test-nvcr-pull.yml

# nvcr.io image pull + size — single-job smoke test.
#
# Pulls a specific nvcr.io image and reports its on-disk size. Does
# not include `docker login` — relies on whatever credentials the
# runner is configured with (the Packer-baked NGC pull-secret on
# nv-gha-runners, if present). A failure with an auth error is
# itself useful signal that the runner is not pre-configured for
# the target namespace.
#
# Triggers: same as `secret-scan.yml` — copy-pr-bot mirror branches
# (`pull-request/[0-9]+`) on NVIDIA/cccl + workflow_dispatch.

name: nvcr image pull + size

run-name: nvcr pull — ${{ github.ref_name }}

on:
  push:
    branches:
      - "pull-request/[0-9]+"
  workflow_dispatch:

concurrency:
  group: ${{ github.workflow }}-on-${{ github.event_name }}-from-${{ github.ref_name }}
  cancel-in-progress: true

permissions:
  contents: read

jobs:
  pull-and-size:
    name: docker pull + size
    # NV self-hosted CPU runner on NVIDIA/cccl; GitHub-hosted fallback
    # on contributor forks where nv-gha-runners labels do not resolve.
    runs-on: ${{ github.repository == 'NVIDIA/cccl' && 'linux-amd64-cpu4' || 'ubuntu-latest' }}
    env:
      NVCR_IMAGE: nvcr.io/nvidian/prodsec/pulse-trufflehog:1.33

    steps:
      - name: docker pull
        run: docker pull "${NVCR_IMAGE}"

      - name: Report size
        run: |
          set -euo pipefail
          bytes=$(docker image inspect "${NVCR_IMAGE}" --format '{{.Size}}')
          mib=$(awk -v b="${bytes}" 'BEGIN { printf "%.1f", b/1024/1024 }')
          gib=$(awk -v b="${bytes}" 'BEGIN { printf "%.2f", b/1024/1024/1024 }')
          echo "Image: ${NVCR_IMAGE}"
          echo "Size:  ${bytes} bytes  (${mib} MiB / ${gib} GiB)"

      - name: Cleanup
        if: always()
        run: docker rmi "${NVCR_IMAGE}" >/dev/null 2>&1 || true