[ci] fix: resolve test matrix from the PR merge commit, not the head

.github/workflows/cicd-main.yml

@@ -89,12 +89,26 @@ jobs:
       expect_l1:         ${{ steps.configure.outputs.expect_l1 }}
       expect_l2:         ${{ steps.configure.outputs.expect_l2 }}
       perf_scripts_only: ${{ steps.configure.outputs.perf_scripts_only }}
+      merge_sha:         ${{ steps.merge-sha.outputs.merge_sha }}
     steps:
       - name: Get PR info
         id: get-pr-info
         if: startsWith(github.ref, 'refs/heads/pull-request/')
         uses: nv-gha-runners/get-pr-info@main
 
+      - name: Resolve merge commit sha
+        id: merge-sha
+        shell: bash -e -u -o pipefail {0}
+        env:
+          IS_PR: ${{ startsWith(github.ref, 'refs/heads/pull-request/') }}
+        run: |
+          if [[ "$IS_PR" == "true" ]]; then
+            SHA=${{ fromJSON(steps.get-pr-info.outputs.pr-info || '{}').merge_commit_sha }}
+          else
+            SHA=${GITHUB_SHA}
+          fi
+          echo "merge_sha=${SHA}" | tee -a "$GITHUB_OUTPUT"
+
       - name: Configure
         id: configure
         shell: bash -x -e -u -o pipefail {0}
@@ -220,7 +234,7 @@ jobs:
   lint-check:
     name: Lint check
     runs-on: ubuntu-latest
-    needs: [pre-flight]
+    needs: [pre-flight, configure]
     if: |
       needs.pre-flight.outputs.is_deployment_workflow == 'false'
       || github.event_name == 'workflow_dispatch'
@@ -229,6 +243,7 @@ jobs:
         uses: actions/checkout@v6
         with:
           submodules: "recursive"
+          ref: ${{ needs.configure.outputs.merge_sha }}
 
       - name: Update MCore submodule (if triggered from MCore)
         if: ${{ github.event.inputs.mcore_ref != '' }}
@@ -325,24 +340,11 @@ jobs:
         if: startsWith(github.ref, 'refs/heads/pull-request/')
         uses: nv-gha-runners/get-pr-info@main
 
-      - name: Get merge commit sha
-        shell: bash -x -e -u -o pipefail {0}
-        id: sha
-        env:
-          IS_PR: ${{ startsWith(github.ref, 'refs/heads/pull-request/') }}
-        run: |
-          if [[ "$IS_PR" == "true" ]]; then
-            SHA=${{ fromJSON(steps.get-pr-info.outputs.pr-info || '{}').merge_commit_sha }}
-          else
-            SHA=${GITHUB_SHA}
-          fi
-          echo "main=${SHA}" | tee -a "$GITHUB_OUTPUT"
-
       - name: Checkout
         uses: actions/checkout@v6
         with:
           submodules: recursive
-          ref: ${{ steps.sha.outputs.main }}
+          ref: ${{ needs.configure.outputs.merge_sha }}
 
       - name: Update MCore submodule (if triggered from MCore)
         if: ${{ github.event.inputs.mcore_ref != '' }}
@@ -464,7 +466,7 @@ jobs:
           no-cache: false
           tags: |
             ${{ matrix.registry }}/megatron-bridge:${{ steps.cache_keys.outputs.key }}
-            ${{ matrix.registry }}/megatron-bridge:${{ github.sha }}
+            ${{ matrix.registry }}/megatron-bridge:${{ needs.configure.outputs.merge_sha }}
           secrets: |
             GH_TOKEN=${{ secrets.PAT }}
 
@@ -484,11 +486,13 @@ jobs:
     steps:
       - name: Checkout
         uses: actions/checkout@v6
+        with:
+          ref: ${{ needs.configure.outputs.merge_sha }}
 
       - name: Run venv import check
         shell: bash -e -u -o pipefail {0}
         env:
-          IMAGE: ${{ needs.pre-flight.outputs.registry }}/megatron-bridge:${{ github.sha }}
+          IMAGE: ${{ needs.pre-flight.outputs.registry }}/megatron-bridge:${{ needs.configure.outputs.merge_sha }}
         run: |
           docker run --rm \
             -v "${{ github.workspace }}/docker/common:/opt/import-check:ro" \
@@ -507,7 +511,7 @@ jobs:
       )
       && !cancelled()
       && (github.event.inputs.test_suite == '' || github.event.inputs.test_suite == 'all' || github.event.inputs.test_suite == 'unit-only' || contains('L0 L1 L2', github.event.inputs.test_suite))
-    needs: [pre-flight, cicd-wait-in-queue, cicd-container-build]
+    needs: [pre-flight, configure, cicd-wait-in-queue, cicd-container-build]
     runs-on: ${{ needs.pre-flight.outputs.runner_prefix }}
     name: Launch_Unit_Tests_Core
     env:
@@ -518,6 +522,7 @@ jobs:
         uses: actions/checkout@v6
         with:
           submodules: recursive
+          ref: ${{ needs.configure.outputs.merge_sha }}
 
       - name: main
         uses: ./.github/actions/test-template
@@ -526,7 +531,7 @@ jobs:
           timeout: 18
           is_unit_test: "true"
           PAT: ${{ secrets.PAT }}
-          container-image: ${{ needs.pre-flight.outputs.registry }}/megatron-bridge:${{ github.sha }}
+          container-image: ${{ needs.pre-flight.outputs.registry }}/megatron-bridge:${{ needs.configure.outputs.merge_sha }}
           test-data-path: ${{ needs.pre-flight.outputs.test_data_path }}
           runner: ${{ needs.pre-flight.outputs.runner_prefix }}
 
@@ -540,7 +545,7 @@ jobs:
       )
       && !cancelled()
       && (github.event.inputs.test_suite == '' || github.event.inputs.test_suite == 'all' || github.event.inputs.test_suite == 'unit-only' || contains('L0 L1 L2', github.event.inputs.test_suite))
-    needs: [pre-flight, cicd-wait-in-queue, cicd-container-build]
+    needs: [pre-flight, configure, cicd-wait-in-queue, cicd-container-build]
     runs-on: ${{ needs.pre-flight.outputs.runner_prefix }}
     name: Launch_Unit_Tests_Diffusion
     env:
@@ -551,6 +556,7 @@ jobs:
         uses: actions/checkout@v6
         with:
           submodules: recursive
+          ref: ${{ needs.configure.outputs.merge_sha }}
 
       - name: main
         uses: ./.github/actions/test-template
@@ -559,12 +565,12 @@ jobs:
           timeout: 18
           is_unit_test: "true"
           PAT: ${{ secrets.PAT }}
-          container-image: ${{ needs.pre-flight.outputs.registry }}/megatron-bridge:${{ github.sha }}
+          container-image: ${{ needs.pre-flight.outputs.registry }}/megatron-bridge:${{ needs.configure.outputs.merge_sha }}
           test-data-path: ${{ needs.pre-flight.outputs.test_data_path }}
           runner: ${{ needs.pre-flight.outputs.runner_prefix }}
 
   generate-test-matrix:
-    needs: [pre-flight, cicd-container-build]
+    needs: [pre-flight, configure, cicd-container-build]
     runs-on: ubuntu-latest
     outputs:
       matrix_l0: ${{ steps.scan.outputs.matrix_l0 }}
@@ -581,6 +587,8 @@ jobs:
       && !cancelled()
     steps:
       - uses: actions/checkout@v6
+        with:
+          ref: ${{ needs.configure.outputs.merge_sha }}
       - id: scan
         shell: bash
         env:
@@ -629,7 +637,7 @@ jobs:
       fail-fast: false
       max-parallel: 16
       matrix: ${{ fromJSON(needs.generate-test-matrix.outputs.matrix_l0) }}
-    needs: [pre-flight, generate-test-matrix, cicd-unit-tests-core, cicd-unit-tests-diffusion]
+    needs: [pre-flight, configure, generate-test-matrix, cicd-unit-tests-core, cicd-unit-tests-diffusion]
     runs-on: ${{ matrix.runner }}
     if: |
       (
@@ -650,6 +658,7 @@ jobs:
         uses: actions/checkout@v6
         with:
           submodules: recursive
+          ref: ${{ needs.configure.outputs.merge_sha }}
 
       - name: main
         uses: ./.github/actions/test-template
@@ -658,7 +667,7 @@ jobs:
           timeout: ${{ fromJSON(matrix.timeout || '30') }}
           is_unit_test: "false"
           PAT: ${{ secrets.PAT }}
-          container-image: ${{ needs.pre-flight.outputs.registry }}/megatron-bridge:${{ github.sha }}
+          container-image: ${{ needs.pre-flight.outputs.registry }}/megatron-bridge:${{ needs.configure.outputs.merge_sha }}
           test-data-path: ${{ needs.pre-flight.outputs.test_data_path }}
           runner: ${{ matrix.runner }}
 
@@ -690,6 +699,7 @@ jobs:
         uses: actions/checkout@v6
         with:
           submodules: recursive
+          ref: ${{ needs.configure.outputs.merge_sha }}
 
       - name: main
         uses: ./.github/actions/test-template
@@ -698,7 +708,7 @@ jobs:
           timeout: ${{ fromJSON(matrix.timeout || '30') }}
           is_unit_test: "false"
           PAT: ${{ secrets.PAT }}
-          container-image: ${{ needs.pre-flight.outputs.registry }}/megatron-bridge:${{ github.sha }}
+          container-image: ${{ needs.pre-flight.outputs.registry }}/megatron-bridge:${{ needs.configure.outputs.merge_sha }}
           test-data-path: ${{ needs.pre-flight.outputs.test_data_path }}
           runner: ${{ matrix.runner }}
 
@@ -730,6 +740,7 @@ jobs:
         uses: actions/checkout@v6
         with:
           submodules: recursive
+          ref: ${{ needs.configure.outputs.merge_sha }}
 
       - name: main
         uses: ./.github/actions/test-template
@@ -738,7 +749,7 @@ jobs:
           timeout: ${{ fromJSON(matrix.timeout || '30') }}
           is_unit_test: "false"
           PAT: ${{ secrets.PAT }}
-          container-image: ${{ needs.pre-flight.outputs.registry }}/megatron-bridge:${{ github.sha }}
+          container-image: ${{ needs.pre-flight.outputs.registry }}/megatron-bridge:${{ needs.configure.outputs.merge_sha }}
           test-data-path: ${{ needs.pre-flight.outputs.test_data_path }}
           runner: ${{ matrix.runner }}
 
@@ -748,7 +759,7 @@ jobs:
       fail-fast: false
       max-parallel: 16
       matrix: ${{ fromJSON(needs.generate-test-matrix.outputs.matrix_flaky) }}
-    needs: [pre-flight, generate-test-matrix, cicd-unit-tests-core, cicd-unit-tests-diffusion]
+    needs: [pre-flight, configure, generate-test-matrix, cicd-unit-tests-core, cicd-unit-tests-diffusion]
     runs-on: ${{ matrix.runner }}
     name: ${{ matrix.script }}
     env:
@@ -760,6 +771,7 @@ jobs:
         uses: actions/checkout@v6
         with:
           submodules: recursive
+          ref: ${{ needs.configure.outputs.merge_sha }}
 
       - name: main
         uses: ./.github/actions/test-template
@@ -769,12 +781,12 @@ jobs:
           timeout: ${{ fromJSON(matrix.timeout || '30') }}
           is_unit_test: "false"
           PAT: ${{ secrets.PAT }}
-          container-image: ${{ needs.pre-flight.outputs.registry }}/megatron-bridge:${{ github.sha }}
+          container-image: ${{ needs.pre-flight.outputs.registry }}/megatron-bridge:${{ needs.configure.outputs.merge_sha }}
           test-data-path: ${{ needs.pre-flight.outputs.test_data_path }}
           runner: ${{ matrix.runner }}
 
   generate-gb200-test-matrix:
-    needs: [pre-flight, cicd-container-build]
+    needs: [pre-flight, configure, cicd-container-build]
     runs-on: ubuntu-latest
     outputs:
       matrix_gb200_l0:    ${{ steps.scan.outputs.matrix_gb200_l0 }}
@@ -792,6 +804,8 @@ jobs:
       && needs.pre-flight.outputs.is_member == 'true'
     steps:
       - uses: actions/checkout@v6
+        with:
+          ref: ${{ needs.configure.outputs.merge_sha }}
       - id: scan
         shell: bash
         run: |
@@ -838,7 +852,7 @@ jobs:
       fail-fast: false
       max-parallel: 16
       matrix: ${{ fromJSON(needs.generate-gb200-test-matrix.outputs.matrix_gb200_l0) }}
-    needs: [pre-flight, generate-gb200-test-matrix, cicd-unit-tests-core, cicd-unit-tests-diffusion]
+    needs: [pre-flight, configure, generate-gb200-test-matrix, cicd-unit-tests-core, cicd-unit-tests-diffusion]
     runs-on: ${{ matrix.runner }}
     if: |
       (
@@ -861,6 +875,7 @@ jobs:
         uses: actions/checkout@v6
         with:
           submodules: recursive
+          ref: ${{ needs.configure.outputs.merge_sha }}
 
       - name: main
         uses: ./.github/actions/test-template
@@ -874,7 +889,7 @@ jobs:
           azure-tenant-id: ${{ secrets.AZURE_TENANT_ID }}
           azure-subscription-id: ${{ secrets.AZURE_SUBSCRIPTION_ID }}
           PAT: ${{ secrets.PAT }}
-          container-image: ${{ env.container-registry-gb200 }}/megatron-bridge:${{ github.sha }}
+          container-image: ${{ env.container-registry-gb200 }}/megatron-bridge:${{ needs.configure.outputs.merge_sha }}
           test-data-path: ${{ needs.pre-flight.outputs.test_data_path }}
           runner: ${{ matrix.runner }}
 
@@ -908,6 +923,7 @@ jobs:
         uses: actions/checkout@v6
         with:
           submodules: recursive
+          ref: ${{ needs.configure.outputs.merge_sha }}
 
       - name: main
         uses: ./.github/actions/test-template
@@ -921,7 +937,7 @@ jobs:
           azure-tenant-id: ${{ secrets.AZURE_TENANT_ID }}
           azure-subscription-id: ${{ secrets.AZURE_SUBSCRIPTION_ID }}
           PAT: ${{ secrets.PAT }}
-          container-image: ${{ env.container-registry-gb200 }}/megatron-bridge:${{ github.sha }}
+          container-image: ${{ env.container-registry-gb200 }}/megatron-bridge:${{ needs.configure.outputs.merge_sha }}
           test-data-path: ${{ needs.pre-flight.outputs.test_data_path }}
           runner: ${{ matrix.runner }}
 
@@ -955,6 +971,7 @@ jobs:
         uses: actions/checkout@v6
         with:
           submodules: recursive
+          ref: ${{ needs.configure.outputs.merge_sha }}
 
       - name: main
         uses: ./.github/actions/test-template
@@ -968,7 +985,7 @@ jobs:
           azure-tenant-id: ${{ secrets.AZURE_TENANT_ID }}
           azure-subscription-id: ${{ secrets.AZURE_SUBSCRIPTION_ID }}
           PAT: ${{ secrets.PAT }}
-          container-image: ${{ env.container-registry-gb200 }}/megatron-bridge:${{ github.sha }}
+          container-image: ${{ env.container-registry-gb200 }}/megatron-bridge:${{ needs.configure.outputs.merge_sha }}
           test-data-path: ${{ needs.pre-flight.outputs.test_data_path }}
           runner: ${{ matrix.runner }}
 
@@ -978,7 +995,7 @@ jobs:
       fail-fast: false
       max-parallel: 16
       matrix: ${{ fromJSON(needs.generate-gb200-test-matrix.outputs.matrix_gb200_flaky) }}
-    needs: [pre-flight, generate-gb200-test-matrix, cicd-unit-tests-core, cicd-unit-tests-diffusion]
+    needs: [pre-flight, configure, generate-gb200-test-matrix, cicd-unit-tests-core, cicd-unit-tests-diffusion]
     runs-on: ${{ matrix.runner }}
     name: gb200_${{ matrix.script }}
     environment: ${{ contains(needs.pre-flight.outputs.registry, 'azure') && 'nemo-ci' || '' }}
@@ -991,6 +1008,7 @@ jobs:
         uses: actions/checkout@v6
         with:
           submodules: recursive
+          ref: ${{ needs.configure.outputs.merge_sha }}
 
       - name: main
         uses: ./.github/actions/test-template
@@ -1004,7 +1022,7 @@ jobs:
           azure-tenant-id: ${{ secrets.AZURE_TENANT_ID }}
           azure-subscription-id: ${{ secrets.AZURE_SUBSCRIPTION_ID }}
           PAT: ${{ secrets.PAT }}
-          container-image: ${{ env.container-registry-gb200 }}/megatron-bridge:${{ github.sha }}
+          container-image: ${{ env.container-registry-gb200 }}/megatron-bridge:${{ needs.configure.outputs.merge_sha }}
           test-data-path: ${{ needs.pre-flight.outputs.test_data_path }}
           runner: ${{ matrix.runner }}
 
@@ -1027,6 +1045,8 @@ jobs:
     steps:
       - name: Checkout
         uses: actions/checkout@v6
+        with:
+          ref: ${{ needs.configure.outputs.merge_sha }}
 
       - name: Get workflow result
         id: result
@@ -1126,6 +1146,8 @@ jobs:
 
       - name: Checkout
         uses: actions/checkout@v6
+        with:
+          ref: ${{ needs.configure.outputs.merge_sha }}
 
       - name: Download coverage reports of current branch
         uses: actions/download-artifact@v7