ci(sidecar): build images in PR and nightly CI

.github/FILTERS.md

@@ -15,7 +15,8 @@ When you open a PR, CI checks which files changed and runs only relevant jobs:
 | `snapshot_vllm` / `snapshot_sglang` / `snapshot_trtllm` | That framework's DynamoCheckpoint deploy suite |
 | `deploy` | Deploy-specific tests |
 | `vllm` / `sglang` / `trtllm` | Backend-specific tests |
-| `sidecar` | Nothing directly; sidecar source and proto files also match `rust` |
+| `vllm_sidecar` / `sglang_sidecar` / `trtllm_sidecar` | That engine's multi-architecture sidecar container build; `lib/sidecar/common/**` changes trigger all three |
+| `sidecar` | Nothing directly (classification only) |
 | `benchmarks` | Dynamo runtime pipeline (runs `tests/benchmarks/**` pytest suite) |
 | `sample` | Sample-backend unified test (piggybacks on vllm image) |
 | `efa` | EFA runtime image builds for vLLM, SGLang, TRT-LLM (`container/templates/aws.Dockerfile` change) |
@@ -25,7 +26,7 @@ When you open a PR, CI checks which files changed and runs only relevant jobs:
 | `ignore` | Nothing (classification only) |
 | `rust` | Rust pre merge checks |
 
-> **Note:** `docs`, `ignore`, and `sidecar` don't directly trigger CI jobs. They exist to satisfy coverage requirements - every file must match at least one filter. Sidecar source and proto files also match `rust`, which runs the workspace Rust checks.
+> **Note:** `ignore` and `sidecar` don't directly trigger CI jobs. They exist to satisfy coverage requirements - every file must match at least one filter. Sidecar source and proto files also match `rust`, which runs the workspace Rust checks.
 
 ## Fixing "Uncovered Files" Errors
 

.github/actions/changed-files/action.yml

@@ -58,6 +58,15 @@
   sidecar:
     description: 'Whether sidecar files changed'
     value: ${{ steps.filter.outputs.sidecar_any_modified }}
+  vllm_sidecar:
+    description: 'Whether vLLM sidecar image inputs changed'
+    value: ${{ steps.filter.outputs.vllm_sidecar_any_modified }}
+  sglang_sidecar:
+    description: 'Whether SGLang sidecar image inputs changed'
+    value: ${{ steps.filter.outputs.sglang_sidecar_any_modified }}
+  trtllm_sidecar:
+    description: 'Whether TensorRT-LLM sidecar image inputs changed'
+    value: ${{ steps.filter.outputs.trtllm_sidecar_any_modified }}
   frontend:
     description: 'Whether frontend files changed'
     value: ${{ steps.filter.outputs.frontend_any_modified }}
@@ -173,6 +182,9 @@
         echo "dgdr: ${{ steps.filter.outputs.dgdr_any_modified }}"
         echo "planner: ${{ steps.filter.outputs.planner_any_modified }}"
         echo "sidecar: ${{ steps.filter.outputs.sidecar_any_modified }}"
+        echo "vllm_sidecar: ${{ steps.filter.outputs.vllm_sidecar_any_modified }}"
+        echo "sglang_sidecar: ${{ steps.filter.outputs.sglang_sidecar_any_modified }}"
+        echo "trtllm_sidecar: ${{ steps.filter.outputs.trtllm_sidecar_any_modified }}"
         echo "vllm: ${{ steps.filter.outputs.vllm_any_modified }}"
         echo "sglang: ${{ steps.filter.outputs.sglang_any_modified }}"
         echo "trtllm: ${{ steps.filter.outputs.trtllm_any_modified }}"
@@ -199,6 +211,9 @@
         echo "dgdr: ${{ steps.filter.outputs.dgdr_all_modified_files }}"
         echo "planner: ${{ steps.filter.outputs.planner_all_modified_files }}"
         echo "sidecar: ${{ steps.filter.outputs.sidecar_all_modified_files }}"
+        echo "vllm_sidecar: ${{ steps.filter.outputs.vllm_sidecar_all_modified_files }}"
+        echo "sglang_sidecar: ${{ steps.filter.outputs.sglang_sidecar_all_modified_files }}"
+        echo "trtllm_sidecar: ${{ steps.filter.outputs.trtllm_sidecar_all_modified_files }}"
         echo "vllm: ${{ steps.filter.outputs.vllm_all_modified_files }}"
         echo "sglang: ${{ steps.filter.outputs.sglang_all_modified_files }}"
         echo "trtllm: ${{ steps.filter.outputs.trtllm_all_modified_files }}"

.github/filters.yaml

@@ -16,11 +16,11 @@
 #   benchmarks -> dynamo build-test (runs tests/benchmarks/** pytest suite)
 #   efa      -> all framework EFA runtime image builds (changes to container/templates/aws.Dockerfile)
 #   examples -> recipe-check (Kustomize recipe generation and unit tests)
-#   sidecar  -> classification only; source and proto files also match rust
+#   vllm_sidecar / sglang_sidecar / trtllm_sidecar -> engine-specific sidecar image build
 #   docs     -> fern docs lint, sync, and version release (docs/ directory)
 #
 # Filters for coverage only (no CI triggered):
-#   examples, ignore, sidecar
+#   ignore, sidecar
 
 all:
   - '**'
@@ -132,6 +132,10 @@ ignore:
   # CODEOWNERS generation tooling (data + scripts). Validated by its own
   # codeowners.yml workflow (triggers on '**'); no backend CI needed here.
   - '.github/codeowners/**'
+  # Sidecar docs are intentionally excluded from the Fern docs filter and do
+  # not affect the built sidecar images.
+  - 'lib/sidecar/**/*.md'
+  - 'lib/sidecar/**/*.rst'
 
 ci: &ci
   - '.github/workflows/**'
@@ -283,6 +287,28 @@ planner:
 
 sidecar:
   - 'lib/sidecar/**'
+  - '!**/*.md'
+  - '!**/*.rst'
+
+# Engine-specific sidecar builds. Changes to common sidecar code exercise all
+# three images; engine-local changes exercise only that engine's image.
+vllm_sidecar:
+  - 'lib/sidecar/common/**'
+  - 'lib/sidecar/vllm/**'
+  - '!**/*.md'
+  - '!**/*.rst'
+
+sglang_sidecar:
+  - 'lib/sidecar/common/**'
+  - 'lib/sidecar/sglang/**'
+  - '!**/*.md'
+  - '!**/*.rst'
+
+trtllm_sidecar:
+  - 'lib/sidecar/common/**'
+  - 'lib/sidecar/trtllm/**'
+  - '!**/*.md'
+  - '!**/*.rst'
 
 vllm:
   - 'container/deps/requirements.vllm.txt'

.github/scripts/test-filters.js

@@ -112,33 +112,43 @@ const testCases = [
   // Sidecar Rust and proto files should trigger Rust checks without unrelated E2E
   {
     file: 'lib/sidecar/common/src/lib.rs',
-    expect: { sidecar: true, rust: true, core: false, frontend: false, vllm: false, sglang: false, trtllm: false },
-    desc: 'common sidecar source avoids unrelated build and E2E filters'
+    expect: { sidecar: true, vllm_sidecar: true, sglang_sidecar: true, trtllm_sidecar: true, rust: true, core: false, frontend: false, vllm: false, sglang: false, trtllm: false },
+    desc: 'common sidecar source triggers all sidecar images without backend E2E'
   },
   {
     file: 'lib/sidecar/vllm/proto/vllm_grpc.proto',
-    expect: { sidecar: true, rust: true, core: false, frontend: false, vllm: false, sglang: false, trtllm: false },
-    desc: 'vllm sidecar proto triggers Rust checks without backend E2E'
+    expect: { sidecar: true, vllm_sidecar: true, sglang_sidecar: false, trtllm_sidecar: false, rust: true, core: false, frontend: false, vllm: false, sglang: false, trtllm: false },
+    desc: 'vllm sidecar proto triggers only the vLLM image and Rust checks'
   },
   {
     file: 'lib/sidecar/sglang/src/lib.rs',
-    expect: { sidecar: true, rust: true, core: false, frontend: false, vllm: false, sglang: false, trtllm: false },
-    desc: 'sglang sidecar source avoids backend E2E'
+    expect: { sidecar: true, vllm_sidecar: false, sglang_sidecar: true, trtllm_sidecar: false, rust: true, core: false, frontend: false, vllm: false, sglang: false, trtllm: false },
+    desc: 'sglang sidecar source triggers only the SGLang image and Rust checks'
   },
   {
     file: 'lib/sidecar/trtllm/src/lib.rs',
-    expect: { sidecar: true, rust: true, core: false, frontend: false, vllm: false, sglang: false, trtllm: false },
-    desc: 'trtllm sidecar source does not route to sglang or trtllm E2E'
+    expect: { sidecar: true, vllm_sidecar: false, sglang_sidecar: false, trtllm_sidecar: true, rust: true, core: false, frontend: false, vllm: false, sglang: false, trtllm: false },
+    desc: 'trtllm sidecar source triggers only the TensorRT-LLM image and Rust checks'
   },
   {
     file: 'lib/sidecar/vllm/deploy/agg.yaml',
-    expect: { sidecar: true, rust: false, core: false, frontend: false, vllm: false, sglang: false, trtllm: false },
-    desc: 'sidecar deployment config avoids Rust and E2E checks'
+    expect: { sidecar: true, vllm_sidecar: true, sglang_sidecar: false, trtllm_sidecar: false, rust: false, core: false, frontend: false, vllm: false, sglang: false, trtllm: false },
+    desc: 'vLLM sidecar deployment config triggers only the vLLM image'
   },
   {
     file: 'lib/sidecar/README.md',
-    expect: { sidecar: true, rust: false, core: false, frontend: false, docs: false, vllm: false, sglang: false, trtllm: false },
-    desc: 'sidecar README avoids Rust, Fern, and E2E checks'
+    expect: { sidecar: false, ignore: true, rust: false, core: false, frontend: false, docs: false, vllm: false, sglang: false, trtllm: false },
+    desc: 'sidecar README avoids container, Rust, Fern, and E2E checks'
+  },
+  {
+    file: '.github/workflows/shared-build-image.yml',
+    expect: { sidecar: false, vllm_sidecar: false, sglang_sidecar: false, trtllm_sidecar: false, core: true },
+    desc: 'shared image build workflow does not trigger sidecar container jobs'
+  },
+  {
+    file: '.github/actions/docker-remote-build/action.yml',
+    expect: { sidecar: false, vllm_sidecar: false, sglang_sidecar: false, trtllm_sidecar: false, core: true },
+    desc: 'shared remote build action does not trigger sidecar container jobs'
   },
 
   // Doc files should be excluded from core (negation patterns)

.github/workflows/nightly-ci.yml

@@ -329,6 +329,63 @@ jobs:
       dev_version_suffix: ${{ needs.compute-dev-version.outputs.dev_suffix }}
     secrets: inherit
 
+  vllm-sidecar-build:
+    name: vllm-sidecar
+    needs: [create-fresh-builder, resolve-source-sha]
+    uses: $/.github/workflows/shared-build-image.yml
+    with:
+      framework: vllm
+      target: sidecar
+      dockerfile: lib/sidecar/vllm/Dockerfile
+      build_target: runtime
+      cuda_version: '[""]'
+      platform: 'linux/amd64,linux/arm64'
+      builder_name: ${{ needs.create-fresh-builder.outputs.builder_name }}
+      builder_flavor: general
+      build_only: true
+      extra_build_args: 'DOCKER_PROXY=${{ vars.ECR_REGISTRY }}/dockerhub/'
+      source_ref: ${{ needs.resolve-source-sha.outputs.source_sha }}
+      image_tag_suffix: '-nightly'
+    secrets: inherit
+
+  sglang-sidecar-build:
+    name: sglang-sidecar
+    needs: [create-fresh-builder, resolve-source-sha]
+    uses: $/.github/workflows/shared-build-image.yml
+    with:
+      framework: sglang
+      target: sidecar
+      dockerfile: lib/sidecar/sglang/Dockerfile
+      build_target: runtime
+      cuda_version: '[""]'
+      platform: 'linux/amd64,linux/arm64'
+      builder_name: ${{ needs.create-fresh-builder.outputs.builder_name }}
+      builder_flavor: general
+      build_only: true
+      extra_build_args: 'DOCKER_PROXY=${{ vars.ECR_REGISTRY }}/dockerhub/'
+      source_ref: ${{ needs.resolve-source-sha.outputs.source_sha }}
+      image_tag_suffix: '-nightly'
+    secrets: inherit
+
+  trtllm-sidecar-build:
+    name: trtllm-sidecar
+    needs: [create-fresh-builder, resolve-source-sha]
+    uses: $/.github/workflows/shared-build-image.yml
+    with:
+      framework: trtllm
+      target: sidecar
+      dockerfile: lib/sidecar/trtllm/Dockerfile
+      build_target: runtime
+      cuda_version: '[""]'
+      platform: 'linux/amd64,linux/arm64'
+      builder_name: ${{ needs.create-fresh-builder.outputs.builder_name }}
+      builder_flavor: general
+      build_only: true
+      extra_build_args: 'DOCKER_PROXY=${{ vars.ECR_REGISTRY }}/dockerhub/'
+      source_ref: ${{ needs.resolve-source-sha.outputs.source_sha }}
+      image_tag_suffix: '-nightly'
+    secrets: inherit
+
   # ============================================================================
   # OPTIONAL NIGHTLY IMAGES (operator, planner, frontend, runtime EFA
   # variants)
@@ -1460,7 +1517,7 @@ jobs:
     name: Clean K8s builder if exists
     runs-on: prod-default-small-v2
     if: always()
-    needs: [vllm-build, sglang-build, trtllm-build, dynamo-pipeline, operator-build, planner-build, frontend-build, vllm-efa-build, sglang-efa-build, trtllm-efa-build, create-fresh-builder]
+    needs: [vllm-build, sglang-build, trtllm-build, vllm-sidecar-build, sglang-sidecar-build, trtllm-sidecar-build, dynamo-pipeline, operator-build, planner-build, frontend-build, vllm-efa-build, sglang-efa-build, trtllm-efa-build, create-fresh-builder]
     permissions:
       contents: read
     steps:
@@ -1482,7 +1539,7 @@ jobs:
   ############################## SLACK NOTIFICATION ##############################
   notify-slack:
     if: always()
-    needs: [vllm-test, vllm-multi-gpu-test, vllm-4-gpu-test, vllm-h100-test, sglang-test, sglang-multi-gpu-test, sglang-4-gpu-test, sglang-h100-test, trtllm-test, trtllm-multi-gpu-test, trtllm-h100-test, deploy-cleanup, rust-tests]
+    needs: [vllm-test, vllm-multi-gpu-test, vllm-4-gpu-test, vllm-h100-test, sglang-test, sglang-multi-gpu-test, sglang-4-gpu-test, sglang-h100-test, trtllm-test, trtllm-multi-gpu-test, trtllm-h100-test, vllm-sidecar-build, sglang-sidecar-build, trtllm-sidecar-build, deploy-cleanup, rust-tests]
     permissions:
       contents: read
       actions: read   # grant the reusable notifier read access to list this run's jobs

.github/workflows/pr.yaml

@@ -3,6 +3,10 @@
 
 name: PR
 
+permissions:
+  contents: read
+  packages: read
+
 on:
   push:
     branches:
@@ -40,6 +44,9 @@ jobs:
       frontend: ${{ steps.changes.outputs.frontend }}
       benchmarks: ${{ steps.changes.outputs.benchmarks }}
       sample: ${{ steps.changes.outputs.sample }}
+      vllm_sidecar: ${{ steps.changes.outputs.vllm_sidecar }}
+      sglang_sidecar: ${{ steps.changes.outputs.sglang_sidecar }}
+      trtllm_sidecar: ${{ steps.changes.outputs.trtllm_sidecar }}
       efa: ${{ steps.changes.outputs.efa }}
       base_ref: ${{ steps.changes.outputs.base_ref }}
       merge_base_sha: ${{ steps.changes.outputs.merge_base_sha }}
@@ -159,6 +166,9 @@ jobs:
       - frontend-build
       - frontend-test
       - frontend-copy-to-acr
+      - vllm-sidecar-build
+      - sglang-sidecar-build
+      - trtllm-sidecar-build
     if: always()
     steps:
       - name: Check all dependent jobs
@@ -337,6 +347,64 @@ jobs:
       - name: Lint and test Helm chart
         run: make -C deploy/helm/charts/power-agent lint test
 
+# ============================================================================
+# SIDECAR CONTAINERS
+# ============================================================================
+
+  vllm-sidecar-build:
+    name: vllm-sidecar
+    needs: [changed-files]
+    if: needs.changed-files.outputs.vllm_sidecar == 'true'
+    uses: $/.github/workflows/shared-build-image.yml
+    with:
+      framework: vllm
+      target: sidecar
+      dockerfile: lib/sidecar/vllm/Dockerfile
+      build_target: runtime
+      cuda_version: '[""]'
+      platform: 'linux/amd64,linux/arm64'
+      builder_name: ${{ needs.changed-files.outputs.builder_name }}
+      builder_flavor: general
+      build_only: true
+      extra_build_args: 'DOCKER_PROXY=${{ vars.ECR_REGISTRY }}/dockerhub/'
+    secrets: inherit
+
+  sglang-sidecar-build:
+    name: sglang-sidecar
+    needs: [changed-files]
+    if: needs.changed-files.outputs.sglang_sidecar == 'true'
+    uses: $/.github/workflows/shared-build-image.yml
+    with:
+      framework: sglang
+      target: sidecar
+      dockerfile: lib/sidecar/sglang/Dockerfile
+      build_target: runtime
+      cuda_version: '[""]'
+      platform: 'linux/amd64,linux/arm64'
+      builder_name: ${{ needs.changed-files.outputs.builder_name }}
+      builder_flavor: general
+      build_only: true
+      extra_build_args: 'DOCKER_PROXY=${{ vars.ECR_REGISTRY }}/dockerhub/'
+    secrets: inherit
+
+  trtllm-sidecar-build:
+    name: trtllm-sidecar
+    needs: [changed-files]
+    if: needs.changed-files.outputs.trtllm_sidecar == 'true'
+    uses: $/.github/workflows/shared-build-image.yml
+    with:
+      framework: trtllm
+      target: sidecar
+      dockerfile: lib/sidecar/trtllm/Dockerfile
+      build_target: runtime
+      cuda_version: '[""]'
+      platform: 'linux/amd64,linux/arm64'
+      builder_name: ${{ needs.changed-files.outputs.builder_name }}
+      builder_flavor: general
+      build_only: true
+      extra_build_args: 'DOCKER_PROXY=${{ vars.ECR_REGISTRY }}/dockerhub/'
+    secrets: inherit
+
 # ============================================================================
 # FRAMEWORK PIPELINES (Build → Test → Copy)
 # ============================================================================
@@ -1969,6 +2037,9 @@ jobs:
       - trtllm-multi-gpu-test
       - trtllm-efa-build
       - dynamo-pipeline
+      - vllm-sidecar-build
+      - sglang-sidecar-build
+      - trtllm-sidecar-build
     steps:
       - name: Checkout repository
         uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd  # v6.0.2