Adding Secret support to Lepton Executor

.github/workflows/build-docs.yml

@@ -0,0 +1,24 @@
+# Copyright (c) 2025, NVIDIA CORPORATION.
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#     http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+name: Build docs
+
+on:
+  pull_request:
+    types: [opened, synchronize, reopened, labeled, unlabeled]
+  workflow_call:
+
+jobs:
+  build-docs:
+    uses: NVIDIA-NeMo/FW-CI-templates/.github/workflows/_build_docs.yml@v0.57.0

.github/workflows/changelog-build.yml

@@ -0,0 +1,123 @@
+name: 'Changelog Build (Release)'
+
+on:
+  workflow_dispatch:
+    inputs:
+      last-release-tag:
+        description: Last Git tag to start from (exclusive) (e.g. `v2.0.0`)
+        type: string
+        required: true
+      release-branch:
+        description: Release branch to build changelog on (e.g. `r2.1.0`)
+        type: string
+        required: true
+      changelog-main-content:
+        description: Custom changelog content to include before detailed changelogs
+        type: string
+        required: false
+        default: ''
+
+jobs:
+  changelog:
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout branch
+        uses: actions/checkout@v4
+        with:
+          ref: main
+          fetch-depth: 0
+
+      - name: Build Changelog
+        id: github_tag
+        uses: mikepenz/release-changelog-builder-action@v3.3.1
+        env:
+          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+        with:
+          # Configuration file is setup with filters for domains
+          # owner:repo must point to current repo
+          # fromTag: Auto resolved from historical tag order (previous tag compared to current tag)
+          # toTag: Current tag reference
+          configuration: ".github/workflows/config/changelog-config.json"
+          owner: ${{ github.repository_owner }}
+          repo: ${{ github.event.repository.name }}
+          ignorePreReleases: "false"
+          failOnError: "false"
+          fromTag: ${{ inputs.last-release-tag }}
+          toTag: ${{ inputs.release-branch }}
+
+      - name: Update changelog file
+        env: 
+          RELEASE_BRANCH: ${{ inputs.release-branch }}
+          CHANGELOG: ${{ steps.github_tag.outputs.changelog }}
+          MAIN_CONTENT: ${{ inputs.changelog-main-content }}
+        shell: bash -x -e -u -o pipefail {0}
+        run: |
+          RELEASE_VERSION=${RELEASE_BRANCH#r}
+          CHANGELOG=$(echo "$CHANGELOG" | sed '/^[[:blank:]]*#/s/#/###/')
+
+          # Build release notes starting with version header
+          RELEASE_NOTES="## NVIDIA Nemo Run $RELEASE_VERSION"
+
+          # Add custom content if provided
+          if [ -n "$MAIN_CONTENT" ]; then
+            RELEASE_NOTES="$RELEASE_NOTES
+
+          $MAIN_CONTENT"
+          fi
+
+          # Add detailed changelogs section
+          RELEASE_NOTES="$RELEASE_NOTES
+
+          ### Detailed Changelogs:
+
+          $CHANGELOG"
+
+          printf "%s\n" "$RELEASE_NOTES" | sed '/<!-- Next changelog -->/r /dev/stdin' CHANGELOG.md > CHANGELOG.tmp.md
+
+          mv CHANGELOG.tmp.md CHANGELOG.md
+
+      - name: Inspect new changelog file
+        run: cat CHANGELOG.md
+
+      - name: Create or update label
+        uses: actions/github-script@v6
+        with:
+          script: |
+            const labelName = '${{ inputs.release-branch }}';
+            const labelColor = '0366d6'; // Blue color
+            const labelDescription = `Release ${labelName}`;
+
+            try {
+              // Try to get the label
+              await github.rest.issues.getLabel({
+                owner: context.repo.owner,
+                repo: context.repo.repo,
+                name: labelName
+              });
+              console.log(`Label '${labelName}' already exists`);
+            } catch (error) {
+              if (error.status === 404) {
+                // Label doesn't exist, create it
+                await github.rest.issues.createLabel({
+                  owner: context.repo.owner,
+                  repo: context.repo.repo,
+                  name: labelName,
+                  color: labelColor,
+                  description: labelDescription
+                });
+                console.log(`Created label '${labelName}'`);
+              } else {
+                throw error;
+              }
+            }
+
+      - name: Create Pull Request
+        uses: peter-evans/create-pull-request@v7
+        with:
+          commit-message: "beep boop: Update changelog"
+          title: "Update changelog for `${{ inputs.release-branch }}`"
+          signoff: true
+          sign-commits: true
+          base: main
+          branch: bot/chore/update-changelog-into-${{ inputs.release-branch }}
+          labels: ${{ inputs.release-branch }}

.github/workflows/cherry-pick-release-commit.yml

@@ -7,7 +7,7 @@ on:
 
 jobs:
   cherry-pick:
-    uses: NVIDIA-NeMo/FW-CI-templates/.github/workflows/_cherry_pick.yml@v0.22.7
+    uses: NVIDIA-NeMo/FW-CI-templates/.github/workflows/_cherry_pick.yml@v0.63.0
     secrets:
       PAT: ${{ secrets.PAT }}
       SLACK_WEBHOOK_ADMIN: ${{ secrets.SLACK_WEBHOOK_ADMIN }}

.github/workflows/close-inactive-issue-pr.yml

@@ -0,0 +1,8 @@
+name: Stale-Close-Inactive-Issues-PRs
+on:
+  schedule:
+    - cron: "30 1 * * *"
+
+jobs:
+  close-issues:
+    uses: NVIDIA-NeMo/FW-CI-templates/.github/workflows/_close_inactive_issue_pr.yml@v0.44.0

.github/workflows/community-bot.yml

@@ -0,0 +1,15 @@
+name: Community Bot
+
+on:
+  issues:
+    types: [opened, edited, reopened, closed, deleted]
+  issue_comment:
+    types: [created, edited, deleted]
+
+jobs:
+  community-bot:
+    uses: NVIDIA-NeMo/FW-CI-templates/.github/workflows/_community_bot.yml@v0.54.4
+    with:
+      community_project_id: ${{ vars.COMMUNITY_PROJECT_ID }}
+    secrets:
+      GH_TOKEN: ${{ secrets.PAT }}

.github/workflows/config/changelog-config.json

@@ -0,0 +1,118 @@
+{
+    "categories": [
+      {
+        "title": "## Executors\n\n",
+        "labels": ["executor", "local", "slurm", "dgxcloud", "lepton", "skypilot", "docker"],
+        "exclude_labels": ["ignore"]
+      },
+      {
+        "title": "\n## Ray Integration\n\n",
+        "labels": ["ray", "kuberay", "ray-slurm"],
+        "exclude_labels": ["ignore"]
+      },
+      {
+        "title": "\n## CLI & Configuration\n\n",
+        "labels": ["cli", "config", "parsing"],
+        "exclude_labels": ["ignore"]
+      },
+      {
+        "title": "\n## Experiment & Job Management\n\n",
+        "labels": ["experiment", "job", "task"],
+        "exclude_labels": ["ignore"]
+      },
+      {
+        "title": "\n## Packaging & Deployment\n\n",
+        "labels": ["packaging", "deployment"],
+        "exclude_labels": ["ignore"]
+      },
+      {
+        "title": "\n## Documentation\n\n",
+        "labels": ["docs", "documentation"],
+        "exclude_labels": ["ignore"]
+      },
+      {
+        "title": "\n## CI/CD\n\n",
+        "labels": ["ci", "github-actions", "workflow"],
+        "exclude_labels": ["ignore"]
+      },
+      {
+        "title": "\n## Bug Fixes\n\n",
+        "labels": ["bug", "bugfix", "fix"],
+        "exclude_labels": ["ignore"]
+      }
+    ],
+    "ignore_labels": [
+      "ignore",
+      "skip-changelog"
+    ],
+    "sort": "ASC",
+    "template": "\n${{CHANGELOG}}\n## Others\n\n${{UNCATEGORIZED}}\n",
+    "pr_template": "- ${{TITLE}} [#${{NUMBER}}](${{URL}})",
+    "empty_template": "- No changes in this release",
+    "label_extractor": [
+      {
+        "pattern": "(.*executor.*)|(.*local.*)|(.*slurm.*)|(.*dgxcloud.*)|(.*lepton.*)|(.*skypilot.*)|(.*docker.*)",
+        "target": "executor",
+        "flags": "gimu",
+        "on_property": ["title", "body"]
+      },
+      {
+        "pattern": "(.*ray.*)|(.*kuberay.*)",
+        "target": "ray",
+        "flags": "gimu",
+        "on_property": ["title", "body"]
+      },
+      {
+        "pattern": "(.*cli.*)|(.*command.*)|(.*parse.*)|(.*argument.*)",
+        "target": "cli",
+        "flags": "gimu",
+        "on_property": ["title", "body"]
+      },
+      {
+        "pattern": "(.*experiment.*)|(.*job.*)|(.*task.*)",
+        "target": "experiment",
+        "flags": "gimu",
+        "on_property": ["title", "body"]
+      },
+      {
+        "pattern": "(.*packaging.*)|(.*package.*)|(.*deploy.*)|(.*archive.*)|(.*mount.*)",
+        "target": "packaging",
+        "flags": "gimu",
+        "on_property": ["title", "body"]
+      },
+      {
+        "pattern": "(.*doc.*)|(.*readme.*)|(.*guide.*)|(.*tutorial.*)",
+        "target": "docs",
+        "flags": "gimu",
+        "on_property": ["title", "body"]
+      },
+      {
+        "pattern": "(.*\\bci\\b.*)|(.*github.*)|(.*workflow.*)|(.*action.*)",
+        "target": "ci",
+        "flags": "gimu",
+        "on_property": ["title", "body"]
+      },
+      {
+        "pattern": "(.*\\[bug.*)|(.*\\bfix\\b.*)|(.*bugfix.*)|(.*patch.*)",
+        "target": "bug",
+        "flags": "gimu",
+        "on_property": ["title", "body"]
+      }
+    ],
+    "duplicate_filter": {
+      "pattern": ".+",
+      "on_property": "title",
+      "method": "match"
+    },
+    "transformers": [
+    ],
+    "max_tags_to_fetch": 100,
+    "max_pull_requests": 500,
+    "max_back_track_time_days": 365,
+    "exclude_merge_branches": [
+    ],
+    "tag_resolver": {
+      "method": "semver"
+    }
+}
+

.github/workflows/copyright-check.yml

@@ -0,0 +1,23 @@
+# Copyright (c) 2025, NVIDIA CORPORATION.
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#     http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+name: Copyright check
+
+on:
+  pull_request:
+  workflow_dispatch:
+
+jobs:
+  copyright-check:
+    uses: NVIDIA-NeMo/FW-CI-templates/.github/workflows/_copyright_check.yml@v0.54.4

.github/workflows/release.yml

@@ -31,7 +31,7 @@ on:
         description: Branch to target for version bump
 jobs:
   release:
-    uses: NVIDIA-NeMo/FW-CI-templates/.github/workflows/_release_library.yml@v0.22.6
+    uses: NVIDIA-NeMo/FW-CI-templates/.github/workflows/_release_library.yml@v0.40.0
     with:
       release-ref: ${{ inputs.release-ref }}
       python-package: nemo_run