ci: restrict Stable result publication to main (#1341)

* ci: restrict Stable result publication to main

Manual Dev comparisons must not replace the complete Stable verdict with a CPU-only compatibility result after GPU promotion. Authorize each publisher before any status write, including failure handling.

Refs: #1301
Signed-off-by: yifeif <277870278+yifeif-nv@users.noreply.github.com>

* ci: keep Community coordination on main

Signed-off-by: yifeif <277870278+yifeif-nv@users.noreply.github.com>

---------

Signed-off-by: yifeif <277870278+yifeif-nv@users.noreply.github.com>

Author: yifeif-nv

.github/community-ci.md

@@ -58,13 +58,22 @@ The switch is captured once per request. Turning it off stops Dev on subsequent
 requests; work already started finishes normally. A Dev branch selection alone
 does not enable automatic dual running. Dev must not be a required merge check.
 
-For manual qualification, select **Actions > Community CI > Run workflow** and
-enter a PR number. Selecting `ci/developer` runs Dev against the existing Stable
-PR snapshot; with dual running enabled it also publishes the paired Stable result.
-Selecting `main` manually starts Stable and, when enabled, Dev. Keep the internal
-snapshot, lane, and request inputs at their defaults. Manual starts require
+For manual qualification, select **Actions > Community CI > Run workflow**,
+keep the workflow branch set to `main`, and enter a PR number. Select `ci_lane=dev`
+to run Dev only against the existing Stable PR snapshot, regardless of the
+dual-run switch. The default `ci_lane=stable` starts Stable and, when enabled, Dev.
+Keep the internal snapshot and request inputs empty. Manual starts require
 maintain or admin access. `run_gpu_smoke` retains the existing manual GPU opt-in.
 
+Coordination and status publication run only from `refs/heads/main`. Dev's
+implementation ref is data selected by `TRTMC_COMMUNITY_CI_DEV_REF`, not the
+workflow ref used to start the coordinator. Direct Dev-branch starts without the
+internal snapshot do not run coordination jobs. Only the main coordinator
+publishes `Stable Community CI`.
+A Dev-only start cannot replace a failed or pending Stable result with the
+successful CPU compatibility check retained for Internal CI. Apply this publisher
+guard to the Dev branch before promoting its GPU implementation to `main`.
+
 ## Dev GPU experiment
 
 GPU policy is versioned in the workflow, independently of the dual-run switch.
@@ -81,8 +90,9 @@ timm ViT, Whisper, and directly changed or added families. Docs-only changes
 skip GPU. Missing public assets fail visibly rather than count as coverage.
 
 The existing `gpu-ci-dispatch` environment permits `main` and protected
-`ci/developer`. Only administrators may update the latter. Additional CI refs
-need protection and environment approval. Dev uses a disposable Brev instance,
+`ci/developer`. Only administrators may update the latter. The dispatcher accepts
+only `main` and `ci/developer`; additional refs need an explicit allowlist update,
+protection, and environment approval. Dev uses a disposable Brev instance,
 with cleanup in the job and an independent cleanup job. Per-PR and per-lane
 concurrency keeps independent PRs parallel; shared provider quota can still
 prevent allocation. Dev GPU type and CUDA architecture default to L40 and 89.

.github/workflows/community-ci.yml

@@ -27,7 +27,7 @@ on:
         default: false
         type: boolean
       ci_lane:
-        description: CI implementation role (filled automatically)
+        description: Select dev for a manual Dev-only run; stable follows the dual-run switch
         required: false
         type: choice
         default: stable
@@ -48,14 +48,15 @@ env:
   COMMUNITY_GPU_EXECUTION_ENABLED: "false"
 
 concurrency:
-  group: community-ci-${{ inputs.source_snapshot != '' && inputs.ci_lane || github.event_name == 'pull_request' && 'stable-pr' || github.ref_name == 'main' && 'start-main' || 'start-dev' }}-${{ github.event.pull_request.number || inputs.pr_number }}
+  group: community-ci-${{ inputs.source_snapshot != '' && inputs.ci_lane || github.event_name == 'pull_request' && 'stable-pr' || (github.event_name == 'workflow_dispatch' && inputs.ci_lane == 'dev') && 'start-dev' || 'start-main' }}-${{ github.event.pull_request.number || inputs.pr_number }}
   cancel-in-progress: true
 
 jobs:
   snapshot:
     name: Capture the Community CI snapshot
     if: >-
       github.repository == 'NVIDIA/TensorRT-Model-Connect' &&
+      github.ref == 'refs/heads/main' &&
       (github.event_name == 'pull_request_target' ||
        (github.event_name == 'workflow_dispatch' && inputs.source_snapshot == ''))
     runs-on: ubuntu-24.04
@@ -76,14 +77,17 @@ jobs:
         id: lanes
         env:
           DUAL_RUN: ${{ vars.TRTMC_COMMUNITY_CI_DUAL_RUN }}
-          CI_BRANCH: ${{ github.ref_name }}
+          CI_ENTRY_REF: ${{ github.ref }}
+          EVENT_NAME: ${{ github.event_name }}
+          REQUESTED_LANE: ${{ inputs.ci_lane }}
         run: |
           set -euo pipefail
+          test "$CI_ENTRY_REF" = refs/heads/main
           lanes='["stable"]'
-          if [ "$DUAL_RUN" = true ]; then
-            lanes='["stable","dev"]'
-          elif [ "$CI_BRANCH" != main ]; then
+          if [ "$EVENT_NAME" = workflow_dispatch ] && [ "$REQUESTED_LANE" = dev ]; then
             lanes='["dev"]'
+          elif [ "$DUAL_RUN" = true ]; then
+            lanes='["stable","dev"]'
           fi
           echo "lanes=$lanes" >> "$GITHUB_OUTPUT"
 
@@ -102,7 +106,7 @@ jobs:
 
       - name: Find the existing Stable PR snapshot
         id: stable
-        if: ${{ github.event_name == 'pull_request_target' || github.ref_name != 'main' }}
+        if: ${{ github.event_name == 'pull_request_target' || inputs.ci_lane == 'dev' }}
         env:
           GH_TOKEN: ${{ github.token }}
           PR_NUMBER: ${{ github.event.pull_request.number || inputs.pr_number }}
@@ -191,7 +195,7 @@ jobs:
         env:
           GH_TOKEN: ${{ github.token }}
           HEAD_SHA: ${{ steps.snapshot.outputs.head_sha }}
-          STATUS_CONTEXT: ${{ github.ref_name == 'main' && 'Stable Community CI' || 'Dev Community CI' }}
+          STATUS_CONTEXT: ${{ steps.lanes.outputs.lanes == '["dev"]' && 'Dev Community CI' || 'Stable Community CI' }}
         run: |
           set -euo pipefail
           [[ "$HEAD_SHA" =~ ^[0-9a-f]{40}$ ]] || exit 0
@@ -204,7 +208,7 @@ jobs:
   dispatch:
     name: Start ${{ matrix.lane }} Community CI
     needs: snapshot
-    if: ${{ needs.snapshot.result == 'success' }}
+    if: ${{ needs.snapshot.result == 'success' && github.ref == 'refs/heads/main' }}
     strategy:
       fail-fast: false
       matrix:
@@ -222,6 +226,26 @@ jobs:
     env:
       STATUS_CONTEXT: ${{ matrix.lane == 'stable' && 'Stable Community CI' || 'Dev Community CI' }}
     steps:
+      - name: Authorize the result publisher
+        id: publisher
+        env:
+          LANE: ${{ matrix.lane }}
+          CI_ENTRY_REF: ${{ github.ref }}
+        run: |
+          set -euo pipefail
+          if [ "$CI_ENTRY_REF" != refs/heads/main ]; then
+            echo "::error::Community CI coordination must run from main."
+            exit 1
+          fi
+          case "$LANE" in
+            stable)
+              test "$STATUS_CONTEXT" = 'Stable Community CI'
+              ;;
+            dev) test "$STATUS_CONTEXT" = 'Dev Community CI' ;;
+            *) echo "::error::Unknown Community CI publisher."; exit 1 ;;
+          esac
+          echo "authorized=true" >> "$GITHUB_OUTPUT"
+
       - name: Mark the selected CI pending
         env:
           GH_TOKEN: ${{ github.token }}
@@ -239,14 +263,18 @@ jobs:
         env:
           GH_TOKEN: ${{ github.token }}
           PR_NUMBER: ${{ needs.snapshot.outputs.pr_number }}
-          CI_REF: ${{ matrix.lane == 'stable' && 'main' || github.ref_name != 'main' && github.ref_name || vars.TRTMC_COMMUNITY_CI_DEV_REF || 'main' }}
+          CI_REF: ${{ matrix.lane == 'stable' && 'main' || vars.TRTMC_COMMUNITY_CI_DEV_REF || 'main' }}
           LANE: ${{ matrix.lane }}
           SOURCE_SNAPSHOT: ${{ needs.snapshot.outputs.source_snapshot }}
           HEAD_SHA: ${{ needs.snapshot.outputs.head_sha }}
           STABLE_RUN_ID: ${{ needs.snapshot.outputs.stable_run_id }}
           RUN_GPU_SMOKE: ${{ inputs.run_gpu_smoke || false }}
         run: |
           set -euo pipefail
+          case "$LANE:$CI_REF" in
+            stable:main|dev:main|dev:ci/developer) ;;
+            *) echo "::error::The CI implementation must use an approved main or ci/developer branch."; exit 1 ;;
+          esac
           if [ "$LANE" = stable ] && [ -n "${STABLE_RUN_ID:-}" ]; then
             [[ "$STABLE_RUN_ID" =~ ^[1-9][0-9]*$ ]]
             echo "run_id=$STABLE_RUN_ID" >> "$GITHUB_OUTPUT"
@@ -349,7 +377,7 @@ jobs:
           exit 1
 
       - name: Report a failed CI request
-        if: ${{ failure() && steps.verdict.outputs.reported != 'true' }}
+        if: ${{ failure() && steps.publisher.outputs.authorized == 'true' && steps.verdict.outputs.reported != 'true' }}
         env:
           GH_TOKEN: ${{ github.token }}
           HEAD_SHA: ${{ needs.snapshot.outputs.head_sha }}