[WoA] Automate public cross-repository dispatch

.github/workflows/ci.yml

@@ -476,6 +476,25 @@ jobs:
       single-cuda-major: ${{ needs.ci-vars.outputs.WINDOWS_ARM64_SINGLE_CUDA_MAJOR == 'true' }}
       python-versions: ${{ needs.ci-vars.outputs.PYTHON_SUPPORTED }}
 
+  woa-main-dispatch:
+    name: Dispatch WoA integration
+    needs:
+      - build-linux-64
+      - build-windows-arm64
+    if: ${{ github.repository_owner == 'nvidia' &&
+            github.event_name == 'push' &&
+            github.ref == 'refs/heads/main' &&
+            needs.build-linux-64.result == 'success' &&
+            needs.build-windows-arm64.result == 'success' }}
+    permissions:
+      actions: read
+      checks: read
+      contents: read
+    uses: ./.github/workflows/woa-main-ci.yml
+    with:
+      public_run_id: ${{ github.run_id }}
+    secrets: inherit
+
   # NOTE: test-sdist jobs are split by platform (mirroring build-* and test-wheel-*)
   # so platform-specific sources (e.g. cuda_bindings/*_windows.pyx selected by
   # build_hooks.py) are exercised on their target OS. Keep these job definitions

.github/workflows/woa-validation-dispatch.yml → .github/workflows/woa-main-ci.yml

@@ -2,19 +2,33 @@
 #
 # SPDX-License-Identifier: Apache-2.0
 
-name: "WoA validation dispatch"
-run-name: "WoA exact dispatch for ${{ inputs.public_run_id || 'latest successful public main CI run' }}"
+name: "WoA main CI"
+run-name: "WoA main CI for ${{ inputs.public_run_id || 'latest successful public main CI run' }}"
 
 on:
+  workflow_call:
+    inputs:
+      public_run_id:
+        required: true
+        type: string
+    secrets:
+      CUDA_PYTHON_WOA_XREPO_CI_PRIVATE_APP_PRIVATE_KEY:
+        required: true
+  schedule:
+    - cron: "17 * * * *"
   workflow_dispatch:
     inputs:
       public_run_id:
-        description: Successful public main CI run; leave empty to find the latest successful main CI run
+        description: Eligible public main CI run; leave empty to find the latest successful main CI run
         required: false
         type: string
 
 permissions: {}
 
+concurrency:
+  group: cuda-python-woa-public-selector
+  cancel-in-progress: false
+
 jobs:
   resolve-public-build:
     if: ${{ github.repository == 'NVIDIA/cuda-python' }}
@@ -25,20 +39,22 @@ jobs:
       contents: read
       checks: read
     outputs:
+      dispatch: ${{ steps.select.outputs.dispatch }}
       correlation-id: ${{ steps.resolve.outputs.correlation_id }}
       public-run-id: ${{ steps.resolve.outputs.public_run_id }}
       public-sha: ${{ steps.resolve.outputs.public_sha }}
     steps:
-      - name: Checkout main run lookup helper
-        if: ${{ inputs.public_run_id == '' }}
+      - name: Checkout CI selection helpers
         uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7.0.1
         with:
-          ref: main
+          ref: ${{ github.sha }}
           persist-credentials: false
-          sparse-checkout: ci/tools/lookup-run-id
+          sparse-checkout: |
+            ci/tools/lookup-run-id
+            ci/tools/select-woa-batch
           sparse-checkout-cone-mode: false
 
-      - name: Resolve exact successful public build
+      - name: Resolve exact public build
         id: resolve
         env:
           GH_TOKEN: ${{ github.token }}
@@ -47,7 +63,7 @@ jobs:
           set -euo pipefail
           public_sha=''
           if [[ -z "$PUBLIC_RUN_ID" ]]; then
-            lookup_output=$(./ci/tools/lookup-run-id --branch main --head-sha NVIDIA/cuda-python CI)
+            lookup_output=$(./ci/tools/lookup-run-id --branch main --event push --head-sha NVIDIA/cuda-python CI)
             mapfile -t lookup_result <<< "$lookup_output"
             [[ ${#lookup_result[@]} == 2 ]]
             PUBLIC_RUN_ID=${lookup_result[0]}
@@ -64,8 +80,8 @@ jobs:
             .path == ".github/workflows/ci.yml" and
             .event == "push" and
             .head_branch == "main" and
-            .status == "completed" and
-            .conclusion == "success" and
+            ((.status == "in_progress" and .conclusion == null) or
+             (.status == "completed" and .conclusion == "success")) and
             ($sha == "" or .head_sha == $sha) and
             (.head_sha | test("^[0-9a-f]{40}$"))
           ' <<< "$run" >/dev/null
@@ -83,11 +99,20 @@ jobs:
           echo "public_run_id=$PUBLIC_RUN_ID" >> "$GITHUB_OUTPUT"
           echo "public_sha=$public_sha" >> "$GITHUB_OUTPUT"
           {
-            echo "Resolved successful public run \`$PUBLIC_RUN_ID\` at commit \`$public_sha\`."
+            echo "Resolved public run \`$PUBLIC_RUN_ID\` at commit \`$public_sha\`."
           } >> "$GITHUB_STEP_SUMMARY"
 
+      - name: Select public batch
+        id: select
+        env:
+          GH_TOKEN: ${{ github.token }}
+          PUBLIC_RUN_ID: ${{ steps.resolve.outputs.public_run_id }}
+          PUBLIC_SHA: ${{ steps.resolve.outputs.public_sha }}
+        run: bash ./ci/tools/select-woa-batch
+
   dispatch-private-validation:
     needs: resolve-public-build
+    if: ${{ needs.resolve-public-build.outputs.dispatch == 'true' }}
     runs-on: ubuntu-latest
     timeout-minutes: 10
     permissions: {}
@@ -123,23 +148,21 @@ jobs:
                 public_workflow_id: "155304118",
                 public_run_id: $run_id,
                 public_sha: $sha,
-                baseline_sha: "",
-                commit_count: "1",
                 correlation_id: $correlation_id
               }
             }')
           response=$(gh api \
             --method POST \
             -H 'X-GitHub-Api-Version: 2026-03-10' \
-            repos/NVIDIA-dev/cuda-python-private/actions/workflows/ctk-next-woa-validation.yml/dispatches \
+            repos/NVIDIA-dev/cuda-python-private/actions/workflows/ctk-next-woa-main-ci.yml/dispatches \
             --input - <<< "$payload")
           private_run_id=$(jq -er '.workflow_run_id | tostring' <<< "$response")
           run=$(gh api \
             -H 'X-GitHub-Api-Version: 2026-03-10' \
             "repos/NVIDIA-dev/cuda-python-private/actions/runs/$private_run_id")
           jq -e '
             .repository.full_name == "NVIDIA-dev/cuda-python-private" and
-            .path == ".github/workflows/ctk-next-woa-validation.yml" and
+            .path == ".github/workflows/ctk-next-woa-main-ci.yml" and
             .event == "workflow_dispatch" and
             .head_branch == "ctk-next"
           ' <<< "$run" >/dev/null

ci/tools/lookup-run-id

@@ -24,6 +24,7 @@ Usage:
 Options:
   --tag <tag>        Find run by git tag (requires local git repo with the tag)
   --branch <branch>  Find latest successful run on the given branch
+  --event <event>    Restrict branch-mode runs to a trigger event (for example push)
   --artifact <glob>  Require an unexpired artifact matching this shell glob
                      (repeatable; branch mode only)
   --head-sha         Also print the run's head commit SHA (second line)
@@ -33,6 +34,7 @@ Examples:
   $0 --branch main NVIDIA/cuda-python
   $0 --branch 12.9.x --artifact 'cuda-bindings-python313-*' NVIDIA/cuda-python
   $0 --branch main --head-sha NVIDIA/cuda-python "CI"
+  $0 --branch main --event push --head-sha NVIDIA/cuda-python "CI"
 EOF
     exit 1
 }
@@ -41,6 +43,7 @@ EOF
 MODE=""
 REF=""
 HEAD_SHA_FLAG=0
+EVENT=""
 ARTIFACT_PATTERNS=()
 
 while [[ $# -gt 0 ]]; do
@@ -56,6 +59,9 @@ while [[ $# -gt 0 ]]; do
         --artifact)
             [[ $# -ge 2 ]] || usage
             ARTIFACT_PATTERNS+=("${2}"); shift 2 ;;
+        --event)
+            [[ $# -ge 2 && -n "${2}" ]] || usage
+            EVENT="${2}"; shift 2 ;;
         --head-sha)
             HEAD_SHA_FLAG=1; shift ;;
         -h|--help)
@@ -83,6 +89,11 @@ if [[ "${MODE}" != "branch" && ${#ARTIFACT_PATTERNS[@]} -gt 0 ]]; then
     exit 1
 fi
 
+if [[ "${MODE}" != "branch" && -n "${EVENT}" ]]; then
+    echo "Error: --event is only supported with --branch" >&2
+    exit 1
+fi
+
 # ── Prerequisite checks ──
 if [[ -z "${GH_TOKEN:-}" ]]; then
     echo "Error: GH_TOKEN environment variable is required" >&2
@@ -176,7 +187,12 @@ if [[ "${MODE}" == "branch" ]]; then
                 "repos/${REPOSITORY}/actions/workflows/${WORKFLOW_ID}/runs" \
                 -f "head_sha=${commit_sha}" \
                 -F "per_page=100" \
-                --jq '[.workflow_runs[] | select(.conclusion == "success") | {id, head_sha, created_at}] | sort_by(.created_at) | reverse'); then
+                | jq -c --arg event "${EVENT}" '
+                    [.workflow_runs[]
+                     | select(.conclusion == "success" and ($event == "" or .event == $event))
+                     | {id, head_sha, created_at}]
+                    | sort_by(.created_at) | reverse
+                '); then
                 echo "Error: Failed to list runs for commit ${commit_sha}" >&2
                 exit 1
             fi