feat(release): mirror release-branch protection onto fake-release/* by ko3n1g · Pull Request #480 · NVIDIA-NeMo/FW-CI-templates

ko3n1g · 2026-05-22T10:00:20Z

Claude summary

Follow-up to #466

Closes a coverage gap in the validate-only release rehearsal: today the rehearsal pushes the bump commit to deploy-release/<uuid> and opens a PR against the version-bump branch (typically main). So the required status checks gating that PR come from main's protection — not from the real release-branch rules a release would actually face. The dry-run isn't testing the release contract.

Change

Two pieces:

Mirror branch protection — the bump job reads the rule matching release-branch-pattern (default [rv][0-9].[0-9].[0-9]) and mirrors it onto a fake-release/* pattern. Idempotent: creates if absent, updates in place if present. Persists across runs.
Dry-run re-targets PR to fake-release/ — in dry-run mode the bump job creates a throwaway fake-release/<uuid> branch off the version-bump branch, PRs deploy-release/<uuid> into it, waits for required checks (now coming from fake-release/* rules = mirrored release-branch rules), merges, then deletes both branches.

Mode	PR base	Merge target	Cleanup
`validate-only=true` (push trigger)	— (no push)	—	—
`validate-only=false, dry-run=true`	`fake-release/<uuid>`	`fake-release/<uuid>`	both deleted
`validate-only=false, dry-run=false` (real release)	`version-bump-branch`	`version-bump-branch`	deploy-release deleted

The mirror step itself runs on every invocation (validate-only=true too), so the rule stays in sync continuously.

Concretely, on NVIDIA-NeMo/Megatron-Bridge today:

Pattern	`requiredStatusCheckContexts`	`requiredApprovingReviewCount`	`requiresStrictStatusChecks`
`[rv][0-9].[0-9].[0-9]` (source)	`["Nemo_CICD_Test"]`	5	true
`fake-release/*` (mirrored)	`["Nemo_CICD_Test"]`	5	true

New input

Input	Type	Default	Forwarded
`release-branch-pattern`	string	`[rv][0-9].[0-9].[0-9]`	`_release_library.yml` → `_release_bump.yml`

Repos with a different release-branch convention can override the pattern. If no rule matches the configured pattern, the step logs a ::warning:: and no-ops.

Required permission

The mirror step calls createBranchProtectionRule / updateBranchProtectionRule via GraphQL. The nemo-automation-bot GitHub App must be granted administration: write at the installation level.

Companion PRs

Same set as #466 — each pins to this PR's head SHA for end-to-end validation.

Repo	PR
Megatron-Bridge	NVIDIA-NeMo/Megatron-Bridge#3935
Megatron-LM	NVIDIA/Megatron-LM#4929
Automodel	NVIDIA-NeMo/Automodel#2295
Curator	NVIDIA-NeMo/Curator#2009
RL	NVIDIA-NeMo/RL#2546
Run	NVIDIA-NeMo/Run#527
Export-Deploy	NVIDIA-NeMo/Export-Deploy#683
Evaluator	NVIDIA-NeMo/Evaluator#1024
Emerging-Optimizers	NVIDIA-NeMo/Emerging-Optimizers#192
Gym	NVIDIA-NeMo/Gym#1392
NeMo	NVIDIA-NeMo/NeMo#15718

Rollout

Grant nemo-automation-bot the administration: write permission at the org installation.
Merge this PR.
Cut FW-CI-templates v1.3.0.
Re-pin each consumer PR from the head SHA to v1.3.0 and merge.

…anch protection) Companion PR to NVIDIA-NeMo/FW-CI-templates#480, which mirrors the branch-protection rule of `[rv][0-9].[0-9].[0-9]` onto `deploy-release/*` so the validate-only release rehearsal is gated by the same required status checks as a real release. Pinned to commit 042e967e4ac9652c324cbd5b78fd126c089aec6c on `ko3n1g/feat/mirror-release-branch-protection`. Re-pin to a released tag once FW-CI-templates#480 lands. Signed-off-by: oliver könig <okoenig@nvidia.com>

…anch protection) Companion PR to NVIDIA-NeMo/FW-CI-templates#480, which mirrors the branch-protection rule of `[rv][0-9].[0-9].[0-9]` onto `deploy-release/*` so the validate-only release rehearsal is gated by the same required status checks as a real release. Pinned to commit 6c7c8135c53d5c41b5bcee6a59800bfb22f66d68 on `ko3n1g/feat/mirror-release-branch-protection`. Re-pin to a released tag once FW-CI-templates#480 lands. Signed-off-by: oliver könig <okoenig@nvidia.com>

…anch protection) Companion PR to NVIDIA-NeMo/FW-CI-templates#480, which mirrors the branch-protection rule of `[rv][0-9].[0-9].[0-9]` onto `deploy-release/*` so the validate-only release rehearsal is gated by the same required status checks as a real release. Pinned to commit fea4af40465ed58215122640cc67f00b8c4803d5 on `ko3n1g/feat/mirror-release-branch-protection`. Re-pin to a released tag once FW-CI-templates#480 lands. Signed-off-by: oliver könig <okoenig@nvidia.com>

…anch protection) Companion PR to NVIDIA-NeMo/FW-CI-templates#480, which mirrors the branch-protection rule of `[rv][0-9].[0-9].[0-9]` onto `deploy-release/*` so the validate-only release rehearsal is gated by the same required status checks as a real release. Pinned to commit 4a43be905fc04380b3d8607dbda6fbf288bf26d1 on `ko3n1g/feat/mirror-release-branch-protection`. Re-pin to a released tag once FW-CI-templates#480 lands. Signed-off-by: oliver könig <okoenig@nvidia.com>

…anch protection) Companion PR to NVIDIA-NeMo/FW-CI-templates#480, which mirrors the branch-protection rule of `[rv][0-9].[0-9].[0-9]` onto `deploy-release/*` so the validate-only release rehearsal is gated by the same required status checks as a real release. Pinned to commit 4190636d64ef82819c800b430280d6d7606089d7 on `ko3n1g/feat/mirror-release-branch-protection`. Re-pin to a released tag once FW-CI-templates#480 lands. Signed-off-by: oliver könig <okoenig@nvidia.com>

Closes a coverage gap in the validate-only release rehearsal: the rehearsal pushed to `deploy-release/<uuid>` and opened a PR against the version-bump branch (typically `main`), so the required status checks gating that PR came from `main`'s protection — not from the real release-branch rules a release would actually face. `_release_bump.yml` now mirrors the rule matching `release-branch-pattern` (default `[rv][0-9].[0-9].[0-9]`) onto the `fake-release/*` pattern — creating the rule if absent, updating it in place if present. In dry-run mode, the bump job also creates a throwaway `fake-release/<uuid>` branch off the version-bump branch and PRs `deploy-release/<uuid>` into it; the merge is then gated by the mirrored release-branch rules. Both branches are deleted on exit. Real releases (validate-only=false, dry-run=false) still PR against the version-bump branch unchanged. Validate-only mode (PR rehearsals) still skips the branch push but the mirror step now runs to keep the rule continuously in sync. Requires the calling GitHub App to hold `administration: write`. If no rule matches the source pattern in the repo, the step logs a warning and no-ops. Signed-off-by: oliver könig <okoenig@nvidia.com>

…-check threading Now that every release-branch rule runs with isAdminEnforced=false, the bot pushes through branch protection via admin bypass. The fake check-run posting, the REQUIRED_CHECK_CONTEXTS env threading, and the wait-for-status-checks step were all workarounds for required-check enforcement that no longer applies. Replace REQUIRED_CHECK_CONTEXTS extraction with a fail-fast guard in the mirror step: if the source rule still has isAdminEnforced=true, error out with a clear message so the misconfigured repo is fixed once, not silently worked around forever. Signed-off-by: oliver könig <okoenig@nvidia.com>

ko3n1g mentioned this pull request May 22, 2026

ci: pin FW-CI-templates to NVIDIA-NeMo/FW-CI-templates#480 (mirror branch protection) NVIDIA-NeMo/Gym#1392

Draft

ko3n1g force-pushed the ko3n1g/feat/mirror-release-branch-protection branch from 042e967 to 6c7c813 Compare May 22, 2026 12:04

ko3n1g force-pushed the ko3n1g/feat/mirror-release-branch-protection branch from fea4af4 to 4a43be9 Compare May 22, 2026 12:33

ko3n1g force-pushed the ko3n1g/feat/mirror-release-branch-protection branch from 4a43be9 to 4190636 Compare May 22, 2026 12:37

ko3n1g added 2 commits May 22, 2026 13:45

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

feat(release): mirror release-branch protection onto fake-release/*#480

feat(release): mirror release-branch protection onto fake-release/*#480
ko3n1g wants to merge 2 commits into
mainfrom
ko3n1g/feat/mirror-release-branch-protection

ko3n1g commented May 22, 2026 •

edited

Loading

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

Conversation

ko3n1g commented May 22, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Follow-up to #466

Change

New input

Required permission

Companion PRs

Rollout

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

ko3n1g commented May 22, 2026 •

edited

Loading