[WoA] Add manual cross-repository broker

.github/workflows/woa-transport-check.yml

@@ -0,0 +1,108 @@
+# SPDX-FileCopyrightText: Copyright (c) 2026 NVIDIA CORPORATION & AFFILIATES. All rights reserved.
+#
+# SPDX-License-Identifier: Apache-2.0
+
+name: "WoA transport check"
+run-name: "WoA transport smoke for current public main"
+
+on:
+  workflow_dispatch:
+
+permissions: {}
+
+jobs:
+  resolve-public-main:
+    if: ${{ github.repository == 'NVIDIA/cuda-python' }}
+    runs-on: ubuntu-latest
+    timeout-minutes: 5
+    permissions:
+      contents: read
+    outputs:
+      correlation-id: ${{ steps.resolve.outputs.correlation_id }}
+      public-sha: ${{ steps.resolve.outputs.public_sha }}
+    steps:
+      - name: Resolve exact public main commit
+        id: resolve
+        env:
+          GH_TOKEN: ${{ github.token }}
+        run: |
+          set -euo pipefail
+
+          public_sha=$(gh api \
+            -H 'X-GitHub-Api-Version: 2026-03-10' \
+            repos/NVIDIA/cuda-python/git/ref/heads/main \
+            --jq .object.sha)
+          [[ "$public_sha" =~ ^[0-9a-f]{40}$ ]]
+
+          commit=$(gh api \
+            -H 'X-GitHub-Api-Version: 2026-03-10' \
+            "repos/NVIDIA/cuda-python/commits/$public_sha")
+          jq -e --arg sha "$public_sha" '.sha == $sha' <<< "$commit" >/dev/null
+
+          comparison=$(gh api \
+            -H 'X-GitHub-Api-Version: 2026-03-10' \
+            "repos/NVIDIA/cuda-python/compare/$public_sha...main")
+          jq -e \
+            --arg sha "$public_sha" \
+            '.base_commit.sha == $sha and
+             .merge_base_commit.sha == $sha and
+             (.status == "ahead" or .status == "identical")' \
+            <<< "$comparison" >/dev/null
+
+          correlation_id="smoke:NVIDIA/cuda-python:main:$public_sha:${GITHUB_RUN_ID}:${GITHUB_RUN_ATTEMPT}"
+          echo "public_sha=$public_sha" >> "$GITHUB_OUTPUT"
+          echo "correlation_id=$correlation_id" >> "$GITHUB_OUTPUT"
+          echo "Transport smoke will report on public main commit \`$public_sha\`." >> "$GITHUB_STEP_SUMMARY"
+
+  dispatch-private-smoke:
+    needs: resolve-public-main
+    runs-on: ubuntu-latest
+    timeout-minutes: 10
+    permissions: {}
+    steps:
+      - name: Create private dispatch token
+        id: private-app-token
+        uses: actions/create-github-app-token@bcd2ba49218906704ab6c1aa796996da409d3eb1  # v3
+        with:
+          client-id: ${{ vars.CUDA_PYTHON_WOA_XREPO_CI_PRIVATE_APP_CLIENT_ID }}
+          private-key: ${{ secrets.CUDA_PYTHON_WOA_XREPO_CI_PRIVATE_APP_PRIVATE_KEY }}
+          owner: NVIDIA-dev
+          repositories: cuda-python-private
+          permission-actions: write
+
+      - name: Dispatch and verify private smoke workflow
+        env:
+          CORRELATION_ID: ${{ needs.resolve-public-main.outputs.correlation-id }}
+          GH_TOKEN: ${{ steps.private-app-token.outputs.token }}
+          PUBLIC_SHA: ${{ needs.resolve-public-main.outputs.public-sha }}
+        run: |
+          set -euo pipefail
+          payload=$(jq -n \
+            --arg correlation_id "$CORRELATION_ID" \
+            --arg public_sha "$PUBLIC_SHA" \
+            '{
+              ref: "ctk-next",
+              return_run_details: true,
+              inputs: {
+                schema_version: "2",
+                public_repository: "NVIDIA/cuda-python",
+                public_sha: $public_sha,
+                correlation_id: $correlation_id
+              }
+            }')
+          response=$(gh api \
+            --method POST \
+            -H 'X-GitHub-Api-Version: 2026-03-10' \
+            repos/NVIDIA-dev/cuda-python-private/actions/workflows/ctk-next-woa-transport-check.yml/dispatches \
+            --input - <<< "$payload")
+          private_run_id=$(jq -er '.workflow_run_id | tostring' <<< "$response")
+          run=$(gh api \
+            -H 'X-GitHub-Api-Version: 2026-03-10' \
+            "repos/NVIDIA-dev/cuda-python-private/actions/runs/$private_run_id")
+          jq -e '
+            .repository.full_name == "NVIDIA-dev/cuda-python-private" and
+            .path == ".github/workflows/ctk-next-woa-transport-check.yml" and
+            .event == "workflow_dispatch" and
+            .head_branch == "ctk-next"
+          ' <<< "$run" >/dev/null
+          echo "Private transport-smoke workflow accepted the exact dispatch." >> "$GITHUB_STEP_SUMMARY"

.github/workflows/woa-validation-dispatch.yml

@@ -0,0 +1,146 @@
+# SPDX-FileCopyrightText: Copyright (c) 2026 NVIDIA CORPORATION & AFFILIATES. All rights reserved.
+#
+# SPDX-License-Identifier: Apache-2.0
+
+name: "WoA validation dispatch"
+run-name: "WoA exact dispatch for ${{ inputs.public_run_id || 'latest successful public main CI run' }}"
+
+on:
+  workflow_dispatch:
+    inputs:
+      public_run_id:
+        description: Successful public main CI run; leave empty to find the latest successful main CI run
+        required: false
+        type: string
+
+permissions: {}
+
+jobs:
+  resolve-public-build:
+    if: ${{ github.repository == 'NVIDIA/cuda-python' }}
+    runs-on: ubuntu-latest
+    timeout-minutes: 10
+    permissions:
+      actions: read
+      contents: read
+      checks: read
+    outputs:
+      correlation-id: ${{ steps.resolve.outputs.correlation_id }}
+      public-run-id: ${{ steps.resolve.outputs.public_run_id }}
+      public-sha: ${{ steps.resolve.outputs.public_sha }}
+    steps:
+      - name: Checkout main run lookup helper
+        if: ${{ inputs.public_run_id == '' }}
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7.0.1
+        with:
+          ref: main
+          persist-credentials: false
+          sparse-checkout: ci/tools/lookup-run-id
+          sparse-checkout-cone-mode: false
+
+      - name: Resolve exact successful public build
+        id: resolve
+        env:
+          GH_TOKEN: ${{ github.token }}
+          PUBLIC_RUN_ID: ${{ inputs.public_run_id }}
+        run: |
+          set -euo pipefail
+          public_sha=''
+          if [[ -z "$PUBLIC_RUN_ID" ]]; then
+            lookup_output=$(./ci/tools/lookup-run-id --branch main --head-sha NVIDIA/cuda-python CI)
+            mapfile -t lookup_result <<< "$lookup_output"
+            [[ ${#lookup_result[@]} == 2 ]]
+            PUBLIC_RUN_ID=${lookup_result[0]}
+            public_sha=${lookup_result[1]}
+            [[ "$public_sha" =~ ^[0-9a-f]{40}$ ]]
+          fi
+          [[ "$PUBLIC_RUN_ID" =~ ^[1-9][0-9]*$ ]]
+          run=$(gh api \
+            -H 'X-GitHub-Api-Version: 2026-03-10' \
+            "repos/NVIDIA/cuda-python/actions/runs/$PUBLIC_RUN_ID")
+          jq -e --arg sha "$public_sha" '
+            .repository.full_name == "NVIDIA/cuda-python" and
+            .workflow_id == 155304118 and
+            .path == ".github/workflows/ci.yml" and
+            .event == "push" and
+            .head_branch == "main" and
+            .status == "completed" and
+            .conclusion == "success" and
+            ($sha == "" or .head_sha == $sha) and
+            (.head_sha | test("^[0-9a-f]{40}$"))
+          ' <<< "$run" >/dev/null
+          if [[ -z "$public_sha" ]]; then
+            public_sha=$(jq -r .head_sha <<< "$run")
+          fi
+
+          comparison=$(gh api \
+            -H 'X-GitHub-Api-Version: 2026-03-10' \
+            "repos/NVIDIA/cuda-python/compare/$public_sha...main")
+          jq -e '.status == "ahead" or .status == "identical"' <<< "$comparison" >/dev/null
+
+          correlation_id="v1:NVIDIA/cuda-python:$PUBLIC_RUN_ID:$public_sha"
+          echo "correlation_id=$correlation_id" >> "$GITHUB_OUTPUT"
+          echo "public_run_id=$PUBLIC_RUN_ID" >> "$GITHUB_OUTPUT"
+          echo "public_sha=$public_sha" >> "$GITHUB_OUTPUT"
+          {
+            echo "Resolved successful public run \`$PUBLIC_RUN_ID\` at commit \`$public_sha\`."
+          } >> "$GITHUB_STEP_SUMMARY"
+
+  dispatch-private-validation:
+    needs: resolve-public-build
+    runs-on: ubuntu-latest
+    timeout-minutes: 10
+    permissions: {}
+    steps:
+      - name: Create private dispatch token
+        id: private-app-token
+        uses: actions/create-github-app-token@bcd2ba49218906704ab6c1aa796996da409d3eb1  # v3
+        with:
+          client-id: ${{ vars.CUDA_PYTHON_WOA_XREPO_CI_PRIVATE_APP_CLIENT_ID }}
+          private-key: ${{ secrets.CUDA_PYTHON_WOA_XREPO_CI_PRIVATE_APP_PRIVATE_KEY }}
+          owner: NVIDIA-dev
+          repositories: cuda-python-private
+          permission-actions: write
+
+      - name: Dispatch and verify exact private validation
+        env:
+          CORRELATION_ID: ${{ needs.resolve-public-build.outputs.correlation-id }}
+          GH_TOKEN: ${{ steps.private-app-token.outputs.token }}
+          PUBLIC_RUN_ID: ${{ needs.resolve-public-build.outputs.public-run-id }}
+          PUBLIC_SHA: ${{ needs.resolve-public-build.outputs.public-sha }}
+        run: |
+          set -euo pipefail
+          payload=$(jq -n \
+            --arg correlation_id "$CORRELATION_ID" \
+            --arg run_id "$PUBLIC_RUN_ID" \
+            --arg sha "$PUBLIC_SHA" \
+            '{
+              ref: "ctk-next",
+              return_run_details: true,
+              inputs: {
+                schema_version: "1",
+                public_repository: "NVIDIA/cuda-python",
+                public_workflow_id: "155304118",
+                public_run_id: $run_id,
+                public_sha: $sha,
+                baseline_sha: "",
+                commit_count: "1",
+                correlation_id: $correlation_id
+              }
+            }')
+          response=$(gh api \
+            --method POST \
+            -H 'X-GitHub-Api-Version: 2026-03-10' \
+            repos/NVIDIA-dev/cuda-python-private/actions/workflows/ctk-next-woa-validation.yml/dispatches \
+            --input - <<< "$payload")
+          private_run_id=$(jq -er '.workflow_run_id | tostring' <<< "$response")
+          run=$(gh api \
+            -H 'X-GitHub-Api-Version: 2026-03-10' \
+            "repos/NVIDIA-dev/cuda-python-private/actions/runs/$private_run_id")
+          jq -e '
+            .repository.full_name == "NVIDIA-dev/cuda-python-private" and
+            .path == ".github/workflows/ctk-next-woa-validation.yml" and
+            .event == "workflow_dispatch" and
+            .head_branch == "ctk-next"
+          ' <<< "$run" >/dev/null
+          echo "Private validation workflow accepted the exact dispatch." >> "$GITHUB_STEP_SUMMARY"