ci(docker): move image builds to cpu-e5 runner and parallelize make

[key4ng]

Description

Problem

The three Docker-image-build workflows (_build-engine-image.yml, release-docker.yml, nightly-docker.yml) all run on runs-on: ["8-gpu-h200"]. Nothing in the build path actually uses the GPU:

• docker/engine.Dockerfile only clones sources and runs shell install scripts inside the base image (no nvcc, no CUDA-arch compile).
• scripts/installation/install-smg.sh does apt → protoc → rustup → maturin build --release --features vendored-openssl → pip install — all CPU/IO-bound.
• Other install-*.sh scripts are 10–18 lines each and contain no GPU work.

Meanwhile the vendored-openssl feature compiles OpenSSL from C source inside a build.rs, but the inner make runs single-threaded by default — it doesn't inherit cargo's parallelism. On a 64-vCPU host this step wastes ~90 s of wall-clock on one core.

Solution

1. Switch the three image-build workflows from ["8-gpu-h200"] to ["cpu-e5"] (a new OCI VM.Standard.E5.Flex self-hosted runner). nightly-benchmark.yml is intentionally left alone — those jobs do need GPU.
2. Export MAKEFLAGS="-j$(nproc)" at the top of install-smg.sh so every downstream make invocation (notably openssl-src's build.rs) fans out across all cores.

Changes

• .github/workflows/_build-engine-image.yml — runs-on label → cpu-e5
• .github/workflows/release-docker.yml — runs-on label → cpu-e5
• .github/workflows/nightly-docker.yml — runs-on label → cpu-e5
• scripts/installation/install-smg.sh — export MAKEFLAGS="-j$(nproc)" before any build step

Test Plan

• Trigger _build-engine-image via workflow_dispatch with dry_run: true for engine: sglang and confirm it lands on the new cpu-e5 runner and completes successfully.
• Confirm total build wall-clock is comparable to or better than the prior H200 build (expect the vendored-openssl step to drop from ~90 s to <10 s).
• Trigger release-docker (workflow_dispatch, no version bump → push=false path) and confirm the build step succeeds on the new runner.
• Verify the cpu-e5 self-hosted runner is registered on the repo and shows Idle before kicking off any workflow.

Checklist

• cargo +nightly fmt passes (N/A — no Rust changes)
• cargo clippy --all-targets --all-features -- -D warnings passes (N/A — no Rust changes)
• (Optional) Documentation updated
• (Optional) Please join us on Slack #sig-smg to discuss, review, and merge PRs

Summary by CodeRabbit

• Chores
  • CI Docker build workflows switched to a CPU-based runner to use optimized build infrastructure.
  • Installation script now enables parallel compilation by exporting build flags that use available CPU cores, speeding local builds.

[gemini-code-assist]

Warning

You have reached your daily quota limit. Please wait up to 24 hours and I will start processing your requests again!

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: ASSERTIVE

Plan: Pro

Run ID: 8ae902ad-60dd-49ed-99ea-8ab07458202e

📥 Commits

Reviewing files that changed from the base of the PR and between 5d5c2dd and b6a7fed.

📒 Files selected for processing (4)

• .github/workflows/_build-engine-image.yml
• .github/workflows/nightly-docker.yml
• .github/workflows/release-docker.yml
• scripts/installation/install-smg.sh

---

📝 Walkthrough

Walkthrough

GitHub Actions Docker build workflows are retargeted from GPU runners (8-gpu-h200) to a CPU runner (cpu-e5) across three pipelines, and the installation script exports MAKEFLAGS="-j$(nproc)" to enable parallel make jobs.

Changes

Cohort / File(s)	Summary
GitHub Actions Workflows \.github/workflows/_build-engine-image.yml, \.github/workflows/nightly-docker.yml, \.github/workflows/release-docker.yml	Updated runs-on for the build-and-push job from 8-gpu-h200 to cpu-e5. No other workflow steps, permissions, or Docker build/push settings changed.
Install script scripts/installation/install-smg.sh	Added export MAKEFLAGS="-j$(nproc)" near the top to run make with parallel jobs equal to CPU cores. No other script logic changed.

Sequence Diagram(s)

(none)

Estimated code review effort

🎯 1 (Trivial) | ⏱️ ~3 minutes

Possibly related PRs

• ci(docker): use H200 runner for builds and add nightly GHCR workflow #507 — Changes GitHub Actions runners from 8-gpu-h200 to cpu-e5 and adds MAKEFLAGS (strong overlap with both workflow and install script edits).
• ci: add Docker image release workflow #431 — Modifies the release-docker.yml workflow that this change also touches (same job file).
• ci(docker): add engine-specific image build pipelines #651 — Edits scripts/installation/install-smg.sh, touching the same install script modified here.

Suggested labels

docker

Suggested reviewers

• CatherineSue
• slin1237
• gongwei-130
• XinyueZhang369

Poem

🐇 I swapped my GPU hat for a CPU cap,

MAKEFLAGS set — now builds go snap-snap.
Cores dance in parallel, drums in a row,
A hoppity signal: compile and go!

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title accurately describes the two main changes: moving Docker builds to the cpu-e5 runner and parallelizing make via MAKEFLAGS, matching the changeset content.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

_{✏️ Tip: You can configure your own custom pre-merge checks in the settings.}

✨ Finishing Touches

📝 Generate docstrings

• Create stacked PR
• Commit on current branch

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch ci/cpu-e5-image-builder

---

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

[claude]

Looks good. Runner change from GPU to CPU for Docker builds is correct — no step requires host GPU access (CUDA cross-compilation happens inside Docker). MAKEFLAGS parallelization is standard.

[coderabbitai]

Actionable comments posted: 1

🤖 Prompt for all review comments with AI agents

Verify each finding against the current code and only fix it if needed.

Inline comments:
In `@scripts/installation/install-smg.sh`:
- Line 8: The assignment to MAKEFLAGS uses command substitution inline which can
mask nproc failures under set -e; change to first capture nproc into a variable
(e.g. cpu_count=$(nproc) and check that it succeeded), then set and export
MAKEFLAGS using that variable (MAKEFLAGS="-j${cpu_count}" and export MAKEFLAGS)
so a failing nproc causes an error/exit instead of leaving MAKEFLAGS as "-j".

🪄 Autofix (Beta)

Fix all unresolved CodeRabbit comments on this PR:

• Push a commit to this branch (recommended)
• Create a new PR with the fixes

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: ASSERTIVE

Plan: Pro

Run ID: 15511f53-1256-4808-9e2a-2f2e183feb76

📥 Commits

Reviewing files that changed from the base of the PR and between 3562749 and 585ee68.

📒 Files selected for processing (4)

• .github/workflows/_build-engine-image.yml
• .github/workflows/nightly-docker.yml
• .github/workflows/release-docker.yml
• scripts/installation/install-smg.sh