docs(cli): spike chat and complete parity #1360

Workflow file for this run

	name: ci
	on:
	push:
	branches: [main]
	pull_request:

	# Workflow-level: dedupe PR pushes only. The group is keyed on the SHA for a
	# push, so two pushes to main never share a group and never cancel each other.
	# That is deliberate: `documentation-checkpoint` and `commit-protocol-tag` below
	# are DIFF-scoped over `github.event.before..github.sha`, so a cancelled main run
	# leaves its own commit range permanently unvalidated (no later run re-covers it,
	# because the next run's `before` is this run's `sha`).
	#
	# The expensive TREE-scoped jobs carry their own job-level group instead, which
	# does collapse superseded main pushes. Net effect: a superseded push to main
	# keeps only its 2 per-commit gates and drops the other 6 jobs.
	concurrency:
	group: ci-${{ github.event.pull_request.number \|\| github.sha }}-${{ github.repository }}
	cancel-in-progress: ${{ github.event_name == 'pull_request' }}

	jobs:
	agent-record:
	# Tree-scoped: validates the record as it stands at HEAD, so only the newest
	# push to a ref is meaningful. Cancellable.
	concurrency:
	group: ci-agent-record-${{ github.ref }}-${{ github.repository }}
	cancel-in-progress: true
	runs-on: ubuntu-latest
	steps:
	- uses: actions/checkout@v4
	with:
	fetch-depth: 0
	- name: Canonical roadmap tables and links are consistent
	run: \|
	python3 scripts/check-agent-record.py
	python3 tests/scripts/test_agent_record.py
	python3 tests/scripts/test_doc_checkpoint.py
	- name: README stays a human-readable user-facing document
	run: \|
	python3 scripts/check-readme-structure.py
	python3 tests/scripts/test_check_readme_structure.py
	- name: Architecture-support checklist matches the row states
	run: \|
	python3 scripts/check-model-checklist.py
	python3 tests/scripts/test_check_model_checklist.py
	- name: Every production env var is documented or classified
	run: \|
	python3 scripts/check-env-doc.py
	python3 tests/scripts/test_check_env_doc.py
	- name: Model add+RMSNorm glue routes through the fusion catalog
	run: \|
	python3 scripts/check-fusion-consistency.py
	python3 tests/scripts/test_check_fusion_consistency.py
	documentation-checkpoint:
	concurrency:
	group: ci-doc-${{ github.ref }}-${{ github.repository }}
	cancel-in-progress: true
	# Gate: every code/test/benchmark/spike/lifecycle iteration refreshes both
	# user-facing status surfaces in that same commit, including void attempts.
	#
	# DIFF-scoped: deliberately carries NO concurrency group. Its verdict covers
	# this push's own `before..sha` range and nothing re-covers that range later,
	# so cancelling it would silently exempt those commits from the gate.
	runs-on: ubuntu-latest
	steps:
	- uses: actions/checkout@v4
	with:
	fetch-depth: 0
	- name: Every feature checkpoint updates README and BENCHMARKS
	env:
	EVENT_NAME: ${{ github.event_name }}
	PR_BASE: ${{ github.event.pull_request.base.sha }}
	PR_HEAD: ${{ github.event.pull_request.head.sha }}
	PUSH_BASE: ${{ github.event.before }}
	PUSH_HEAD: ${{ github.sha }}
	run: \|
	set -eu
	if [ "$EVENT_NAME" = "pull_request" ]; then
	base="$PR_BASE"
	head="$PR_HEAD"
	else
	base="$PUSH_BASE"
	head="$PUSH_HEAD"
	fi
	python3 scripts/check-doc-checkpoint.py --base "$base" --head "$head"
	commit-protocol-tag:
	concurrency:
	group: ci-commit-${{ github.ref }}-${{ github.repository }}
	cancel-in-progress: true
	# Gate: every NEW commit must carry the FOLLOWING_AGENTS_PROTOCOL trailer,
	# asserting the contributor read AGENTS.md. See .agents/ai-coding-assistants.md.
	#
	# DIFF-scoped: deliberately carries NO concurrency group, same reasoning as
	# documentation-checkpoint above. It walks `before..sha` per push, so a
	# cancelled run means those commits are never checked for the trailer.
	runs-on: ubuntu-latest
	steps:
	- uses: actions/checkout@v4
	with:
	fetch-depth: 0
	- name: Every new commit carries FOLLOWING_AGENTS_PROTOCOL
	run: \|
	set -eu
	if [ "${{ github.event_name }}" = "pull_request" ]; then
	base="${{ github.event.pull_request.base.sha }}"
	head="${{ github.event.pull_request.head.sha }}"
	else
	base="${{ github.event.before }}"
	head="${{ github.sha }}"
	fi
	# Enforce on the FIRST-PARENT mainline (the commits the submitter
	# directly lands on the target branch, incl. merge commits which are
	# skipped below). Merged-in feature-branch commits are owned by the
	# submitter via the merge and are not re-checked here.
	# New branch / unreachable base (all-zero SHA): only check the tip commit.
	if ! git cat-file -e "${base}^{commit}" 2>/dev/null; then
	commits="$head"
	else
	commits="$(git rev-list --first-parent "${base}..${head}")"
	fi
	fail=0
	for c in $commits; do
	# Skip merge commits (>1 parent) — they are not authored content.
	if [ "$(git rev-list --parents -n1 "$c" \| wc -w)" -gt 2 ]; then continue; fi
	if ! git log -1 --format=%B "$c" \| grep -q 'FOLLOWING_AGENTS_PROTOCOL'; then
	echo "::error::commit $c is missing the FOLLOWING_AGENTS_PROTOCOL trailer — read AGENTS.md"
	git log -1 --oneline "$c"
	fail=1
	fi
	done
	if [ "$fail" -ne 0 ]; then
	echo "One or more commits lack FOLLOWING_AGENTS_PROTOCOL. See AGENTS.md / .agents/ai-coding-assistants.md."
	exit 1
	fi
	echo "OK: all new commits carry FOLLOWING_AGENTS_PROTOCOL."
	cuda-arch-features:
	# Configure-tier assertions on the CUDA per-arch FEATURE TABLE. Needs neither
	# a CUDA toolkit nor a GPU: it drives cmake/CudaArchFeatures.cmake directly,
	# so the resolution that decides which architectures get fp4-mma /
	# cutlass-nvfp4 / cutlass-fp8 / marlin-nvfp4 / fa2 (whose historical failure
	# mode was a SILENT capability drop) is checked on every push.
	#
	# Tree-scoped (drives cmake at HEAD): cancellable.
	concurrency:
	group: ci-cuda-arch-features-${{ github.ref }}-${{ github.repository }}
	cancel-in-progress: true
	runs-on: ubuntu-latest
	steps:
	- uses: actions/checkout@v4
	- name: CUDA feature table resolves per architecture
	run: cmake -P cmake/CudaArchFeaturesTest.cmake
	device-leakage:
	# The DSR RATCHET (work row `S1` of .agents/specs/accelerator-seam-audit.md).
	# Counts device-specific references in `src/vllm/` + `include/vllm/` — the
	# layer that is supposed to be device-agnostic — and fails on ANY increase
	# over scripts/device-leakage-baseline.json. A reduction must lower the
	# baseline in the SAME commit, so the number can only ever move down.
	#
	# It exists because the audit re-measured the leakage and found it had DRIFTED
	# UPWARD with no bad commit: DeepSeek-V2, Qwen3-Coder and the attention-registry
	# work each added a device test in passing. Leakage grows silently under
	# well-executed work, which is a job for a ratchet, not a cleanup.
	#
	# Needs neither a CUDA toolkit nor a GPU — pure static analysis, like the
	# cuda-arch-features job above. The mutation suite proves the checker actually
	# catches a planted leak; an unpoliced checker is worse than none.
	#
	# Tree-scoped: the ratchet compares HEAD against the committed baseline, so
	# only the newest push matters. Cancellable.
	concurrency:
	group: ci-device-leakage-${{ github.ref }}-${{ github.repository }}
	cancel-in-progress: true
	runs-on: ubuntu-latest
	steps:
	- uses: actions/checkout@v4
	- name: Shared-layer device leakage does not grow (DSR ratchet)
	run: \|
	python3 scripts/check-device-leakage.py --report
	python3 tests/scripts/test_device_leakage.py
	build-test-cpu:
	# Tree-scoped and the most expensive lane in the workflow. Cancellable.
	concurrency:
	group: ci-build-test-cpu-${{ github.ref }}-${{ github.repository }}
	cancel-in-progress: true
	runs-on: ubuntu-latest
	steps:
	- uses: actions/checkout@v4
	- name: Configure
	run: cmake -S . -B build -DVLLM_CPP_BUILD_TESTS=ON
	- name: Build
	# Bounded parallelism: a bare `-j` lets Make link ALL test executables at
	# once, which OOM-kills the runner (ld signal 9) during the parallel link.
	run: cmake --build build -j 2
	- name: Test
	run: ctest --test-dir build --output-on-failure
	sanitize-cpu:
	# The DYNAMIC detector lanes (VLLM_CPP_SANITIZE, see CMakeLists.txt). The
	# plain build-test-cpu job above proves the suite PASSES; it cannot see a
	# read one past a tensor row, a use-after-free of an engine-owned container,
	# a signed-overflow index computation, or an unsynchronized access between
	# the serving threads — every one of which stays green under -O2 until it
	# silently corrupts a token stream. These jobs run the SAME suite with
	# ASan+UBSan and with TSan.
	#
	# Two jobs, not one: the runtimes are mutually exclusive. Both are CPU-tier
	# (the lane refuses to configure with the CUDA backend on) and both are
	# `continue-on-error` for their FIRST landing so a pre-existing finding
	# cannot block unrelated work — the finding is triaged, then this flag is
	# removed and the lane becomes binding. Removing it is tracked as the
	# closing step of the hardening-adoption row.
	strategy:
	fail-fast: false
	matrix:
	lane: ["address,undefined", "thread"]
	continue-on-error: true
	# Tree-scoped: cancellable. `matrix.lane` MUST be part of the group key, or
	# the two mutually-exclusive sanitizer legs of the SAME run would land in one
	# group and cancel each other, leaving only whichever started second.
	concurrency:
	group: ci-sanitize-cpu-${{ matrix.lane }}-${{ github.ref }}-${{ github.repository }}
	cancel-in-progress: true
	runs-on: ubuntu-latest
	steps:
	- uses: actions/checkout@v4
	- name: Configure
	run: \|
	cmake -S . -B build-sanitize \
	-DVLLM_CPP_BUILD_TESTS=ON \
	-DVLLM_CPP_CUDA=OFF \
	-DVLLM_CPP_SANITIZE='${{ matrix.lane }}'
	- name: Build
	run: cmake --build build-sanitize -j 2
	- name: Test
	# ctest runs the suite serially: the sanitizer runtimes multiply peak RSS,
	# and a parallel run OOM-kills the runner before it reports a finding.
	env:
	UBSAN_OPTIONS: print_stacktrace=1
	ASAN_OPTIONS: detect_leaks=1:strict_string_checks=1
	run: ctest --test-dir build-sanitize --output-on-failure

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

docs(cli): spike chat and complete parity #1360

Workflow file

docs(cli): spike chat and complete parity #1360

Uh oh!

Workflow file for this run