[TRTLLM-10804][fix] Unify Docker image orchestration and nightly wheel selection by niukuo · Pull Request #20596 · NVIDIA/TensorRT-LLM

niukuo · 2026-10-19T09:57:37Z

Description

Regular Docker builds and NGC container scanning can each launch BuildDockerImages, creating redundant builds. Route both through Build-Docker-Images and scan the resulting image manifest only after the helper returns SUCCESS, including when build failures are configured to be ignored.

Keep triggerType consistent with the actual parent job. For nightly releases, pass useWheelFromBuildStage according to whether the wheel target is selected; leave it unspecified for other runs.

Explicitly enable nSpect image registration for nightly and postmerge builds and disable it for premerge builds, while retaining compliance checks. The helper's existing nspect_id and action conditions still apply.

Test Coverage

Local Groovy harness: 36 L0 parameter and scheduling fixtures, including nSpect registration selection.
Local Groovy harness: 96 downstream nSpect registration/compliance cases using the upstream helper.
Local Groovy harness: 33 success/failure cases covering scan-only, combined builds, nightly, ignored failures, UNSTABLE, interruptions, and dry runs.
Groovy syntax checks and repository pre-commit hooks passed.

Full Jenkins and Docker builds were not run locally.

PR Checklist

Reviewed the applicable repository PR checklist items.

Dev Engineer Review

Build-Docker-Images now handles Docker builds and NGC container scanning.
Container scanning runs only after Build-Docker-Images returns SUCCESS, including ignored build failures.
Nightly runs set useWheelFromBuildStage from wheel-target selection.
triggerType remains aligned with the parent job.
The separate container-scanning job path was removed.
Review finding counts and test execution results are unavailable.

QA Engineer Review

No test changes.

Per-File QA Perspective

jenkins/L0_MergeRequest.groovy: Verify nightly, post-merge, explicit Docker-build, and NGC scan flows. Verify scan suppression after build failure, including ignored failures, plus triggerType values and nightly wheel selection.

coderabbitai · 2026-10-19T10:31:25Z

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Repository: NVIDIA/TensorRT-LLM/.coderabbit.yaml
Review profile: CHILL
Plan: Enterprise
Run ID: df1ac4e7-1132-48ca-ad3f-88ac2d39cd6b

📥 Commits

Reviewing files that changed from the base of the PR and between 86d7375 and a3b3bf0.

📒 Files selected for processing: 1

jenkins/L0_MergeRequest.groovy

Included review availability: This review used your included allowance. Your plan provides up to 12 included reviews per hour; 10 remain after this review.

Walkthrough

The Jenkins pipeline selects Docker image builds and container scans through flags. It configures the build job by run mode and runs compliance scanning only when scanning was requested and the image build succeeded.

Changes

Docker build and scan

Layer / File(s)	Summary
Docker build selection `jenkins/L0_MergeRequest.groovy`	Nightly, post-merge, and explicit requests set build or scan flags. The pipeline adds the unified Docker build job when either flag is enabled.
Build parameters and scan gating `jenkins/L0_MergeRequest.groovy`	The pipeline selects image-build parameters by run mode, stores the job result, and creates the compliance scan stage only when scanning was requested and the build succeeded.

Priority: ⬇️ Low

Estimated code review effort: 3 (Moderate) | ~20 minutes

Change: Bug fix

Sequence Diagram(s)

sequenceDiagram
  participant JenkinsPipeline
  participant DockerImageBuildJob
  participant ComplianceScanStage
  JenkinsPipeline->>DockerImageBuildJob: Launch with run-mode parameters
  DockerImageBuildJob-->>JenkinsPipeline: Return image build status
  JenkinsPipeline->>ComplianceScanStage: Create scan stage when scanning is enabled and status is SUCCESS

Merge Risk: ⚪ Minimal · up to a3b3b

The change routes Docker builds and container scans through the unified build helper and runs the scan only after a successful build. No concrete merge-blocking risk was found in the supplied changes.

Pre-merge checks: 5

Check name	Status	Explanation
Title check		The title follows the repository format and clearly identifies the Docker orchestration and nightly wheel-selection changes.
Description check		The description includes the required Description, Test Coverage, and PR Checklist sections. It explains the changes, lists relevant tests, and marks the checklist reviewed.
Docstring Coverage		No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff. Analyzed 0 functions across 0…
Linked Issues check		Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check		Check skipped because no linked issues were found for this pull request.

Full details: Docstring Coverage

Explanation

No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff. Analyzed 0 functions across 0 files. (1 skipped: 1 unsupported.)

✨ Finishing Touches

🧪 Generate unit tests (beta)

Create a new PR

Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

_{Comment @coderabbitai help to get the list of available commands.}

niukuo · 2026-10-20T01:03:48Z

/bot run --stage-list 'NGC-Container-Scaning'

github-actions · 2026-10-20T01:03:56Z

⚠️ Bot command ignored: The /bot command must appear at the very beginning of the comment (no leading blank lines or spaces). Please post a new comment with /bot as the first character.

niukuo · 2026-10-20T01:54:21Z

/bot run --stage-list 'NGC-Container-Scaning'

tensorrt-cicd · 2026-10-20T02:00:32Z

PR_Github #79088 [ run ] triggered by Bot. Commit: 5d3eeac Link to invocation

tensorrt-cicd · 2026-10-20T08:26:16Z

PR_Github #79088 [ run ] completed with state SUCCESS. Commit: 5d3eeac
/LLM/main/L0_MergeRequest_PR pipeline #65148 (Partly Tested) completed with status: 'SUCCESS'

CI Report

Link to invocation

niukuo · 2026-10-20T08:50:02Z

/bot run --stage-list 'Build-Docker-Images'

tensorrt-cicd · 2026-10-20T08:57:40Z

PR_Github #79224 [ run ] triggered by Bot. Commit: 5d3eeac Link to invocation

tensorrt-cicd · 2026-10-20T09:03:33Z

PR_Github #79225 [ run ] triggered by Bot. Commit: 86d7375 Link to invocation

tensorrt-cicd · 2026-10-20T09:03:37Z

PR_Github #79224 [ run ] completed with state ABORTED. Commit: 5d3eeac

Link to invocation

…l selection Run Docker image builds once from Build-Docker-Images and derive their trigger type from the parent job. Scan the resulting images directly only when the helper returns SUCCESS, including when failures are ignored. Select build-stage wheels for nightly releases when the wheel target is enabled. Register images for nightly and postmerge builds, and disable image registration for premerge builds while retaining compliance checks. Signed-off-by: Yiteng Niu <6831097+niukuo@users.noreply.github.com>

tensorrt-cicd · 2026-10-20T09:50:59Z

PR_Github #79234 [ run ] triggered by Bot. Commit: a3b3bf0 Link to invocation

tensorrt-cicd · 2026-10-20T09:55:26Z

PR_Github #79225 [ run ] completed with state ABORTED. Commit: 86d7375

Link to invocation

tensorrt-cicd · 2026-10-20T15:23:44Z

PR_Github #79234 [ run ] completed with state FAILURE. Commit: a3b3bf0
/LLM/main/L0_MergeRequest_PR pipeline #65264 (Partly Tested) completed with status: 'FAILURE'

CI Report

⚠️ Action Required:

Please check the failed tests and fix your PR
If you cannot view the failures, ask the CI triggerer to share details
Once fixed, request an NVIDIA team member to trigger CI again

CI Agent Failure Analysis

Link to invocation

niukuo · 2026-10-20T15:41:53Z

/bot run --stage-list 'NGC-Container-Scaning,Build-Docker-Images'

tensorrt-cicd · 2026-10-20T15:49:35Z

PR_Github #79297 [ run ] triggered by Bot. Commit: a3b3bf0 Link to invocation

tensorrt-cicd · 2026-10-21T01:15:26Z

PR_Github #79297 [ run ] completed with state FAILURE. Commit: a3b3bf0
/LLM/main/L0_MergeRequest_PR pipeline #65316 (Partly Tested) completed with status: 'FAILURE'

CI Report

⚠️ Action Required:

Please check the failed tests and fix your PR
If you cannot view the failures, ask the CI triggerer to share details
Once fixed, request an NVIDIA team member to trigger CI again

CI Agent Failure Analysis

Link to invocation

niukuo · 2026-10-21T02:03:32Z

/bot skip --comment "downstream job triggered as expected"

tensorrt-cicd · 2026-10-21T02:11:47Z

PR_Github #79468 [ skip ] triggered by Bot. Commit: a3b3bf0 Link to invocation

tensorrt-cicd · 2026-10-21T02:23:01Z

PR_Github #79468 [ skip ] completed with state SUCCESS. Commit: a3b3bf0
Skipping testing for commit a3b3bf0

Link to invocation

yuanjingx87

The PR looks good. I left a comment about the SBSA release container build, which currently fails because the wheel build stage is skipped. Please disregard it if this has already been addressed in another PR.

github-actions · 2026-10-22T01:02:51Z

Automatically added "ci: full pre-merge approved" because this PR has satisfied the required GitHub review approvals. Unresolved review conversations and other required checks remain independent merge requirements.

niukuo requested a review from a team as a code owner October 19, 2026 09:57

niukuo requested review from dpitman-nvda and yuanjingx87 October 19, 2026 09:57

github-actions Bot assigned niukuo Oct 19, 2026

niukuo requested a review from chzblych October 20, 2026 07:12

niukuo force-pushed the user/yitengn/unify-docker-builds-20261019 branch from 5d3eeac to 86d7375 Compare October 20, 2026 09:02

niukuo force-pushed the user/yitengn/unify-docker-builds-20261019 branch from 86d7375 to a3b3bf0 Compare October 20, 2026 09:47

yuanjingx87 reviewed Oct 22, 2026

View reviewed changes

Comment thread jenkins/L0_MergeRequest.groovy

yuanjingx87 approved these changes Oct 22, 2026

View reviewed changes

trtllm-agent added the ci: full pre-merge approved label Oct 22, 2026

niukuo merged commit 0084e98 into NVIDIA:main Oct 22, 2026
17 checks passed

Conversation

niukuo commented Oct 19, 2026 • edited by coderabbitai Bot Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Description

Test Coverage

PR Checklist

Dev Engineer Review

QA Engineer Review

Per-File QA Perspective

Uh oh!

coderabbitai Bot commented Oct 19, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Walkthrough

Changes

Sequence Diagram(s)

Uh oh!

niukuo commented Oct 20, 2026

Uh oh!

github-actions Bot commented Oct 20, 2026

Uh oh!

niukuo commented Oct 20, 2026

Uh oh!

tensorrt-cicd commented Oct 20, 2026

Uh oh!

tensorrt-cicd commented Oct 20, 2026

Uh oh!

niukuo commented Oct 20, 2026

Uh oh!

tensorrt-cicd commented Oct 20, 2026

Uh oh!

tensorrt-cicd commented Oct 20, 2026

Uh oh!

tensorrt-cicd commented Oct 20, 2026

Uh oh!

tensorrt-cicd commented Oct 20, 2026

Uh oh!

tensorrt-cicd commented Oct 20, 2026

Uh oh!

tensorrt-cicd commented Oct 20, 2026

Uh oh!

niukuo commented Oct 20, 2026

Uh oh!

tensorrt-cicd commented Oct 20, 2026

Uh oh!

tensorrt-cicd commented Oct 21, 2026

Uh oh!

niukuo commented Oct 21, 2026

Uh oh!

tensorrt-cicd commented Oct 21, 2026

Uh oh!

tensorrt-cicd commented Oct 21, 2026

Uh oh!

Uh oh!

yuanjingx87 left a comment

Choose a reason for hiding this comment

Uh oh!

github-actions Bot commented Oct 22, 2026

Uh oh!

Uh oh!

Reviewers

Uh oh!

Assignees

Labels

Projects

Milestone

Development

Uh oh!

4 participants

niukuo commented Oct 19, 2026 •

edited by coderabbitai Bot

Loading

coderabbitai Bot commented Oct 19, 2026 •

edited

Loading