Update to 26.08#22517
Merged
Merged
Conversation
github-actions
Bot
added
Python
jolorunyomi
added
the
improvement
samson-nvidia
approved these changes
May 14, 2026
📝 WalkthroughSummary by CodeRabbit
WalkthroughThis PR bumps RAPIDS components from version 26.06 to 26.08 across the entire codebase, updates CI workflow references from pinned ChangesRAPIDS 26.06 → 26.08 version bump and CI infrastructure update
Estimated code review effort🎯 2 (Simple) | ⏱️ ~10 minutes Possibly related PRs
Suggested labels
Suggested reviewers
🚥 Pre-merge checks | ✅ 5✅ Passed checks (5 passed)
✏️ Tip: You can configure your own custom pre-merge checks in the settings. ✨ Finishing Touches🧪 Generate unit tests (beta)
Comment |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 3
Caution
Some comments are outside the diff and can’t be posted inline due to platform limitations.
⚠️ Outside diff range comments (1)
.github/workflows/pr.yaml (1)
711-720:⚠️ Potential issue | 🟠 Major | ⚡ Quick winRemove
inputs.*from this push-triggered workflow.This workflow uses
on: pushonly, but lines 715-717, 737-739, and 756-758 referenceinputs.branch,inputs.date, andinputs.sha. Theseinputs.*expressions are undefined in push-triggered workflows and will cause failures.Suggested fix
third-party-integration-tests-cudf-pandas: @@ with: build_type: pull-request - branch: ${{ inputs.branch }} - date: ${{ inputs.date }} - sha: ${{ inputs.sha }} node_type: "gpu-l4-latest-1" continue-on-error: true container_image: "rapidsai/ci-conda:26.08-latest" @@ pandas-tests: @@ with: build_type: pull-request - branch: ${{ inputs.branch }} - date: ${{ inputs.date }} - sha: ${{ inputs.sha }} node_type: "gpu-l4-latest-1" container_image: "rapidsai/citestwheel:26.08-latest" script: ci/cudf_pandas_scripts/pandas-tests/run.sh pr @@ narwhals-tests: @@ with: build_type: pull-request - branch: ${{ inputs.branch }} - date: ${{ inputs.date }} - sha: ${{ inputs.sha }} node_type: "gpu-l4-latest-1" container_image: "rapidsai/ci-conda:26.08-latest" script: ci/test_narwhals.sh🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In @.github/workflows/pr.yaml around lines 711 - 720, The workflow references undefined inputs (inputs.branch, inputs.date, inputs.sha) in the job using rapidsai/shared-workflows/.github/workflows/custom-job.yaml@main; replace these push-only invalid expressions with appropriate GitHub context values: use github.ref_name (or extract branch from github.ref) instead of inputs.branch, use github.sha instead of inputs.sha, and use github.event.head_commit.timestamp (or github.run_id/github.run_number if preferred) instead of inputs.date; update the with: block entries for branch, date, and sha accordingly so the job runs under push triggers without undefined inputs.
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In @.github/workflows/build.yaml:
- Line 60: Replace all reusable workflow references that currently use the
mutable suffix "@main" with immutable commit SHAs for reproducible CI: update
the occurrences referencing conda-cpp-build.yaml, conda-python-build.yaml,
conda-upload-packages.yaml, custom-job.yaml, wheels-build.yaml, and
wheels-publish.yaml so each "uses: rapidsai/shared-workflows/...@main" becomes
"uses: rapidsai/shared-workflows/...@<commit-sha>" (choose and insert the
appropriate immutable SHA for each referenced workflow); ensure every repeated
reference to the same workflow file is pinned consistently and commit the
change.
In @.github/workflows/pr_issue_status_automation.yml:
- Line 16: The reusable workflow reference uses a mutable `@main` ref which is
insecure for a privileged pull_request_target workflow (the problematic line is
the uses:
rapidsai/shared-workflows/.github/workflows/project-get-item-id.yaml@main);
update that ref to an immutable commit SHA or a release tag (e.g., replace `@main`
with @<commit-sha>), and verify the workflow still receives
ADD_TO_PROJECT_GITHUB_TOKEN correctly; apply the same pinning approach to other
rapidsai/shared-workflows references across workflows to fully remediate the
supply-chain risk.
In @.github/workflows/trigger-breaking-change-alert.yaml:
- Line 16: The reusable workflow reference currently uses a mutable ref
"rapidsai/shared-workflows/.github/workflows/breaking-change-alert.yaml@main";
replace the mutable "@main" with an immutable full commit SHA (40 hex chars) of
the target repo to pin the workflow, i.e., update the `uses` value to
"rapidsai/shared-workflows/.github/workflows/breaking-change-alert.yaml@<commit-sha>"
(obtain the SHA from the remote repo or a trusted commit) so the
`pull_request_target` run cannot be changed by updates to main.
---
Outside diff comments:
In @.github/workflows/pr.yaml:
- Around line 711-720: The workflow references undefined inputs (inputs.branch,
inputs.date, inputs.sha) in the job using
rapidsai/shared-workflows/.github/workflows/custom-job.yaml@main; replace these
push-only invalid expressions with appropriate GitHub context values: use
github.ref_name (or extract branch from github.ref) instead of inputs.branch,
use github.sha instead of inputs.sha, and use github.event.head_commit.timestamp
(or github.run_id/github.run_number if preferred) instead of inputs.date; update
the with: block entries for branch, date, and sha accordingly so the job runs
under push triggers without undefined inputs.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Path: .coderabbit.yaml
Review profile: CHILL
Plan: Enterprise
Run ID: 9ec764a5-d338-49ef-a788-94ad07178687
📒 Files selected for processing (29)
.devcontainer/cuda12.9-conda/devcontainer.json.devcontainer/cuda12.9-pip/devcontainer.json.devcontainer/cuda13.2-conda/devcontainer.json.devcontainer/cuda13.2-pip/devcontainer.json.github/workflows/build.yaml.github/workflows/compute-sanitizer-run.yaml.github/workflows/pandas-tests.yaml.github/workflows/pr.yaml.github/workflows/pr_issue_status_automation.yml.github/workflows/test.yaml.github/workflows/trigger-breaking-change-alert.yaml.pre-commit-config.yamlVERSIONconda/environments/all_cuda-129_arch-aarch64.yamlconda/environments/all_cuda-129_arch-x86_64.yamlconda/environments/all_cuda-132_arch-aarch64.yamlconda/environments/all_cuda-132_arch-x86_64.yamldependencies.yamljava/ci/README.mdjava/pom.xmlpython/cudf/cudf/VERSIONpython/cudf/cudf_pandas_tests/third_party_integration_tests/dependencies.yamlpython/cudf/pyproject.tomlpython/cudf_kafka/pyproject.tomlpython/cudf_polars/pyproject.tomlpython/custreamz/pyproject.tomlpython/dask_cudf/pyproject.tomlpython/libcudf/pyproject.tomlpython/pylibcudf/pyproject.toml
| pull-requests: read | ||
| secrets: inherit # zizmor: ignore[secrets-inherit] | ||
| uses: rapidsai/shared-workflows/.github/workflows/conda-cpp-build.yaml@cuda-13.2.0 | ||
| uses: rapidsai/shared-workflows/.github/workflows/conda-cpp-build.yaml@main |
There was a problem hiding this comment.
🧩 Analysis chain
🏁 Script executed:
#!/bin/bash
# Verify all mutable shared-workflow refs in this workflow file
rg -n 'uses:\s*rapidsai/shared-workflows/.+@main' .github/workflows/build.yamlRepository: rapidsai/cudf
Length of output: 1301
Pin all reusable workflow references to immutable commit SHAs.
Using @main for workflow references makes CI behavior mutable and weakens reproducibility. Replace all 15 instances with specific commit SHAs:
- Line 60:
conda-cpp-build.yaml - Lines 77, 95:
conda-python-build.yaml - Line 111:
conda-upload-packages.yaml - Line 130:
custom-job.yaml - Lines 149, 189, 228, 267, 306:
wheels-build.yaml - Lines 169, 210, 249, 289, 328:
wheels-publish.yaml
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In @.github/workflows/build.yaml at line 60, Replace all reusable workflow
references that currently use the mutable suffix "@main" with immutable commit
SHAs for reproducible CI: update the occurrences referencing
conda-cpp-build.yaml, conda-python-build.yaml, conda-upload-packages.yaml,
custom-job.yaml, wheels-build.yaml, and wheels-publish.yaml so each "uses:
rapidsai/shared-workflows/...@main" becomes "uses:
rapidsai/shared-workflows/...@<commit-sha>" (choose and insert the appropriate
immutable SHA for each referenced workflow); ensure every repeated reference to
the same workflow file is pinned consistently and commit the change.
| jobs: | ||
| get-project-id: | ||
| uses: rapidsai/shared-workflows/.github/workflows/project-get-item-id.yaml@cuda-13.2.0 | ||
| uses: rapidsai/shared-workflows/.github/workflows/project-get-item-id.yaml@main |
There was a problem hiding this comment.
🧩 Analysis chain
🏁 Script executed:
#!/bin/bash
set -euo pipefail
file=".github/workflows/pr_issue_status_automation.yml"
echo "== pull_request_target + mutable reusable workflow refs =="
rg -n 'pull_request_target|uses:\s*rapidsai/shared-workflows/.+@main' "$file"Repository: rapidsai/cudf
Length of output: 440
🏁 Script executed:
cat -n ".github/workflows/pr_issue_status_automation.yml"Repository: rapidsai/cudf
Length of output: 4119
🏁 Script executed:
#!/bin/bash
# Search for all uses of rapidsai/shared-workflows to see pinning patterns
rg -n 'rapidsai/shared-workflows' --type yamlRepository: rapidsai/cudf
Length of output: 39
🏁 Script executed:
#!/bin/bash
# Broader search for shared-workflows usage
rg 'shared-workflows' --type yamlRepository: rapidsai/cudf
Length of output: 39
🏁 Script executed:
#!/bin/bash
# Find all workflow files and check for shared-workflows references
find .github/workflows -name "*.yml" -o -name "*.yaml" | head -20Repository: rapidsai/cudf
Length of output: 552
🏁 Script executed:
#!/bin/bash
# Search across all workflow files for shared-workflows references
for f in .github/workflows/*.{yml,yaml}; do
if [ -f "$f" ]; then
echo "=== $f ==="
rg 'shared-workflows' "$f" || echo "No matches"
fi
doneRepository: rapidsai/cudf
Length of output: 5800
🏁 Script executed:
#!/bin/bash
# Check if this is a systemic pattern - count `@main` vs other pinning
echo "=== Shared-workflows refs across all workflows ==="
rg 'rapidsai/shared-workflows' .github/workflows/ --no-filename | sort | uniq -c | sort -rnRepository: rapidsai/cudf
Length of output: 1724
🏁 Script executed:
#!/bin/bash
# Check if this is a broader organizational pattern - look at one non-privileged workflow
echo "=== pr.yaml permissions ==="
head -20 .github/workflows/pr.yaml | grep -A 5 "^permissions"
echo ""
echo "=== pr_issue_status_automation.yml permissions ==="
head -20 .github/workflows/pr_issue_status_automation.yml | grep -A 5 "^permissions"Repository: rapidsai/cudf
Length of output: 400
🏁 Script executed:
#!/bin/bash
# Check if there's any documentation or comments about this pattern
echo "=== Checking for shared-workflows tag/release info ==="
rg 'shared-workflows' .github/ --type md --type txt 2>/dev/null || echo "No docs found"
echo ""
echo "=== Check git to see if rapidsai/shared-workflows is referenced ==="
rg 'shared-workflows' . --type md --type txt 2>/dev/null | head -20Repository: rapidsai/cudf
Length of output: 706
Pin reusable workflow refs to immutable commits in privileged workflows.
This pull_request_target workflow passes ADD_TO_PROJECT_GITHUB_TOKEN secret to reusable workflows referenced with mutable @main branches, creating supply-chain and reproducibility risks. While this pattern is codebase-wide (affecting ~70 references to rapidsai/shared-workflows across multiple workflows), it should be addressed systematically. Note: pinning this file alone is incomplete without addressing the broader organizational pattern.
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In @.github/workflows/pr_issue_status_automation.yml at line 16, The reusable
workflow reference uses a mutable `@main` ref which is insecure for a privileged
pull_request_target workflow (the problematic line is the uses:
rapidsai/shared-workflows/.github/workflows/project-get-item-id.yaml@main);
update that ref to an immutable commit SHA or a release tag (e.g., replace `@main`
with @<commit-sha>), and verify the workflow still receives
ADD_TO_PROJECT_GITHUB_TOKEN correctly; apply the same pinning approach to other
rapidsai/shared-workflows references across workflows to fully remediate the
supply-chain risk.
| permissions: | ||
| contents: read | ||
| uses: rapidsai/shared-workflows/.github/workflows/breaking-change-alert.yaml@cuda-13.2.0 | ||
| uses: rapidsai/shared-workflows/.github/workflows/breaking-change-alert.yaml@main |
There was a problem hiding this comment.
🧩 Analysis chain
🏁 Script executed:
#!/bin/bash
set -euo pipefail
file=".github/workflows/trigger-breaking-change-alert.yaml"
echo "== pull_request_target + mutable reusable workflow refs =="
rg -n 'pull_request_target|uses:\s*rapidsai/shared-workflows/.+@main' "$file"Repository: rapidsai/cudf
Length of output: 230
Pin this reusable workflow to an immutable commit SHA instead of @main.
The pull_request_target trigger grants access to secrets; using a mutable ref (@main) allows unexpected workflow changes to execute with those secrets.
🔒 Suggested fix
- uses: rapidsai/shared-workflows/.github/workflows/breaking-change-alert.yaml@main
+ uses: rapidsai/shared-workflows/.github/workflows/breaking-change-alert.yaml@<pinned-commit-sha>🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In @.github/workflows/trigger-breaking-change-alert.yaml at line 16, The
reusable workflow reference currently uses a mutable ref
"rapidsai/shared-workflows/.github/workflows/breaking-change-alert.yaml@main";
replace the mutable "@main" with an immutable full commit SHA (40 hex chars) of
the target repo to pin the workflow, i.e., update the `uses` value to
"rapidsai/shared-workflows/.github/workflows/breaking-change-alert.yaml@<commit-sha>"
(obtain the SHA from the remote repo or a trusted commit) so the
`pull_request_target` run cannot be changed by updates to main.
mhaseeb123
pushed a commit
to mhaseeb123/cudf
that referenced
this pull request
May 15, 2026
This PR updates the repository to version 26.08. This is part of the 26.06 release burndown process.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
3 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
This PR updates the repository to version 26.08.
This is part of the 26.06 release burndown process.