Gate example and GPU test lanes on the files they cover, and consolidate the CI gate

[kevalmorabia97]

What does this PR do?

Type of change: CI/CD improvement

Follow-up to #2086, which carried the speculative-decoding fix; this PR is the CI half.

Lanes now run only when their own files change. A one-line edit to any example started all 12 example lanes, and any modelopt/** change started every GPU suite.

• Each lane gates itself inside _example_tests_runner.yml / _gpu_tests_runner.yml, deriving its watch list from the example or suite name it was already given (examples/<name>/**, tests/examples/<name>/**, tests/<suite>/**). Adding a new example stays a one-line matrix entry — no central mapping to update.
• The five cross-example dependencies are declared as watch_extra next to the example that needs them: hf_ptq → llm_eval (huggingface_example.sh runs lm_eval from ../llm_eval), torch_trt → onnx_ptq, speculative_decoding → hf_ptq + dataset, llm_qat / gpt-oss → dataset.
• gpu_tests.yml is split into caller + runner to match. This shape is forced, not stylistic: job-level if: cannot read matrix, and container: images are pulled before any step runs, so gating inside the job would still pull 10–20 GB and hold a GPU runner for every skipped suite.
• modelopt/**, modelopt_recipes/**, pyproject.toml and tests/_test_utils/** still run every lane. The gate now watches the last two, which example tests depend on but it previously ignored.

Docs-only changes no longer start GPU jobs. The gate ignores **.md, **.rst, **.png and **.ipynb by default, so a README edit short-circuits the whole workflow. Nothing executes notebooks (no nbmake/nbval in the repo), and .sh/.yaml/.txt stay watched since examples run them.

One file holds the gate logic. .github/actions/changed-files-gate is a composite action doing the merge-base + changed-files comparison and, optionally, the ^linux$ wait. _pr_gate.yml and _wait_for_checks.yml are both deleted: each top-level workflow keeps a 12-line pr-gate job that is pure wiring, and the runners use the action as steps so a lane shows gate + run-test rather than three checks. Calling a reusable workflow always materializes all of its jobs, including skipped ones, which is what made the per-lane check list noisy.

unit_tests.yml also drops its DCO wait: DCO can be marked passing manually, so blocking the matrix on it only delayed feedback. The ^linux$ wait remains, which is the gate that actually protects GPU runners.

Also, from the original lane consolidation:

• One TensorRT-LLM lane. trtllm-pr and trtllm-non-pr merge into a single trtllm job gated like the others, so llm_eval now runs on PRs, where it was nightly-only.
• gpt-oss moves to the TensorRT-LLM image. Its deploy step needs tensorrt_llm, which pytorch doesn't have, so deploy_gpt_oss_trtllm silently skipped in CI. Its importorskip is dropped now that the lane guarantees the dependency.
• Containers bumped where no reason was documented: pytorch 26.06/26.01 → 26.07 (torch example lane, regression). Left pinned with their existing in-file reasons: pytorch 26.05 for the gpu lane (EXPLICIT_BATCH removed in TensorRT 11), tensorrt 26.05 for the onnx lane (torch-tensorrt needs libnvinfer.so.10), vllm v0.20.0 (legacy FusedMoE coverage). TensorRT-LLM stays on 1.3.0rc20: rc21–rc23 ship a quickstart_multimodal.py importing MultimodalConfig before tensorrt_llm.llmapi exported it (fixed upstream in [https://nvbugs/6537081][fix] Fix import error TensorRT-LLM#17112, one day after rc23 was cut), which fails the hf_ptq VLM deploy smoke test.

Also clarifies the changelog line in the PR template to spell out when an entry is expected.

Two silent-failure fixes found in review:

• Every gate used any_changed, which is ACMR and excludes deletions, so a delete-only PR (removing an example, a test, or library code) ran nothing. Now any_modified (ACMRD), fixed in example_tests.yml, _pr_gate.yml and unit_tests.yml.
• git merge-base was piped into tee, so a failure returned tee's exit status and emitted an empty base, quietly changing which lanes run instead of failing.

Nightly secret scanning is fixed. code_quality.yml excludes trufflehog's lob detector: its (live|test)_[a-zA-Z0-9_]{35} pattern matches any pytest function whose name is exactly 35 characters after test_ — 60 of them in this repo, e.g. test_all_zero_activation_yields_no_scale — and reports them as verified secrets. This only ever failed nightly because the action scans all history on schedule and only the PR diff on pull_request.

Testing

Workflow YAML validated locally and the selection logic checked by hand across scenarios (examples/diffusers/** → onnx lane only; examples/dataset/** → llm_qat, speculative_decoding, gpt-oss; examples/llm_eval/** → hf_ptq + llm_eval; modelopt/** and nightly → everything). Gating behavior itself can only be exercised by a real PR run — the failure mode to watch for is a lane skipping when it should have run.

Before your PR is "Ready for review"

• Is this change backward compatible?: ✅
• If you copied code from any other sources or added a new PIP dependency, did you follow guidance in CONTRIBUTING.md: N/A
• Did you write any new necessary tests?: N/A — CI configuration
• Did you update Changelog?: N/A
• Did you get Claude approval on this PR?: ❌ — not yet run

Summary by CodeRabbit

• CI Improvements

  • Improved change detection for model recipes, test utilities, workflow actions, and documentation-only updates.
  • Streamlined pull request checks and status monitoring.
  • Consolidated TensorRT-LLM example validation and refined conditional test execution.
  • Updated test environments to newer PyTorch releases.
  • Refined GPU, regression, and unit test triggers.
  • Deployment tests no longer automatically skip when TensorRT-LLM is unavailable.
  • Updated secret scanning configuration.

• Documentation

  • Updated pull request checklist guidance to include deprecations and critical bug fixes.

[coderabbitai]

Note

Reviews paused

It looks like this branch is under active development. To avoid overwhelming you with review comments due to an influx of new commits, CodeRabbit has automatically paused this review. You can configure this behavior by changing the reviews.auto_review.auto_pause_after_reviewed_commits setting.

Use the following commands to manage reviews:

• @coderabbitai resume to resume automatic reviews.
• @coderabbitai review to trigger a single review.

Use the checkboxes below for quick actions:

• ▶️ Resume reviews
• 🔍 Trigger review

📝 Walkthrough

Walkthrough

The PR updates CI change detection, test lane gating, workflow images, secret scanning, GPT-OSS test behavior, and changelog guidance.

Changes

CI test gating and workflow consolidation

Layer / File(s)	Summary
Changed-files gate implementation .github/actions/pr-merge-base/action.yml, .github/workflows/_pr_gate.yml	The PR gate resolves merge-base data with a local action, filters ignored files, and waits for Linux status checks with a direct status-check action.
Example test lane gating .github/workflows/example_tests.yml	The workflow classifies changes into test lanes, gates each lane independently, consolidates TensorRT-LLM jobs, updates the PyTorch matrix and image, and revises the required check.
CI policy and test adjustments .github/workflows/gpu_tests.yml, .github/workflows/regression_tests.yml, .github/workflows/unit_tests.yml, .github/workflows/code_quality.yml	CI workflows expand path gates, update images, remove DCO wiring, and exclude the lob detector from secret scanning.
Test and changelog policy updates tests/examples/gpt-oss/test_gpt_oss_qat.py, .github/PULL_REQUEST_TEMPLATE.md	GPT-OSS deployment tests no longer skip on missing tensorrt_llm. Changelog guidance includes deprecations and critical bug fixes.

Estimated code review effort: 4 (Complex) | ~45 minutes

Sequence Diagram(s)

sequenceDiagram
  participant PullRequest
  participant PRGate
  participant ChangedFiles
  participant TestJobs
  participant StatusChecks
  PullRequest->>PRGate: trigger workflow
  PRGate->>ChangedFiles: compare merge base and head with ignored paths
  ChangedFiles-->>PRGate: return lane outputs
  PRGate->>StatusChecks: wait for Linux status
  StatusChecks-->>PRGate: return check status
  PRGate->>TestJobs: run matching test lanes
  TestJobs-->>PullRequest: report test results

Loading

Suggested reviewers: aanoosheh

🚥 Pre-merge checks | ✅ 6

✅ Passed checks (6 passed)

Check name	Status	Explanation
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Security Anti-Patterns	✅ Passed	The commit only removes an import skip in a test Python file; no forbidden security-pattern additions, # nosec comments, or dependency-manifest changes were found.
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly summarizes the main changes: file-based gating for example and GPU test lanes and CI gate consolidation.

✨ Finishing Touches

📝 Generate docstrings

• Create stacked PR
• Commit on current branch

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch kmorabia/ci-improvements

---

_{Comment @coderabbitai help to get the list of available commands.}

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 78.08%. Comparing base (22b6a14) to head (b043da5).
⚠️ Report is 1 commits behind head on main.

Additional details and impacted files

@@            Coverage Diff             @@
##             main    #2090      +/-   ##
==========================================
- Coverage   78.60%   78.08%   -0.52%     
==========================================
  Files         522      522              
  Lines       60167    60167              
==========================================
- Hits        47294    46982     -312     
- Misses      12873    13185     +312     

Flag	Coverage Δ
examples	42.93% <ø> (+1.06%)	⬆️
gpu	58.65% <ø> (-0.62%)	⬇️
regression	14.90% <ø> (+0.04%)	⬆️
unit	55.39% <ø> (ø)

Flags with carried forward coverage won't be shown. Click here to find out more.

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.

[coderabbitai]

Warning

CodeRabbit couldn't request changes on this pull request because it doesn't have sufficient GitHub permissions.

Please grant CodeRabbit Pull requests: Read and write permission and re-run the review.

👉 Steps to fix this

Actionable comments posted: 4

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In @.github/workflows/_example_tests_runner.yml:
- Around line 54-64: Add .github/workflows/example_tests.yml to the watched
paths in .github/workflows/_example_tests_runner.yml (lines 54-64), and add
.github/workflows/gpu_tests.yml to the watched paths in
.github/workflows/_gpu_tests_runner.yml (lines 34-43), so caller workflow
changes trigger the corresponding test gates.

In @.github/workflows/_gpu_tests_runner.yml:
- Line 53: Update the job container image configuration using
inputs.container_image to require an immutable `@sha256` digest reference; either
validate and reject tag-only values before starting the job or ensure callers
provide digest-pinned images, rather than using mutable tags directly.

In @.github/workflows/gpu_tests.yml:
- Around line 33-44: Update the gpu-tests caller watch list in the workflow’s
files block to include .github/workflows/_gpu_tests_runner.yml and the
.github/actions/changed-files-gate/** dependency path, preserving the existing
entries so changes to these reusable GPU runner dependencies allow the gpu-tests
matrix to run.

In @.github/workflows/regression_tests.yml:
- Around line 33-42: Update the path filters in the regression-tests workflow’s
files list to include the full modelopt/** and modelopt_recipes/** trees, and
add tests/_test_utils/**. Preserve the existing regression-specific paths and
ensure changes in all three shared dependency areas trigger every regression
lane.

🪄 Autofix

Fix all unresolved CodeRabbit comments on this PR:

• Push a commit to this branch (recommended)
• Create a new PR with the fixes

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Enterprise

Run ID: fa843867-81ce-4c40-b34e-3e2b9e985854

📥 Commits

Reviewing files that changed from the base of the PR and between 22b6a14 and 9ba5793.

📒 Files selected for processing (11)

• .github/PULL_REQUEST_TEMPLATE.md
• .github/actions/changed-files-gate/action.yml
• .github/workflows/_example_tests_runner.yml
• .github/workflows/_gpu_tests_runner.yml
• .github/workflows/_pr_gate.yml
• .github/workflows/_wait_for_checks.yml
• .github/workflows/example_tests.yml
• .github/workflows/gpu_tests.yml
• .github/workflows/regression_tests.yml
• .github/workflows/unit_tests.yml
• tests/examples/gpt-oss/test_gpt_oss_qat.py

💤 Files with no reviewable changes (3)

• tests/examples/gpt-oss/test_gpt_oss_qat.py
• .github/workflows/_pr_gate.yml
• .github/workflows/_wait_for_checks.yml

[coderabbitai]

Note

GitHub couldn't provide a complete incremental comparison for this pull request, so CodeRabbit is performing a full review instead. This review may take a little longer.

[coderabbitai]

Warning

CodeRabbit couldn't request changes on this pull request because it doesn't have sufficient GitHub permissions.

Please grant CodeRabbit Pull requests: Read and write permission and re-run the review.

👉 Steps to fix this

Actionable comments posted: 3

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In @.github/actions/pr-merge-base/action.yml:
- Line 20: Pin all three GitHub Actions references to their resolved full commit
SHAs and retain the original release reference as a version comment: update
nv-gha-runners/get-pr-info in .github/actions/pr-merge-base/action.yml:20,
step-security/changed-files in .github/workflows/_pr_gate.yml:44, and
poseidon/wait-for-status-checks in .github/workflows/_pr_gate.yml:60. Do not
leave mutable branches or tags in the uses values.
- Line 35: Ensure the merge-base computation in the step writing merge-base to
GITHUB_OUTPUT propagates git merge-base failures instead of returning tee’s
status; configure the pipeline or command structure so a failed git merge-base
causes the action step to fail and prevents emitting an invalid value.

In @.github/workflows/_pr_gate.yml:
- Around line 10-18: Restrict the default files_ignore patterns in the pr-gate
workflow to documentation-specific directories instead of matching every .ipynb,
.png, .md, or .rst file. Update the default block and any affected callers so
notebooks and images under paths such as examples, tests, modelopt, or
modelopt_recipes continue triggering their relevant test lanes; pass broader
ignore patterns only from documentation-specific or GPU workflow callers where
appropriate.

🪄 Autofix

Fix all unresolved CodeRabbit comments on this PR:

• Push a commit to this branch (recommended)
• Create a new PR with the fixes

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Enterprise

Run ID: 1fb08572-3664-4c30-8e56-722126b057e4

📥 Commits

Reviewing files that changed from the base of the PR and between 22b6a14 and a947004.

📒 Files selected for processing (9)

• .github/PULL_REQUEST_TEMPLATE.md
• .github/actions/pr-merge-base/action.yml
• .github/workflows/_pr_gate.yml
• .github/workflows/_wait_for_checks.yml
• .github/workflows/example_tests.yml
• .github/workflows/gpu_tests.yml
• .github/workflows/regression_tests.yml
• .github/workflows/unit_tests.yml
• tests/examples/gpt-oss/test_gpt_oss_qat.py

💤 Files with no reviewable changes (2)

• .github/workflows/_wait_for_checks.yml
• tests/examples/gpt-oss/test_gpt_oss_qat.py

🚧 Files skipped from review as they are similar to previous changes (2)

• .github/PULL_REQUEST_TEMPLATE.md
• .github/workflows/unit_tests.yml

[coderabbitai]

Note

GitHub couldn't provide a complete incremental comparison for this pull request, so CodeRabbit is performing a full review instead. This review may take a little longer.

[coderabbitai]

Warning

CodeRabbit couldn't request changes on this pull request because it doesn't have sufficient GitHub permissions.

Please grant CodeRabbit Pull requests: Read and write permission and re-run the review.

👉 Steps to fix this

Actionable comments posted: 2

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In @.github/workflows/example_tests.yml:
- Around line 35-37: Update the actions/checkout step in the gate job to set
persist-credentials to false while preserving fetch-depth: 0, ensuring checkout
does not persist Git credentials.
- Around line 81-85: Update the lane-detection assignments for COMMON, TORCH,
TRTLLM, MEGATRON, and ONNX to use each corresponding
steps.changed.*_any_modified output, or combine *_any_changed with
*_any_deleted, so deletions under modelopt/** still activate the appropriate
example lanes.

🪄 Autofix

Fix all unresolved CodeRabbit comments on this PR:

• Push a commit to this branch (recommended)
• Create a new PR with the fixes

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Enterprise

Run ID: 8a3946c4-a16c-4124-a779-a48c553033b2

📥 Commits

Reviewing files that changed from the base of the PR and between 22b6a14 and 8c5b219.

📒 Files selected for processing (9)

• .github/PULL_REQUEST_TEMPLATE.md
• .github/actions/pr-merge-base/action.yml
• .github/workflows/_pr_gate.yml
• .github/workflows/_wait_for_checks.yml
• .github/workflows/example_tests.yml
• .github/workflows/gpu_tests.yml
• .github/workflows/regression_tests.yml
• .github/workflows/unit_tests.yml
• tests/examples/gpt-oss/test_gpt_oss_qat.py

💤 Files with no reviewable changes (2)

• tests/examples/gpt-oss/test_gpt_oss_qat.py
• .github/workflows/_wait_for_checks.yml

🚧 Files skipped from review as they are similar to previous changes (5)

• .github/workflows/unit_tests.yml
• .github/PULL_REQUEST_TEMPLATE.md
• .github/actions/pr-merge-base/action.yml
• .github/workflows/gpu_tests.yml
• .github/workflows/_pr_gate.yml

[coderabbitai]

Note

GitHub couldn't provide a complete incremental comparison for this pull request, so CodeRabbit is performing a full review instead. This review may take a little longer.

[coderabbitai]

Warning

CodeRabbit couldn't request changes on this pull request because it doesn't have sufficient GitHub permissions.

Please grant CodeRabbit Pull requests: Read and write permission and re-run the review.

👉 Steps to fix this

Actionable comments posted: 1

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In @.github/workflows/example_tests.yml:
- Around line 56-76: Add tests/conftest.py and tests/examples/conftest.py to the
common file patterns in files_yaml, preserving the existing lane configuration.

🪄 Autofix

Fix all unresolved CodeRabbit comments on this PR:

• Push a commit to this branch (recommended)
• Create a new PR with the fixes

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Enterprise

Run ID: 73c55664-77e1-45bf-89cd-28d5bafbfc03

📥 Commits

Reviewing files that changed from the base of the PR and between ccf44ea and af082ef.

📒 Files selected for processing (9)

• .github/PULL_REQUEST_TEMPLATE.md
• .github/actions/pr-merge-base/action.yml
• .github/workflows/_pr_gate.yml
• .github/workflows/_wait_for_checks.yml
• .github/workflows/example_tests.yml
• .github/workflows/gpu_tests.yml
• .github/workflows/regression_tests.yml
• .github/workflows/unit_tests.yml
• tests/examples/gpt-oss/test_gpt_oss_qat.py

💤 Files with no reviewable changes (2)

• tests/examples/gpt-oss/test_gpt_oss_qat.py
• .github/workflows/_wait_for_checks.yml

🚧 Files skipped from review as they are similar to previous changes (5)

• .github/actions/pr-merge-base/action.yml
• .github/workflows/unit_tests.yml
• .github/workflows/_pr_gate.yml
• .github/PULL_REQUEST_TEMPLATE.md
• .github/workflows/regression_tests.yml

[coderabbitai]

Note

GitHub couldn't provide a complete incremental comparison for this pull request, so CodeRabbit is performing a full review instead. This review may take a little longer.

[coderabbitai]

Note

GitHub couldn't provide a complete incremental comparison for this pull request, so CodeRabbit is performing a full review instead. This review may take a little longer.

[coderabbitai]

Warning

CodeRabbit couldn't request changes on this pull request because it doesn't have sufficient GitHub permissions.

Please grant CodeRabbit Pull requests: Read and write permission and re-run the review.

👉 Steps to fix this

Actionable comments posted: 1

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In @.github/workflows/code_quality.yml:
- Around line 27-30: Keep the lob detector enabled by removing lob from the
exclude-detectors value in the workflow’s extra_args. Suppress only the known
false-positive lines with trufflehog:ignore annotations, or configure a narrowly
scoped exclude-paths file without disabling other lob findings.

🪄 Autofix

Fix all unresolved CodeRabbit comments on this PR:

• Push a commit to this branch (recommended)
• Create a new PR with the fixes

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Enterprise

Run ID: 02f798f7-fca7-45f7-bfa4-8150049c98e0

📥 Commits

Reviewing files that changed from the base of the PR and between ccf44ea and a2c0dfe.

📒 Files selected for processing (10)

• .github/PULL_REQUEST_TEMPLATE.md
• .github/actions/pr-merge-base/action.yml
• .github/workflows/_pr_gate.yml
• .github/workflows/_wait_for_checks.yml
• .github/workflows/code_quality.yml
• .github/workflows/example_tests.yml
• .github/workflows/gpu_tests.yml
• .github/workflows/regression_tests.yml
• .github/workflows/unit_tests.yml
• tests/examples/gpt-oss/test_gpt_oss_qat.py

💤 Files with no reviewable changes (2)

• tests/examples/gpt-oss/test_gpt_oss_qat.py
• .github/workflows/_wait_for_checks.yml

🚧 Files skipped from review as they are similar to previous changes (6)

• .github/PULL_REQUEST_TEMPLATE.md
• .github/actions/pr-merge-base/action.yml
• .github/workflows/regression_tests.yml
• .github/workflows/unit_tests.yml
• .github/workflows/gpu_tests.yml
• .github/workflows/_pr_gate.yml

[kevalmorabia97]

/claude review

[github-actions]

PR Preview Action v1.8.1
Preview removed because the pull request was closed.
2026-08-07 07:17 UTC