ci(lmcache): ship LMCache wheels as Docker Hub images, not GitHub Releases

[yhl-amd]

Why

lmcache-rocm-wheel.yaml (#2388) published wheels as GitHub Releases targeting GITHUB_SHA. The lmcache-v0.5.6.dev98-g05fc77a0-rocm-torch210 tag it created on main was picked up by setuptools-scm's git describe and could not be parsed, so pip install -e . failed in every Pre Checkin run (e.g. https://github.com/ROCm/ATOM/actions/runs/35996699729). That tag and release have been deleted. Until this merges, dispatching the workflow from main with publish=true would do the same thing again. After it, the workflow creates no git tags or releases; the only tag creators left are ATOM's own vX.Y.Z release workflows, so no git describe filter is added.

What

1. lmcache-rocm-wheel.yaml: publish to Docker Hub, not Releases

• publish pushes a FROM scratch image holding only the wheel, as rocm/atom-dev:lmcache-v<version>-g<sha8>-rocm-torch210, and outputs its digest. It uses the repo's Docker Hub credentials (scoped to the push step) via docker-auth + docker_push_retry.sh. gh release is gone, and the job has contents: read only.
• Overwrite guard: only no such manifest counts as the tag being free. Rate limits, 5xx and network errors fail the job.
• check-inputs job: requires a full 40-hex lmcache_commit on every path, requires source_run_id to be numeric, and rejects source_run_id without publish.
• source_run_id: publishes the wheel an earlier run built. That run must be this workflow, on the default or current branch, with a successful build job in the latest unexpired attempt. Without it, publish uses the build's own attempt, so "Re-run failed jobs" works.
• bump-pr (from ci: open a pin-bump PR after publishing an LMCache wheel #2391, via feat(offload): support native DSv4 checkpoints with LMCache MP #2250): after publishing, opens a draft PR that moves the Dockerfile pin with bump_lmcache_wheel_pin.py and lists Requires-Dist changes.

2. Dockerfiles: install LMCache from the digest-pinned wheel image

docker/Dockerfile and docker/atom_release.dockerfile move from LMCache's 0.5.5rc3 release wheel to 0.5.6.dev98 (dev@05fc77a, contains LMCache/LMCache#5132):

ARG LMCACHE_WHEEL_IMAGE="rocm/atom-dev:lmcache-v0.5.6.dev98-g05fc77a0-rocm-torch210@sha256:d3cfe74f…"
FROM ${LMCACHE_WHEEL_IMAGE} AS lmcache_wheel
...
ARG LMCACHE_WHEEL_SHA256=a5fe8f3f…
COPY --from=lmcache_wheel / /tmp/lmcache-wheel/

The sha256 check, --no-deps install and import validation are kept, and lmcache.__version__ is asserted against the wheel name. grpcio>=1.78.0 and protobuf>=6.31.1,<7 are added for the newer wheel. This supersedes #2394, which made the same change on #2250's branch.

Validation

• Pre Checkin (non-GPU unit tests, Black, Ruff), workflow lint, and the offline inference smoke test pass on this PR. The smoke test's first attempt died on a Docker Hub token expiring mid-pull (unauthorized); the rerun passed.
• The wheel image was published by https://github.com/ROCm/ATOM/actions/runs/36002407218 from run 35984043135's artifact. An anonymous pull contains exactly that wheel, with sha256 a5fe8f3f….
• https://github.com/ROCm/ATOM/actions/runs/36009420936 ran the fixed publish path end to end: it resolved the artifact, checked the sha256, then refused to overwrite the existing tag.
• LMCache 0.5.5rc3 → 0.5.6.dev98 on main's code: in rocm/atom-dev:latest (2026-09-23 nightly, MI355X), I ran all 72 test files that touch lmcache/kv_transfer/offload with this branch's source, once on the image's 0.5.5rc3 and once after installing the new wheel from the image above. Both runs gave 2375 passed. Both had the same 10 failures (vLLM plugin layout/SeqView and scheduler metrics), which are already present on 0.5.5rc3 because the nightly lags main.
• The Dockerfile's LMCache RUN step was run verbatim in that image: OK: lmcache 0.5.6.dev98+g05fc77a0… HIP cuda_ops.
• actionlint 1.7.7 clean.
• Not run: a full image build, and serving or accuracy with LMCache offload enabled on the new LMCache.

🤖 Generated with Claude Code

[github-actions]

🏷️ CI Guide

Runs automatically on every eligible PR before approval:

• ✅ Pre Checkin: Black, Ruff, catalog schema validation, non-GPU unit tests

Heavy model tests:

• ✅ Run after the PR is approved and Pre Checkin passes
• ✅ Run immediately when an approval review is submitted
• ✅ Can be requested before approval with labels

Label	Tests
ci:full	Run all heavy PR model tests: native ATOM, vLLM, and SGLang
ci:atom	Run native ATOM model accuracy tests
ci:vllm	Run ATOM vLLM OOT model accuracy tests
ci:sglang	Run ATOM SGLang model accuracy tests

Heavy jobs are skipped when the PR is not approved and no matching ci:* label is present.
Add labels via the sidebar or gh pr edit 2395 --add-label <label>