ci(pr): classify PR test failures as new vs. known and post sticky comment

.github/workflows/pr.yaml

@@ -378,6 +378,10 @@ jobs:
     uses: rapidsai/shared-workflows/.github/workflows/checks.yaml@main
     with:
       enable_check_generated_files: false
+      # pr-test-summary is informational (posts the failure-classification
+      # comment) and intentionally not in pr-builder's needs, so the
+      # dependency checker must skip it.
+      ignored_pr_jobs: pr-test-summary
   conda-cpp-build:
     needs: [checks, compute-matrix-filters, changed-files]
     # Consumed by conda-cpp-tests, conda-python-build, and (transitively) docs-build.
@@ -627,3 +631,19 @@ jobs:
     with:
       build_type: pull-request
       script: ci/test_self_hosted_service.sh
+  pr-test-summary:
+    needs:
+      - conda-cpp-tests
+      - conda-python-tests
+      - wheel-tests-cuopt
+      - wheel-tests-cuopt-server
+      - test-self-hosted-server
+    if: always()
+    permissions:
+      contents: read
+      pull-requests: write
+    uses: ./.github/workflows/pr_test_summary.yaml
+    secrets:
+      CUOPT_AWS_ACCESS_KEY_ID: ${{ secrets.CUOPT_AWS_ACCESS_KEY_ID }}
+      CUOPT_AWS_SECRET_ACCESS_KEY: ${{ secrets.CUOPT_AWS_SECRET_ACCESS_KEY }}
+      CUOPT_S3_URI: ${{ secrets.CUOPT_S3_URI }}

.github/workflows/pr_test_summary.yaml

@@ -0,0 +1,69 @@
+# SPDX-FileCopyrightText: Copyright (c) 2026, NVIDIA CORPORATION & AFFILIATES. All rights reserved.
+# SPDX-License-Identifier: Apache-2.0
+
+# Reusable workflow: aggregate per-matrix PR test summaries from S3,
+# classify every failure as NEW (introduced by this PR) vs. KNOWN
+# (recurring on nightly, known flaky on nightly, or flaked in this run),
+# and post (or update) a single sticky comment on the PR.
+#
+# Called from pr.yaml after the PR test jobs finish.  Purely informational
+# — never gates the PR.
+
+name: pr-test-summary
+
+on:
+  workflow_call:
+    secrets:
+      CUOPT_AWS_ACCESS_KEY_ID:
+        required: true
+      CUOPT_AWS_SECRET_ACCESS_KEY:
+        required: true
+      CUOPT_S3_URI:
+        required: true
+
+jobs:
+  pr-test-summary:
+    runs-on: linux-amd64-cpu4
+    container:
+      image: python:3.14-slim
+    permissions:
+      contents: read
+      pull-requests: write
+    steps:
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        with:
+          persist-credentials: false
+      - name: Install dependencies
+        run: |
+          apt-get update
+          apt-get install -y --no-install-recommends curl
+          pip install awscli
+      - name: Aggregate per-matrix summaries and post sticky comment
+        env:
+          CUOPT_AWS_ACCESS_KEY_ID: ${{ secrets.CUOPT_AWS_ACCESS_KEY_ID }}
+          CUOPT_AWS_SECRET_ACCESS_KEY: ${{ secrets.CUOPT_AWS_SECRET_ACCESS_KEY }}
+          CUOPT_S3_URI: ${{ secrets.CUOPT_S3_URI }}
+          GITHUB_REPOSITORY: ${{ github.repository }}
+          GITHUB_RUN_ID: ${{ github.run_id }}
+          GITHUB_SHA: ${{ github.sha }}
+          GITHUB_TOKEN: ${{ github.token }}
+        run: |
+          set -euo pipefail
+          # Resolve PR number from the pull-request/{N} branch ref.
+          # Read $GITHUB_REF via env, not a workflow expression — zizmor
+          # flags inlining github.ref into a shell as a code-injection
+          # vector.
+          PR_NUMBER=$(echo "$GITHUB_REF" | sed 's|refs/heads/pull-request/||')
+          if ! [[ "${PR_NUMBER}" =~ ^[0-9]+$ ]]; then
+              echo "ERROR: could not parse PR number from $GITHUB_REF" >&2
+              exit 1
+          fi
+          export PR_NUMBER
+
+          # Push events don't expose the PR target branch; ask the API.
+          GITHUB_BASE_REF=$(python3 ci/utils/pr_comment_helper.py base-ref \
+              --repo "${GITHUB_REPOSITORY}" --pr "${PR_NUMBER}")
+          export GITHUB_BASE_REF
+          echo "PR #${PR_NUMBER} → target branch: ${GITHUB_BASE_REF}"
+
+          bash ci/pr_summary.sh

ci/pr_summary.sh

@@ -0,0 +1,52 @@
+#!/bin/bash
+# SPDX-FileCopyrightText: Copyright (c) 2026, NVIDIA CORPORATION & AFFILIATES. All rights reserved.
+# SPDX-License-Identifier: Apache-2.0
+#
+# Aggregate per-matrix PR test summaries from S3 and post (or update)
+# the sticky PR classification comment.  See ci/utils/aggregate_pr.py
+# (content) and ci/utils/pr_comment_helper.py (GitHub API).
+
+set -euo pipefail
+
+: "${PR_NUMBER:?required}"
+: "${GITHUB_REPOSITORY:?required}"
+: "${GITHUB_RUN_ID:?required}"
+: "${GITHUB_BASE_REF:?required}"
+: "${GITHUB_SHA:?required}"
+: "${GITHUB_TOKEN:?required}"
+: "${CUOPT_S3_URI:?required}"
+: "${CUOPT_AWS_ACCESS_KEY_ID:?required}"
+: "${CUOPT_AWS_SECRET_ACCESS_KEY:?required}"
+
+SCRIPT_DIR="$(dirname "$(realpath "${BASH_SOURCE[0]}")")"
+OUTPUT_DIR="${PWD}/pr-aggregate-output"
+mkdir -p "${OUTPUT_DIR}"
+
+# aws CLI reads the standard AWS_* env vars; map the cuOpt-prefixed
+# secrets onto them.
+export AWS_ACCESS_KEY_ID="${CUOPT_AWS_ACCESS_KEY_ID}"
+export AWS_SECRET_ACCESS_KEY="${CUOPT_AWS_SECRET_ACCESS_KEY}"
+unset AWS_SESSION_TOKEN
+
+GITHUB_RUN_URL="https://github.com/${GITHUB_REPOSITORY}/actions/runs/${GITHUB_RUN_ID}"
+S3_PR_SUMMARIES_PREFIX="${CUOPT_S3_URI}ci_test_reports/pr/run-${GITHUB_RUN_ID}/"
+COMMENT_FILE="${OUTPUT_DIR}/pr_comment.md"
+
+echo "Aggregating PR per-matrix summaries from ${S3_PR_SUMMARIES_PREFIX}"
+python3 "${SCRIPT_DIR}/utils/aggregate_pr.py" \
+    --s3-pr-summaries-prefix "${S3_PR_SUMMARIES_PREFIX}" \
+    --output-dir "${OUTPUT_DIR}" \
+    --target-branch "${GITHUB_BASE_REF}" \
+    --sha "${GITHUB_SHA}" \
+    --github-run-url "${GITHUB_RUN_URL}" \
+    --run-date "$(date +%F)"
+
+if [ ! -s "${COMMENT_FILE}" ]; then
+    echo "No failures or flakes; not posting a PR comment."
+    exit 0
+fi
+
+python3 "${SCRIPT_DIR}/utils/pr_comment_helper.py" post \
+    --repo "${GITHUB_REPOSITORY}" \
+    --pr "${PR_NUMBER}" \
+    --body-file "${COMMENT_FILE}"