Skip to content

beep boop 🤖: Bumping Emerging-Optimizers to v0.2.1#195

Open
nemo-automation-bot[bot] wants to merge 2 commits into
fake-release/f04084fd-9683-4113-b40a-d2a36699026afrom
deploy-release/9e8c6731-b035-46aa-8ade-f0bf20080de6
Open

beep boop 🤖: Bumping Emerging-Optimizers to v0.2.1#195
nemo-automation-bot[bot] wants to merge 2 commits into
fake-release/f04084fd-9683-4113-b40a-d2a36699026afrom
deploy-release/9e8c6731-b035-46aa-8ade-f0bf20080de6

Conversation

@nemo-automation-bot
Copy link
Copy Markdown

This is an automated PR to bump Emerging-Optimizers to v0.2.1.

ko3n1g and others added 2 commits May 22, 2026 12:43
…anch protection)

Companion PR to NVIDIA-NeMo/FW-CI-templates#480, which mirrors the
branch-protection rule of `[rv][0-9].[0-9].[0-9]` onto `deploy-release/*` so
the validate-only release rehearsal is gated by the same required status
checks as a real release.

Pinned to commit a2d0fba9aaaf595d9bb3a0e8f3e71461983e0f15 on `ko3n1g/feat/mirror-release-branch-protection`.
Re-pin to a released tag once FW-CI-templates#480 lands.

Signed-off-by: oliver könig <okoenig@nvidia.com>
Signed-off-by: github-actions[bot] <github-actions[bot]@users.noreply.github.com>
@nemo-automation-bot nemo-automation-bot Bot requested a review from a team as a code owner May 22, 2026 12:45
@copy-pr-bot
Copy link
Copy Markdown

copy-pr-bot Bot commented May 22, 2026

This pull request requires additional validation before any workflows can run on NVIDIA's runners.

Pull request vetters can view their responsibilities here.

Contributors can view more details about this message here.

@greptile-apps
Copy link
Copy Markdown
Contributor

greptile-apps Bot commented May 22, 2026

Greptile Summary

This automated bot PR bumps the Emerging-Optimizers package from v0.2.0 to v0.2.1 by incrementing PATCH in package_info.py and updating the release workflow's reusable-workflow reference from a mutable tag to a pinned commit SHA.

  • package_info.py: PATCH incremented from 0 to 1; version is now 0.2.1.
  • release.yaml: _release_library.yml reference changed from @v1.1.0 (mutable tag) to a full commit SHA (a2d0fba...), which improves supply-chain security but leaves the SHA undocumented and inconsistent with the _cicd_preflight.yml reference that still uses a mutable tag.

Confidence Score: 4/5

Safe to merge — the version bump is correct and the SHA pin is a valid (and more secure) way to reference a reusable workflow.

Both changes are minimal and mechanical. The version increment in package_info.py is clean. The workflow change swaps a mutable tag for a commit SHA, which is intentionally more secure, but the SHA has no companion comment identifying the corresponding release tag, and the two workflow references in the file are now inconsistent in style.

release.yaml — the undocumented SHA and the inconsistency with the _cicd_preflight.yml tag reference are worth a quick second look.

Important Files Changed

Filename Overview
emerging_optimizers/package_info.py Patch version bumped from 0 to 1, making the package version 0.2.1. Straightforward and correct.
.github/workflows/release.yaml The _release_library.yml reusable workflow reference was switched from a mutable tag (@v1.1.0) to a full commit SHA, with no inline comment indicating which version the SHA corresponds to.

Sequence Diagram

sequenceDiagram
    participant Bot as nemo-automation-bot
    participant PR as Pull Request
    participant WF as release.yaml
    participant PF as _cicd_preflight.yml@v0.94.1
    participant RL as _release_library.yml@SHA(a2d0fba)

    Bot->>PR: Bump PATCH 0→1 (v0.2.1)
    Bot->>PR: Pin _release_library.yml to commit SHA
    PR->>WF: Merge triggers workflow
    WF->>PF: pre-flight check (tag ref)
    PF-->>WF: outputs (docs_only, is_deployment_workflow)
    WF->>RL: release job (SHA-pinned ref)
    RL-->>WF: publish wheel / GH release / docs
    WF->>WF: release-summary (pass/fail)
Loading

Reviews (1): Last reviewed commit: "beep boop 🤖: Bumping Emerging-Optimizer..." | Re-trigger Greptile

&& !(needs.pre-flight.outputs.docs_only == 'true'
|| needs.pre-flight.outputs.is_deployment_workflow == 'true')
uses: NVIDIA-NeMo/FW-CI-templates/.github/workflows/_release_library.yml@v1.1.0
uses: NVIDIA-NeMo/FW-CI-templates/.github/workflows/_release_library.yml@a2d0fba9aaaf595d9bb3a0e8f3e71461983e0f15
Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

P2 Pinning to a commit SHA is good practice for supply-chain security, but without an inline comment the SHA is opaque — it's impossible to tell at a glance what version of _release_library.yml is in use, which makes future audits and upgrades harder. Adding a comment with the corresponding tag name keeps the security benefit while restoring readability. Note also that _cicd_preflight.yml on line 75 is still referenced via a mutable tag (@v0.94.1), so the two workflow references are now inconsistent.

Suggested change
uses: NVIDIA-NeMo/FW-CI-templates/.github/workflows/_release_library.yml@a2d0fba9aaaf595d9bb3a0e8f3e71461983e0f15
uses: NVIDIA-NeMo/FW-CI-templates/.github/workflows/_release_library.yml@a2d0fba9aaaf595d9bb3a0e8f3e71461983e0f15 # v1.1.0

@skyw
Copy link
Copy Markdown
Contributor

skyw commented May 22, 2026

Can actually bump to 0.3.0, I forgot to do it after tagging v0.2 release :(.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants