CVS-191622 [GHA] Docker action for NNCF pipeline

.ci/cspell_dict.txt

@@ -112,6 +112,7 @@ desynchronization
 distilbert
 dlyakhov
 dnnl
+dockerfiles
 docstrings
 dokuchaev
 dtypes
@@ -321,6 +322,7 @@ onnxroi
 onnxx
 openbookqa
 openvino
+openvinogithubactions
 openvinotoolkit
 oplambda
 opset

.github/actionlint.yaml

@@ -3,3 +3,6 @@ self-hosted-runner:
     - windows-2025-8-core
     - windows-2025-16-core
     - aks-linux-6-cores-55gb-gpu-a10
+    - Linux
+    - NNCF
+    - aks-linux-4-cores-16gb-docker-build

.github/dockerfiles/.dockerignore

@@ -0,0 +1 @@
+*

.github/dockerfiles/docker_tag

@@ -0,0 +1 @@
+pr-4156

.github/dockerfiles/nncf/pytorch_cuda/Dockerfile

@@ -0,0 +1,27 @@
+ARG REGISTRY="docker.io"
+FROM ${REGISTRY}/library/ubuntu:24.04
+
+ENV DEBIAN_FRONTEND="noninteractive" \
+    TZ="Europe/London" \
+    NODE_EXTRA_CA_CERTS="/usr/local/share/ca-certificates/IntelProxyRootCA-Base64.crt" \
+    GIT_SSL_CAINFO="/usr/local/share/ca-certificates/IntelProxyRootCA-Base64.crt" \
+    PIP_CERT="/usr/local/share/ca-certificates/IntelProxyRootCA-Base64.crt" \
+    REQUESTS_CA_BUNDLE="/usr/local/share/ca-certificates/IntelProxyRootCA-Base64.crt" \
+    SSL_CERT_FILE="/usr/local/share/ca-certificates/IntelProxyRootCA-Base64.crt"
+
+RUN apt-get update && \
+    apt-get --assume-yes install --no-install-recommends \
+        git \
+        git-lfs \
+        ca-certificates \
+        build-essential \
+        ninja-build \
+        libgl1-mesa-dev \
+        libglib2.0-0 \
+        wget \
+        make \
+    && rm -rf /var/lib/apt/lists/*
+
+RUN wget -q https://developer.download.nvidia.com/compute/cuda/12.6.3/local_installers/cuda_12.6.3_560.35.05_linux.run -O /tmp/cuda_installer.run && \
+    sh /tmp/cuda_installer.run --toolkit --silent && \
+    rm -f /tmp/cuda_installer.run

.github/workflows/call_precommit.yml

@@ -19,182 +19,121 @@ on:
         required: false
 
 jobs:
-  common:
-    timeout-minutes: 40
+  check_changes:
+    name: Check changes
+    timeout-minutes: 10
     runs-on: ubuntu-latest
-    defaults:
-      run:
-        shell: bash
+    if: ${{ inputs.gpu_enabled == true }}
+    outputs:
+      changed_components: ${{ steps.check_docker.outputs.changed_components }}
     steps:
-      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
         with:
-          lfs: true
-      - uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0
-        with:
-          python-version: ${{ inputs.python_version }}
-      - name: Install uv
-        uses: astral-sh/setup-uv@20cfd1bf945f4377ade1205e4dbc17946fc9a30d # v10.0.1
-      - name: Override constraints
-        if: ${{ inputs.override_requirements != '' }}
-        run: python .github/scripts/override_constraints.py "${{ inputs.override_requirements }}"
-        shell: bash
-      - name: Install NNCF and test requirements
-        run: uv pip install --system . -r tests/common/requirements.txt
-      - name: Print installed modules
-        run: pip list
-      - name: Run common precommit test scope
-        run: make test-common
-        env:
-          NUM_WORKERS: 2
+          fetch-depth: 0
 
-  onnx:
-    timeout-minutes: 40
-    runs-on: ubuntu-latest-8-cores
-    defaults:
-      run:
-        shell: bash
-    steps:
-      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
-        with:
-          lfs: true
-      - uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0
-        with:
-          python-version: ${{ inputs.python_version }}
-      - name: Install uv
-        uses: astral-sh/setup-uv@20cfd1bf945f4377ade1205e4dbc17946fc9a30d # v10.0.1
-      - name: Override constraints
-        if: ${{ inputs.override_requirements != '' }}
-        run: python .github/scripts/override_constraints.py "${{ inputs.override_requirements }}"
-        shell: bash
-      - name: Install NNCF and test requirements
-        run: uv pip install --system . -r tests/onnx/requirements.txt
-      - name: Print installed modules
-        run: pip list
-      - name: Run ONNX precommit test scope
-        run: make test-onnx
-        env:
-          NUM_WORKERS: 4
-
-  openvino:
-    timeout-minutes: 40
-    runs-on: ubuntu-latest-8-cores
-    defaults:
-      run:
-        shell: bash
-    steps:
-      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
-        with:
-          lfs: true
-      - uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0
-        with:
-          python-version: ${{ inputs.python_version }}
-      - name: Install uv
-        uses: astral-sh/setup-uv@20cfd1bf945f4377ade1205e4dbc17946fc9a30d # v10.0.1
-      - name: Override constraints
-        if: ${{ inputs.override_requirements != '' }}
-        run: python .github/scripts/override_constraints.py "${{ inputs.override_requirements }}"
-        shell: bash
-      - name: Install NNCF and test requirements
-        run: uv pip install --system . -r tests/openvino/requirements.txt
-      - name: Print installed modules
-        run: pip list
-      - name: Run OV precommit test scope
-        run: make test-openvino
+      - name: Check for dockerfile changes
+        id: check_docker
         env:
-          NUM_WORKERS: 4
+          BASE_SHA: ${{ github.event.pull_request.base.sha }}
+          HEAD_SHA: ${{ github.event.pull_request.head.sha }}
+        run: |
+          if git diff --quiet "$BASE_SHA" "$HEAD_SHA" -- .github/dockerfiles; then
+            dockerfiles=false
+          else
+            dockerfiles=true
+          fi
+          if git diff --quiet "$BASE_SHA" "$HEAD_SHA" -- .dockerignore .github/dockerfiles; then
+            docker_env=false
+          else
+            docker_env=true
+          fi
+          echo "changed_components={\"docker_env\": $docker_env, \"dockerfiles\": $dockerfiles}" >> "$GITHUB_OUTPUT"
 
-  tools:
-    timeout-minutes: 40
-    runs-on: ubuntu-latest
-    defaults:
-      run:
-        shell: bash
+  docker:
+    name: Docker
+    timeout-minutes: 15
+    needs: check_changes
+    runs-on: aks-linux-4-cores-16gb-docker-build
+    if: ${{ inputs.gpu_enabled == true }}
+    container:
+      image: openvinogithubactions.azurecr.io/docker_build:0.2
+      volumes:
+        - /mount:/mount
+    outputs:
+      images: "${{ steps.handle_docker.outputs.images }}"
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
-        with:
-          lfs: true
-      - uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0
-        with:
-          python-version: ${{ inputs.python_version }}
-      - name: Install uv
-        uses: astral-sh/setup-uv@20cfd1bf945f4377ade1205e4dbc17946fc9a30d # v10.0.1
-      - name: Install test requirements
-        run: uv pip install --system . -r tests/tools/requirements.txt
-      - name: Print installed modules
-        run: pip list
-      - name: Run tools precommit test scope
-        run: pytest -ra tests/tools
 
-  pytorch-cpu:
-    timeout-minutes: 40
-    runs-on: ubuntu-latest
-    # TODO(AlexanderDokuchaev): Enable with torchao=0.18.0 release
-    if: ${{ inputs.python_version != '3.14' }}
-    defaults:
-      run:
-        shell: bash
-    steps:
-      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+      - uses: openvinotoolkit/openvino/.github/actions/handle_docker@1f6bb04df50d71dd7e392537eee6b834312f269a
+        id: handle_docker
         with:
-          lfs: true
-      - uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0
-        with:
-          python-version: ${{ inputs.python_version }}
-      - name: Install uv
-        uses: astral-sh/setup-uv@20cfd1bf945f4377ade1205e4dbc17946fc9a30d # v10.0.1
-      - name: Override constraints
-        if: ${{ inputs.override_requirements != '' }}
-        run: python .github/scripts/override_constraints.py "${{ inputs.override_requirements }}"
-        shell: bash
-      - name: Install NNCF and test requirements
-        run: uv pip install --system . -r tests/torch/requirements.txt
-      - name: Print installed modules
-        run: pip list
-      - name: Run torch precommit test scope
-        run: pytest -ra -n2 --durations=30 tests/torch -m "not cuda"
+          images: |
+            nncf/pytorch_cuda
+          registry: 'openvinogithubactions.azurecr.io'
+          dockerfiles_root_dir: '.github/dockerfiles'
+          changed_components: ${{ needs.check_changes.outputs.changed_components }}
 
   pytorch-cuda:
     timeout-minutes: 40
-    runs-on: aks-linux-6-cores-55gb-gpu-a10
+    needs: docker
+    runs-on:
+      group: Nvidia-GPU
+      labels: [Linux, NNCF]
     if: ${{ inputs.gpu_enabled == true }}
+    container:
+      image: ${{ fromJSON(needs.docker.outputs.images).nncf.pytorch_cuda }}
+      options: --gpus all --ipc=host
+      volumes:
+        - /usr/local/share/ca-certificates:/usr/local/share/ca-certificates:ro
+        - /opt/home/actions_runner/actions-runner/pip-cache:/opt/pip-cache
+      env:
+        PIP_CACHE_DIR: /opt/pip-cache
     defaults:
       run:
         shell: bash
-    env:
-      DEBIAN_FRONTEND: noninteractive
     steps:
-      - name: Install dependencies
-        run : |
-          sudo apt-get update
-          sudo apt-get --assume-yes install build-essential ninja-build libgl1-mesa-dev libglib2.0-0 wget make
-      - name: Download CUDA
-        run: |
-          wget -q https://developer.download.nvidia.com/compute/cuda/12.6.3/local_installers/cuda_12.6.3_560.35.05_linux.run
-          sudo sh cuda_12.6.3_560.35.05_linux.run --toolkit --silent
+      - name: Update CA certificates
+        run: update-ca-certificates
+
       - name: Runner info
         continue-on-error: true
         run: |
           nvidia-smi
           cat /proc/cpuinfo
-      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+
+      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
         with:
           lfs: true
+
       - uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0
         with:
           python-version: ${{ inputs.python_version }}
-      - name: Install uv
-        uses: astral-sh/setup-uv@20cfd1bf945f4377ade1205e4dbc17946fc9a30d # v10.0.1
+
+      - name: Register toolcache libpython with the dynamic linker
+        run: |
+          echo "$pythonLocation/lib" > /etc/ld.so.conf.d/zz-python-toolcache.conf
+          ldconfig
+
+      - name: Create virtual environment
+        run: |
+          python3 -m venv .venv
+          echo "$PWD/.venv/bin" >> "$GITHUB_PATH"
+
       - name: Override constraints
         if: ${{ inputs.override_requirements != '' }}
         run: python .github/scripts/override_constraints.py "${{ inputs.override_requirements }}"
         shell: bash
+
       - name: Install NNCF and test requirements
-        run: uv pip install --system . -r tests/torch/requirements.txt
+        run: pip install . -r tests/torch/requirements.txt
+
       - name: Print installed modules
         run: pip list
+
       - name: Check CUDA
         run: |
           python -c "import torch; print(torch.cuda.is_available())"
+
       - name: Run PyTorch precommit test scope
         run: |
           pytest -ra --durations=30 tests/torch -m cuda

docs/ci/dockerfiles.md

@@ -0,0 +1,72 @@
+# Docker images
+
+## Custom docker images and handle_docker action
+
+To optimize the time required to install dependencies in workflows and to make local reproduction of workflow steps easier,
+we create custom Docker images for different types of validation and use them in our workflows.
+The dockerfiles for these images are stored in this repository in [`.github/dockerfiles`](./../../.github/dockerfiles)
+folder. Dockerfiles are organized as follows:
+
+* [`.github/dockerfiles/nncf`](./../../.github/dockerfiles/nncf) - contains images used in nncf workflows
+
+The changes to these dockerfiles are getting checked and applied automatically in pre-commits via the reusable
+[handle_docker](https://github.com/openvinotoolkit/openvino/tree/master/.github/actions/handle_docker) action from the
+OpenVINO repository, which is executed in workflows before starting actual validation in a separate job called `docker`.
+The action checks if a pull request changes either dockerfiles or environment setup scripts, and if so - triggers
+affected docker images build and validation with the updated images. The images are tagged with the ID of the pull
+request that changes them, and the tag must be updated in git by changing PR ID in
+[.github/dockerfiles/docker_tag](./../../.github/dockerfiles/docker_tag). The action will prompt you to do that once
+you change something that alters docker environment.
+
+The `changed_components` input expected by the action is produced by the `check_changes` job. This job diffs the pull request against its base
+branch and emits a JSON object of the form `{"docker_env": <bool>, "dockerfiles": <bool>}`, where `docker_env` is `true`
+if `.dockerignore` or any file under `.github/dockerfiles` changed, and `dockerfiles` is `true` if any file under
+`.github/dockerfiles` changed.
+
+**Important**: If you add a new environment configuration script to be used in dockerfiles, please, exclude the path to this script
+from [.dockerignore](./../../.github/dockerfiles/.dockerignore) (this will make sure that Docker itself detects a script file).
+
+The action accepts a list of the desired images to build as an input and outputs fully-qualified Docker image references
+to use in workflow jobs.
+
+### Using custom images in workflow jobs
+
+* Make sure that the `docker` job is called in your workflow. Pass a path or multiple paths to the folders with
+dockerfiles, that are going to be used further in a workflow, to `images` parameter of the `handle_docker` action.
+
+Example, taken from [call_precommit.yml](./../../.github/workflows/call_precommit.yml):
+
+```yaml
+  docker:
+    needs: check_changes
+    name: Docker
+    runs-on: aks-linux-4-cores-16gb-docker-build
+    container:
+      image: openvinogithubactions.azurecr.io/docker_build:0.2
+      volumes:
+        - /mount:/mount
+    outputs:
+      images: "${{ steps.handle_docker.outputs.images }}"
+    steps:
+      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+
+      - uses: openvinotoolkit/openvino/.github/actions/handle_docker@1f6bb04df50d71dd7e392537eee6b834312f269a
+        id: handle_docker
+        with:
+          images: |
+            nncf/pytorch_cuda
+          registry: 'openvinogithubactions.azurecr.io'
+          dockerfiles_root_dir: '.github/dockerfiles'
+          changed_components: ${{ needs.check_changes.outputs.changed_components }}
+```
+
+* Add `docker` to the `needs:` block of the job that will be executed with the desired custom image and set
+`container.image` key in this job to point to the docker image taken from `handle_docker`'s outputs, like that:
+
+```yaml
+  pytorch-cuda:
+    needs: docker
+    ...
+    container:
+      image: ${{ fromJSON(needs.docker.outputs.images).nncf.pytorch_cuda }}
+```