Merged
Conversation
Contributor
📝 WalkthroughWalkthroughUpdated GitHub Actions workflow to re-enable previously commented build-test-publish-wheel jobs with enhanced configuration. Version reference updated from v0.64.2 to v0.69.1, new configuration inputs added, and multiple job parameters and secrets restored with updated container image and runner configuration. Changes
Estimated code review effort🎯 2 (Simple) | ⏱️ ~12 minutes 🚥 Pre-merge checks | ✅ 4✅ Passed checks (4 passed)
✏️ Tip: You can configure your own custom pre-merge checks in the settings. ✨ Finishing touches🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
Contributor
There was a problem hiding this comment.
Actionable comments posted: 1
🤖 Fix all issues with AI agents
In @.github/workflows/build-test-publish-wheel.yml:
- Around line 72-95: The summary job build-test-publish-wheel-summary is calling
gh run view but lacks actions:read permission and masks errors with "|| echo 0",
causing false success; update the job to include permissions: { actions: read }
and set GH_TOKEN: ${{ github.token }} in the Result step's environment, remove
the "|| echo 0" error-masking so gh run view errors surface, and ensure both gh
run view invocations use the GH_TOKEN env so authorization failures are reported
instead of being treated as zero failed jobs.
Comment on lines
+72
to
+95
| build-test-publish-wheel-summary: | ||
| needs: [pre-flight, build-test-publish-wheel] | ||
| if: | | ||
| ( | ||
| needs.pre-flight.outputs.docs_only == 'true' | ||
| || needs.pre-flight.outputs.is_deployment_workflow == 'true' | ||
| || always() | ||
| ) | ||
| && !cancelled() | ||
| runs-on: ubuntu-latest | ||
| steps: | ||
| - name: Result | ||
| run: | | ||
| FAILED_JOBS=$(gh run view $GITHUB_RUN_ID --json jobs --jq '[.jobs[] | select(.status == "completed" and .conclusion != "success")] | length') || echo 0 | ||
|
|
||
| # if [ "${FAILED_JOBS:-0}" -eq 0 ] || [ "$SKIPPING_IS_ALLOWED" == "true" ]; then | ||
| # echo "✅ All previous jobs completed successfully" | ||
| # exit 0 | ||
| # else | ||
| # echo "❌ Found $FAILED_JOBS failed job(s)" | ||
| # # Show which jobs failed | ||
| # gh run view $GITHUB_RUN_ID --json jobs --jq '.jobs[] | select(.status == "completed" and .conclusion != "success") | .name' | ||
| # exit 1 | ||
| # fi | ||
| if [ "${FAILED_JOBS:-0}" -eq 0 ] || [ "$SKIPPING_IS_ALLOWED" == "true" ]; then | ||
| echo "✅ All previous jobs completed successfully" | ||
| exit 0 | ||
| else | ||
| echo "❌ Found $FAILED_JOBS failed job(s)" | ||
| # Show which jobs failed | ||
| gh run view $GITHUB_RUN_ID --json jobs --jq '.jobs[] | select(.status == "completed" and .conclusion != "success") | .name' | ||
| exit 1 | ||
| fi |
Contributor
There was a problem hiding this comment.
🧩 Analysis chain
🏁 Script executed:
find . -name "build-test-publish-wheel.yml" -type fRepository: NVIDIA-NeMo/Megatron-Bridge
Length of output: 119
🏁 Script executed:
cat -n .github/workflows/build-test-publish-wheel.ymlRepository: NVIDIA-NeMo/Megatron-Bridge
Length of output: 4293
🌐 Web query:
GitHub Actions gh cli run view required permissions actions:read
💡 Result:
To run gh run view inside a GitHub Actions workflow, authenticate gh with GH_TOKEN and ensure the workflow token has Actions read permission.
jobs:
view:
runs-on: ubuntu-latest
permissions:
actions: read # required for viewing workflow runs
contents: read # commonly needed if you also use actions/checkout
# checks: read # only needed if you use features that fetch annotations (e.g., gh run watch)
steps:
- uses: actions/checkout@v4
- run: gh run view ${{ github.run_id }} --log
env:
GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}Notes:
- In GitHub Actions, each step that uses
ghmust setGH_TOKENto a token with the required permissions/scopes. [1] - Grant/limit
GITHUB_TOKENpermissions via thepermissions:block. [2] - If you also need annotations (commonly via
gh run watch), you may needchecks: readin addition toactions: read. [3] actions/checkoutrecommendscontents: read. [4]
Sources: [1] [2] [3] [4]
🏁 Script executed:
# Verify if there's any job-level permission override in the summary job
sed -n '73,96p' .github/workflows/build-test-publish-wheel.yml | grep -i "permissions"Repository: NVIDIA-NeMo/Megatron-Bridge
Length of output: 53
gh run view fails silently due to missing actions:read permission.
The workflow's permission block (lines 28–30) grants only id-token: write and contents: read. The build-test-publish-wheel-summary job has no job-level permission override and calls gh run view on line 86 with error masking (|| echo 0), which hides the authorization failure and causes FAILED_JOBS to be set to 0. The job then exits with status 0, incorrectly reporting success even when the check itself failed. Line 94's second gh run view call is also unprotected and will fail without actions:read permission.
Add permissions: {actions: read} to the job and set GH_TOKEN: ${{ github.token }} in the step to grant the necessary access. Replace the error-masking || echo 0 with strict failure handling to catch and report permission errors.
Suggested fix
build-test-publish-wheel-summary:
needs: [pre-flight, build-test-publish-wheel]
if: |
(
needs.pre-flight.outputs.docs_only == 'true'
|| needs.pre-flight.outputs.is_deployment_workflow == 'true'
|| always()
)
&& !cancelled()
+ permissions:
+ actions: read
+ contents: read
runs-on: ubuntu-latest
steps:
- name: Result
+ env:
+ GH_TOKEN: ${{ github.token }}
run: |
- FAILED_JOBS=$(gh run view $GITHUB_RUN_ID --json jobs --jq '[.jobs[] | select(.status == "completed" and .conclusion != "success")] | length') || echo 0
+ FAILED_JOBS=$(gh run view $GITHUB_RUN_ID --json jobs --jq '[.jobs[] | select(.status == "completed" and .conclusion != "success")] | length') || { echo "gh run view failed"; exit 1; }📝 Committable suggestion
‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.
Suggested change
| build-test-publish-wheel-summary: | |
| needs: [pre-flight, build-test-publish-wheel] | |
| if: | | |
| ( | |
| needs.pre-flight.outputs.docs_only == 'true' | |
| || needs.pre-flight.outputs.is_deployment_workflow == 'true' | |
| || always() | |
| ) | |
| && !cancelled() | |
| runs-on: ubuntu-latest | |
| steps: | |
| - name: Result | |
| run: | | |
| FAILED_JOBS=$(gh run view $GITHUB_RUN_ID --json jobs --jq '[.jobs[] | select(.status == "completed" and .conclusion != "success")] | length') || echo 0 | |
| # if [ "${FAILED_JOBS:-0}" -eq 0 ] || [ "$SKIPPING_IS_ALLOWED" == "true" ]; then | |
| # echo "✅ All previous jobs completed successfully" | |
| # exit 0 | |
| # else | |
| # echo "❌ Found $FAILED_JOBS failed job(s)" | |
| # # Show which jobs failed | |
| # gh run view $GITHUB_RUN_ID --json jobs --jq '.jobs[] | select(.status == "completed" and .conclusion != "success") | .name' | |
| # exit 1 | |
| # fi | |
| if [ "${FAILED_JOBS:-0}" -eq 0 ] || [ "$SKIPPING_IS_ALLOWED" == "true" ]; then | |
| echo "✅ All previous jobs completed successfully" | |
| exit 0 | |
| else | |
| echo "❌ Found $FAILED_JOBS failed job(s)" | |
| # Show which jobs failed | |
| gh run view $GITHUB_RUN_ID --json jobs --jq '.jobs[] | select(.status == "completed" and .conclusion != "success") | .name' | |
| exit 1 | |
| fi | |
| build-test-publish-wheel-summary: | |
| needs: [pre-flight, build-test-publish-wheel] | |
| if: | | |
| ( | |
| needs.pre-flight.outputs.docs_only == 'true' | |
| || needs.pre-flight.outputs.is_deployment_workflow == 'true' | |
| || always() | |
| ) | |
| && !cancelled() | |
| permissions: | |
| actions: read | |
| contents: read | |
| runs-on: ubuntu-latest | |
| steps: | |
| - name: Result | |
| env: | |
| GH_TOKEN: ${{ github.token }} | |
| run: | | |
| FAILED_JOBS=$(gh run view $GITHUB_RUN_ID --json jobs --jq '[.jobs[] | select(.status == "completed" and .conclusion != "success")] | length') || { echo "gh run view failed"; exit 1; } | |
| if [ "${FAILED_JOBS:-0}" -eq 0 ] || [ "$SKIPPING_IS_ALLOWED" == "true" ]; then | |
| echo "✅ All previous jobs completed successfully" | |
| exit 0 | |
| else | |
| echo "❌ Found $FAILED_JOBS failed job(s)" | |
| # Show which jobs failed | |
| gh run view $GITHUB_RUN_ID --json jobs --jq '.jobs[] | select(.status == "completed" and .conclusion != "success") | .name' | |
| exit 1 | |
| fi |
🤖 Prompt for AI Agents
In @.github/workflows/build-test-publish-wheel.yml around lines 72 - 95, The
summary job build-test-publish-wheel-summary is calling gh run view but lacks
actions:read permission and masks errors with "|| echo 0", causing false
success; update the job to include permissions: { actions: read } and set
GH_TOKEN: ${{ github.token }} in the Result step's environment, remove the "||
echo 0" error-masking so gh run view errors surface, and ensure both gh run view
invocations use the GH_TOKEN env so authorization failures are reported instead
of being treated as zero failed jobs.
Signed-off-by: oliver könig <okoenig@nvidia.com>
Signed-off-by: oliver könig <okoenig@nvidia.com>
Signed-off-by: oliver könig <okoenig@nvidia.com>
Signed-off-by: oliver könig <okoenig@nvidia.com>
thomasdhc
reviewed
Feb 4, 2026
thomasdhc
previously approved these changes
Feb 4, 2026
thomasdhc
previously approved these changes
Feb 4, 2026
Signed-off-by: oliver könig <okoenig@nvidia.com>
Signed-off-by: oliver könig <okoenig@nvidia.com>
Signed-off-by: oliver könig <okoenig@nvidia.com>
This was referenced Feb 18, 2026
Merged
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What does this PR do ?
Add a one line overview of what this PR aims to accomplish.
Changelog
GitHub Actions CI
See the CI sectionin the Contributing doc for how to trigger the CI. A Nvidia developer will need to approve and trigger the CI for external contributors.
Before your PR is "Ready for review"
Pre checks:
If you haven't finished some of the above items you can still open "Draft" PR.
Additional Information
Summary by CodeRabbit