fix(ci): unblock release checks - #415
Merged
Merged
Conversation
Signed-off-by: Ajay Thorve <athorve@nvidia.com>
|
Auto-sync is disabled for draft pull requests in this repository. Workflows must be run manually. Contributors can view more details about this message here. |
|
No actionable comments were generated in the recent review. 🎉 ℹ️ Recent review info⚙️ Run configurationConfiguration used: Path: .coderabbit.yaml Review profile: ASSERTIVE Plan: Enterprise Run ID: 📒 Files selected for processing (8)
📜 Recent review details⏰ Context from checks skipped due to timeout. (3)
🧰 Additional context used📓 Path-based instructions (6)**/*📄 CodeRabbit inference engine (CONTRIBUTING.md)
Files:
**/*.{py,yml,yaml,js,jsx,ts,tsx,json,md}📄 CodeRabbit inference engine (AGENTS.md)
Files:
{docs/**,README.md,CONTRIBUTING.md,SECURITY.md,CODE-OF-CONDUCT.md}⚙️ CodeRabbit configuration file
Files:
**/*.py📄 CodeRabbit inference engine (CONTRIBUTING.md)
Files:
mcp/**/*.py📄 CodeRabbit inference engine (CONTRIBUTING.md)
Files:
docs/source/**/*📄 CodeRabbit inference engine (AGENTS.md)
Files:
🧠 Learnings (1)📓 Common learnings🔇 Additional comments (8)
WalkthroughThe MCP release profile now targets ChangesMCP cryptography dependency update
Repository maintenance updates
Estimated code review effort: 2 (Simple) | ~10 minutes 🚥 Pre-merge checks | ✅ 3 | ❌ 2❌ Failed checks (2 warnings)
✅ Passed checks (3 passed)
✨ Finishing Touches 💡 1📝 Generate docstrings 💡
🧪 Generate unit tests (beta)
Comment |
KyleZheng1284
left a comment
KyleZheng1284
left a comment
Contributor
There was a problem hiding this comment.
Agent-assisted review by Codex of b2c8e11fafd080f23f9528463ec00ae40aa2a553 against release/2.2. The API/config surface is unchanged, and the local MCP suite plus the Linux container CI path pass. I found two compatibility/documentation items that should be addressed before describing the PR as fully non-breaking; details are inline.
Signed-off-by: Ajay Thorve <athorve@nvidia.com>
AjayThorve
force-pushed
the
ajay/ci-unblock-aug-2026
branch
from
August 4, 2026 19:26
69ded0b to
d47356e
Compare
Collaborator
|
/ok to test d47356e |
Member
Author
|
/merge |
8 tasks
rapids-bot Bot
pushed a commit
that referenced
this pull request
Aug 4, 2026
#### Overview Some OpenAI-compatible frontier providers return the requested Pydantic contract as schema-valid JSON in ordinary assistant content instead of emitting the structured-output tool call. In deep research, that prevents `SourceRoutingPlan`, `ResearchPlan`, or `ResearchNotes` from reaching the persistence middleware and can leave the workflow retrying a completed stage. This change: - promotes exact, schema-valid JSON assistant content to the requested structured response; - makes at most one tools-disabled corrective call for empty or invalid plain-text responses, so the fallback cannot spiral; - leaves native structured responses and ordinary tool calls unchanged; - applies the compatibility middleware only at the source-router, planner, and researcher structured-response boundaries; and - updates the existing frontier profile to use the direct OpenAI provider with `OPENAI_API_KEY`: GPT Sol for orchestration, planning, and writing, and GPT Luna for source routing and research. The default Ultra profile is unchanged. #### DCO sign-off for the squash commit Signed-off-by: Ajay Thorve <athorve@nvidia.com> #### Validation - [x] `uv run ruff check .` - [x] `uv run pytest -q` — 2022 passed, 13 skipped - [x] Focused post-format run — 183 passed - [x] `uv run nat validate --config_file configs/config_frontier_models.yml` - [x] `uv run nat validate --config_file configs/config_web_default_llamaindex.yml` - [x] GPT Sol/Luna semantic smoke advanced through routing, planning, research, and writing with a non-sentinel cited report. - [x] Deterministic 20-task GPT DRB-II pilot completed with 20/20 generation and 20/20 official judge coverage. - [x] Patched-runtime Ultra regression smoke completed a DRB-II task with a 24.6k-character cited report, 1/1 clean collection, and no fallback correction. Harbor used one internal retry before the successful attempt. - [x] I added or updated tests for behavior changes. - [x] Documentation changes are not required; the user-facing frontier example config is updated directly. - [x] I confirmed this PR does not include secrets, credentials, internal endpoints, or internal-only data. - [x] I certify this contribution under the Developer Certificate of Origin (DCO) and signed my commit with `git commit -s`. - [x] I replaced the DCO sign-off placeholder with my GitHub commit identity and kept the required angle brackets around the email address. The remaining all-files Markdown-link and dependency-audit failures are release-branch-wide CI issues unrelated to this diff and are addressed separately by #415. #### Where should reviewers start? Start with `StructuredResponseTextFallbackMiddleware` in `custom_middleware.py`, then its three placements in `factory.py`, and finally the direct-OpenAI Sol/Luna role split in `config_frontier_models.yml`. #### Related Issues - Relates to the model endpoint deprecation migration. ## Summary by CodeRabbit * **New Features** * Improved deep-research reliability by automatically correcting responses that do not match the expected structured format. * Preserved valid structured responses while retrying invalid responses without tool calls. * **Configuration** * Updated frontier-model workflows to use GPT Sol and GPT Luna for orchestration, planning, writing, routing, and research. * Updated model inference settings and token limits. * **Tests** * Added coverage for structured-response recovery, retry behavior, middleware integration, and frontier-model configuration. Authors: - Ajay Thorve (https://github.com/AjayThorve) Approvers: - Chantal D Gama Rose (https://github.com/cdgamarose-nv) URL: #413
cdgamarose-nv
pushed a commit
to cdgamarose-nv/aiq
that referenced
this pull request
Aug 10, 2026
## Summary - keep repository-wide Markdown link validation, but skip `build.nvidia.com` because NVIDIA Build returns HTTP 202 for valid pages and the checker treats that response as dead - update the isolated MCP release lock from `aiohttp` 3.14.1 to 3.14.3 and from `cryptography` 48.0.1 to 50.0.0, resolving the newly published advisories blocking every PR - preserve fail-closed runtime dependency validation with exact compatibility exceptions for `langchain-litellm`, `nvidia-nat-core`, and `oci` - update the MCP security documentation and compatibility tests to match the audited release profile ## Root cause PR NVIDIA-AI-Blueprints#413 exposed two release-branch-wide CI failures unrelated to its GPT compatibility diff: 1. NVIDIA Build began returning HTTP 202 for valid public model and documentation pages. `markdown-link-check` classified every such page as dead. 2. New `aiohttp` and `cryptography` advisories were published after the current MCP release lock was created. The required production audit correctly rejected the vulnerable versions. ## Validation - full `pre-commit run --all-files` - MCP suite: 238 passed, 18 skipped - CI script test harness: 11 passed, 0 failed - production-only MCP sync and runtime import canary - production vulnerability gate: 308 packages audited, 0 vulnerabilities - CycloneDX SBOM and license inventory generation - MCP wheel build and license-file assertion The local Docker daemon was not running, so the Compose health/protocol smoke was not reproduced locally; GitHub Actions will exercise that boundary. ## Summary by CodeRabbit * **Documentation** * Updated MCP release and security guidance for `cryptography` 50.0.0. * Clarified Linux x86_64 with CPython 3.13 support, container usage, and development-only platforms. * Documented unsupported macOS and 32-bit Windows configurations. * **Chores** * Updated dependency resolution and validation rules for the new security baseline. * Excluded NVIDIA Build URLs from automated Markdown link checking. * **Tests** * Expanded coverage for dependency compatibility and platform policy consistency. Authors: - Ajay Thorve (https://github.com/AjayThorve) Approvers: - Tanner Leach (https://github.com/tanleach) URL: NVIDIA-AI-Blueprints#415
cdgamarose-nv
pushed a commit
to cdgamarose-nv/aiq
that referenced
this pull request
Aug 10, 2026
#### Overview Some OpenAI-compatible frontier providers return the requested Pydantic contract as schema-valid JSON in ordinary assistant content instead of emitting the structured-output tool call. In deep research, that prevents `SourceRoutingPlan`, `ResearchPlan`, or `ResearchNotes` from reaching the persistence middleware and can leave the workflow retrying a completed stage. This change: - promotes exact, schema-valid JSON assistant content to the requested structured response; - makes at most one tools-disabled corrective call for empty or invalid plain-text responses, so the fallback cannot spiral; - leaves native structured responses and ordinary tool calls unchanged; - applies the compatibility middleware only at the source-router, planner, and researcher structured-response boundaries; and - updates the existing frontier profile to use the direct OpenAI provider with `OPENAI_API_KEY`: GPT Sol for orchestration, planning, and writing, and GPT Luna for source routing and research. The default Ultra profile is unchanged. #### DCO sign-off for the squash commit Signed-off-by: Ajay Thorve <athorve@nvidia.com> #### Validation - [x] `uv run ruff check .` - [x] `uv run pytest -q` — 2022 passed, 13 skipped - [x] Focused post-format run — 183 passed - [x] `uv run nat validate --config_file configs/config_frontier_models.yml` - [x] `uv run nat validate --config_file configs/config_web_default_llamaindex.yml` - [x] GPT Sol/Luna semantic smoke advanced through routing, planning, research, and writing with a non-sentinel cited report. - [x] Deterministic 20-task GPT DRB-II pilot completed with 20/20 generation and 20/20 official judge coverage. - [x] Patched-runtime Ultra regression smoke completed a DRB-II task with a 24.6k-character cited report, 1/1 clean collection, and no fallback correction. Harbor used one internal retry before the successful attempt. - [x] I added or updated tests for behavior changes. - [x] Documentation changes are not required; the user-facing frontier example config is updated directly. - [x] I confirmed this PR does not include secrets, credentials, internal endpoints, or internal-only data. - [x] I certify this contribution under the Developer Certificate of Origin (DCO) and signed my commit with `git commit -s`. - [x] I replaced the DCO sign-off placeholder with my GitHub commit identity and kept the required angle brackets around the email address. The remaining all-files Markdown-link and dependency-audit failures are release-branch-wide CI issues unrelated to this diff and are addressed separately by NVIDIA-AI-Blueprints#415. #### Where should reviewers start? Start with `StructuredResponseTextFallbackMiddleware` in `custom_middleware.py`, then its three placements in `factory.py`, and finally the direct-OpenAI Sol/Luna role split in `config_frontier_models.yml`. #### Related Issues - Relates to the model endpoint deprecation migration. ## Summary by CodeRabbit * **New Features** * Improved deep-research reliability by automatically correcting responses that do not match the expected structured format. * Preserved valid structured responses while retrying invalid responses without tool calls. * **Configuration** * Updated frontier-model workflows to use GPT Sol and GPT Luna for orchestration, planning, writing, routing, and research. * Updated model inference settings and token limits. * **Tests** * Added coverage for structured-response recovery, retry behavior, middleware integration, and frontier-model configuration. Authors: - Ajay Thorve (https://github.com/AjayThorve) Approvers: - Chantal D Gama Rose (https://github.com/cdgamarose-nv) URL: NVIDIA-AI-Blueprints#413
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
3 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
build.nvidia.combecause NVIDIA Build returns HTTP 202 for valid pages and the checker treats that response as deadaiohttp3.14.1 to 3.14.3 and fromcryptography48.0.1 to 50.0.0, resolving the newly published advisories blocking every PRlangchain-litellm,nvidia-nat-core, andociRoot cause
PR #413 exposed two release-branch-wide CI failures unrelated to its GPT compatibility diff:
markdown-link-checkclassified every such page as dead.aiohttpandcryptographyadvisories were published after the current MCP release lock was created. The required production audit correctly rejected the vulnerable versions.Validation
pre-commit run --all-filesThe local Docker daemon was not running, so the Compose health/protocol smoke was not reproduced locally; GitHub Actions will exercise that boundary.
Summary by CodeRabbit
Documentation
cryptography50.0.0.Chores
Tests