fix(build): suppress MLX folding warning after flags (#24) #1375
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: ci | |
| on: | |
| push: | |
| branches: [main] | |
| pull_request: | |
| # Workflow-level: dedupe PR pushes only. The group is keyed on the SHA for a | |
| # push, so two pushes to main never share a group and never cancel each other. | |
| # That is deliberate: `documentation-checkpoint` and `commit-protocol-tag` below | |
| # are DIFF-scoped over `github.event.before..github.sha`, so a cancelled main run | |
| # leaves its own commit range permanently unvalidated (no later run re-covers it, | |
| # because the next run's `before` is this run's `sha`). | |
| # | |
| # The expensive TREE-scoped jobs carry their own job-level group instead, which | |
| # does collapse superseded main pushes. Net effect: a superseded push to main | |
| # keeps only its 2 per-commit gates and drops the other 6 jobs. | |
| concurrency: | |
| group: ci-${{ github.event.pull_request.number || github.sha }}-${{ github.repository }} | |
| cancel-in-progress: ${{ github.event_name == 'pull_request' }} | |
| jobs: | |
| agent-record: | |
| # Tree-scoped: validates the record as it stands at HEAD, so only the newest | |
| # push to a ref is meaningful. Cancellable. | |
| concurrency: | |
| group: ci-agent-record-${{ github.ref }}-${{ github.repository }} | |
| cancel-in-progress: true | |
| runs-on: ubuntu-latest | |
| steps: | |
| - uses: actions/checkout@v4 | |
| with: | |
| fetch-depth: 0 | |
| - name: Canonical roadmap tables and links are consistent | |
| run: | | |
| python3 scripts/check-agent-record.py | |
| python3 tests/scripts/test_agent_record.py | |
| python3 tests/scripts/test_doc_checkpoint.py | |
| - name: README stays a human-readable user-facing document | |
| run: | | |
| python3 scripts/check-readme-structure.py | |
| python3 tests/scripts/test_check_readme_structure.py | |
| - name: Architecture-support checklist matches the row states | |
| run: | | |
| python3 scripts/check-model-checklist.py | |
| python3 tests/scripts/test_check_model_checklist.py | |
| - name: Every production env var is documented or classified | |
| run: | | |
| python3 scripts/check-env-doc.py | |
| python3 tests/scripts/test_check_env_doc.py | |
| - name: Model add+RMSNorm glue routes through the fusion catalog | |
| run: | | |
| python3 scripts/check-fusion-consistency.py | |
| python3 tests/scripts/test_check_fusion_consistency.py | |
| documentation-checkpoint: | |
| concurrency: | |
| group: ci-doc-${{ github.ref }}-${{ github.repository }} | |
| cancel-in-progress: true | |
| # Gate: every code/test/benchmark/spike/lifecycle iteration refreshes both | |
| # user-facing status surfaces in that same commit, including void attempts. | |
| # | |
| # DIFF-scoped: deliberately carries NO concurrency group. Its verdict covers | |
| # this push's own `before..sha` range and nothing re-covers that range later, | |
| # so cancelling it would silently exempt those commits from the gate. | |
| runs-on: ubuntu-latest | |
| steps: | |
| - uses: actions/checkout@v4 | |
| with: | |
| fetch-depth: 0 | |
| - name: Every feature checkpoint updates README and BENCHMARKS | |
| env: | |
| EVENT_NAME: ${{ github.event_name }} | |
| PR_BASE: ${{ github.event.pull_request.base.sha }} | |
| PR_HEAD: ${{ github.event.pull_request.head.sha }} | |
| PUSH_BASE: ${{ github.event.before }} | |
| PUSH_HEAD: ${{ github.sha }} | |
| run: | | |
| set -eu | |
| if [ "$EVENT_NAME" = "pull_request" ]; then | |
| base="$PR_BASE" | |
| head="$PR_HEAD" | |
| else | |
| base="$PUSH_BASE" | |
| head="$PUSH_HEAD" | |
| fi | |
| python3 scripts/check-doc-checkpoint.py --base "$base" --head "$head" | |
| commit-protocol-tag: | |
| concurrency: | |
| group: ci-commit-${{ github.ref }}-${{ github.repository }} | |
| cancel-in-progress: true | |
| # Gate: every NEW commit must carry the FOLLOWING_AGENTS_PROTOCOL trailer, | |
| # asserting the contributor read AGENTS.md. See .agents/ai-coding-assistants.md. | |
| # | |
| # DIFF-scoped: deliberately carries NO concurrency group, same reasoning as | |
| # documentation-checkpoint above. It walks `before..sha` per push, so a | |
| # cancelled run means those commits are never checked for the trailer. | |
| runs-on: ubuntu-latest | |
| steps: | |
| - uses: actions/checkout@v4 | |
| with: | |
| fetch-depth: 0 | |
| - name: Every new commit carries FOLLOWING_AGENTS_PROTOCOL | |
| run: | | |
| set -eu | |
| if [ "${{ github.event_name }}" = "pull_request" ]; then | |
| base="${{ github.event.pull_request.base.sha }}" | |
| head="${{ github.event.pull_request.head.sha }}" | |
| else | |
| base="${{ github.event.before }}" | |
| head="${{ github.sha }}" | |
| fi | |
| # Enforce on the FIRST-PARENT mainline (the commits the submitter | |
| # directly lands on the target branch, incl. merge commits which are | |
| # skipped below). Merged-in feature-branch commits are owned by the | |
| # submitter via the merge and are not re-checked here. | |
| # New branch / unreachable base (all-zero SHA): only check the tip commit. | |
| if ! git cat-file -e "${base}^{commit}" 2>/dev/null; then | |
| commits="$head" | |
| else | |
| commits="$(git rev-list --first-parent "${base}..${head}")" | |
| fi | |
| fail=0 | |
| for c in $commits; do | |
| # Skip merge commits (>1 parent) — they are not authored content. | |
| if [ "$(git rev-list --parents -n1 "$c" | wc -w)" -gt 2 ]; then continue; fi | |
| if ! git log -1 --format=%B "$c" | grep -q 'FOLLOWING_AGENTS_PROTOCOL'; then | |
| echo "::error::commit $c is missing the FOLLOWING_AGENTS_PROTOCOL trailer — read AGENTS.md" | |
| git log -1 --oneline "$c" | |
| fail=1 | |
| fi | |
| done | |
| if [ "$fail" -ne 0 ]; then | |
| echo "One or more commits lack FOLLOWING_AGENTS_PROTOCOL. See AGENTS.md / .agents/ai-coding-assistants.md." | |
| exit 1 | |
| fi | |
| echo "OK: all new commits carry FOLLOWING_AGENTS_PROTOCOL." | |
| cuda-arch-features: | |
| # Configure-tier assertions on the CUDA per-arch FEATURE TABLE. Needs neither | |
| # a CUDA toolkit nor a GPU: it drives cmake/CudaArchFeatures.cmake directly, | |
| # so the resolution that decides which architectures get fp4-mma / | |
| # cutlass-nvfp4 / cutlass-fp8 / marlin-nvfp4 / fa2 (whose historical failure | |
| # mode was a SILENT capability drop) is checked on every push. | |
| # | |
| # Tree-scoped (drives cmake at HEAD): cancellable. | |
| concurrency: | |
| group: ci-cuda-arch-features-${{ github.ref }}-${{ github.repository }} | |
| cancel-in-progress: true | |
| runs-on: ubuntu-latest | |
| steps: | |
| - uses: actions/checkout@v4 | |
| - name: CUDA feature table resolves per architecture | |
| run: cmake -P cmake/CudaArchFeaturesTest.cmake | |
| device-leakage: | |
| # The DSR RATCHET (work row `S1` of .agents/specs/accelerator-seam-audit.md). | |
| # Counts device-specific references in `src/vllm/` + `include/vllm/` — the | |
| # layer that is supposed to be device-agnostic — and fails on ANY increase | |
| # over scripts/device-leakage-baseline.json. A reduction must lower the | |
| # baseline in the SAME commit, so the number can only ever move down. | |
| # | |
| # It exists because the audit re-measured the leakage and found it had DRIFTED | |
| # UPWARD with no bad commit: DeepSeek-V2, Qwen3-Coder and the attention-registry | |
| # work each added a device test in passing. Leakage grows silently under | |
| # well-executed work, which is a job for a ratchet, not a cleanup. | |
| # | |
| # Needs neither a CUDA toolkit nor a GPU — pure static analysis, like the | |
| # cuda-arch-features job above. The mutation suite proves the checker actually | |
| # catches a planted leak; an unpoliced checker is worse than none. | |
| # | |
| # Tree-scoped: the ratchet compares HEAD against the committed baseline, so | |
| # only the newest push matters. Cancellable. | |
| concurrency: | |
| group: ci-device-leakage-${{ github.ref }}-${{ github.repository }} | |
| cancel-in-progress: true | |
| runs-on: ubuntu-latest | |
| steps: | |
| - uses: actions/checkout@v4 | |
| - name: Shared-layer device leakage does not grow (DSR ratchet) | |
| run: | | |
| python3 scripts/check-device-leakage.py --report | |
| python3 tests/scripts/test_device_leakage.py | |
| build-test-cpu: | |
| # Tree-scoped and the most expensive lane in the workflow. Cancellable. | |
| concurrency: | |
| group: ci-build-test-cpu-${{ github.ref }}-${{ github.repository }} | |
| cancel-in-progress: true | |
| runs-on: ubuntu-latest | |
| steps: | |
| - uses: actions/checkout@v4 | |
| - name: Configure | |
| run: cmake -S . -B build -DVLLM_CPP_BUILD_TESTS=ON | |
| - name: Build | |
| # Bounded parallelism: a bare `-j` lets Make link ALL test executables at | |
| # once, which OOM-kills the runner (ld signal 9) during the parallel link. | |
| run: cmake --build build -j 2 | |
| - name: Test | |
| run: ctest --test-dir build --output-on-failure | |
| sanitize-cpu: | |
| # The DYNAMIC detector lanes (VLLM_CPP_SANITIZE, see CMakeLists.txt). The | |
| # plain build-test-cpu job above proves the suite PASSES; it cannot see a | |
| # read one past a tensor row, a use-after-free of an engine-owned container, | |
| # a signed-overflow index computation, or an unsynchronized access between | |
| # the serving threads — every one of which stays green under -O2 until it | |
| # silently corrupts a token stream. These jobs run the SAME suite with | |
| # ASan+UBSan and with TSan. | |
| # | |
| # Two jobs, not one: the runtimes are mutually exclusive. Both are CPU-tier | |
| # (the lane refuses to configure with the CUDA backend on) and both are | |
| # `continue-on-error` for their FIRST landing so a pre-existing finding | |
| # cannot block unrelated work — the finding is triaged, then this flag is | |
| # removed and the lane becomes binding. Removing it is tracked as the | |
| # closing step of the hardening-adoption row. | |
| strategy: | |
| fail-fast: false | |
| matrix: | |
| lane: ["address,undefined", "thread"] | |
| continue-on-error: true | |
| # Tree-scoped: cancellable. `matrix.lane` MUST be part of the group key, or | |
| # the two mutually-exclusive sanitizer legs of the SAME run would land in one | |
| # group and cancel each other, leaving only whichever started second. | |
| concurrency: | |
| group: ci-sanitize-cpu-${{ matrix.lane }}-${{ github.ref }}-${{ github.repository }} | |
| cancel-in-progress: true | |
| runs-on: ubuntu-latest | |
| steps: | |
| - uses: actions/checkout@v4 | |
| - name: Configure | |
| run: | | |
| cmake -S . -B build-sanitize \ | |
| -DVLLM_CPP_BUILD_TESTS=ON \ | |
| -DVLLM_CPP_CUDA=OFF \ | |
| -DVLLM_CPP_SANITIZE='${{ matrix.lane }}' | |
| - name: Build | |
| run: cmake --build build-sanitize -j 2 | |
| - name: Test | |
| # ctest runs the suite serially: the sanitizer runtimes multiply peak RSS, | |
| # and a parallel run OOM-kills the runner before it reports a finding. | |
| env: | |
| UBSAN_OPTIONS: print_stacktrace=1 | |
| ASAN_OPTIONS: detect_leaks=1:strict_string_checks=1 | |
| run: ctest --test-dir build-sanitize --output-on-failure |