
File: containers/Dockerfile.cuda:100-106
Timestamp: 2026-06-01T18:47:21.036Z
Learning: In `containers/Dockerfile.cuda` (tools stage), `uv`/`uvx` are installed via `mise run setup` with the version pinned in `mise.lock`, and then copied to `/usr/local/bin/` via `cp "$(mise which uv)" /usr/local/bin/uv`. This is the intentional and reproducible approach — there is no need for a separate `FROM ghcr.io/astral-sh/uv:<version>` stage. The `PATH="/usr/local/bin:/mise/shims:${PATH}"` addition is required (not a noop) because `tools/install-mise.sh` installs the `mise` binary at `/usr/local/bin/mise`, so it must be on PATH before the shims are available for subsequent `mise trust` and `mise run setup` calls.
Applied to files:
STYLE_GUIDE.mddocs/user-guide/docker.mddocs/developer-guide/docker.mdcontainers/README.mdMakefilecontainers/Dockerfile.cuda
📚 Learning: 2026-05-14T17:03:10.291Z
Learnt from: CR
Repo: NVIDIA-NeMo/Safe-Synthesizer PR: 0
File: STYLE_GUIDE.md:0-0
Timestamp: 2026-05-14T17:03:10.291Z
Learning: Applies to containers/Dockerfile* : Create a non-root user (`appuser`) with `NVIDIA_VISIBLE_DEVICES=all` for GPU access.
Applied to files:
STYLE_GUIDE.mddocs/user-guide/docker.mddocs/developer-guide/docker.mdcontainers/README.mdMakefilecontainers/Dockerfile.cuda
📚 Learning: 2026-05-14T21:47:20.140Z
Learnt from: CR
Repo: NVIDIA-NeMo/Safe-Synthesizer PR: 0
File: tests/TESTING.md:0-0
Timestamp: 2026-05-14T21:47:20.140Z
Learning: Applies to tests/**/tests/e2e/**/test_*.py : For e2e tests requiring GPU, use staged Make targets (`test-e2e-default` and `test-e2e-dp`) with single-process execution (`-n 0`).
Applied to files:
STYLE_GUIDE.mddocs/developer-guide/docker.mdcontainers/README.mdMakefile
📚 Learning: 2026-05-14T17:03:10.291Z
Learnt from: CR
Repo: NVIDIA-NeMo/Safe-Synthesizer PR: 0
File: STYLE_GUIDE.md:0-0
Timestamp: 2026-05-14T17:03:10.291Z
Learning: Applies to containers/Dockerfile* : Include comments explaining cache invalidation points.
Applied to files:
STYLE_GUIDE.mdcontainers/README.mdcontainers/Dockerfile.cuda
📚 Learning: 2026-05-20T22:25:01.000Z
Learnt from: CR
Repo: NVIDIA-NeMo/Safe-Synthesizer PR: 0
File: CONTRIBUTING.md:0-0
Timestamp: 2026-05-20T22:25:01.000Z
Learning: GPU tests run on NVIDIA self-hosted A100 runners via `gpu-tests.yml` workflow with smoke tests and end-to-end tests; manual dispatch available with `gh workflow run` command
Applied to files:
.github/workflows/README.mddocs/user-guide/docker.md.github/workflows/container-build.ymldocs/developer-guide/docker.mdcontainers/README.mdMakefilecontainers/Dockerfile.cuda
📚 Learning: 2026-05-20T22:25:01.000Z
Learnt from: CR
Repo: NVIDIA-NeMo/Safe-Synthesizer PR: 0
File: CONTRIBUTING.md:0-0
Timestamp: 2026-05-20T22:25:01.000Z
Learning: Applies to **/*.py : Run `make check` to verify all CI checks including format-check, lint, typecheck, and copyright headers before submitting PRs
Applied to files:
.github/workflows/README.md
📚 Learning: 2026-05-20T22:25:01.000Z
Learnt from: CR
Repo: NVIDIA-NeMo/Safe-Synthesizer PR: 0
File: CONTRIBUTING.md:0-0
Timestamp: 2026-05-20T22:25:01.000Z
Learning: Applies to .github/workflows/**/*.{yaml,yml} : CI/CD workflows must enforce required approvals (1), code owner review, signed commits, required status checks, linear history, and block force pushes and deletions on main branch
Applied to files:
.github/workflows/README.md
📚 Learning: 2026-05-20T22:25:01.000Z
Learnt from: CR
Repo: NVIDIA-NeMo/Safe-Synthesizer PR: 0
File: CONTRIBUTING.md:0-0
Timestamp: 2026-05-20T22:25:01.000Z
Learning: Applies to **/*.py : All commits merged to main must follow Conventional Commits specification with format `<type>(<scope>): <description>` where type is one of: feat, fix, docs, style, refactor, perf, test, build, ci, chore, revert
Applied to files:
.github/workflows/README.md
📚 Learning: 2026-05-14T21:46:37.073Z
Learnt from: CR
Repo: NVIDIA-NeMo/Safe-Synthesizer PR: 0
File: AGENTS.md:0-0
Timestamp: 2026-05-14T21:46:37.073Z
Learning: The canonical `uv sync` command for a full GPU/dev environment is: `uv sync --frozen --extra cu129 --extra engine --group dev`
Applied to files:
docs/user-guide/docker.mddocs/developer-guide/docker.mdcontainers/README.mdMakefilecontainers/Dockerfile.cuda
📚 Learning: 2026-05-14T17:03:10.291Z
Learnt from: CR
Repo: NVIDIA-NeMo/Safe-Synthesizer PR: 0
File: STYLE_GUIDE.md:0-0
Timestamp: 2026-05-14T17:03:10.291Z
Learning: Applies to containers/Dockerfile* : Copy uv from `ghcr.io/astral-sh/uv:<version>`.
Applied to files:
docs/developer-guide/docker.mdcontainers/README.mdcontainers/Dockerfile.cuda
📚 Learning: 2026-05-14T17:03:10.291Z
Learnt from: CR
Repo: NVIDIA-NeMo/Safe-Synthesizer PR: 0
File: STYLE_GUIDE.md:0-0
Timestamp: 2026-05-14T17:03:10.291Z
Learning: Applies to containers/Dockerfile* : Set `ENV UV_LINK_MODE=copy` when using cache mounts (hardlinks into cache layers vanish after unmount).
Applied to files:
docs/developer-guide/docker.mdcontainers/Dockerfile.cuda
📚 Learning: 2026-05-14T17:03:10.291Z
Learnt from: CR
Repo: NVIDIA-NeMo/Safe-Synthesizer PR: 0
File: STYLE_GUIDE.md:0-0
Timestamp: 2026-05-14T17:03:10.291Z
Learning: Applies to containers/Dockerfile* : Use `--mount=type=cache` for pip/uv caches and APT (`/var/cache/apt`, `/var/lib/apt/lists`). Prefer cache mounts over `rm -rf /var/lib/apt/lists/*`.
Applied to files:
docs/developer-guide/docker.md
📚 Learning: 2026-05-14T21:46:37.073Z
Learnt from: CR
Repo: NVIDIA-NeMo/Safe-Synthesizer PR: 0
File: AGENTS.md:0-0
Timestamp: 2026-05-14T21:46:37.073Z
Learning: Use `uv` for everything -- never `pip` or raw `python`
Applied to files:
docs/developer-guide/docker.md
📚 Learning: 2026-05-20T22:25:01.000Z
Learnt from: CR
Repo: NVIDIA-NeMo/Safe-Synthesizer PR: 0
File: CONTRIBUTING.md:0-0
Timestamp: 2026-05-20T22:25:01.000Z
Learning: Applies to .mise.toml : Tool versions including uv, ruff, ty, gh, and mise itself are pinned in `.mise.toml` and locked in `mise.lock` for reproducible developer toolchains across systems
Applied to files:
docs/developer-guide/docker.md
📚 Learning: 2026-05-20T22:25:01.000Z
Learnt from: CR
Repo: NVIDIA-NeMo/Safe-Synthesizer PR: 0
File: CONTRIBUTING.md:0-0
Timestamp: 2026-05-20T22:25:01.000Z
Learning: Install development tools via `mise` using `make setup` and bootstrap Python dependencies using appropriate `make bootstrap-nss` target (cpu, cuda, engine, or dev)
Applied to files:
containers/README.md
📚 Learning: 2026-05-20T22:25:01.000Z
Learnt from: CR
Repo: NVIDIA-NeMo/Safe-Synthesizer PR: 0
File: CONTRIBUTING.md:0-0
Timestamp: 2026-05-20T22:25:01.000Z
Learning: Applies to Makefile : The Makefile is the single source of truth for how CI checks run; use `make` targets instead of running ruff, ty, or other tools directly
Applied to files:
containers/README.md
📚 Learning: 2026-05-14T21:46:37.073Z
Learnt from: CR
Repo: NVIDIA-NeMo/Safe-Synthesizer PR: 0
File: AGENTS.md:0-0
Timestamp: 2026-05-14T21:46:37.073Z
Learning: Always use Make targets or wrapper scripts in `tools/` instead of running `ruff` or `ty` directly
Applied to files:
containers/README.md
🪛 LanguageTool
docs/developer-guide/docker.md
[uncategorized] ~62-~62: The official name of this software platform is spelled with a capital “H”.
Context: ...erate uv.lock. 3. Add a matrix row to .github/workflows/container-build.yml. 4. Buil...
(GITHUB)
🪛 Trivy (0.69.3)
containers/Dockerfile.cuda
[error] 143-143: Image user should not be 'root'
Last USER command in Dockerfile should not be 'root'
Rule: DS-0002
(IaC/Dockerfile)
🔇 Additional comments (12)
STYLE_GUIDE.md (1)
766-766: LGTM!containers/Dockerfile.cuda (4)
27-34: LGTM!
36-83: LGTM!
85-133: LGTM!
145-181: LGTM!Makefile (3)
341-348: LGTM!
380-396: LGTM!
398-439: LGTM!.github/workflows/container-build.yml (2)
95-110: LGTM!
1-13: ⚡ Quick winConfirm CI won’t require the SPDX one-liner for
.github/workflows/container-build.yml
make format-checkrunstools/codestyle/copyright_fixer.py --check ., but.copyrightignoreexcludes the entire.github/directory, so this workflow file is not checked for SPDX header formatting. Additionally, the checker only looks for copyright markers (e.g.,Copyright (c)) rather than enforcing an exact SPDX line format..github/workflows/README.md (2)
16-16: LGTM!
91-94: LGTM!Also applies to: 108-108
| tags: | | ||
| type=raw,value=${{ matrix.variant }},enable=${{ startsWith(github.ref, 'refs/tags/v') }} | ||
| type=raw,value=latest-${{ matrix.variant }},enable=${{ startsWith(github.ref, 'refs/tags/v') }} | ||
| type=sha,prefix=sha-,suffix=-${{ matrix.variant }} | ||
| type=semver,pattern={{version}}-${{ matrix.variant }} | ||
| type=semver,pattern={{major}}.{{minor}}-${{ matrix.variant }} | ||
| labels: | | ||
| org.opencontainers.image.version=${{ steps.package-version.outputs.version }} | ||
| com.nvidia.nemo.safe-synthesizer.extra=${{ matrix.extra }} | ||
| com.nvidia.nemo.safe-synthesizer.variant=${{ matrix.variant }} |
There was a problem hiding this comment.
🧩 Analysis chain
🌐 Web query:
docker/metadata-action prerelease handling type=raw vs type=semver floating tags
💡 Result:
In the docker/metadata-action, the choice between type=raw and type=semver significantly impacts how pre-release versions are handled, particularly regarding tag floating, prefix stripping, and automatic 'latest' tag generation [1][2]. Type=semver The semver type is designed for automated versioning based on SemVer-compliant Git tags [1]. It includes opinionated, built-in logic for pre-release handling [1]. - Pre-release behavior: When a pre-release (e.g., v1.2.3-alpha) is detected, the action intentionally limits tag generation [1][3]. It will typically only produce the full version string ({{version}} or {{raw}}) and avoids creating broader, mutable 'floating' tags like the major (e.g., v1) or minor (e.g., v1.2) identifiers [1][2]. This is by design to prevent unstable pre-release code from overriding stable production tags [1]. - Prefix handling: By default, type=semver strips the 'v' prefix from tags [4][2]. To preserve the 'v', you should use the prefix attribute (e.g., type=semver,pattern={{version}},prefix=v) rather than hardcoding it into the pattern [4][2]. - Latest tag: For pre-releases, the implicit 'latest' tag generation (if flavor.latest=auto is used) is automatically disabled [5]. Type=raw The raw type provides a way to output custom, explicit tag values [1]. - Pre-release behavior: It does not inherently understand SemVer or distinguish between releases and pre-releases [1]. It simply outputs exactly what is provided in the value attribute [1]. - Floating tags: If you use type=raw to manually create 'floating' tags (e.g., naming your image 'my-app:1'), the action will create these tags regardless of whether the source tag is a pre-release [6]. You must implement your own conditional logic using the enable attribute if you wish to prevent pre-release versions from overriding these tags [3][6]. - Usage: This type is best suited for scenarios where you need full control over the tag naming convention and do not want the action's opinionated semver logic applied [1]. Summary Table Feature | type=semver | type=raw --- | --- | --- Automatic Pre-release Logic | Yes (Limits output to prevent overriding) [1] | No (Literal output) [1] Prefix Handling | Automatically strips 'v' (configurable) [4][2] | None (Literal) [1] Implicit 'latest' Tag | Automatically disabled for pre-releases [5] | Not influenced (can lead to conflicts) [5] Control | Opinionated/Automated [1] | Manual/Explicit [1] To maintain safety during pre-release cycles, prefer type=semver to benefit from the built-in safeguards that prevent unstable builds from inadvertently updating 'latest' or major/minor floating tags [1][5]. Use type=raw only when you have specific, non-standard naming requirements and are prepared to manually manage the conditional logic for when those tags should be applied [6].
Citations:
- 1: https://github.com/docker/metadata-action?tab=readme-ov-file
- 2: Strip the prefix
vfrom tags created on release event docker/metadata-action#422 - 3: Is it possible to check if a tag is a pre-release? docker/metadata-action#276
- 4: docs: Add advice for pre-release image tag (
vprefix support) docker/metadata-action#590 - 5: Better document
latesttag (flavor.latest=autodefault vstype=raw,value=latest) docker/metadata-action#593 - 6: `push tag` event to write semver tags isn't triggered because tags are pushed using `GITHUB_TOKEN` docker/metadata-action#503
Prevent RC tags from overwriting the floating cu129 / latest-cu129 tags
In .github/workflows/container-build.yml (lines 84-93), the type=raw tags for value=${{ matrix.variant }} and value=latest-${{ matrix.variant }} are enabled for any refs/tags/v*. Since type=raw doesn’t have prerelease awareness, RC tags (per the repo’s vX.Y.ZrcN scheme) will also generate/overwrite the floating “stable” tags for that variant.
Gate these type=raw entries to exclude prereleases (e.g., tags containing rc):
🔧 Possible approach (exclude RC prereleases from the raw floating tags)
- type=raw,value=${{ matrix.variant }},enable=${{ startsWith(github.ref, 'refs/tags/v') }}
- type=raw,value=latest-${{ matrix.variant }},enable=${{ startsWith(github.ref, 'refs/tags/v') }}
+ type=raw,value=${{ matrix.variant }},enable=${{ startsWith(github.ref, 'refs/tags/v') && !contains(github.ref_name, 'rc') }}
+ type=raw,value=latest-${{ matrix.variant }},enable=${{ startsWith(github.ref, 'refs/tags/v') && !contains(github.ref_name, 'rc') }}| manual --> ci & gpu | ||
| pr --> ci & conventional & secrets | ||
| tag[Tag push v[0-9]*] --> release | ||
| tag[Tag push v[0-9]*] --> release & containers |
There was a problem hiding this comment.
Quote the Mermaid node label -- nested brackets will break the diagram.
tag[Tag push v[0-9]*] contains [ and ] inside the node text. Mermaid terminates the label at the first ], leaving *] to cause a parse/render error. Wrap the label in quotes.
📝 Proposed fix
- tag[Tag push v[0-9]*] --> release & containers
+ tag["Tag push v[0-9]*"] --> release & containersAs per coding guidelines: "Use Mermaid diagrams with no spaces in node IDs, quote labels with special characters".
| | Variant | Extra | Status | | ||
| |---------|-------|--------| | ||
| | `cu129` | `cu129` | Built today | | ||
| | `cu130` | `cu130` | Add after the CUDA 13.0 dependency extra lands | |
There was a problem hiding this comment.
Replace time-relative variant status with a stable state label.
Built today will become stale and ambiguous quickly in reference docs. Use a stable status like Enabled or Supported to avoid misleading users about current variant support.
As per coding guidelines, containers/README.md should stay synchronized with container build inputs/outputs, so status wording should remain durable.
coderabbitai
Bot
added
docs
Greptile SummaryThis PR replaces the
Confidence Score: 5/5Safe to merge; the architectural change is well-structured and the issues found are minor correctness nits with no runtime impact. The Dockerfile refactor correctly moves CUDA delivery into Python extras, the layered sync strategy is sound, and the workflow security posture (pinned SHAs, least-privilege token, no uncontrolled inputs) is solid. The two findings — a duplicate /opt/venv/bin PATH entry and missing registry cache for manual builds — have no impact on correctness or security. containers/Dockerfile.cuda (duplicate PATH ENV) and .github/workflows/container-build.yml (cold-start manual builds) Important Files Changed
|
![greptile-apps[bot]](https://avatars.githubusercontent.com/in/867647?s=60&v=4){kind=small}
| persist-credentials: false | ||
| fetch-depth: 0 |
There was a problem hiding this comment.
fetch-depth: 0 fetches the full repository history, but nothing in this workflow consumes it. The version is resolved purely from GITHUB_REF/GITHUB_REF_NAME/GITHUB_SHA (no git describe or similar), and the Docker build context excludes .git/ via .dockerignore. On large repos this meaningfully slows the checkout step.
| persist-credentials: false | |
| fetch-depth: 0 | |
| persist-credentials: false | |
| fetch-depth: 1 |
Note: If this suggestion doesn't match your team's coding style, reply to this and let me know. I'll remember it for next time!
kendrickb-nvidia
left a comment
kendrickb-nvidia
left a comment
There was a problem hiding this comment.
Looks reasonable to me, but will defer to Aaron and how this interacts with the cuda 13 PR and mise PR on ordering.
coderabbitai
Bot
added
feature
15ae98e to
0742a4e
Compare
coderabbitai
Bot
added
feature
There was a problem hiding this comment.
Caution
Some comments are outside the diff and can’t be posted inline due to platform limitations.
⚠️ Outside diff range comments (1)
containers/Dockerfile.cuda (1)
195-233:⚠️ Potential issue | 🟠 Major | ⚡ Quick winDev image runs as root by default.
Line 195 switches to
root, and thedevstage never switches back. Impact: commands run against bind mounts can create root-owned files on the host and reduce container isolation. Trigger: building/running--target dev. Smallest fix: switch back toappuserbefore finalWORKDIR/CMD.Suggested fix
RUN git config --global --add safe.directory /workspace +USER appuser WORKDIR /workspace ENTRYPOINT [] CMD ["/bin/bash"]As per coding guidelines:
containers/Dockerfile*: Use non-root user (appuser) withNVIDIA_VISIBLE_DEVICES=allfor GPU access.
ℹ️ Review info
⚙️ Run configuration
Configuration used: Path: .coderabbit.yaml
Review profile: CHILL
Plan: Enterprise
Run ID: 9d296b2e-16c0-495b-aaae-d0edd6fd36cc
📒 Files selected for processing (10)
.dockerignore.github/workflows/README.md.github/workflows/container-build.yml.mise/tasks/container/build/gpu.mise/tasks/container/build/gpu-dev.mise/tasks/container/build/gpu-multiarchcontainers/Dockerfile.cudacontainers/README.mddocs/developer-guide/docker.mddocs/user-guide/docker.md
💤 Files with no reviewable changes (1)
- .dockerignore
✅ Files skipped from review due to trivial changes (2)
- docs/user-guide/docker.md
- containers/README.md
🚧 Files skipped from review as they are similar to previous changes (1)
- .github/workflows/container-build.yml
📜 Review details
🧰 Additional context used
📓 Path-based instructions (10)
.github/**
⚙️ CodeRabbit configuration file
Review GitHub configuration for branch protection expectations, CODEOWNERS alignment, least privilege permissions, pinned actions where practical, and consistency with CONTRIBUTING.md.
Files:
.github/workflows/README.md
containers/Dockerfile*
📄 CodeRabbit inference engine (STYLE_GUIDE.md)
containers/Dockerfile*: Use multi-stage builds for production images.
Copy uv fromghcr.io/astral-sh/uv:<version>.
Use--mount=type=cachefor pip/uv caches and APT (/var/cache/apt,/var/lib/apt/lists). Prefer cache mounts overrm -rf /var/lib/apt/lists/*.
SetENV UV_LINK_MODE=copywhen using cache mounts (hardlinks into cache layers vanish after unmount).
Use--no-install-recommendson allapt-get installinvocations.
Use non-root user (appuser) withNVIDIA_VISIBLE_DEVICES=allfor GPU access.
Usetinior--initfor proper PID 1 signal handling in batch containers.
OrderCOPYdirectives for cache efficiency (deps before source).
Include comments explaining cache invalidation points.
Files:
containers/Dockerfile.cuda
**/*
📄 CodeRabbit inference engine (STYLE_GUIDE.md)
Include a newline at end of file, with no trailing whitespace.
Files:
containers/Dockerfile.cudadocs/developer-guide/docker.md
⚙️ CodeRabbit configuration file
**/*: Review as a senior maintainer for NeMo Safe Synthesizer. Prioritize issues that can change behavior, break user workflows, weaken privacy guarantees, hide failures, make tests unreliable, or create maintenance risk. Avoid generic style commentary unless it points to a concrete project convention that automated tools will not catch.
Comment only when the finding is actionable and tied to changed code. For each finding, state the impact, the condition that triggers it, and the smallest practical fix. Prefer one precise comment over broad advice. Do not ask for refactors outside the PR scope unless the changed code creates the problem.
Review type guidance: - Potential issue: use for correctness bugs, data loss, privacy leaks,
security risks, broken public APIs, invalid config behavior, missing
validation, hidden failures, nondeterministic tests, or CI breakage.
- Refactor suggestion: use for local maintainability problems introduced
by the diff when they have clear future cost, such as duplicated setup,
unclear boundaries, over-mocking, avoidable complexity, or opaque test
helpers.- Nitpick: avoid in chill mode. Do not emit formatting, import-order,
wording, or style-only comments unless automated tools cannot catch the
issue and it affects maintainability.Severity guidance: - Critical: security/privacy leaks, data loss, training/test/holdout
contamination, or broken release/package/core pipeline execution.
- Major: incorrect generation/training/evaluation behavior, broken
CLI/SDK public API, invalid config defaults or validators, or GPU/vLLM
cleanup and process-isolation bugs likely to fail CI or production
runs.- Minor: localized bugs, missing focused tests for changed behavior, or
bad test patterns that weaken regression coverage.- Trivial: small cleanup with no behavior impact. Usually suppress in
chill mode.- Info: context only. Avoid unless it helps reviewers understand risk.
Safe-Synthesizer-specific review focus: - Data ...
Files:
containers/Dockerfile.cudadocs/developer-guide/docker.md
containers/**
⚙️ CodeRabbit configuration file
Review container changes against STYLE_GUIDE.md and containers/README.md. Check cache mounts, uv usage, non-root runtime behavior, CUDA settings, and copy order.
Files:
containers/Dockerfile.cuda
**/*.{md,markdown,py}
📄 CodeRabbit inference engine (.cursor/rules/agent-markdown-style.mdc)
**/*.{md,markdown,py}: Avoid decorative bold (**text**) in list items, body text, and docstrings; use structural cues (headers, list markers, colons, backticks) for emphasis instead
Use backticks for code identifiers, paths, and CLI commands in markdown and docstrings
Files:
docs/developer-guide/docker.md
**/*.{md,markdown}
📄 CodeRabbit inference engine (.cursor/rules/agent-markdown-style.mdc)
**/*.{md,markdown}: Bold is acceptable only in markdown tables where it's the conventional way to mark header-like cells in the body
Use##headers to segment markdown sections instead of bold text
Use--(em-dash) instead of-(hyphen) for asides in markdown
Files:
docs/developer-guide/docker.md
**/*.md
📄 CodeRabbit inference engine (STYLE_GUIDE.md)
**/*.md: Use American English spelling: 'initialize' not 'initialise', 'recognize' not 'recognise', 'color' not 'colour'.
No decorative**bold**in body text, list items, or docstrings. Use headers, list markers, colons, and backticks for structure. Bold is acceptable in table headers and MkDocs Material card grid titles.
Use--(em-dash) for asides, not-(hyphen).
Use single backticks for code identifiers, paths, and CLI commands in Markdown.
UseMermaiddiagrams with no spaces in node IDs, quote labels with special characters, and no explicit colors or styles.
Include SPDX copyright headers with HTML comments (<!-- SPDX-... -->) for markdown files without YAML frontmatter.
For Markdown files that start with YAML frontmatter (---), use hash-comment headers inside the frontmatter block instead of HTML comments.
Use single space between sentences, never two.
Files:
docs/developer-guide/docker.md
docs/**/*.md
📄 CodeRabbit inference engine (STYLE_GUIDE.md)
Classify documentation pages as tutorial, how-to, explanation, or reference per the Diataxis framework. Use MkDocs Material syntax: admonitions (
!!! note), tabs (===), code blocks with titles and highlights.Use MkDocs Material Markdown extensions for documentation: admonitions, content tabs, code blocks, Mermaid diagrams, task lists, footnotes, definition lists
docs/**/*.md: Use MkDocs Material admonition syntax (!!! note, !!! warning, ??? tip) for highlighting important information and collapsible sections in documentation
Use MkDocs Material tabs syntax (=== "Label") to present alternative views or language-specific examples in documentation
Use code block syntax with title and highlight line parameters (title="filename", hl_lines="2 3") for code examples in documentation
Use Mermaid diagram syntax (```mermaid flowchart, etc.) for visualizations in documentation
Files:
docs/developer-guide/docker.md
**/*.{py,sh,yaml,yml,md}
📄 CodeRabbit inference engine (CONTRIBUTING.md)
All source files (.py, .sh, .yaml, .yml, .md) must include SPDX copyright headers
Files:
docs/developer-guide/docker.md
docs/**
⚙️ CodeRabbit configuration file
Review documentation as MkDocs Material content. Check Diataxis fit, accurate commands, internal links, code fences, and markdown style from STYLE_GUIDE.md.
Files:
docs/developer-guide/docker.md
🧠 Learnings (16)
📓 Common learnings
Learnt from: binaryaaron
Repo: NVIDIA-NeMo/Safe-Synthesizer PR: 481
File: containers/Dockerfile.cuda:100-106
Timestamp: 2026-06-01T18:47:21.036Z
Learning: In `containers/Dockerfile.cuda` (tools stage), `uv`/`uvx` are installed via `mise run setup` with the version pinned in `mise.lock`, and then copied to `/usr/local/bin/` via `cp "$(mise which uv)" /usr/local/bin/uv`. This is the intentional and reproducible approach — there is no need for a separate `FROM ghcr.io/astral-sh/uv:<version>` stage. The `PATH="/usr/local/bin:/mise/shims:${PATH}"` addition is required (not a noop) because `tools/install-mise.sh` installs the `mise` binary at `/usr/local/bin/mise`, so it must be on PATH before the shims are available for subsequent `mise trust` and `mise run setup` calls.
Learnt from: CR
Repo: NVIDIA-NeMo/Safe-Synthesizer PR: 0
File: STYLE_GUIDE.md:0-0
Timestamp: 2026-06-03T23:08:14.151Z
Learning: Applies to containers/Dockerfile* : Use multi-stage builds for production images.
Learnt from: CR
Repo: NVIDIA-NeMo/Safe-Synthesizer PR: 0
File: STYLE_GUIDE.md:0-0
Timestamp: 2026-06-03T23:08:14.151Z
Learning: Applies to containers/Dockerfile* : Use non-root user (`appuser`) with `NVIDIA_VISIBLE_DEVICES=all` for GPU access.
📚 Learning: 2026-06-03T23:08:14.151Z
Learnt from: CR
Repo: NVIDIA-NeMo/Safe-Synthesizer PR: 0
File: STYLE_GUIDE.md:0-0
Timestamp: 2026-06-03T23:08:14.151Z
Learning: Applies to containers/Dockerfile* : Use non-root user (`appuser`) with `NVIDIA_VISIBLE_DEVICES=all` for GPU access.
Applied to files:
.mise/tasks/container/build/gpu.mise/tasks/container/build/gpu-dev.mise/tasks/container/build/gpu-multiarchcontainers/Dockerfile.cudadocs/developer-guide/docker.md
📚 Learning: 2026-06-01T18:47:21.036Z
Learnt from: binaryaaron
Repo: NVIDIA-NeMo/Safe-Synthesizer PR: 481
File: containers/Dockerfile.cuda:100-106
Timestamp: 2026-06-01T18:47:21.036Z
Learning: In `containers/Dockerfile.cuda` (tools stage), `uv`/`uvx` are installed via `mise run setup` with the version pinned in `mise.lock`, and then copied to `/usr/local/bin/` via `cp "$(mise which uv)" /usr/local/bin/uv`. This is the intentional and reproducible approach — there is no need for a separate `FROM ghcr.io/astral-sh/uv:<version>` stage. The `PATH="/usr/local/bin:/mise/shims:${PATH}"` addition is required (not a noop) because `tools/install-mise.sh` installs the `mise` binary at `/usr/local/bin/mise`, so it must be on PATH before the shims are available for subsequent `mise trust` and `mise run setup` calls.
Applied to files:
.mise/tasks/container/build/gpu.mise/tasks/container/build/gpu-dev.mise/tasks/container/build/gpu-multiarch.github/workflows/README.mdcontainers/Dockerfile.cudadocs/developer-guide/docker.md
📚 Learning: 2026-06-03T23:06:56.798Z
Learnt from: CR
Repo: NVIDIA-NeMo/Safe-Synthesizer PR: 0
File: AGENTS.md:0-0
Timestamp: 2026-06-03T23:06:56.798Z
Learning: Use `uv sync --frozen --extra cu129 --extra engine --group dev` for a full GPU/dev environment setup
Applied to files:
.mise/tasks/container/build/gpu-devcontainers/Dockerfile.cudadocs/developer-guide/docker.md
📚 Learning: 2026-06-03T23:08:14.151Z
Learnt from: CR
Repo: NVIDIA-NeMo/Safe-Synthesizer PR: 0
File: STYLE_GUIDE.md:0-0
Timestamp: 2026-06-03T23:08:14.151Z
Learning: Applies to **/*.md : Use `Mermaid` diagrams with no spaces in node IDs, quote labels with special characters, and no explicit colors or styles.
Applied to files:
.github/workflows/README.md
📚 Learning: 2026-06-03T23:09:13.516Z
Learnt from: CR
Repo: NVIDIA-NeMo/Safe-Synthesizer PR: 0
File: .cursor/rules/writing-docs.mdc:0-0
Timestamp: 2026-06-03T23:09:13.516Z
Learning: Applies to docs/**/*.md : Use Mermaid diagram syntax (```mermaid flowchart, etc.) for visualizations in documentation
Applied to files:
.github/workflows/README.md
📚 Learning: 2026-06-03T23:08:14.151Z
Learnt from: CR
Repo: NVIDIA-NeMo/Safe-Synthesizer PR: 0
File: STYLE_GUIDE.md:0-0
Timestamp: 2026-06-03T23:08:14.151Z
Learning: Applies to containers/Dockerfile* : Use multi-stage builds for production images.
Applied to files:
.github/workflows/README.mdcontainers/Dockerfile.cudadocs/developer-guide/docker.md
📚 Learning: 2026-06-03T23:08:50.142Z
Learnt from: CR
Repo: NVIDIA-NeMo/Safe-Synthesizer PR: 0
File: tests/TESTING.md:0-0
Timestamp: 2026-06-03T23:08:50.142Z
Learning: Run tests using `mise run test` for unit tests (excludes slow, e2e, and smoke), `mise run test:unit-slow` for slow unit tests, `mise run test:smoke` for CPU smoke tests, `mise run test:smoke:gpu` for GPU smoke tests, `mise run test:e2e` for end-to-end tests, or `mise run test:ci` for CI unit tests with coverage
Applied to files:
.github/workflows/README.mddocs/developer-guide/docker.md
📚 Learning: 2026-06-03T23:08:32.341Z
Learnt from: CR
Repo: NVIDIA-NeMo/Safe-Synthesizer PR: 0
File: CONTRIBUTING.md:0-0
Timestamp: 2026-06-03T23:08:32.341Z
Learning: Applies to **/*.py : Use ruff for linting and formatting checks; run via mise run check for read-only local quality checks
Applied to files:
.github/workflows/README.md
📚 Learning: 2026-06-03T23:08:32.341Z
Learnt from: CR
Repo: NVIDIA-NeMo/Safe-Synthesizer PR: 0
File: CONTRIBUTING.md:0-0
Timestamp: 2026-06-03T23:08:32.341Z
Learning: Use mise tasks (mise run <task>) instead of running ruff, ty, or pytest directly to ensure pinned tool versions from .mise.toml are used
Applied to files:
.github/workflows/README.md
📚 Learning: 2026-06-03T23:06:56.798Z
Learnt from: CR
Repo: NVIDIA-NeMo/Safe-Synthesizer PR: 0
File: AGENTS.md:0-0
Timestamp: 2026-06-03T23:06:56.798Z
Learning: Use mise tasks or wrapper scripts in `tools/` instead of running `ruff` or `ty` directly
Applied to files:
.github/workflows/README.md
📚 Learning: 2026-06-03T23:08:32.341Z
Learnt from: CR
Repo: NVIDIA-NeMo/Safe-Synthesizer PR: 0
File: CONTRIBUTING.md:0-0
Timestamp: 2026-06-03T23:08:32.341Z
Learning: Applies to **/*.py : Use ty (Pyright) for type checking; run via mise run check
Applied to files:
.github/workflows/README.md
📚 Learning: 2026-06-03T23:08:32.341Z
Learnt from: CR
Repo: NVIDIA-NeMo/Safe-Synthesizer PR: 0
File: CONTRIBUTING.md:0-0
Timestamp: 2026-06-03T23:08:32.341Z
Learning: Applies to tests/**/*.py : Run mise run test to execute unit tests (excludes slow unit tests, smoke and e2e)
Applied to files:
.github/workflows/README.md
📚 Learning: 2026-06-03T23:08:14.151Z
Learnt from: CR
Repo: NVIDIA-NeMo/Safe-Synthesizer PR: 0
File: STYLE_GUIDE.md:0-0
Timestamp: 2026-06-03T23:08:14.151Z
Learning: Applies to containers/Dockerfile* : Copy uv from `ghcr.io/astral-sh/uv:<version>`.
Applied to files:
containers/Dockerfile.cudadocs/developer-guide/docker.md
📚 Learning: 2026-06-03T23:08:14.151Z
Learnt from: CR
Repo: NVIDIA-NeMo/Safe-Synthesizer PR: 0
File: STYLE_GUIDE.md:0-0
Timestamp: 2026-06-03T23:08:14.151Z
Learning: Applies to containers/Dockerfile* : Include comments explaining cache invalidation points.
Applied to files:
containers/Dockerfile.cuda
📚 Learning: 2026-06-03T23:08:14.151Z
Learnt from: CR
Repo: NVIDIA-NeMo/Safe-Synthesizer PR: 0
File: STYLE_GUIDE.md:0-0
Timestamp: 2026-06-03T23:08:14.151Z
Learning: Applies to containers/Dockerfile* : Set `ENV UV_LINK_MODE=copy` when using cache mounts (hardlinks into cache layers vanish after unmount).
Applied to files:
containers/Dockerfile.cuda
🪛 LanguageTool
.github/workflows/README.md
[uncategorized] ~154-~154: The official name of this software platform is spelled with a capital “H”.
Context: ... workflow/action changes. GPU jobs use .github/actions/setup-gpu-test-env for shared ...
(GITHUB)
docs/developer-guide/docker.md
[uncategorized] ~65-~65: The official name of this software platform is spelled with a capital “H”.
Context: ...erate uv.lock. 3. Add a matrix row to .github/workflows/container-build.yml. 4. Buil...
(GITHUB)
[style] ~132-~132: Three successive sentences begin with the same word. Consider rewording the sentence or use a thesaurus to find a synonym.
Context: ...-no-install-package ... --no-group dev` installs the CUDA dependency closure while omitt...
(ENGLISH_WORD_REPEAT_BEGINNING_RULE)
🪛 Trivy (0.69.3)
containers/Dockerfile.cuda
[error] 195-195: Image user should not be 'root'
Last USER command in Dockerfile should not be 'root'
Rule: DS-0002
(IaC/Dockerfile)
🔇 Additional comments (6)
.github/workflows/README.md (2)
105-105: Quote the Mermaid node label with special characters.
tag[Tag push v[0-9]*]should quote the label to avoid Mermaid parse/render failures.As per coding guidelines, "Use
Mermaiddiagrams with no spaces in node IDs, quote labels with special characters, and no explicit colors or styles."
16-16: LGTM!Also applies to: 91-95, 104-104, 108-108, 117-117, 119-119, 124-125, 127-127, 136-139, 154-154
docs/developer-guide/docker.md (1)
6-7: LGTM!Also applies to: 17-19, 23-30, 33-40, 42-48, 52-67, 70-84, 89-97, 102-105, 114-114, 119-125, 128-140, 142-153, 156-180, 183-220, 225-225, 229-235, 238-240, 249-252, 264-266, 270-270, 273-273, 287-287, 314-320
.mise/tasks/container/build/gpu (1)
1-22: LGTM!.mise/tasks/container/build/gpu-dev (1)
1-22: LGTM!.mise/tasks/container/build/gpu-multiarch (1)
1-35: LGTM!
0742a4e to
87a88c0
Compare
Codecov Report✅ All modified and coverable lines are covered by tests. 📢 Thoughts on this report? Let us know! |
87a88c0 to
870e3bf
Compare
Signed-off-by: Matt Kornfield <mkornfield@nvidia.com>
870e3bf to
e0abe06
Compare
github-actions
Bot
added
area:dev-ex
binaryaaron
left a comment
binaryaaron
left a comment
There was a problem hiding this comment.
seems good; will update the multiple-cuda versions pr as it hits this too, but that can just make multiple container tags
Signed-off-by: Matt Kornfield <mkornfield@nvidia.com>
3 participants
Summary
Pre-Review Checklist
Ensure that the following pass:
make format && make checkor via prek validation.make testpasses locallymake test-e2epasses locallymake test-ci-containerpasses locally (recommended)/syncon this PR to trigger a run (auto-triggers on ready-for-review)Pre-Merge Checklist
Other Notes
Summary by CodeRabbit
New Features
cu129,cu130) via build parameters instead of fixed base images.Documentation
Chores