Skip to content

CI: provision EC2 runners through shared workflows, with retry and backoff #760

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
harrism merged 4 commits into from
Sep 3, 2026
Merged

CI: provision EC2 runners through shared workflows, with retry and backoff #760

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
4 commits
Select commit Hold shift + click to select a range
1a3e810
CI: let the runner token be forwarded to a local reusable workflow
harrism Sep 3, 2026
53bdb4c
CI: provision EC2 runners through shared workflows, with retry and ba…
harrism Sep 3, 2026
08012f8
Merge remote-tracking branch 'upstream/main' into mjh/ci-runner-reusa…
harrism Sep 3, 2026
c90f2d7
CI: pick the winning runner attempt by outcome, and clean up the losers
harrism Sep 3, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
96 changes: 32 additions & 64 deletions .github/workflows/cu130.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -33,29 +33,19 @@ jobs:
start-build-runner:
name: Start CPU-only EC2 runner for build
needs: [check-changes, versions]
runs-on: ubuntu-latest
permissions:
id-token: write # Required for AWS OIDC
if: >-
needs.check-changes.outputs.should_test == 'true'
&& (github.event.pull_request.draft == false || github.event_name != 'pull_request_target')
outputs:
label: ${{ steps.start-build-runner.outputs.label }}
ec2-instance-id: ${{ steps.start-build-runner.outputs.ec2-instance-id }}
steps:
- name: Configure AWS credentials
uses: aws-actions/configure-aws-credentials@e6de054238d6b7531b4efff3b6587d9aade6a06c # v6.2.3
with:
role-to-assume: ${{ needs.versions.outputs.aws-role }}
aws-region: ${{ needs.versions.outputs.aws-region }}
- name: Start EC2 runner
id: start-build-runner
uses: machulav/ec2-github-runner@343a1b2ae682e681c3cec9a235d882da17ff04ef # v2.6.1
with:
mode: start
github-token: ${{ secrets.EC2_RUNNER_TOKEN }}
ec2-instance-type: m6a.8xlarge
availability-zones-config: ${{ needs.versions.outputs.aws-cpu-az-config }}
uses: ./.github/workflows/start-ec2-runner.yml
with:
instance-type: m6a.8xlarge
az-config: ${{ needs.versions.outputs.aws-cpu-az-config }}
aws-role: ${{ needs.versions.outputs.aws-role }}
aws-region: ${{ needs.versions.outputs.aws-region }}
secrets:
EC2_RUNNER_TOKEN: ${{ secrets.EC2_RUNNER_TOKEN }}

##############################################################################
# BUILD FVDB
Expand Down Expand Up @@ -205,52 +195,36 @@ jobs:
- start-build-runner # required to get output from the start-build-runner job
- fvdb-build # required to wait when the main job is done
- versions
runs-on: ubuntu-latest
permissions:
id-token: write # Required for AWS OIDC
# required to stop the runner even if the error happened in the previous jobs
# but only if the start-build-runner job was not skipped
if: ${{ always() && needs.start-build-runner.result != 'skipped' }}
steps:
- name: Configure AWS credentials
uses: aws-actions/configure-aws-credentials@e6de054238d6b7531b4efff3b6587d9aade6a06c # v6.2.3
with:
role-to-assume: ${{ needs.versions.outputs.aws-role }}
aws-region: ${{ needs.versions.outputs.aws-region }}
- name: Stop EC2 runner
uses: machulav/ec2-github-runner@343a1b2ae682e681c3cec9a235d882da17ff04ef # v2.6.1
with:
mode: stop
github-token: ${{ secrets.EC2_RUNNER_TOKEN }}
label: ${{ needs.start-build-runner.outputs.label }}
ec2-instance-id: ${{ needs.start-build-runner.outputs.ec2-instance-id }}
uses: ./.github/workflows/stop-ec2-runner.yml
with:
label: ${{ needs.start-build-runner.outputs.label }}
ec2-instance-id: ${{ needs.start-build-runner.outputs.ec2-instance-id }}
aws-role: ${{ needs.versions.outputs.aws-role }}
aws-region: ${{ needs.versions.outputs.aws-region }}
secrets:
EC2_RUNNER_TOKEN: ${{ secrets.EC2_RUNNER_TOKEN }}

##############################################################################
# START FVDB TESTS GPU RUNNER
##############################################################################
start-tests-gpu-runner:
name: Start EC2 GPU runner for gtests
needs: [fvdb-build, versions]
runs-on: ubuntu-latest
permissions:
id-token: write # Required for AWS OIDC
outputs:
label: ${{ steps.start-tests-gpu-runner.outputs.label }}
ec2-instance-id: ${{ steps.start-tests-gpu-runner.outputs.ec2-instance-id }}
steps:
- name: Configure AWS credentials
uses: aws-actions/configure-aws-credentials@e6de054238d6b7531b4efff3b6587d9aade6a06c # v6.2.3
with:
role-to-assume: ${{ needs.versions.outputs.aws-role }}
aws-region: ${{ needs.versions.outputs.aws-region }}
- name: Start EC2 GPU runner
id: start-tests-gpu-runner
uses: machulav/ec2-github-runner@343a1b2ae682e681c3cec9a235d882da17ff04ef # v2.6.1
with:
mode: start
github-token: ${{ secrets.EC2_RUNNER_TOKEN }}
ec2-instance-type: g6.xlarge # 4 CPU-core, L4 GPU
availability-zones-config: ${{ needs.versions.outputs.aws-gpu-az-config }}
uses: ./.github/workflows/start-ec2-runner.yml
with:
instance-type: g6.xlarge # 4 CPU-core, L4 GPU
az-config: ${{ needs.versions.outputs.aws-gpu-az-config }}
aws-role: ${{ needs.versions.outputs.aws-role }}
aws-region: ${{ needs.versions.outputs.aws-region }}
secrets:
EC2_RUNNER_TOKEN: ${{ secrets.EC2_RUNNER_TOKEN }}

##############################################################################
# RUN FVDB GTESTS
Expand Down Expand Up @@ -573,22 +547,16 @@ jobs:
- fvdb-unit-test # required to wait when the main job is done
- fvdb-docs-test # required to wait when the main job is done
- versions
runs-on: ubuntu-latest
permissions:
id-token: write # Required for AWS OIDC
# required to stop the runner even if the error happened in the previous jobs
# but only if the start-tests-gpu-runner job was not skipped
if: ${{ always() && needs.start-tests-gpu-runner.result != 'skipped' }}
steps:
- name: Configure AWS credentials
uses: aws-actions/configure-aws-credentials@e6de054238d6b7531b4efff3b6587d9aade6a06c # v6.2.3
with:
role-to-assume: ${{ needs.versions.outputs.aws-role }}
aws-region: ${{ needs.versions.outputs.aws-region }}
- name: Stop EC2 runner
uses: machulav/ec2-github-runner@343a1b2ae682e681c3cec9a235d882da17ff04ef # v2.6.1
with:
mode: stop
github-token: ${{ secrets.EC2_RUNNER_TOKEN }}
label: ${{ needs.start-tests-gpu-runner.outputs.label }}
ec2-instance-id: ${{ needs.start-tests-gpu-runner.outputs.ec2-instance-id }}
uses: ./.github/workflows/stop-ec2-runner.yml
with:
label: ${{ needs.start-tests-gpu-runner.outputs.label }}
ec2-instance-id: ${{ needs.start-tests-gpu-runner.outputs.ec2-instance-id }}
aws-role: ${{ needs.versions.outputs.aws-role }}
aws-region: ${{ needs.versions.outputs.aws-region }}
secrets:
EC2_RUNNER_TOKEN: ${{ secrets.EC2_RUNNER_TOKEN }}
96 changes: 32 additions & 64 deletions .github/workflows/cu132.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -33,29 +33,19 @@ jobs:
start-build-runner:
name: Start CPU-only EC2 runner for build
needs: [check-changes, versions]
runs-on: ubuntu-latest
permissions:
id-token: write # Required for AWS OIDC
if: >-
needs.check-changes.outputs.should_test == 'true'
&& (github.event.pull_request.draft == false || github.event_name != 'pull_request_target')
outputs:
label: ${{ steps.start-build-runner.outputs.label }}
ec2-instance-id: ${{ steps.start-build-runner.outputs.ec2-instance-id }}
steps:
- name: Configure AWS credentials
uses: aws-actions/configure-aws-credentials@e6de054238d6b7531b4efff3b6587d9aade6a06c # v6.2.3
with:
role-to-assume: ${{ needs.versions.outputs.aws-role }}
aws-region: ${{ needs.versions.outputs.aws-region }}
- name: Start EC2 runner
id: start-build-runner
uses: machulav/ec2-github-runner@343a1b2ae682e681c3cec9a235d882da17ff04ef # v2.6.1
with:
mode: start
github-token: ${{ secrets.EC2_RUNNER_TOKEN }}
ec2-instance-type: m6a.8xlarge
availability-zones-config: ${{ needs.versions.outputs.aws-cpu-az-config }}
uses: ./.github/workflows/start-ec2-runner.yml
with:
instance-type: m6a.8xlarge
az-config: ${{ needs.versions.outputs.aws-cpu-az-config }}
aws-role: ${{ needs.versions.outputs.aws-role }}
aws-region: ${{ needs.versions.outputs.aws-region }}
secrets:
EC2_RUNNER_TOKEN: ${{ secrets.EC2_RUNNER_TOKEN }}

##############################################################################
# BUILD FVDB
Expand Down Expand Up @@ -205,52 +195,36 @@ jobs:
- start-build-runner # required to get output from the start-build-runner job
- fvdb-build # required to wait when the main job is done
- versions
runs-on: ubuntu-latest
permissions:
id-token: write # Required for AWS OIDC
# required to stop the runner even if the error happened in the previous jobs
# but only if the start-build-runner job was not skipped
if: ${{ always() && needs.start-build-runner.result != 'skipped' }}
steps:
- name: Configure AWS credentials
uses: aws-actions/configure-aws-credentials@e6de054238d6b7531b4efff3b6587d9aade6a06c # v6.2.3
with:
role-to-assume: ${{ needs.versions.outputs.aws-role }}
aws-region: ${{ needs.versions.outputs.aws-region }}
- name: Stop EC2 runner
uses: machulav/ec2-github-runner@343a1b2ae682e681c3cec9a235d882da17ff04ef # v2.6.1
with:
mode: stop
github-token: ${{ secrets.EC2_RUNNER_TOKEN }}
label: ${{ needs.start-build-runner.outputs.label }}
ec2-instance-id: ${{ needs.start-build-runner.outputs.ec2-instance-id }}
uses: ./.github/workflows/stop-ec2-runner.yml
with:
label: ${{ needs.start-build-runner.outputs.label }}
ec2-instance-id: ${{ needs.start-build-runner.outputs.ec2-instance-id }}
aws-role: ${{ needs.versions.outputs.aws-role }}
aws-region: ${{ needs.versions.outputs.aws-region }}
secrets:
EC2_RUNNER_TOKEN: ${{ secrets.EC2_RUNNER_TOKEN }}

##############################################################################
# START FVDB TESTS GPU RUNNER
##############################################################################
start-tests-gpu-runner:
name: Start EC2 GPU runner for gtests
needs: [fvdb-build, versions]
runs-on: ubuntu-latest
permissions:
id-token: write # Required for AWS OIDC
outputs:
label: ${{ steps.start-tests-gpu-runner.outputs.label }}
ec2-instance-id: ${{ steps.start-tests-gpu-runner.outputs.ec2-instance-id }}
steps:
- name: Configure AWS credentials
uses: aws-actions/configure-aws-credentials@e6de054238d6b7531b4efff3b6587d9aade6a06c # v6.2.3
with:
role-to-assume: ${{ needs.versions.outputs.aws-role }}
aws-region: ${{ needs.versions.outputs.aws-region }}
- name: Start EC2 GPU runner
id: start-tests-gpu-runner
uses: machulav/ec2-github-runner@343a1b2ae682e681c3cec9a235d882da17ff04ef # v2.6.1
with:
mode: start
github-token: ${{ secrets.EC2_RUNNER_TOKEN }}
ec2-instance-type: g6.xlarge # 4 CPU-core, L4 GPU
availability-zones-config: ${{ needs.versions.outputs.aws-gpu-az-config }}
uses: ./.github/workflows/start-ec2-runner.yml
with:
instance-type: g6.xlarge # 4 CPU-core, L4 GPU
az-config: ${{ needs.versions.outputs.aws-gpu-az-config }}
aws-role: ${{ needs.versions.outputs.aws-role }}
aws-region: ${{ needs.versions.outputs.aws-region }}
secrets:
EC2_RUNNER_TOKEN: ${{ secrets.EC2_RUNNER_TOKEN }}

##############################################################################
# RUN FVDB GTESTS
Expand Down Expand Up @@ -573,22 +547,16 @@ jobs:
- fvdb-unit-test # required to wait when the main job is done
- fvdb-docs-test # required to wait when the main job is done
- versions
runs-on: ubuntu-latest
permissions:
id-token: write # Required for AWS OIDC
# required to stop the runner even if the error happened in the previous jobs
# but only if the start-tests-gpu-runner job was not skipped
if: ${{ always() && needs.start-tests-gpu-runner.result != 'skipped' }}
steps:
- name: Configure AWS credentials
uses: aws-actions/configure-aws-credentials@e6de054238d6b7531b4efff3b6587d9aade6a06c # v6.2.3
with:
role-to-assume: ${{ needs.versions.outputs.aws-role }}
aws-region: ${{ needs.versions.outputs.aws-region }}
- name: Stop EC2 runner
uses: machulav/ec2-github-runner@343a1b2ae682e681c3cec9a235d882da17ff04ef # v2.6.1
with:
mode: stop
github-token: ${{ secrets.EC2_RUNNER_TOKEN }}
label: ${{ needs.start-tests-gpu-runner.outputs.label }}
ec2-instance-id: ${{ needs.start-tests-gpu-runner.outputs.ec2-instance-id }}
uses: ./.github/workflows/stop-ec2-runner.yml
with:
label: ${{ needs.start-tests-gpu-runner.outputs.label }}
ec2-instance-id: ${{ needs.start-tests-gpu-runner.outputs.ec2-instance-id }}
aws-role: ${{ needs.versions.outputs.aws-role }}
aws-region: ${{ needs.versions.outputs.aws-region }}
secrets:
EC2_RUNNER_TOKEN: ${{ secrets.EC2_RUNNER_TOKEN }}
94 changes: 25 additions & 69 deletions .github/workflows/nightly-publish.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -59,42 +59,29 @@ jobs:
name: Start CPU-only EC2 runner for nightly build
needs: [check-new-commits, versions]
if: needs.check-new-commits.outputs.should_build == 'true'
runs-on: ubuntu-latest
permissions:
id-token: write # Required for AWS OIDC
strategy:
fail-fast: false
matrix: ${{ fromJSON(needs.versions.outputs.publish-matrix) }}
steps:
- name: Stagger job starts to avoid API rate limits
run: |
DELAY=$((RANDOM % 16))
echo "Delaying start by ${DELAY} seconds for Python ${MATRIX_PYTHON_VERSION}"
sleep $DELAY
env:
MATRIX_PYTHON_VERSION: ${{ matrix.python-version }}
- name: Configure AWS credentials
uses: aws-actions/configure-aws-credentials@e6de054238d6b7531b4efff3b6587d9aade6a06c # v6.2.3
with:
role-to-assume: ${{ needs.versions.outputs.aws-role }}
aws-region: ${{ needs.versions.outputs.aws-region }}
- name: Start EC2 runner
id: start-build-runner
uses: machulav/ec2-github-runner@343a1b2ae682e681c3cec9a235d882da17ff04ef # v2.6.1
with:
mode: start
github-token: ${{ secrets.EC2_RUNNER_TOKEN }}
ec2-instance-type: m6a.xlarge
availability-zones-config: ${{ needs.versions.outputs.aws-cpu-az-config }}
label: nightly-${{ matrix.python-version }}-pt${{ matrix.torch-version }}-cu${{ matrix.cuda-version }}-${{ github.run_id }}
aws-resource-tags: >
[
{"Key": "RunnerLabel", "Value": "nightly-${{ matrix.python-version }}-pt${{ matrix.torch-version }}-cu${{ matrix.cuda-version }}-${{ github.run_id }}"},
{"Key": "PythonVersion", "Value": "${{ matrix.python-version }}"},
{"Key": "TorchVersion", "Value": "${{ matrix.torch-version }}"},
{"Key": "CudaVersion", "Value": "${{ matrix.cuda-version }}"},
{"Key": "GitHubRunId", "Value": "${{ github.run_id }}"}
]
uses: ./.github/workflows/start-ec2-runner.yml
with:
instance-type: m6a.xlarge
az-config: ${{ needs.versions.outputs.aws-cpu-az-config }}
runner-label: nightly-${{ matrix.python-version }}-pt${{ matrix.torch-version }}-cu${{ matrix.cuda-version }}-${{ github.run_id }}
aws-resource-tags: >
[
{"Key": "RunnerLabel", "Value": "nightly-${{ matrix.python-version }}-pt${{ matrix.torch-version }}-cu${{ matrix.cuda-version }}-${{ github.run_id }}"},
{"Key": "PythonVersion", "Value": "${{ matrix.python-version }}"},
{"Key": "TorchVersion", "Value": "${{ matrix.torch-version }}"},
{"Key": "CudaVersion", "Value": "${{ matrix.cuda-version }}"},
{"Key": "GitHubRunId", "Value": "${{ github.run_id }}"}
]
stagger-seconds: 15
aws-role: ${{ needs.versions.outputs.aws-role }}
aws-region: ${{ needs.versions.outputs.aws-region }}
secrets:
EC2_RUNNER_TOKEN: ${{ secrets.EC2_RUNNER_TOKEN }}

##############################################################################
# BUILD NIGHTLY WHEELS
Expand Down Expand Up @@ -360,47 +347,16 @@ jobs:
- start-build-runner
- nightly-build
- versions
runs-on: ubuntu-latest
if: ${{ always() && needs.start-build-runner.result != 'skipped' }}
permissions:
id-token: write # Required for AWS OIDC
strategy:
fail-fast: false
matrix: ${{ fromJSON(needs.versions.outputs.publish-matrix) }}
steps:
- name: Configure AWS credentials
uses: aws-actions/configure-aws-credentials@e6de054238d6b7531b4efff3b6587d9aade6a06c # v6.2.3
with:
role-to-assume: ${{ needs.versions.outputs.aws-role }}
aws-region: ${{ needs.versions.outputs.aws-region }}
- name: Find EC2 instance ID by label
id: find-instance
run: |
LABEL="nightly-${MATRIX_PYTHON_VERSION}-pt${MATRIX_TORCH_VERSION}-cu${MATRIX_CUDA_VERSION}-${{ github.run_id }}"
echo "Looking for instance with RunnerLabel: $LABEL"

INSTANCE_ID=$(aws ec2 describe-instances \
--filters "Name=tag:RunnerLabel,Values=$LABEL" "Name=instance-state-name,Values=running,pending,stopping,stopped" \
--query 'Reservations[0].Instances[0].InstanceId' \
--output text)

if [ "$INSTANCE_ID" == "None" ] || [ -z "$INSTANCE_ID" ]; then
echo "ERROR: No instance found with RunnerLabel=$LABEL"
echo "instance-id=" >> $GITHUB_OUTPUT
exit 1
else
echo "Found instance: $INSTANCE_ID"
echo "instance-id=$INSTANCE_ID" >> $GITHUB_OUTPUT
fi
env:
MATRIX_PYTHON_VERSION: ${{ matrix.python-version }}
MATRIX_TORCH_VERSION: ${{ matrix.torch-version }}
MATRIX_CUDA_VERSION: ${{ matrix.cuda-version }}
- name: Stop EC2 runner
if: steps.find-instance.outputs.instance-id != ''
uses: machulav/ec2-github-runner@343a1b2ae682e681c3cec9a235d882da17ff04ef # v2.6.1
with:
mode: stop
github-token: ${{ secrets.EC2_RUNNER_TOKEN }}
label: nightly-${{ matrix.python-version }}-pt${{ matrix.torch-version }}-cu${{ matrix.cuda-version }}-${{ github.run_id }}
ec2-instance-id: ${{ steps.find-instance.outputs.instance-id }}
uses: ./.github/workflows/stop-ec2-runner.yml
with:
label: nightly-${{ matrix.python-version }}-pt${{ matrix.torch-version }}-cu${{ matrix.cuda-version }}-${{ github.run_id }}
aws-role: ${{ needs.versions.outputs.aws-role }}
aws-region: ${{ needs.versions.outputs.aws-region }}
secrets:
EC2_RUNNER_TOKEN: ${{ secrets.EC2_RUNNER_TOKEN }}
Loading
Loading