feat(scorer): add lora-load-state-scorer reading vLLM adapter residency #8817
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: CI - Lint | |
| on: | |
| push: | |
| branches: | |
| - main | |
| - 'release-*' | |
| pull_request: | |
| branches: | |
| - main | |
| pull_request_target: | |
| branches: | |
| - main | |
| types: [ opened, synchronize, reopened ] | |
| merge_group: | |
| types: [checks_requested] | |
| permissions: | |
| contents: read | |
| actions: read | |
| concurrency: | |
| group: ${{ github.workflow }}-${{ github.event_name }}-${{ github.event.pull_request.number || github.ref }} | |
| cancel-in-progress: true | |
| jobs: | |
| check-changes: | |
| # pull_request_target fires even when GITHUB_TOKEN creates the PR (e.g. the | |
| # release-notes bot). pull_request does not. We register pull_request_target | |
| # so bot-created PRs get a "skipped" conclusion that satisfies branch | |
| # protection, but we skip all real work: pull_request already covers human | |
| # PRs, and running twice would cause the concurrency group to cancel one run. | |
| if: github.event_name != 'pull_request_target' | |
| runs-on: ubuntu-latest | |
| outputs: | |
| src: ${{ steps.filter.outputs.src }} | |
| steps: | |
| - name: Checkout source | |
| uses: actions/checkout@v7 | |
| - uses: dorny/paths-filter@v4 | |
| id: filter | |
| with: | |
| filters: | | |
| src: | |
| - '**/*.go' | |
| - Dockerfile.* | |
| - Makefile* | |
| - go.mod | |
| - go.sum | |
| - .golangci.yml | |
| - .golangci-security.yml | |
| - .typos.toml | |
| - scripts/** | |
| - hack/** | |
| - test/** | |
| - .github/workflows/ci-lint.yaml | |
| lint: | |
| needs: check-changes | |
| if: ${{ needs.check-changes.outputs.src == 'true' }} | |
| runs-on: ubuntu-latest | |
| timeout-minutes: 30 | |
| permissions: | |
| contents: read | |
| actions: read | |
| security-events: write | |
| steps: | |
| - name: Checkout source | |
| uses: actions/checkout@v7 | |
| - name: Set up Go | |
| uses: actions/setup-go@v7 | |
| with: | |
| go-version-file: go.mod | |
| cache: true | |
| - name: Verify go.mod and go.sum are tidy | |
| run: go mod tidy -diff | |
| - name: Create Go cache dirs | |
| id: go-cache | |
| run: | | |
| mkdir -p "$HOME/.cache/llm-d-gomodcache" "$HOME/.cache/llm-d-gobuildcache" | |
| echo "mod=$HOME/.cache/llm-d-gomodcache" >> "$GITHUB_OUTPUT" | |
| echo "build=$HOME/.cache/llm-d-gobuildcache" >> "$GITHUB_OUTPUT" | |
| - name: Cache Go modules and build cache | |
| uses: actions/cache@v6 | |
| with: | |
| path: | | |
| ${{ steps.go-cache.outputs.mod }} | |
| ${{ steps.go-cache.outputs.build }} | |
| key: go-cache-${{ runner.os }}-${{ hashFiles('go.sum') }} | |
| restore-keys: | | |
| go-cache-${{ runner.os }}- | |
| - name: Run make build | |
| env: | |
| GO_MOD_CACHE_VOL: ${{ steps.go-cache.outputs.mod }} | |
| GO_BUILD_CACHE_VOL: ${{ steps.go-cache.outputs.build }} | |
| run: make build | |
| - name: Run make lint | |
| env: | |
| GO_MOD_CACHE_VOL: ${{ steps.go-cache.outputs.mod }} | |
| GO_BUILD_CACHE_VOL: ${{ steps.go-cache.outputs.build }} | |
| run: make lint | |
| - name: Run govulncheck | |
| run: | | |
| go install golang.org/x/vuln/cmd/govulncheck@v1.3.0 | |
| govulncheck ./... | |
| - name: Run make lint-security | |
| env: | |
| GO_MOD_CACHE_VOL: ${{ steps.go-cache.outputs.mod }} | |
| GO_BUILD_CACHE_VOL: ${{ steps.go-cache.outputs.build }} | |
| run: make lint-security | |
| # Fork PRs run with a read only GITHUB_TOKEN that cannot upload SARIF. | |
| # merge_group is excluded because the checked-out ref is the merge | |
| # queue's ephemeral gh-readonly-queue branch, which GitHub can delete | |
| # before the upload's processing wait completes, failing the call with | |
| # "ref not found". The persistent pull_request/push runs already cover | |
| # code scanning for the branch. | |
| # Pinned to a commit SHA rather than a tag, unlike other actions in this | |
| # workflow, per GitHub's guidance for actions that write security data. | |
| - name: Upload gosec SARIF | |
| if: ${{ !cancelled() && github.event_name != 'merge_group' && (github.event_name != 'pull_request' || github.event.pull_request.head.repo.full_name == github.repository) }} | |
| uses: github/codeql-action/upload-sarif@cdf488f595d80d6e07e03d4674febd5ab45fa938 # v4.37.9 | |
| with: | |
| sarif_file: gosec.sarif | |
| category: gosec | |
| # On runs that skip the upload above the artifact is the only way to | |
| # reach the findings. | |
| - name: Upload gosec SARIF artifact | |
| if: ${{ !cancelled() }} | |
| uses: actions/upload-artifact@v7 | |
| with: | |
| name: gosec-sarif | |
| path: gosec.sarif | |
| retention-days: 7 | |
| if-no-files-found: warn |