Skip to content

[CI] Harden ARM64 package access and Docker disk usage #2951

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Draft
neverhook wants to merge 3 commits into
base: main
Choose a base branch
from
Draft

[CI] Harden ARM64 package access and Docker disk usage #2951

Changes from all commits
Commits
Show all changes
3 commits
Select commit Hold shift + click to select a range
6649a81
ci: harden ARM64 CUDA package installation
Jul 16, 2026
572f77c
ci: guard Docker builds against disk exhaustion
Jul 16, 2026
3c73857
ci: persist ARM64 network hardening
Jul 16, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
45 changes: 43 additions & 2 deletions .github/workflows/ci.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -355,7 +355,26 @@ jobs:

- name: Install CUDA Toolkit 13.0 (arm64 SBSA)
run: |
wget https://developer.download.nvidia.com/compute/cuda/repos/ubuntu2204/sbsa/cuda-keyring_1.1-1_all.deb
for source_file in \
/etc/apt/sources.list \
/etc/apt/sources.list.d/*.list \
/etc/apt/sources.list.d/*.sources; do
if [[ -f "$source_file" ]]; then
sudo sed -i \
's|http://ports.ubuntu.com/ubuntu-ports|https://ports.ubuntu.com/ubuntu-ports|g' \
"$source_file"
fi
done

sudo tee /etc/apt/apt.conf.d/99mooncake-ci-network >/dev/null <<'EOF'
Acquire::ForceIPv4 "true";
Acquire::Retries "3";
Acquire::http::Timeout "30";
Acquire::https::Timeout "30";
EOF

wget --inet4-only --tries=3 --timeout=30 \
https://developer.download.nvidia.com/compute/cuda/repos/ubuntu2204/sbsa/cuda-keyring_1.1-1_all.deb
sudo dpkg -i cuda-keyring_1.1-1_all.deb
sudo apt-get update
sudo apt-get install -y cuda-toolkit-13-0
Expand Down Expand Up @@ -780,16 +799,38 @@ jobs:
with:
persist-credentials: false

- name: Free up disk space
run: |
echo "Disk usage before cleanup:"
df -h
docker system df || true

sudo rm -rf /usr/share/dotnet
sudo rm -rf /opt/ghc
sudo rm -rf /opt/hostedtoolcache/CodeQL
sudo rm -rf /usr/local/lib/android
docker system prune --all --force --volumes

echo "Disk usage after cleanup:"
df -h
docker system df || true

- name: Set up Docker Buildx
uses: docker/setup-buildx-action@v2

- name: Build Docker image
run: |
docker build -f docker/mooncake.Dockerfile \
docker build --progress=plain -f docker/mooncake.Dockerfile \
--build-arg PYTHON_VERSION=3.10 \
--build-arg EP_TORCH_VERSIONS="2.12.1" \
-t mooncake:from-source .

- name: Report final disk usage
if: always()
run: |
df -h
docker system df || true

spell-check:
name: Spell Check with Typos
if: >-
Expand Down
Loading