feat: package CLI for PyPI and npm - #569
Conversation
Signed-off-by: Will Killian <wkillian@nvidia.com>
github-actions
Bot
added
size:L
|
No actionable comments were generated in the recent review. 🎉 ℹ️ Recent review info⚙️ Run configurationConfiguration used: Path: .coderabbit.yaml Review profile: ASSERTIVE Plan: Enterprise Run ID: ⛔ Files ignored due to path filters (1)
📒 Files selected for processing (6)
📜 Recent review details⏰ Context from checks skipped due to timeout. (2)
🧰 Additional context used📓 Path-based instructions (14)**/*.{md,rst,html,txt}📄 CodeRabbit inference engine (.agents/skills/review-doc-style/assets/nvidia-style-brand-terminology.md)
Files:
**/*.{md,rst,html}📄 CodeRabbit inference engine (.agents/skills/review-doc-style/assets/nvidia-style-brand-terminology.md)
Files:
**/*.{md,rst,txt}📄 CodeRabbit inference engine (.agents/skills/review-doc-style/assets/nvidia-style-guide.md)
Files:
**/*.{md,rst}📄 CodeRabbit inference engine (.agents/skills/review-doc-style/assets/nvidia-style-guide.md)
Files:
**/*.md📄 CodeRabbit inference engine (.agents/skills/review-doc-style/assets/nvidia-style-technical-docs.md)
Files:
**/*.{md,mdx}📄 CodeRabbit inference engine (AGENTS.md)
Files:
**/*.{md,markdown,mdx}📄 CodeRabbit inference engine (CONTRIBUTING.md)
Files:
**/*📄 CodeRabbit inference engine (.agents/skills/validate-change/SKILL.md)
Files:
.github/workflows/*.{yml,yaml}📄 CodeRabbit inference engine (.agents/skills/maintain-ci/SKILL.md)
Files:
{justfile,codecov.yml,codecov.yaml,.github/workflows/**/*.yml,.github/workflows/**/*.yaml}📄 CodeRabbit inference engine (.agents/skills/maintain-dynamic-plugins/SKILL.md)
Files:
{.github/**,.gitlab-ci.yml,.pre-commit-config.yaml,justfile,scripts/**}⚙️ CodeRabbit configuration file
Files:
.gitlab-ci.yml📄 CodeRabbit inference engine (.agents/skills/maintain-packaging/SKILL.md)
Files:
RELEASING.md📄 CodeRabbit inference engine (.agents/skills/maintain-ci/SKILL.md)
Files:
{docs/**,README.md,CONTRIBUTING.md,RELEASING.md,SECURITY.md}⚙️ CodeRabbit configuration file
Files:
🧠 Learnings (3)📚 Learning: 2026-05-03T04:23:07.497ZApplied to files:
📚 Learning: 2026-04-15T18:16:52.951ZApplied to files:
📚 Learning: 2026-05-01T13:41:07.485ZApplied to files:
🪛 zizmor (1.28.0).github/workflows/ci_rust.yml[warning] 314-314: code injection via template expansion (template-injection): may expand into attacker-controllable code (template-injection) 🔇 Additional comments (8)
WalkthroughThis change adds cross-platform CLI binary packaging for PyPI and npm, integrates split artifact creation and publishing into GitHub and GitLab CI, adds version synchronization and packaging tests, and updates installation and release documentation. ChangesCLI Binary Distribution
Estimated code review effort: 4 (Complex) | ~45 minutes Sequence Diagram(s)sequenceDiagram
participant RustPackageJob
participant PackageCliBin
participant ArtifactStore
participant PublishJobs
RustPackageJob->>PackageCliBin: package staged binary for target and version
PackageCliBin->>ArtifactStore: upload wheel and npm tarball artifacts
ArtifactStore->>PublishJobs: download split CLI and Node artifacts
PublishJobs->>PublishJobs: generate checksums and publish packages
Possibly related PRs
🚥 Pre-merge checks | ✅ 5✅ Passed checks (5 passed)
✨ Finishing Touches🧪 Generate unit tests (beta)
Comment |
License DiffCompared against Lockfile license changesLockfile License ChangesRustAdded
Removed
Updated/Changed
|
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 3
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In `@crates/cli/README.md`:
- Around line 65-81: Update the installation section in the README so each code
block is introduced by a complete, descriptive sentence rather than the labels
“PyPI,” “npm,” and “Python API package extra.” Use wording that clearly
identifies the package source and, for the optional extra, explains that it
installs the Python API with the matching CLI.
In `@README.md`:
- Around line 55-63: Update the preceding quick-start prose in README.md to
reference nemo-relay-cli-bin, or use the generic name “NeMo Relay CLI,” so it
matches the Python and npm installation commands.
In `@scripts/package-cli-bin.py`:
- Line 145: Update the LICENSE reads in build_wheel, build_npm_platform, and
build_npm_launcher to resolve the file relative to scripts/package-cli-bin.py
(or the module’s established script-directory symbol), rather than the process
current working directory. Preserve the existing behavior while ensuring these
functions work when called directly from any directory.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Path: .coderabbit.yaml
Review profile: ASSERTIVE
Plan: Enterprise
Run ID: 144540cc-df23-464d-b19e-1a2b31f2310e
⛔ Files ignored due to path filters (2)
package-lock.jsonis excluded by!**/package-lock.jsonuv.lockis excluded by!**/*.lock
📒 Files selected for processing (17)
.github/ci-path-filters.yml.github/workflows/ci.yaml.github/workflows/ci_check.yml.github/workflows/ci_rust.yml.gitlab-ci.ymlREADME.mdRELEASING.mdcrates/cli/README.mddocs/getting-started/installation.mdxjustfilepackage.jsonpackages/cli-bin/package.jsonpyproject.tomlpython/cli-bin/pyproject.tomlpython/cli-bin/src/nemo_relay_cli_bin/__init__.pyscripts/package-cli-bin.pyscripts/tests/test_package_cli_bin.py
📜 Review details
🧰 Additional context used
📓 Path-based instructions (33)
**/*.{rs,py}
📄 CodeRabbit inference engine (AGENTS.md)
Follow binding naming conventions in Rust and Python: use
snake_case.
Files:
python/cli-bin/src/nemo_relay_cli_bin/__init__.pyscripts/tests/test_package_cli_bin.pyscripts/package-cli-bin.py
**/*.{rs,py,js,mjs,cjs,ts,tsx}
📄 CodeRabbit inference engine (AGENTS.md)
**/*.{rs,py,js,mjs,cjs,ts,tsx}: UseJson = serde_json::Valuein Rust-facing runtime APIs where the existing code expects JSON payloads.
UseResult<T>withFlowErrorin core runtime paths, and keep errors explicit and binding-appropriate at the wrapper layer.
Keep async behavior on the existing tokio-based model; bindings should preserve callback and future lifetimes rather than blocking or hiding async work unexpectedly.
Files:
python/cli-bin/src/nemo_relay_cli_bin/__init__.pyscripts/tests/test_package_cli_bin.pyscripts/package-cli-bin.py
**/*.py
📄 CodeRabbit inference engine (CONTRIBUTING.md)
**/*.py: When changing the Python wrapper package, tests, or docs tooling, lint with Ruff (E,F,W,I), format with Ruff formatter (120-character lines, double quotes), and passtytype checking.
Add the SPDX license header to all Python source files using the#comment form.
Files:
python/cli-bin/src/nemo_relay_cli_bin/__init__.pyscripts/tests/test_package_cli_bin.pyscripts/package-cli-bin.py
**/*.{rs,py,go,js,ts,c,h}
📄 CodeRabbit inference engine (CONTRIBUTING.md)
Use language-appropriate naming conventions: Rust
snake_case, C FFI exports prefixednemo_relay_, GoPascalCase, Node.jscamelCase, and Pythonsnake_case.
Files:
python/cli-bin/src/nemo_relay_cli_bin/__init__.pyscripts/tests/test_package_cli_bin.pyscripts/package-cli-bin.py
{crates/**/src/**/*.rs,python/**/*.py}
📄 CodeRabbit inference engine (.agents/skills/maintain-dynamic-plugins/SKILL.md)
Do not add tests under
src; Rust tests belong in cratetests/trees, and Python SDK tests belong underpython/tests.
Files:
python/cli-bin/src/nemo_relay_cli_bin/__init__.py
**/*.{py,go,js,ts}
📄 CodeRabbit inference engine (.agents/skills/maintain-observability/SKILL.md)
Keep Python, Go, and Node.js config objects and subscriber/exporter methods aligned so all bindings expose the same logical knobs and semantics.
Files:
python/cli-bin/src/nemo_relay_cli_bin/__init__.pyscripts/tests/test_package_cli_bin.pyscripts/package-cli-bin.py
**/*
📄 CodeRabbit inference engine (.agents/skills/validate-change/SKILL.md)
**/*: Format changed files with the language-native formatter before the final lint/test pass.
If dynamic plugin behavior changed, usemaintain-dynamic-pluginsand include the native SDK, worker protocol, Python SDK, docs, packaging, and Codecov surfaces in the validation plan.
If code changes alter APIs, bindings, commands, paths, packaging behavior, observability/adaptive semantics, or documented best practices, update any dependent maintainer or consumer skills in the same branch.
During iteration, preferuv run pre-commit run --files <changed files...>.
Before review or handoff, runuv run pre-commit run --all-files.
Files:
python/cli-bin/src/nemo_relay_cli_bin/__init__.pypackages/cli-bin/package.jsonpython/cli-bin/pyproject.tomlscripts/tests/test_package_cli_bin.pypyproject.tomlREADME.mdpackage.jsoncrates/cli/README.mddocs/getting-started/installation.mdxRELEASING.mdjustfilescripts/package-cli-bin.py
**/*.{rs,py,go,js,ts}
📄 CodeRabbit inference engine (.agents/skills/validate-change/SKILL.md)
If a language surface changed, always run that language's test target even when Rust core did not change.
Files:
python/cli-bin/src/nemo_relay_cli_bin/__init__.pyscripts/tests/test_package_cli_bin.pyscripts/package-cli-bin.py
**/*.{rs,py,js,ts,tsx,go,java,kt,swift}
📄 CodeRabbit inference engine (.agents/skills/add-middleware/SKILL.md)
Add tests covering registration and duplicate names, deregistration and missing names, priority ordering, callback failure policy, scope-local inheritance and cleanup, event payload semantics, immutable mark and scope fields, and parity across affected bindings.
Files:
python/cli-bin/src/nemo_relay_cli_bin/__init__.pyscripts/tests/test_package_cli_bin.pyscripts/package-cli-bin.py
**/*.toml
📄 CodeRabbit inference engine (CONTRIBUTING.md)
Add the SPDX license header to all TOML files using the
#comment form.
Files:
python/cli-bin/pyproject.tomlpyproject.toml
{.github/**,.gitlab-ci.yml,.pre-commit-config.yaml,justfile,scripts/**}
⚙️ CodeRabbit configuration file
{.github/**,.gitlab-ci.yml,.pre-commit-config.yaml,justfile,scripts/**}: Review automation changes for reproducibility, pinned versions where appropriate, secret handling, and consistency with the documented validation matrix.
Pay attention to commands that need generated native artifacts, FFI libraries, or platform-specific environment variables.
Files:
scripts/tests/test_package_cli_bin.py.github/workflows/ci_check.yml.github/workflows/ci.yaml.github/workflows/ci_rust.yml.gitlab-ci.yml.github/ci-path-filters.ymljustfilescripts/package-cli-bin.py
pyproject.toml
📄 CodeRabbit inference engine (.agents/skills/maintain-packaging/SKILL.md)
Keep Python packaging metadata in the root
pyproject.tomlconsistent with the package’s published name, imports, and build behavior.
Files:
pyproject.toml
**/*.{md,rst,html,txt}
📄 CodeRabbit inference engine (.agents/skills/review-doc-style/assets/nvidia-style-brand-terminology.md)
**/*.{md,rst,html,txt}: Always spellNVIDIAin all caps. Do not useNvidia,nvidia,nVidia,nVIDIA, orNV.
Usean NVIDIAbefore a noun because the name starts with an 'en' sound.
Do not add a registered trademark symbol afterNVIDIAwhen referring to the company.
Use trademark symbols with product names only when the document type or legal guidance requires them.
Verify official capitalization, spacing, and hyphenation for product names.
Precede NVIDIA product names withNVIDIAon first mention when it is natural and accurate.
Do not rewrite product names for grammar or title-case rules.
Preserve third-party product names according to the owner's spelling.
Include the company name and full model qualifier on first use when it helps identify the model.
Preserve the official capitalization and punctuation of model names.
Use shorter family names only after the full name is established.
Spell out a term on first use and put the acronym in parentheses unless the acronym is widely understood by the intended audience.
Use the acronym on later mentions after it has been defined.
For long documents, reintroduce the full term if readers might lose context.
Form plurals of acronyms withs, not an apostrophe, such asGPUs.
In headings, common acronyms can remain abbreviated. Spell out the term in the first or second sentence of the body.
Common terms such asCPU,GPU,PC,API, andUIusually do not need to be spelled out for developer audiences.
Files:
README.mdcrates/cli/README.mdRELEASING.md
**/*.{md,rst,html}
📄 CodeRabbit inference engine (.agents/skills/review-doc-style/assets/nvidia-style-brand-terminology.md)
Link the first mention of a product name when the destination helps the reader.
Files:
README.mdcrates/cli/README.mdRELEASING.md
**/*.{md,rst,txt}
📄 CodeRabbit inference engine (.agents/skills/review-doc-style/assets/nvidia-style-guide.md)
Spell
NVIDIAin all caps. Do not useNvidia,nvidia, orNV.
Files:
README.mdcrates/cli/README.mdRELEASING.md
**/*.{md,rst}
📄 CodeRabbit inference engine (.agents/skills/review-doc-style/assets/nvidia-style-guide.md)
**/*.{md,rst}: Format commands, code elements, expressions, package names, file names, and paths as inline code.
Use descriptive link text. Avoid raw URLs and weak anchors such as "here" or "read more."
Use title case consistently for technical documentation headings.
Introduce code blocks, lists, tables, and images with complete sentences.
Write procedures as imperative steps. Keep steps parallel and split long procedures into smaller tasks.
Prefer active voice, present tense, short sentences, contractions, and plain English.
Usecanfor possibility and reservemayfor permission.
Useafterfor temporal relationships instead ofonce.
Preferrefer tooverseewhen the wording points readers to another resource.
Avoid culture-specific idioms, unnecessary Latinisms, jokes, and marketing exaggeration in technical docs.
Spell out months in body text, avoid ordinal dates, and use clear time zones.
Spell out whole numbers from zero through nine unless they are technical values, parameters, versions, or UI values.
Use numerals for 10 or greater and include commas in thousands.
Do not add trademark symbols to learning-oriented docs unless the source, platform, or legal guidance explicitly requires them.
Files:
README.mdcrates/cli/README.mdRELEASING.md
**/*.md
📄 CodeRabbit inference engine (.agents/skills/review-doc-style/assets/nvidia-style-technical-docs.md)
**/*.md: Use title case consistently in technical documentation headings
Avoid quotation marks, ampersands, and exclamation marks in headings
Keep product, event, research, and whitepaper names in their official title case
Use title case for table headers
Do not force social-media sentence case into technical docs
Format code elements, commands, parameters, package names, and expressions in monospace
Format directories, file names, and paths in monospace using backticks
Use angle brackets inside monospace for variables inside paths, such as/home/<username>/.login
Format error messages and strings in quotation marks, keeping literal code strings in code formatting when clearer
Format UI buttons, menus, fields, and labels in bold
Use angle brackets between UI labels for menu paths, such as File > Save As
Use italics for new terms on first use, sparingly and only when introducing the term
Use italics for publication titles
Format keyboard shortcuts in plain text, such as Press Ctrl+Alt+Delete
Use owner/repo link text for GitHub repositories, preferring[NVIDIA/NeMo](link)over prose references like 'the GitHub repo'
Introduce every code block with a complete sentence
Do not make a code block complete the grammar of the previous sentence
Do not continue a sentence after a code block
Use syntax highlighting when the format supports it for code blocks
Avoid the word 'snippet' unless the surrounding docs already use it as a term of art
Keep inline method, function, and class references consistent with nearby docs, omitting empty parentheses for prose readability when no call is shown
Use descriptive anchor text that matches the destination title when possible for links
Avoid raw URLs in running text
Avoid generic anchor text such as 'here,' 'this page,' and 'read more'
Include acronyms in link text when a linked term includes an acronym
Do not link long sentences or multiple sentences
Avoid links that pull readers away from a procedure unless the link is a p...
Files:
README.mdcrates/cli/README.mdRELEASING.md
{README.md,docs/**/*.{md,rst,txt},fern/**/*}
📄 CodeRabbit inference engine (.agents/skills/prepare-code-freeze/SKILL.md)
Search and update documentation source for references to the old version in
README.md,docs, andferndirectories, updating current-version install commands, package examples, and configuration examples to<next-version>
Files:
README.md
**/*.{md,mdx}
📄 CodeRabbit inference engine (AGENTS.md)
Update
README.md,fern/, package READMEs, and binding-support notes when public behavior, package names, examples, or supported bindings change.
**/*.{md,mdx}: Prefer the documented public API, not internal shortcuts
Keep package names, repo references, and build commands current
Keep release-process and release-notes guidance in repo-maintainer docs such asRELEASING.md, not as user-facing docs pages orCHANGELOG.md
Keep stable user-facing wrappers atscripts/root in docs and examples; only point at namespaced helper paths when documenting internal maintenance work
When detailed dynamic plugin guides exist, keep Rust native plugin examples, Python worker plugin examples, andgrpc-v1protocol details on separate pagesIf links in documentation change, run
just docs-linkcheck.
Files:
README.mdcrates/cli/README.mddocs/getting-started/installation.mdxRELEASING.md
**/*.{md,markdown,mdx}
📄 CodeRabbit inference engine (CONTRIBUTING.md)
Add the SPDX license header to all Markdown/MDX documentation files using the HTML comment block form.
Files:
README.mdcrates/cli/README.mddocs/getting-started/installation.mdxRELEASING.md
{docs/**/*.md,README.md}
📄 CodeRabbit inference engine (.agents/skills/add-binding-feature/SKILL.md)
Update reference docs, language-binding docs, READMEs, and example documentation when the public surface or expected usage changes.
Files:
README.md
{README.md,docs/index.md}
📄 CodeRabbit inference engine (.agents/skills/contribute-docs/SKILL.md)
Update entry-point docs when examples or reading paths change
Files:
README.md
README.md
📄 CodeRabbit inference engine (.agents/skills/validate-change/SKILL.md)
If documentation examples or commands in
README.mdchange, run the targeted docs checks appropriate to the change.
Files:
README.md
{docs/**,README.md,CONTRIBUTING.md,RELEASING.md,SECURITY.md}
⚙️ CodeRabbit configuration file
{docs/**,README.md,CONTRIBUTING.md,RELEASING.md,SECURITY.md}: Review documentation for technical accuracy against the current API, command correctness, and consistency across language bindings.
Flag stale examples, missing SPDX headers where required, and instructions that no longer match CI or pre-commit behavior.
Files:
README.mddocs/getting-started/installation.mdxRELEASING.md
.github/workflows/*.{yml,yaml}
📄 CodeRabbit inference engine (.agents/skills/maintain-ci/SKILL.md)
.github/workflows/*.{yml,yaml}: Putpermissions:on each job that needs token access.
Avoid workflow-levelpermissions:unless the repository intentionally centralizes them and the inheritance tradeoff is documented.
Keep third-party actions pinned to full commit SHAs and preserve the readable version comment after the SHA.
Prefer action-native or ecosystem-native caching over genericactions/cache.
Use lockfiles or dependency manifests to drive cache invalidation.
Keep deploy and publish permissions isolated to the jobs that need them.
Read both caller and callee when a workflow usesworkflow_call.
Put release-tag validation in the earliest practical caller job when the pipeline has tag-based publish behavior.
Keep pure-Python plugin SDK packaging as a single wheel artifact instead of duplicating it across every platform matrix entry.
contents: readis the default minimum for checkout-based build, test, docs, and packaging jobs.
pull-requests: readis required for PR metadata lookup jobs.
pages: writeandid-token: writeshould be limited to Pages deployment jobs and any caller that invokes them through a reusable workflow.
For reusable workflows, the caller must grant every permission the called jobs require; the callee cannot elevate beyond what the caller provides.
Preferastral-sh/setup-uvcache support withcache-dependency-globanchored touv.lock.
PreferSwatinem/rust-cachewith explicitshared-keyandworkspacesinstead of ad hoc target-directory caching.
Avoid caching generated outputs that can hide stale behavior unless the repo already relies on them deliberately.Keep CI workflow commands and package references in GitHub Actions workflows aligned with the current install, build, and example commands.
Files:
.github/workflows/ci_check.yml.github/workflows/ci.yaml.github/workflows/ci_rust.yml
{justfile,codecov.yml,codecov.yaml,.github/workflows/**/*.yml,.github/workflows/**/*.yaml}
📄 CodeRabbit inference engine (.agents/skills/maintain-dynamic-plugins/SKILL.md)
justfile, Codecov, and CI package/test workflows must include new plugin crates and packages.
Files:
.github/workflows/ci_check.yml.github/workflows/ci.yaml.github/workflows/ci_rust.ymljustfile
{package.json,package-lock.json}
📄 CodeRabbit inference engine (.agents/skills/maintain-packaging/SKILL.md)
Keep the root Node workspace metadata in
package.jsonandpackage-lock.jsonconsistent with the published package and workspace layout.
Files:
package.json
.gitlab-ci.yml
📄 CodeRabbit inference engine (.agents/skills/maintain-packaging/SKILL.md)
Keep CI workflow commands and package references in
.gitlab-ci.ymlaligned with the current install, build, and example commands.
Files:
.gitlab-ci.yml
**/*.mdx
📄 CodeRabbit inference engine (.agents/skills/review-doc-style/SKILL.md)
MDX top-of-file SPDX comments must use {/* ... */} delimiters instead of HTML comment delimiters (Must-Fix)
In MDX files, top-of-file comments must use JSX comment delimiters (
{/*to open and*/}to close); do not use HTML comments for MDX SPDX headers
Files:
docs/getting-started/installation.mdx
{docs,examples}/**/*
📄 CodeRabbit inference engine (.agents/skills/rename-surfaces/SKILL.md)
Update docs and examples.
Files:
docs/getting-started/installation.mdx
docs/**/*
📄 CodeRabbit inference engine (.agents/skills/validate-change/SKILL.md)
If documentation examples or commands under
docs/change, run the targeted docs checks appropriate to the change.
Files:
docs/getting-started/installation.mdx
RELEASING.md
📄 CodeRabbit inference engine (.agents/skills/maintain-ci/SKILL.md)
Keep release-tag policy aligned with
RELEASING.md: raw SemVer tags only, no leadingv.Document release tags as raw SemVer without a leading
v, and keep release history and release-note links pointing to GitHub Releases rather thanCHANGELOG.mdor docs pages.
Files:
RELEASING.md
justfile
📄 CodeRabbit inference engine (.agents/skills/maintain-packaging/SKILL.md)
Keep
justfilebuild, test, clean, version, and package recipes for plugin crates and packages aligned with the current packaging layout.
Files:
justfile
🧠 Learnings (3)
📚 Learning: 2026-05-03T04:23:07.497Z
Learnt from: willkill07
Repo: NVIDIA/NeMo-Flow PR: 46
File: .github/workflows/ci_rust.yml:31-64
Timestamp: 2026-05-03T04:23:07.497Z
Learning: In GitHub Actions workflow YAML, it’s valid to conditionally disable a service container by setting the service container’s `image` to an empty string (`''`) via a matrix variable (e.g., `redis_service_image: ''`). This intentionally makes the runner skip service initialization for that matrix entry rather than failing the job. When reviewing workflows, don’t flag this as an error if the workflow uses an empty `image` to disable the service on specific matrix entries (e.g., OS-specific setups); verify the `image` is sourced from the matrix variable and that the service is only expected to be available when a non-empty image is provided.
Applied to files:
.github/workflows/ci_check.yml.github/workflows/ci_rust.yml
📚 Learning: 2026-04-15T18:16:52.951Z
Learnt from: bbednarski9
Repo: NVIDIA/NeMo-Flow PR: 1
File: docs/atof-event-format.md:381-381
Timestamp: 2026-04-15T18:16:52.951Z
Learning: In docs/atof-event-format.md (and when reviewing references to this format across the NeMo-Flow repo), treat `AtifExporter.events_to_steps()` as the intended public/API method name. Do not flag it as inconsistent with internal Rust symbol names (e.g., `event_to_steps` in `crates/core/src/atif.rs`)—the documentation’s public-facing naming may differ intentionally from internal implementation details.
Applied to files:
.gitlab-ci.yml
📚 Learning: 2026-05-01T13:41:07.485Z
Learnt from: willkill07
Repo: NVIDIA/NeMo-Flow PR: 34
File: .gitlab-ci.yml:95-103
Timestamp: 2026-05-01T13:41:07.485Z
Learning: In NVIDIA/NeMo-Flow’s .gitlab-ci.yml, when listing GitHub Actions runs for a tag-triggered workflow, use `gh run list --branch "$tag"` to filter runs by the tag name. For annotated tag pushes in this repo, GitHub sets `headBranch` to the tag (e.g., `0.1.0-rc.5`), so `--branch "$tag"` returns only the tag-triggered run. Prefer this over `--commit <sha>`, which can be less precise because it may include both the tag run and a main-branch run that share the same commit SHA.
Applied to files:
.gitlab-ci.yml
🪛 ast-grep (0.44.1)
scripts/tests/test_package_cli_bin.py
[error] 70-75: Command coming from incoming request
Context: subprocess.run(
["node", output / "launcher/package/bin/nemo-relay.js", "--version"],
check=False,
capture_output=True,
text=True,
)
Note: [CWE-78] Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection').
(subprocess-from-request)
scripts/package-cli-bin.py
[info] 183-183: use jsonify instead of json.dumps for JSON output
Context: json.dumps(manifest, indent=2)
Note: [CWE-116] Improper Encoding or Escaping of Output.
(use-jsonify)
[info] 208-208: use jsonify instead of json.dumps for JSON output
Context: json.dumps(mapping, indent=2)
Note: [CWE-116] Improper Encoding or Escaping of Output.
(use-jsonify)
[info] 249-249: use jsonify instead of json.dumps for JSON output
Context: json.dumps(manifest, indent=2)
Note: [CWE-116] Improper Encoding or Escaping of Output.
(use-jsonify)
🪛 Ruff (0.15.21)
scripts/tests/test_package_cli_bin.py
[warning] 19-19: Assertion should be broken down into multiple parts
Break down assertion into multiple parts
(PT018)
[warning] 28-28: Avoid specifying long messages outside the exception class
(TRY003)
[error] 71-71: subprocess call: check for execution of untrusted input
(S603)
[error] 72-72: Starting a process with a partial executable path
(S607)
[warning] 82-82: Use pytest.raises instead of unittest-style assertRaisesRegex
Replace assertRaisesRegex with pytest.raises
(PT027)
scripts/package-cli-bin.py
[warning] 98-98: Avoid specifying long messages outside the exception class
(TRY003)
[warning] 113-113: Boolean-typed positional argument in function definition
(FBT001)
[warning] 113-113: Boolean default positional argument in function definition
(FBT002)
[warning] 269-269: Avoid specifying long messages outside the exception class
(TRY003)
🪛 zizmor (1.26.1)
.github/workflows/ci.yaml
[error] 482-482: code injection via template expansion (template-injection): may expand into attacker-controllable code
(template-injection)
.github/workflows/ci_rust.yml
[warning] 285-285: code injection via template expansion (template-injection): may expand into attacker-controllable code
(template-injection)
[warning] 287-287: code injection via template expansion (template-injection): may expand into attacker-controllable code
(template-injection)
[error] 291-291: code injection via template expansion (template-injection): may expand into attacker-controllable code
(template-injection)
[error] 292-292: code injection via template expansion (template-injection): may expand into attacker-controllable code
(template-injection)
[warning] 303-303: code injection via template expansion (template-injection): may expand into attacker-controllable code
(template-injection)
🔇 Additional comments (28)
RELEASING.md (1)
34-35: LGTM!Also applies to: 64-66, 147-152, 179-180, 257-259, 271-275, 308-310, 341-344
docs/getting-started/installation.mdx (1)
36-53: LGTM!Also applies to: 68-71, 180-182
package.json (1)
10-11: LGTM!packages/cli-bin/package.json (1)
1-7: LGTM!pyproject.toml (1)
69-72: LGTM!Also applies to: 113-113
python/cli-bin/pyproject.toml (1)
1-17: LGTM!python/cli-bin/src/nemo_relay_cli_bin/__init__.py (1)
1-4: LGTM!scripts/package-cli-bin.py (3)
1-111: LGTM!
120-144: LGTM!Also applies to: 146-190, 192-251, 253-284
113-117: 🎯 Functional CorrectnessNo change needed here.
ZipInfo.external_attralready preserves the0o755mode bits as written, so omittingstat.S_IFREGdoes not drop the CLI script’s executable bit. The extra mode assertion is not required for this path.> Likely an incorrect or invalid review comment.scripts/tests/test_package_cli_bin.py (1)
1-32: LGTM!Also applies to: 71-88
justfile (3)
565-565: LGTM!
693-721: LGTM!
1707-1722: LGTM!.github/workflows/ci_rust.yml (2)
308-327: LGTM!
306-306: 🩺 Stability & AvailabilityNo change needed for
pythonhere this job already runsactions/setup-pythonwith the configured default version beforepython scripts/package-cli-bin.py, so the package step uses the selected interpreter.> Likely an incorrect or invalid review comment..github/ci-path-filters.yml (4)
62-65: LGTM!
85-88: LGTM!
104-107: LGTM!
134-136: LGTM!.github/workflows/ci.yaml (3)
403-409: LGTM!
450-456: LGTM!
479-497: LGTM!.gitlab-ci.yml (4)
71-71: LGTM!
135-142: LGTM!
174-174: LGTM!
338-340: LGTM!.github/workflows/ci_check.yml (1)
223-226: LGTM!
Signed-off-by: Will Killian <wkillian@nvidia.com>
ericevans-nv
left a comment
ericevans-nv
left a comment
There was a problem hiding this comment.
Requesting changes because the PyPI wheel installs the Unix CLI without execute permission. I also noted that the GitHub Release artifact selector now includes package-manager artifacts.
Signed-off-by: Will Killian <wkillian@nvidia.com>
github-actions
Bot
added
size:XL
Signed-off-by: Will Killian <wkillian@nvidia.com>
Signed-off-by: Will Killian <wkillian@nvidia.com>
There was a problem hiding this comment.
Actionable comments posted: 4
Caution
Some comments are outside the diff and can’t be posted inline due to platform limitations.
⚠️ Outside diff range comments (1)
.github/workflows/ci.yaml (1)
535-552: 🔒 Security & Privacy | 🟠 Major | ⚡ Quick winAvoid interpolating
${{ github.ref_name }}directly into the shell script.
version="${{ github.ref_name }}"is substituted by GitHub Actions before the shell parses the script, so an unexpected ref name could inject shell syntax (flagged by zizmor). Prefer the runner-provided$GITHUB_REF_NAMEenv var, which is shell-quoted safely. The Node publish step above (Line 519) has the same pattern and would benefit from the same fix.🔒 Proposed fix
- name: Publish CLI packages to npm run: | set -euo pipefail - version="${{ github.ref_name }}" + version="$GITHUB_REF_NAME"🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In @.github/workflows/ci.yaml around lines 535 - 552, Replace direct GitHub Actions interpolation of github.ref_name with the runner-provided GITHUB_REF_NAME environment variable in the npm publish steps, including the version assignment in the shown publishing block and the corresponding Node publish step. Preserve the existing version-based package naming and publishing behavior.Source: Linters/SAST tools
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In @.github/workflows/ci_node.yml:
- Around line 313-314: Update the Checkout step in the PackageSmoke job to set
persist-credentials to false, ensuring the checkout token is not retained in the
local Git configuration while preserving the existing checkout action and
revision.
In @.github/workflows/ci_rust.yml:
- Around line 308-315: Update the “Install and run CLI wheel” step to create and
activate a disposable virtual environment before installing the wheel, ensuring
`python -m pip` and `nemo-relay --version` use the venv interpreter instead of
the runner Python.
In @.gitlab-ci.yml:
- Around line 135-150: Add an empty-artifact validation alongside the existing
checks in the collect:github-artifacts flow, verifying that collected/cli-npm
contains at least one .tgz file after copying from downloaded/cli-npm. On
failure, emit an appropriate error to stderr and exit nonzero, matching the
established wheel and node guard behavior.
In `@scripts/package-node-bin.py`:
- Around line 63-73: Update metapackage_files to raise TypeError instead of
ValueError for both isinstance-based validation failures: a non-dictionary
exports value and a non-dictionary export entry. Keep the existing messages and
file-processing behavior unchanged.
---
Outside diff comments:
In @.github/workflows/ci.yaml:
- Around line 535-552: Replace direct GitHub Actions interpolation of
github.ref_name with the runner-provided GITHUB_REF_NAME environment variable in
the npm publish steps, including the version assignment in the shown publishing
block and the corresponding Node publish step. Preserve the existing
version-based package naming and publishing behavior.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Path: .coderabbit.yaml
Review profile: ASSERTIVE
Plan: Enterprise
Run ID: bfc54d92-dd6b-4cf7-b439-dc6b3d7aff0b
📒 Files selected for processing (12)
.github/ci-path-filters.yml.github/workflows/ci.yaml.github/workflows/ci_check.yml.github/workflows/ci_node.yml.github/workflows/ci_rust.yml.gitlab-ci.ymlRELEASING.mdjustfilescripts/package-cli-bin.pyscripts/package-node-bin.pyscripts/tests/test_package_cli_bin.pyscripts/tests/test_package_node_bin.py
📜 Review details
🧰 Additional context used
📓 Path-based instructions (22)
.github/workflows/*.{yml,yaml}
📄 CodeRabbit inference engine (.agents/skills/maintain-ci/SKILL.md)
.github/workflows/*.{yml,yaml}: Putpermissions:on each job that needs token access.
Avoid workflow-levelpermissions:unless the repository intentionally centralizes them and the inheritance tradeoff is documented.
Keep third-party actions pinned to full commit SHAs and preserve the readable version comment after the SHA.
Prefer action-native or ecosystem-native caching over genericactions/cache.
Use lockfiles or dependency manifests to drive cache invalidation.
Keep deploy and publish permissions isolated to the jobs that need them.
Read both caller and callee when a workflow usesworkflow_call.
Put release-tag validation in the earliest practical caller job when the pipeline has tag-based publish behavior.
Keep pure-Python plugin SDK packaging as a single wheel artifact instead of duplicating it across every platform matrix entry.
contents: readis the default minimum for checkout-based build, test, docs, and packaging jobs.
pull-requests: readis required for PR metadata lookup jobs.
pages: writeandid-token: writeshould be limited to Pages deployment jobs and any caller that invokes them through a reusable workflow.
For reusable workflows, the caller must grant every permission the called jobs require; the callee cannot elevate beyond what the caller provides.
Preferastral-sh/setup-uvcache support withcache-dependency-globanchored touv.lock.
PreferSwatinem/rust-cachewith explicitshared-keyandworkspacesinstead of ad hoc target-directory caching.
Avoid caching generated outputs that can hide stale behavior unless the repo already relies on them deliberately.Keep CI workflow commands and package references in GitHub Actions workflows aligned with the current install, build, and example commands.
Files:
.github/workflows/ci_check.yml.github/workflows/ci_rust.yml.github/workflows/ci_node.yml.github/workflows/ci.yaml
{justfile,codecov.yml,codecov.yaml,.github/workflows/**/*.yml,.github/workflows/**/*.yaml}
📄 CodeRabbit inference engine (.agents/skills/maintain-dynamic-plugins/SKILL.md)
justfile, Codecov, and CI package/test workflows must include new plugin crates and packages.
Files:
.github/workflows/ci_check.yml.github/workflows/ci_rust.yml.github/workflows/ci_node.ymljustfile.github/workflows/ci.yaml
{.github/**,.gitlab-ci.yml,.pre-commit-config.yaml,justfile,scripts/**}
⚙️ CodeRabbit configuration file
{.github/**,.gitlab-ci.yml,.pre-commit-config.yaml,justfile,scripts/**}: Review automation changes for reproducibility, pinned versions where appropriate, secret handling, and consistency with the documented validation matrix.
Pay attention to commands that need generated native artifacts, FFI libraries, or platform-specific environment variables.
Files:
.github/workflows/ci_check.ymlscripts/tests/test_package_node_bin.py.github/ci-path-filters.yml.github/workflows/ci_rust.ymlscripts/package-node-bin.py.github/workflows/ci_node.ymlscripts/tests/test_package_cli_bin.py.gitlab-ci.ymlscripts/package-cli-bin.pyjustfile.github/workflows/ci.yaml
**/*.{rs,py}
📄 CodeRabbit inference engine (AGENTS.md)
Follow binding naming conventions in Rust and Python: use
snake_case.
Files:
scripts/tests/test_package_node_bin.pyscripts/package-node-bin.pyscripts/tests/test_package_cli_bin.pyscripts/package-cli-bin.py
**/*.{rs,py,js,mjs,cjs,ts,tsx}
📄 CodeRabbit inference engine (AGENTS.md)
**/*.{rs,py,js,mjs,cjs,ts,tsx}: UseJson = serde_json::Valuein Rust-facing runtime APIs where the existing code expects JSON payloads.
UseResult<T>withFlowErrorin core runtime paths, and keep errors explicit and binding-appropriate at the wrapper layer.
Keep async behavior on the existing tokio-based model; bindings should preserve callback and future lifetimes rather than blocking or hiding async work unexpectedly.
Files:
scripts/tests/test_package_node_bin.pyscripts/package-node-bin.pyscripts/tests/test_package_cli_bin.pyscripts/package-cli-bin.py
**/*.py
📄 CodeRabbit inference engine (CONTRIBUTING.md)
**/*.py: When changing the Python wrapper package, tests, or docs tooling, lint with Ruff (E,F,W,I), format with Ruff formatter (120-character lines, double quotes), and passtytype checking.
Add the SPDX license header to all Python source files using the#comment form.
Files:
scripts/tests/test_package_node_bin.pyscripts/package-node-bin.pyscripts/tests/test_package_cli_bin.pyscripts/package-cli-bin.py
**/*.{rs,py,go,js,ts,c,h}
📄 CodeRabbit inference engine (CONTRIBUTING.md)
Use language-appropriate naming conventions: Rust
snake_case, C FFI exports prefixednemo_relay_, GoPascalCase, Node.jscamelCase, and Pythonsnake_case.
Files:
scripts/tests/test_package_node_bin.pyscripts/package-node-bin.pyscripts/tests/test_package_cli_bin.pyscripts/package-cli-bin.py
**/*.{py,go,js,ts}
📄 CodeRabbit inference engine (.agents/skills/maintain-observability/SKILL.md)
Keep Python, Go, and Node.js config objects and subscriber/exporter methods aligned so all bindings expose the same logical knobs and semantics.
Files:
scripts/tests/test_package_node_bin.pyscripts/package-node-bin.pyscripts/tests/test_package_cli_bin.pyscripts/package-cli-bin.py
**/*
📄 CodeRabbit inference engine (.agents/skills/validate-change/SKILL.md)
**/*: Format changed files with the language-native formatter before the final lint/test pass.
If dynamic plugin behavior changed, usemaintain-dynamic-pluginsand include the native SDK, worker protocol, Python SDK, docs, packaging, and Codecov surfaces in the validation plan.
If code changes alter APIs, bindings, commands, paths, packaging behavior, observability/adaptive semantics, or documented best practices, update any dependent maintainer or consumer skills in the same branch.
During iteration, preferuv run pre-commit run --files <changed files...>.
Before review or handoff, runuv run pre-commit run --all-files.
Files:
scripts/tests/test_package_node_bin.pyscripts/package-node-bin.pyscripts/tests/test_package_cli_bin.pyscripts/package-cli-bin.pyjustfileRELEASING.md
**/*.{rs,py,go,js,ts}
📄 CodeRabbit inference engine (.agents/skills/validate-change/SKILL.md)
If a language surface changed, always run that language's test target even when Rust core did not change.
Files:
scripts/tests/test_package_node_bin.pyscripts/package-node-bin.pyscripts/tests/test_package_cli_bin.pyscripts/package-cli-bin.py
**/*.{rs,py,js,ts,tsx,go,java,kt,swift}
📄 CodeRabbit inference engine (.agents/skills/add-middleware/SKILL.md)
Add tests covering registration and duplicate names, deregistration and missing names, priority ordering, callback failure policy, scope-local inheritance and cleanup, event payload semantics, immutable mark and scope fields, and parity across affected bindings.
Files:
scripts/tests/test_package_node_bin.pyscripts/package-node-bin.pyscripts/tests/test_package_cli_bin.pyscripts/package-cli-bin.py
.gitlab-ci.yml
📄 CodeRabbit inference engine (.agents/skills/maintain-packaging/SKILL.md)
Keep CI workflow commands and package references in
.gitlab-ci.ymlaligned with the current install, build, and example commands.
Files:
.gitlab-ci.yml
justfile
📄 CodeRabbit inference engine (.agents/skills/maintain-packaging/SKILL.md)
Keep
justfilebuild, test, clean, version, and package recipes for plugin crates and packages aligned with the current packaging layout.
Files:
justfile
**/*.{md,rst,html,txt}
📄 CodeRabbit inference engine (.agents/skills/review-doc-style/assets/nvidia-style-brand-terminology.md)
**/*.{md,rst,html,txt}: Always spellNVIDIAin all caps. Do not useNvidia,nvidia,nVidia,nVIDIA, orNV.
Usean NVIDIAbefore a noun because the name starts with an 'en' sound.
Do not add a registered trademark symbol afterNVIDIAwhen referring to the company.
Use trademark symbols with product names only when the document type or legal guidance requires them.
Verify official capitalization, spacing, and hyphenation for product names.
Precede NVIDIA product names withNVIDIAon first mention when it is natural and accurate.
Do not rewrite product names for grammar or title-case rules.
Preserve third-party product names according to the owner's spelling.
Include the company name and full model qualifier on first use when it helps identify the model.
Preserve the official capitalization and punctuation of model names.
Use shorter family names only after the full name is established.
Spell out a term on first use and put the acronym in parentheses unless the acronym is widely understood by the intended audience.
Use the acronym on later mentions after it has been defined.
For long documents, reintroduce the full term if readers might lose context.
Form plurals of acronyms withs, not an apostrophe, such asGPUs.
In headings, common acronyms can remain abbreviated. Spell out the term in the first or second sentence of the body.
Common terms such asCPU,GPU,PC,API, andUIusually do not need to be spelled out for developer audiences.
Files:
RELEASING.md
**/*.{md,rst,html}
📄 CodeRabbit inference engine (.agents/skills/review-doc-style/assets/nvidia-style-brand-terminology.md)
Link the first mention of a product name when the destination helps the reader.
Files:
RELEASING.md
**/*.{md,rst,txt}
📄 CodeRabbit inference engine (.agents/skills/review-doc-style/assets/nvidia-style-guide.md)
Spell
NVIDIAin all caps. Do not useNvidia,nvidia, orNV.
Files:
RELEASING.md
**/*.{md,rst}
📄 CodeRabbit inference engine (.agents/skills/review-doc-style/assets/nvidia-style-guide.md)
**/*.{md,rst}: Format commands, code elements, expressions, package names, file names, and paths as inline code.
Use descriptive link text. Avoid raw URLs and weak anchors such as "here" or "read more."
Use title case consistently for technical documentation headings.
Introduce code blocks, lists, tables, and images with complete sentences.
Write procedures as imperative steps. Keep steps parallel and split long procedures into smaller tasks.
Prefer active voice, present tense, short sentences, contractions, and plain English.
Usecanfor possibility and reservemayfor permission.
Useafterfor temporal relationships instead ofonce.
Preferrefer tooverseewhen the wording points readers to another resource.
Avoid culture-specific idioms, unnecessary Latinisms, jokes, and marketing exaggeration in technical docs.
Spell out months in body text, avoid ordinal dates, and use clear time zones.
Spell out whole numbers from zero through nine unless they are technical values, parameters, versions, or UI values.
Use numerals for 10 or greater and include commas in thousands.
Do not add trademark symbols to learning-oriented docs unless the source, platform, or legal guidance explicitly requires them.
Files:
RELEASING.md
**/*.md
📄 CodeRabbit inference engine (.agents/skills/review-doc-style/assets/nvidia-style-technical-docs.md)
**/*.md: Use title case consistently in technical documentation headings
Avoid quotation marks, ampersands, and exclamation marks in headings
Keep product, event, research, and whitepaper names in their official title case
Use title case for table headers
Do not force social-media sentence case into technical docs
Format code elements, commands, parameters, package names, and expressions in monospace
Format directories, file names, and paths in monospace using backticks
Use angle brackets inside monospace for variables inside paths, such as/home/<username>/.login
Format error messages and strings in quotation marks, keeping literal code strings in code formatting when clearer
Format UI buttons, menus, fields, and labels in bold
Use angle brackets between UI labels for menu paths, such as File > Save As
Use italics for new terms on first use, sparingly and only when introducing the term
Use italics for publication titles
Format keyboard shortcuts in plain text, such as Press Ctrl+Alt+Delete
Use owner/repo link text for GitHub repositories, preferring[NVIDIA/NeMo](link)over prose references like 'the GitHub repo'
Introduce every code block with a complete sentence
Do not make a code block complete the grammar of the previous sentence
Do not continue a sentence after a code block
Use syntax highlighting when the format supports it for code blocks
Avoid the word 'snippet' unless the surrounding docs already use it as a term of art
Keep inline method, function, and class references consistent with nearby docs, omitting empty parentheses for prose readability when no call is shown
Use descriptive anchor text that matches the destination title when possible for links
Avoid raw URLs in running text
Avoid generic anchor text such as 'here,' 'this page,' and 'read more'
Include acronyms in link text when a linked term includes an acronym
Do not link long sentences or multiple sentences
Avoid links that pull readers away from a procedure unless the link is a p...
Files:
RELEASING.md
**/*.{md,mdx}
📄 CodeRabbit inference engine (AGENTS.md)
Update
README.md,fern/, package READMEs, and binding-support notes when public behavior, package names, examples, or supported bindings change.
**/*.{md,mdx}: Prefer the documented public API, not internal shortcuts
Keep package names, repo references, and build commands current
Keep release-process and release-notes guidance in repo-maintainer docs such asRELEASING.md, not as user-facing docs pages orCHANGELOG.md
Keep stable user-facing wrappers atscripts/root in docs and examples; only point at namespaced helper paths when documenting internal maintenance work
When detailed dynamic plugin guides exist, keep Rust native plugin examples, Python worker plugin examples, andgrpc-v1protocol details on separate pagesIf links in documentation change, run
just docs-linkcheck.
Files:
RELEASING.md
**/*.{md,markdown,mdx}
📄 CodeRabbit inference engine (CONTRIBUTING.md)
Add the SPDX license header to all Markdown/MDX documentation files using the HTML comment block form.
Files:
RELEASING.md
RELEASING.md
📄 CodeRabbit inference engine (.agents/skills/maintain-ci/SKILL.md)
Keep release-tag policy aligned with
RELEASING.md: raw SemVer tags only, no leadingv.Document release tags as raw SemVer without a leading
v, and keep release history and release-note links pointing to GitHub Releases rather thanCHANGELOG.mdor docs pages.
Files:
RELEASING.md
{docs/**,README.md,CONTRIBUTING.md,RELEASING.md,SECURITY.md}
⚙️ CodeRabbit configuration file
{docs/**,README.md,CONTRIBUTING.md,RELEASING.md,SECURITY.md}: Review documentation for technical accuracy against the current API, command correctness, and consistency across language bindings.
Flag stale examples, missing SPDX headers where required, and instructions that no longer match CI or pre-commit behavior.
Files:
RELEASING.md
🧠 Learnings (3)
📚 Learning: 2026-05-03T04:23:07.497Z
Learnt from: willkill07
Repo: NVIDIA/NeMo-Flow PR: 46
File: .github/workflows/ci_rust.yml:31-64
Timestamp: 2026-05-03T04:23:07.497Z
Learning: In GitHub Actions workflow YAML, it’s valid to conditionally disable a service container by setting the service container’s `image` to an empty string (`''`) via a matrix variable (e.g., `redis_service_image: ''`). This intentionally makes the runner skip service initialization for that matrix entry rather than failing the job. When reviewing workflows, don’t flag this as an error if the workflow uses an empty `image` to disable the service on specific matrix entries (e.g., OS-specific setups); verify the `image` is sourced from the matrix variable and that the service is only expected to be available when a non-empty image is provided.
Applied to files:
.github/workflows/ci_check.yml.github/workflows/ci_rust.yml.github/workflows/ci_node.yml
📚 Learning: 2026-04-15T18:16:52.951Z
Learnt from: bbednarski9
Repo: NVIDIA/NeMo-Flow PR: 1
File: docs/atof-event-format.md:381-381
Timestamp: 2026-04-15T18:16:52.951Z
Learning: In docs/atof-event-format.md (and when reviewing references to this format across the NeMo-Flow repo), treat `AtifExporter.events_to_steps()` as the intended public/API method name. Do not flag it as inconsistent with internal Rust symbol names (e.g., `event_to_steps` in `crates/core/src/atif.rs`)—the documentation’s public-facing naming may differ intentionally from internal implementation details.
Applied to files:
.gitlab-ci.yml
📚 Learning: 2026-05-01T13:41:07.485Z
Learnt from: willkill07
Repo: NVIDIA/NeMo-Flow PR: 34
File: .gitlab-ci.yml:95-103
Timestamp: 2026-05-01T13:41:07.485Z
Learning: In NVIDIA/NeMo-Flow’s .gitlab-ci.yml, when listing GitHub Actions runs for a tag-triggered workflow, use `gh run list --branch "$tag"` to filter runs by the tag name. For annotated tag pushes in this repo, GitHub sets `headBranch` to the tag (e.g., `0.1.0-rc.5`), so `--branch "$tag"` returns only the tag-triggered run. Prefer this over `--commit <sha>`, which can be less precise because it may include both the tag run and a main-branch run that share the same commit SHA.
Applied to files:
.gitlab-ci.yml
🪛 ast-grep (0.45.0)
scripts/tests/test_package_node_bin.py
[info] 51-51: use jsonify instead of json.dumps for JSON output
Context: json.dumps(source_manifest)
Note: [CWE-116] Improper Encoding or Escaping of Output.
(use-jsonify)
scripts/package-node-bin.py
[info] 94-94: use jsonify instead of json.dumps for JSON output
Context: json.dumps(manifest, indent=2)
Note: [CWE-116] Improper Encoding or Escaping of Output.
(use-jsonify)
[info] 115-115: use jsonify instead of json.dumps for JSON output
Context: json.dumps(manifest, indent=2)
Note: [CWE-116] Improper Encoding or Escaping of Output.
(use-jsonify)
🪛 Ruff (0.16.0)
scripts/tests/test_package_node_bin.py
[warning] 17-17: Assertion should be broken down into multiple parts
Break down assertion into multiple parts
(PT018)
[warning] 27-27: Avoid specifying long messages outside the exception class
(TRY003)
scripts/package-node-bin.py
[warning] 68-68: Prefer TypeError exception for invalid type
(TRY004)
[warning] 68-68: Avoid specifying long messages outside the exception class
(TRY003)
[warning] 71-71: Prefer TypeError exception for invalid type
(TRY004)
[warning] 71-71: Avoid specifying long messages outside the exception class
(TRY003)
[warning] 92-92: Avoid specifying long messages outside the exception class
(TRY003)
🪛 zizmor (1.28.0)
.github/workflows/ci_node.yml
[warning] 211-211: code injection via template expansion (template-injection): may expand into attacker-controllable code
(template-injection)
[warning] 313-314: credential persistence through GitHub Actions artifacts (artipacked): does not set persist-credentials: false
(artipacked)
[warning] 344-344: ad-hoc installation of packages (adhoc-packages): installs a package outside of a lockfile
(adhoc-packages)
.github/workflows/ci.yaml
[error] 538-538: code injection via template expansion (template-injection): may expand into attacker-controllable code
(template-injection)
🔇 Additional comments (17)
scripts/package-cli-bin.py (3)
119-125: LGTM! Confirmed this resolves the earlier "pip installs as 0644 / permission denied" finding viastat.S_IFREG+ explicit mode, andcreate_system = 3.
180-203: LGTM! LICENSE now resolves viaROOT / "LICENSE"instead of cwd-relativePath("LICENSE"), addressing the earlier cwd-dependency finding, and the renamednemo-relay-bin-npm-*output naming matches the CI/publish scripts and RELEASING.md.Also applies to: 248-267
92-110: LGTM!scripts/package-node-bin.py (1)
76-98: LGTM! Matches the test coverage inscripts/tests/test_package_node_bin.py(native package name/os/cpu/libc/main, metapackage file inclusion/exclusion, andoptionalDependenciesversion propagation).Also applies to: 101-121
scripts/tests/test_package_cli_bin.py (1)
34-107: LGTM! Assertions align with the currentpackage-cli-bin.pyimplementation (regular-file wheel entry mode, renamednemo-relay-bin-npm-*tarballs, PEP 440 translation cases).scripts/tests/test_package_node_bin.py (1)
34-89: LGTM! Covers native package manifest fields,.nodeexclusion from the metapackage, andoptionalDependenciesversion propagation for both release and dev (+sha) versions.justfile (2)
1565-1624: LGTM!node_platformauto-derivation only runs when the CI-set value is empty, and--metapackageis scoped to the singlelinux-amd64build, matching the analogous--npm-launcher-only-on-linux-amd64 pattern inci_rust.yml.
1741-1756: LGTM!.github/workflows/ci_rust.yml (2)
281-307: LGTM! Version derivation intentionally diverges from the raw binary asset'sdev-<sha>label sincewheel_version()requires a strict SemVer-like format; using<cargo-version>+<sha>here is correct for that constraint.
316-335: LGTM! Artifact naming (cli-binary-*,cli-python-wheel-*,cli-npm-package-*) aligns with the downstream collectors inci.yamland.gitlab-ci.yml..github/workflows/ci_node.yml (1)
175-178: LGTM!node_platformwiring matchespackage-node-bin.py'sPLATFORMSkeys, and the new smoke test correctly asserts exactly one native package plus all documented entrypoints resolve.Also applies to: 203-222, 290-364
.github/ci-path-filters.yml (1)
62-65: LGTM!Also applies to: 85-89, 105-108, 135-137
.github/workflows/ci.yaml (2)
272-345: LGTM! Verified theexpect_countglob patterns don't collide across CLI binaries, wheels, and npm tarballs, and the counts (5/5/5/6/6) correctly account for 5 platforms plus one shared launcher/metapackage each for CLI and Node.
452-458: LGTM! Download patterns line up with the upload names inci_rust.yml/ci_node.yml.Also applies to: 487-506
.github/workflows/ci_check.yml (1)
224-229: LGTM! Node.js is already provisioned earlier in this job, which the launcher subprocess test intest_package_cli_bin.pyneeds..gitlab-ci.yml (1)
304-304: LGTM! Split-per-platformnpm publishloops for both Node and CLI packages are consistent with the removal of the old consolidated-artifactbefore_scripttooling.Also applies to: 324-331
RELEASING.md (1)
34-37: LGTM! Package/platform names (nemo-relay-node-linux-x64-gnu,nemo-relay-cli-bin-linux-x64, etc.) matchpackage-node-bin.py'sPlatform.package_nameand the CLI npm naming used inpackage-cli-bin.py/tests exactly.Also applies to: 149-156, 257-273, 320-323, 354-357
Signed-off-by: Will Killian <wkillian@nvidia.com>
|
/merge |
3 participants
Overview
Publish the NeMo Relay CLI as
nemo-relay-cli-binon PyPI and npm, add the exact-versionnemo-relay[cli]extra, and splitnemo-relay-nodeinto a portable metapackage plus platform-specific native npm packages. Keep Cargo installation and direct GitHub Release binaries supported while attaching the main Python API wheels and clearly named package-manager artifacts to each GitHub Release.Details
nemo-relay --versionon every supported packaging runner.nemo-relay[cli]with an exact dependency on the matchingnemo-relay-cli-binrelease.Additional Publishing Changes
nemo-relay-nodeas the JavaScript/TypeScript metapackage and publish five exact-version native packages for Linux x64/ARM64 GNU, macOS ARM64, and Windows x64/ARM64.latestandnextdist-tag policy.nemo-relayAPI wheels alongside the raw CLI binaries, fivenemo-relay-cli-binwheels, six CLI npm tarballs, and six split Node npm tarballs on GitHub Releases. Include every attached distribution inSHA256SUMS, while retaining individual checksums for raw CLI binaries used by installers.nemo-relay-bin-npm[-<os>-<cpu>]-<version>.tgzandnemo-relay-node-npm[-<os>-<cpu>]-<version>.tgzwithout changing their registry package names.Validation:
just test-python— 562 passedjust test-node— 293 passeduv run --no-project python -m unittest -v scripts.tests.test_package_cli_bin scripts.tests.test_package_node_bin— 4 passednemo-relay --versionjust --set output_dir <temp> --set node_platform macos-arm64 --set ref_name 0.7.0 package-nodebash scripts/test-install-mocks.sh— 8 scenarios passedWhere should the reviewer start?
Start with
scripts/package-cli-bin.pyfor the wheel permission fix and CLI release filenames, thenscripts/package-node-bin.pyfor the Node metapackage/native split. Review.github/workflows/ci_node.ymland.github/workflows/ci.yamlfor per-platform smoke tests, publication order, release attachment naming, and checksums.Related Issues: (use one of the action keywords Closes / Fixes / Resolves / Relates to)
Closes RELAY-532
Summary by CodeRabbit
nemo-relay-cli-bindistribution packages for PyPI and npm, including platform variants and npm launcher support.nemo-relay-cli-bin.