ci: scope initial platform image contracts

Author: hooray03

.github/configs/ascend.yml

@@ -20,9 +20,9 @@ hardware_name: ascend
 display_name: "Ascend NPU Tests"
 
 # Docker image for this hardware
-ci_image: harbor.baai.ac.cn/flagos-dev/flagscale:manual-20260812-ascend-dev-inference
-ci_train_image: harbor.baai.ac.cn/flagos-dev/flagscale:manual-20260812-ascend-dev-train
-ci_inference_image: harbor.baai.ac.cn/flagos-dev/flagscale:manual-20260812-ascend-dev-inference
+ci_image: harbor.baai.ac.cn/flagos-dev/flagscale:manual-20260812-ascend-dev-inference@sha256:e5b8e3b2c37584f980dffa1c08649b44e9edd2415522e123502e8d82a7854ef1
+ci_train_image: harbor.baai.ac.cn/flagos-dev/flagscale:manual-20260812-ascend-dev-train@sha256:2b6ceb58a1dc345ba89b2f8eb22dcc73aeec2048aa8e141abfaaf80f8635b91c
+ci_inference_image: harbor.baai.ac.cn/flagos-dev/flagscale:manual-20260812-ascend-dev-inference@sha256:e5b8e3b2c37584f980dffa1c08649b44e9edd2415522e123502e8d82a7854ef1
 
 # Runner labels for this hardware
 runner_labels: ["flagscale-ascend-ascend910-gpu2-32c-128g"]

.github/configs/metax.yml

@@ -65,5 +65,4 @@ env_names:
   train: "base"
   hetero_train: ""
   inference: ""
-  serve: ""
   rl: ""

.github/workflows/build_image_ascend.yml

@@ -16,20 +16,11 @@ on:
         required: true
         type: choice
         options: [train, inference]
-      push:
-        description: Push the candidate to shared Harbor
-        required: true
-        type: boolean
-        default: true
       run_tests:
         description: Run the existing Ascend matrix with the candidate
         required: true
         type: boolean
         default: true
-      tag:
-        description: Optional tag override
-        required: false
-        type: string
 
 permissions:
   contents: read
@@ -44,8 +35,8 @@ env:
   ASCEND_TE_REF: 94c7007c84107028919b4e52213d1bcb4ca3f7cf
   ASCEND_MEGATRON_REF: 409c1ed949675ddf9aa540aaae48652f446351cc
   ASCEND_VLLM_PLUGIN_REF: 43edeb601f4b8f616f56109de64836529e758deb
-  MANUAL_TRAIN_IMAGE: harbor.baai.ac.cn/flagos-dev/flagscale:manual-20260812-ascend-dev-train
-  MANUAL_INFERENCE_IMAGE: harbor.baai.ac.cn/flagos-dev/flagscale:manual-20260812-ascend-dev-inference
+  MANUAL_TRAIN_IMAGE: harbor.baai.ac.cn/flagos-dev/flagscale:manual-20260812-ascend-dev-train@sha256:2b6ceb58a1dc345ba89b2f8eb22dcc73aeec2048aa8e141abfaaf80f8635b91c
+  MANUAL_INFERENCE_IMAGE: harbor.baai.ac.cn/flagos-dev/flagscale:manual-20260812-ascend-dev-inference@sha256:e5b8e3b2c37584f980dffa1c08649b44e9edd2415522e123502e8d82a7854ef1
 
 jobs:
   prepare:
@@ -62,11 +53,8 @@ jobs:
         run: |
           set -euo pipefail
           short_sha="${GITHUB_SHA::7}"
-          tag='${{ inputs.tag }}'
-          if [ -z "$tag" ]; then
-            tag="${short_sha}-ascend-dev"
-          fi
-          image="${REGISTRY}/${REGISTRY_NAMESPACE}/flagscale-${{ inputs.task }}:${tag}"
+          tag="${short_sha}-ascend-${{ inputs.task }}-dev"
+          image="${REGISTRY}/${REGISTRY_NAMESPACE}/flagscale:${tag}"
           train_image="$MANUAL_TRAIN_IMAGE"
           inference_image="$MANUAL_INFERENCE_IMAGE"
           if [ '${{ inputs.task }}' = train ]; then
@@ -93,7 +81,6 @@ jobs:
           persist-credentials: false
 
       - name: Log in to shared Harbor
-        if: inputs.push
         shell: bash
         run: echo "$REGISTRY_PASSWORD" | docker login "$REGISTRY" --username "$REGISTRY_USERNAME" --password-stdin
 
@@ -145,7 +132,6 @@ jobs:
           '
 
       - name: Push candidate
-        if: inputs.push
         shell: bash
         run: docker push '${{ needs.prepare.outputs.image }}'
 
@@ -157,6 +143,8 @@ jobs:
             echo
             echo "- Task: \`${{ inputs.task }}\`"
             echo "- Image: \`${{ needs.prepare.outputs.image }}\`"
+            digest="$(docker image inspect '${{ needs.prepare.outputs.image }}' --format '{{range .RepoDigests}}{{println .}}{{end}}' | head -n 1)"
+            echo "- Digest: \`$digest\`"
             echo "- TransformerEngine-FL: \`${ASCEND_TE_REF}\`"
             echo "- Megatron-LM-FL: \`${ASCEND_MEGATRON_REF}\`"
             echo "- vllm-plugin-FL: \`${ASCEND_VLLM_PLUGIN_REF}\`"
@@ -165,7 +153,7 @@ jobs:
   tests:
     name: Test Ascend candidate
     needs: [prepare, build]
-    if: inputs.push && inputs.run_tests
+    if: inputs.run_tests
     uses: ./.github/workflows/all_tests_common.yml
     secrets: inherit
     with:

.github/workflows/build_image_metax.yml

@@ -6,19 +6,8 @@ name: Build Docker Images - MetaX
 on:
   workflow_dispatch:
     inputs:
-      task:
-        description: MetaX image to build
-        required: true
-        type: choice
-        options: [train, inference, all]
-        default: train
-      push:
-        description: Push candidate to shared Harbor
-        required: true
-        type: boolean
-        default: true
       run_tests:
-        description: Run the current MetaX matrix after build
+        description: Run the current MetaX train and benchmark matrix after build
         required: true
         type: boolean
         default: true
@@ -27,10 +16,6 @@ on:
         required: true
         type: boolean
         default: false
-      tag:
-        description: Optional tag override
-        required: false
-        type: string
       base_image:
         description: Validated MetaX base image (prefer an immutable digest)
         required: true
@@ -41,56 +26,37 @@ permissions:
   contents: read
 
 concurrency:
-  group: build-image-metax-${{ github.ref }}-${{ inputs.task }}
+  group: build-image-metax-${{ github.ref }}
   cancel-in-progress: false
 
 env:
   REGISTRY: harbor.baai.ac.cn
   REGISTRY_NAMESPACE: flagos-dev
   METAX_MEGATRON_REF: 409c1ed949675ddf9aa540aaae48652f446351cc
   METAX_TE_REF: 94c7007c84107028919b4e52213d1bcb4ca3f7cf
-  CURRENT_TRAIN_IMAGE: harbor.baai.ac.cn/flagscale/megatron-lm-with-te:202603231839
-  CURRENT_INFERENCE_IMAGE: harbor.baai.ac.cn/flagscale/megatron-lm-with-te:202603231839
 
 jobs:
   prepare:
-    name: Prepare MetaX candidate
+    name: Prepare MetaX train candidate
     runs-on: ubuntu-latest
     outputs:
-      matrix: ${{ steps.params.outputs.matrix }}
       candidate: ${{ steps.params.outputs.candidate }}
-      train_image: ${{ steps.params.outputs.train_image }}
-      inference_image: ${{ steps.params.outputs.inference_image }}
     steps:
       - name: Resolve build parameters
         id: params
         shell: bash
         run: |
           set -euo pipefail
           short_sha="${GITHUB_SHA::7}"
-          tag='${{ inputs.tag }}'
-          if [ -z "$tag" ]; then
-            tag="${short_sha}-metax-dev"
-          fi
-          candidate="${REGISTRY}/${REGISTRY_NAMESPACE}/flagscale-${{ inputs.task }}:${tag}"
-          train_image="$CURRENT_TRAIN_IMAGE"
-          inference_image="$CURRENT_INFERENCE_IMAGE"
-          case '${{ inputs.task }}' in
-            train) train_image="$candidate" ;;
-            inference) inference_image="$candidate" ;;
-            all) train_image="$candidate"; inference_image="$candidate" ;;
-          esac
-          echo 'matrix={"task":["${{ inputs.task }}"]}' >> "$GITHUB_OUTPUT"
+          candidate="${REGISTRY}/${REGISTRY_NAMESPACE}/flagscale:${short_sha}-metax-train-dev"
           echo "candidate=$candidate" >> "$GITHUB_OUTPUT"
-          echo "train_image=$train_image" >> "$GITHUB_OUTPUT"
-          echo "inference_image=$inference_image" >> "$GITHUB_OUTPUT"
 
   runtime_contract:
     name: Validate MetaX base runtime
     needs: prepare
     runs-on: flagscale-metax-c550-gpu2-8c-256g
     steps:
-      - name: Validate devices and collective
+      - name: Validate eight devices and TP2 collective
         shell: bash
         run: |
           set -euo pipefail
@@ -126,36 +92,22 @@ jobs:
               torchrun --standalone --nnodes=1 --nproc-per-node=2 /tmp/metax_collective.py
             '
 
-      - name: Validate MetaX vLLM contract
-        if: inputs.task == 'inference' || inputs.task == 'all'
-        shell: bash
-        run: |
-          set -euo pipefail
-          base_image='${{ inputs.base_image }}'
-          docker run --rm \
-            --ipc=host --group-add video \
-            --device=/dev/dri --device=/dev/mxcd \
-            --entrypoint python "$base_image" -c '
-          import importlib.metadata as metadata
-          import vllm
-          print("vllm:", metadata.version("vllm"))
-          print("module:", vllm.__file__)
-          '
-
   build:
-    name: Build MetaX candidate
+    name: Build and push MetaX train candidate
     needs: [prepare, runtime_contract]
     uses: ./.github/workflows/build_image_common.yml
     secrets: inherit
     with:
       platform: metax
       runs_on: '["flagscale-metax-c550-gpu2-8c-256g"]'
-      matrix: ${{ needs.prepare.outputs.matrix }}
+      matrix: '{"task":["train"]}'
       target: dev
       build_images: true
       no_cache: ${{ inputs.no_cache }}
-      push: ${{ inputs.push }}
+      push: true
       registry: harbor.baai.ac.cn
+      # The common builder requires all three inputs; this train-only matrix
+      # reads only train_image.
       train_image: ${{ needs.prepare.outputs.candidate }}
       inference_image: ${{ needs.prepare.outputs.candidate }}
       all_image: ${{ needs.prepare.outputs.candidate }}
@@ -166,12 +118,11 @@ jobs:
         FLAGSCALE_TE_REF=94c7007c84107028919b4e52213d1bcb4ca3f7cf
 
   candidate_contract:
-    name: Validate MetaX candidate runtime
+    name: Validate MetaX train candidate
     needs: [prepare, build]
     runs-on: flagscale-metax-c550-gpu2-8c-256g
     steps:
-      - name: Validate pinned training framework imports
-        if: inputs.task == 'train' || inputs.task == 'all'
+      - name: Validate pinned training stack on C550
         shell: bash
         run: |
           set -euo pipefail
@@ -183,36 +134,40 @@ jobs:
             --entrypoint python "$image" -c '
           import torch
           import transformer_engine
+          from transformer_engine.pytorch import DotProductAttention, LayerNormLinear
+          from megatron.core.extensions.transformer_engine import HAVE_TE
+          from megatron.core.extensions.transformer_engine_spec_provider import TESpecProvider
           from megatron.core.models.gpt import GPTModel
-          print("devices:", torch.cuda.device_count())
+
+          assert torch.cuda.device_count() == 8
+          assert HAVE_TE
+          assert TESpecProvider is not None
           print("transformer_engine:", transformer_engine.__file__)
+          print("TE modules:", DotProductAttention, LayerNormLinear)
           print("megatron GPTModel:", GPTModel)
           '
 
-      - name: Validate MetaX vLLM import
-        if: inputs.task == 'inference' || inputs.task == 'all'
+      - name: Record Harbor digest
         shell: bash
         run: |
           set -euo pipefail
           image='${{ needs.prepare.outputs.candidate }}'
-          docker pull "$image"
-          docker run --rm \
-            --ipc=host --group-add video \
-            --device=/dev/dri --device=/dev/mxcd \
-            --entrypoint python "$image" -c '
-          import importlib.metadata as metadata
-          import vllm
-          print("vllm:", metadata.version("vllm"))
-          print("module:", vllm.__file__)
-          '
+          digest="$(docker image inspect "$image" --format '{{range .RepoDigests}}{{println .}}{{end}}' | head -n 1)"
+          {
+            echo '### MetaX train candidate'
+            echo
+            echo "- Image: \`$image\`"
+            echo "- Digest: \`$digest\`"
+            echo "- Megatron-LM-FL: \`${METAX_MEGATRON_REF}\`"
+            echo "- TransformerEngine-FL: \`${METAX_TE_REF}\`"
+          } >> "$GITHUB_STEP_SUMMARY"
 
   tests:
-    name: Test MetaX candidate
+    name: Test MetaX train candidate
     needs: [prepare, build, candidate_contract]
-    if: inputs.push && inputs.run_tests
+    if: inputs.run_tests
     uses: ./.github/workflows/all_tests_common.yml
     secrets: inherit
     with:
       platform: metax
-      ci_train_image: ${{ needs.prepare.outputs.train_image }}
-      ci_inference_image: ${{ needs.prepare.outputs.inference_image }}
+      ci_train_image: ${{ needs.prepare.outputs.candidate }}

docker/ascend/Dockerfile.train

@@ -60,7 +60,7 @@ RUN --mount=type=cache,target=/root/.cache/pip \
         /workspace/tools/install/utils/*.sh \
         /workspace/tools/install/ascend/*.sh && \
     ./tools/install/install.sh --platform ascend --task train \
-        --pkg-mgr ${PKG_MGR} --no-system --force-build && \
+        --pkg-mgr ${PKG_MGR} --no-system --no-base --force-build && \
     rm -rf /workspace/*
 
 FROM deps AS dev
@@ -93,7 +93,7 @@ RUN --mount=type=cache,target=/root/.cache/pip \
         /workspace/tools/install/utils/*.sh \
         /workspace/tools/install/ascend/*.sh && \
     ./tools/install/install.sh --platform ascend --task train \
-        --pkg-mgr ${PKG_MGR} --no-system --no-dev --force-build && \
+        --pkg-mgr ${PKG_MGR} --no-system --no-dev --no-base --force-build && \
     rm -rf /workspace/*
 
 CMD ["/bin/bash"]