v1.1.2: air-gapped NeMo-RL v0.7.0 stack, multimodal SDG, validated finance tool-calling recipe

.dockerignore

@@ -0,0 +1,41 @@
+# Build context excludes for dockerfiles/Dockerfile.nvflow (COPY . -> /opt/nvflow).
+# The client image bakes the source + a fresh uv venv. We KEEP .git in the context
+# (hatch-vcs versioning needs it at build); the image then squashes it to a single
+# history-free snapshot commit (nemo-run only needs `git archive HEAD`). We drop
+# everything heavy, generated, or secret. Other NVFlow Dockerfiles clone their
+# sources (they do not COPY this context), so these excludes are safe for them.
+
+# Prebuilt/host venv (the image builds its own) and uv cache
+.venv/
+**/.venv/
+.uv-cache/
+uv-cache/
+
+# Huge untracked local caches / outputs (cache/ is tens of GB)
+cache/
+outputs/
+htmlcov/
+
+# Python/pytest/tooling artifacts
+**/__pycache__/
+*.pyc
+*.pyo
+.pytest_cache/
+.ruff_cache/
+.mypy_cache/
+
+# Editor/local backups. Scope to cluster-config backups only -- a bare *.bak*
+# would also drop TRACKED dataset files (e.g. datasets/finance_agent/*.bak),
+# which then show up as phantom deletions and mark the baked tree dirty.
+cluster_configs/*.bak*
+*~
+
+# Secrets / personal cluster config (gitignored; must never be baked into an image)
+cluster_configs/my_cluster.yaml
+**/*.env
+.env
+
+# Container image artifacts that should never enter the context
+*.sqsh
+*.tar
+*.tar.gz

.github/workflows/secrets-detector.yml

@@ -30,6 +30,11 @@ jobs:
         run: |
           curl -sSfL https://raw.githubusercontent.com/trufflesecurity/trufflehog/main/scripts/install.sh | sh -s -- -b /usr/local/bin
 
+      # --results=verified,unknown fails on confirmed secrets and on anything
+      # TruffleHog could not check, but drops findings it actively verified as
+      # not a secret.  Without it, any 40-hex string near a keyword trips a
+      # detector -- pinned upstream git SHAs read as Weights & Biases keys.
+      # Keep the flags in sync with the secrets-detector job in .gitlab-ci.yml.
       - name: Scan for secrets
         run: |
-          trufflehog git file://. --since-commit ${{ github.event.pull_request.base.sha }} --fail --no-update
+          trufflehog git file://. --since-commit ${{ github.event.pull_request.base.sha }} --fail --no-update --results=verified,unknown

.github/workflows/unit-tests.yml

@@ -35,9 +35,10 @@ jobs:
         run: |
           curl -LsSf https://astral.sh/uv/install.sh | sh
           uv venv --python 3.12
-          uv pip install pytest pytest-cov pytest-timeout
-          uv pip install PyYAML omegaconf rich
+          # Dependency list is shared with .gitlab-ci.yml so the two pipelines
+          # cannot drift.  Add test-only deps to tests/requirements-ci.txt.
           uv pip install -e . --no-deps
+          uv pip install -r tests/requirements-ci.txt
 
       - name: Test
         run: |

.gitignore

@@ -25,14 +25,13 @@ wheels/
 *.egg
 
 # Virtual environments
-.venv/
+.venv
 venv/
 ENV/
 env/
 
 # UV
 .uv/
-
 # IDE
 .vscode/
 .idea/
@@ -46,6 +45,12 @@ env/
 htmlcov/
 .tox/
 
+# HF / tokenizer / debug caches.  Created by ad-hoc local Python sessions
+# (e.g. AutoConfig.from_pretrained(..., trust_remote_code=True)) when
+# HF_HOME defaults to $cwd/cache.  Pipeline runs use the Lustre HF cache,
+# never this directory -- keep it out of git to avoid accidental commits.
+/cache/
+
 # Data and outputs (customize based on your needs)
 /data
 /data/
@@ -82,6 +87,7 @@ nvflow/recipes/finance/datasets/finance_agent/*.json
 
 # Backup files
 *.bak
+*.bak-*
 
 # OS
 .DS_Store

.gitlab-ci.yml

@@ -43,7 +43,24 @@ dco-check:
   stage: lint
   image: python:3.12-slim
   script:
-    - python scripts/check_dco.py
+    - python3 scripts/check_dco.py
+  rules:
+    - if: $CI_PIPELINE_SOURCE == "merge_request_event"
+
+# Mirrors .github/workflows/secrets-detector.yml.  The GitHub copy only runs on
+# pull requests, and this repo opens one per release, so without this job a
+# finding stays invisible until release day.  Keep the flags in sync with the
+# GitHub workflow.
+secrets-detector:
+  stage: lint
+  image: python:3.12-slim
+  variables:
+    GIT_DEPTH: 0
+  before_script:
+    - apt-get update -qq && apt-get install -y -qq git curl > /dev/null
+    - curl -sSfL https://raw.githubusercontent.com/trufflesecurity/trufflehog/main/scripts/install.sh | sh -s -- -b /usr/local/bin
+  script:
+    - trufflehog git file://. --since-commit "$CI_MERGE_REQUEST_DIFF_BASE_SHA" --fail --no-update --results=verified,unknown
   rules:
     - if: $CI_PIPELINE_SOURCE == "merge_request_event"
 
@@ -54,11 +71,14 @@ test:
   stage: test
   image: python:3.12-slim
   script:
-    # Lightweight install: skip heavy core deps (nemo-skills ~200+ packages)
-    # that unit tests don't need.  Only install the project + test deps.
+    # Lightweight install: the project plus tests/requirements-ci.txt, but not
+    # the heavy nemo-skills stack (~200 packages incl. torch).  Tests that
+    # genuinely need nemo-skills use pytest.importorskip and skip here; they
+    # run in the full-deps CI.  The dependency list is shared with
+    # .github/workflows/unit-tests.yml — edit it there, in one place.
     - uv venv --python 3.12
-    - uv pip install -e ".[dev]" --no-deps
-    - uv pip install pytest pytest-cov pytest-xdist pytest-timeout PyYAML omegaconf rich
+    - uv pip install -e . --no-deps
+    - uv pip install -r tests/requirements-ci.txt
     # --no-sync prevents `uv run` from implicitly auto-installing heavy core
     # deps (nemo-skills etc) that we deliberately skipped above.  Without it,
     # tests would pass here for the wrong reason and fail on GitHub CI.

.pre-commit-config.yaml

@@ -43,5 +43,5 @@ repos:
     rev: v1.7.1
     hooks:
       - id: mypy
-        additional_dependencies: [types-PyYAML, types-tqdm]
+        additional_dependencies: [types-PyYAML, types-tqdm, types-requests]
         args: [--ignore-missing-imports]

CONTRIBUTING.md

@@ -63,12 +63,12 @@ By making a contribution to this project, I certify that:
     this project or the open source license(s) involved.
 ```
 
-## Merge Requests
+## Pull Requests
 
 1. Fork the repository and create a branch from `main`.
 2. Make your changes with signed-off commits (`git commit -s`).
-3. Push your branch and open a Merge Request into `main`.
-4. Ensure the MR description references any related issues and describes the change clearly.
+3. Push your branch and open a Pull Request into `main`.
+4. Ensure the PR description references any related issues and describes the change clearly.
 
 ## Code and Documentation
 
@@ -80,7 +80,6 @@ By making a contribution to this project, I certify that:
 
 By contributing, you agree that your contributions will be licensed under the same license as the project: the Apache License, Version 2.0. See [LICENSE](LICENSES/LICENSE) for the full text.
 
-## IP Review and Open Source Compliance
+## Third-Party Code
 
-- **Ongoing modifications**: For changes to project code (including contributions by third parties), follow NVIDIA's IP review process: [https://nv/ip_review_process](https://nv/ip_review_process).
-- **Open Source compliance**: This project follows NVIDIA OSRB recommendations for Apache 2.0 release.
+If your contribution adds or updates a third-party dependency, make sure its license is compatible with Apache 2.0 and record it in [`LICENSES/THIRD_PARTY_SW_LICENSE_INFO.md`](LICENSES/THIRD_PARTY_SW_LICENSE_INFO.md).