fix: stamp CLI release version before packaging

[willkill07]

Overview

Stamp the intended package version into every prebuilt CLI binary before compilation and prevent corrected 0.7.0 binaries from reusing gateways started by incorrectly identified RC artifacts.

• I confirm this contribution is my own work, or I have the right to submit it under this project's license.
• I searched existing issues and open pull requests, and this does not duplicate existing work.

Details

• Add a Cargo-only version recipe with SemVer build metadata support.
• Derive one CLI package version in CI and reuse it for Cargo, wheel, npm, and binary verification.
• Assert exact nemo-relay <version> output across native, manylinux, musllinux, macOS, and Windows packaging paths.
• Increment the bootstrap protocol from 2 to 3 and reject protocol-2 gateways.
• Update bootstrap and CLI compatibility fixtures for protocol 3.
• No public API changes. Existing protocol-2 gateways are intentionally incompatible and must stop or idle-shutdown before replacement.

Validation:

• Cargo version recipe with 0.7.0-rc.6 and 0.7.0+deadbeef
• Exact prerelease CLI --version assertion
• CLI packaging-script tests
• Focused bootstrap compatibility test
• All 98 CLI integration tests
• cargo fmt --all -- --check
• cargo clippy --workspace --all-targets -- -D warnings
• uv run pre-commit run --all-files
• just test-rust passed the affected workspace and CLI suites; its final FFI unit target encountered an ambient /Users/wkillian/.nemo-relay/plugins.toml, causing one unexpected discovery warning and cascading poisoned-lock failures unrelated to this change.

Where should the reviewer start?

Start with .github/workflows/ci_rust.yml for the single-source version derivation and exact verification, then crates/cli/src/bootstrap/mod.rs and the bootstrap compatibility test for the protocol bump.

Related Issues: (use one of the action keywords Closes / Fixes / Resolves / Relates to)

• Closes RELAY-664

Summary by CodeRabbit

• New Features

  • Added support for the updated bootstrap protocol, improving compatibility with current gateway connections.
  • Added a dedicated command to update the Cargo package version independently.

• Bug Fixes

  • Improved version validation for SemVer build metadata and invalid leading-zero identifiers.
  • Added checks to ensure CLI binaries and packages report the expected version.

• Tests

  • Expanded compatibility coverage for unsupported protocol and package-version combinations.

[coderabbitai]

Walkthrough

The PR centralizes CLI package version derivation and validates versions across native, Linux, and musllinux artifacts. It also increments the bootstrap protocol to version 3 and updates related test responses and compatibility coverage.

Changes

CLI version validation

Layer / File(s)	Summary
Cargo version tooling justfile	Cargo version validation accepts build metadata and rejects invalid numeric identifiers. The new set-cargo-version target updates only Cargo workspace versions.
Package version derivation .github/workflows/ci_rust.yml	The Package job installs uv and just, derives and exports the CLI package version, updates Cargo metadata, and reuses the exported version for wheel packaging.
Artifact version checks .github/workflows/ci_rust.yml	Native, Linux runtime, and musllinux artifacts compare nemo-relay --version with the expected package version.

Bootstrap protocol version 3

Layer / File(s)	Summary
Bootstrap protocol constant crates/cli/src/bootstrap/mod.rs	BOOTSTRAP_PROTOCOL_VERSION changes from 2 to 3.
Bootstrap protocol test coverage crates/cli/tests/cli_tests.rs, crates/cli/tests/coverage/shared/bootstrap_tests.rs	Test responses and assertions use the shared version constant. Listener adoption tests cover current and previous protocol versions.

Estimated code review effort: 3 (Moderate) | ~20 minutes

Possibly related PRs

• NVIDIA/NeMo-Relay#590: Modifies related musllinux CLI packaging and version validation.
• NVIDIA/NeMo-Relay#643: Modifies related CI package versioning and Python artifact packaging.

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Title check	✅ Passed	The title uses the allowed fix type, gives a concise imperative summary, stays under 72 characters, and has no trailing period.
Description check	✅ Passed	The description includes all required template sections, clear implementation details, reviewer guidance, checkboxes, and a related issue.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests

---

_{Comment @coderabbitai help to get the list of available commands.}

[coderabbitai]

Actionable comments posted: 1

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In `@justfile`:
- Around line 456-464: Update the version validation regex in the Cargo version
check to use ASCII digit classes and enforce SemVer numeric identifier rules:
require major, minor, patch, and prerelease numeric components to have no
leading zeroes unless the value is exactly zero. Keep the existing prerelease
labels and build-metadata validation behavior.

🪄 Autofix

Fix all unresolved CodeRabbit comments on this PR:

• Push a commit to this branch (recommended)
• Create a new PR with the fixes

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: ASSERTIVE

Plan: Enterprise

Run ID: a273f2ee-0e2f-4903-a034-86e3eeb13313

📥 Commits

Reviewing files that changed from the base of the PR and between 0ef068f and 5ccfd70.

📒 Files selected for processing (5)

• .github/workflows/ci_rust.yml
• crates/cli/src/bootstrap/mod.rs
• crates/cli/tests/cli_tests.rs
• crates/cli/tests/coverage/shared/bootstrap_tests.rs
• justfile

📜 Review details

🧰 Additional context used

📓 Path-based instructions (17)

**/*.rs

📄 CodeRabbit inference engine (.agents/skills/prepare-pr/SKILL.md)

**/*.rs: Any Rust change must run just test-rust
Any Rust change must run cargo fmt --all
Any Rust change must run cargo clippy --workspace --all-targets -- -D warnings

**/*.rs: Run cargo fmt --all for all FFI work since it is Rust work
Run just test-rust to validate FFI changes
Run cargo clippy --workspace --all-targets -- -D warnings to enforce strict linting on FFI work

When Rust files changed as part of Go work, also run cargo fmt --all, just test-rust, and cargo clippy --workspace --all-targets -- -D warnings

**/*.rs: Run cargo fmt --all when Rust files are changed as part of Node work
Run cargo clippy --workspace --all-targets -- -D warnings when Rust files are changed as part of Node work
Run just test-rust when Rust files are changed as part of Node work

**/*.rs: If any Rust code changed, always run just test-rust.
If any Rust code changed, also run cargo fmt --all.
If any Rust code changed, also run cargo clippy --workspace --all-targets -- -D warnings.
For Rust changes headed for review, run cargo fmt --all and cargo clippy --workspace --all-targets -- -D warnings even if relying on pre-commit.

**/*.rs: Format Rust code with rustfmt defaults using cargo fmt.
Run cargo clippy -- -D warnings; all Rust warnings must be treated as errors.
Use Rust snake_case naming conventions.

Files:

• crates/cli/src/bootstrap/mod.rs
• crates/cli/tests/coverage/shared/bootstrap_tests.rs
• crates/cli/tests/cli_tests.rs

{crates/**/src/**/*.rs,python/**/*.py}

📄 CodeRabbit inference engine (.agents/skills/maintain-dynamic-plugins/SKILL.md)

Do not add tests under src; Rust tests belong in crate tests/ trees, and Python SDK tests belong under python/tests.

Files:

• crates/cli/src/bootstrap/mod.rs

**/*

📄 CodeRabbit inference engine (.agents/skills/validate-change/SKILL.md)

**/*: Format changed files with the language-native formatter before the final lint/test pass.
If dynamic plugin behavior changed, use maintain-dynamic-plugins and include the native SDK, worker protocol, Python SDK, docs, packaging, and Codecov surfaces in the validation plan.
If code changes alter APIs, bindings, commands, paths, packaging behavior, observability/adaptive semantics, or documented best practices, update any dependent maintainer or consumer skills in the same branch.
During iteration, prefer uv run pre-commit run --files <changed files...>.
Before review or handoff, run uv run pre-commit run --all-files.

**/*: Use release tags in raw Rust-compatible SemVer without a leading v; tags such as v0.1.0 are prohibited.
Use branch prefixes feat/, fix/, docs/, test/, or refactor/ according to the change purpose.
Every commit in a pull request must include a DCO Signed-off-by: sign-off.
Before submitting a pull request, ensure pre-commit hooks, relevant tests, target-specific builds, documentation updates, and a rebase on the latest main are complete.
Use commit messages in the form type: short description, with a valid type and a first line under 72 characters.

Files:

• crates/cli/src/bootstrap/mod.rs
• crates/cli/tests/coverage/shared/bootstrap_tests.rs
• justfile
• crates/cli/tests/cli_tests.rs

**/*.{rs,py,go,js,ts}

📄 CodeRabbit inference engine (.agents/skills/validate-change/SKILL.md)

If a language surface changed, always run that language's test target even when Rust core did not change.

**/*.{rs,py,go,js,ts}: When observability configuration or lifecycle is exposed, keep FFI and Python, Go, and Node.js binding-native config objects and subscriber/exporter methods aligned in logical knobs and semantics.
Require every OpenTelemetry endpoint to have a type and nonblank destination; resolve header_env values at activation and reject missing, blank, or duplicate headers.
Concatenate layered ATOF sink, ATIF storage, and OpenTelemetry endpoint lists with higher-precedence entries first.
Preserve correct handling of mark events, start/end events, orphan cases, and span or trajectory fields derived from intended event data.
Run affected Rust tests and just test-rust when event fields change; run just test-python, just test-go, and just test-node when binding-native configuration or lifecycle changes.

Files:

• crates/cli/src/bootstrap/mod.rs
• crates/cli/tests/coverage/shared/bootstrap_tests.rs
• crates/cli/tests/cli_tests.rs

**/*.{rs,py,js,ts,tsx,go,java,kt,swift}

📄 CodeRabbit inference engine (.agents/skills/add-middleware/SKILL.md)

Add tests covering registration and duplicate names, deregistration and missing names, priority ordering, callback failure policy, scope-local inheritance and cleanup, event payload semantics, immutable mark and scope fields, and parity across affected bindings.

Files:

• crates/cli/src/bootstrap/mod.rs
• crates/cli/tests/coverage/shared/bootstrap_tests.rs
• crates/cli/tests/cli_tests.rs

**/*.{rs,py,js,jsx,ts,tsx,go,c,h,cc,cpp,md,toml,yml,yaml,sh}

📄 CodeRabbit inference engine (AGENTS.md)

Keep SPDX headers on source, documentation, scripts, and configuration files; the project is Apache-2.0.

Files:

• crates/cli/src/bootstrap/mod.rs
• crates/cli/tests/coverage/shared/bootstrap_tests.rs
• crates/cli/tests/cli_tests.rs

**/*.{rs,py}

📄 CodeRabbit inference engine (AGENTS.md)

Use snake_case naming in Rust and Python.

Files:

• crates/cli/src/bootstrap/mod.rs
• crates/cli/tests/coverage/shared/bootstrap_tests.rs
• crates/cli/tests/cli_tests.rs

crates/**/*.rs

📄 CodeRabbit inference engine (AGENTS.md)

crates/**/*.rs: Use Json = serde_json::Value in Rust-facing runtime APIs where existing code expects JSON payloads.
Treat Rust as the source of truth for runtime behavior; binding APIs should mirror Rust semantics unless a language-specific wrapper intentionally improves ergonomics.

Files:

• crates/cli/src/bootstrap/mod.rs
• crates/cli/tests/coverage/shared/bootstrap_tests.rs
• crates/cli/tests/cli_tests.rs

**/*.{rs,py,js,mjs,ts,tsx}

📄 CodeRabbit inference engine (AGENTS.md)

Preserve the existing Tokio-based asynchronous model and callback/future lifetimes; do not unexpectedly block or hide async work in bindings.

Files:

• crates/cli/src/bootstrap/mod.rs
• crates/cli/tests/coverage/shared/bootstrap_tests.rs
• crates/cli/tests/cli_tests.rs

**/*.{rs,py,go,js,jsx,ts,tsx,c,h}

📄 CodeRabbit inference engine (CONTRIBUTING.md)

**/*.{rs,py,go,js,jsx,ts,tsx,c,h}: Run tests for every language affected by a change; changes to the core Rust crate require tests across all bindings.
Use SONAR_IGNORE_START / SONAR_IGNORE_END only for documented false positives, keep ignored blocks minimal, explain them with a comment, and obtain reviewer sign-off.
Preserve the layered architecture in which Rust provides the core runtime and C FFI, PyO3, and NAPI provide bindings that mirror the full API surface.

Files:

• crates/cli/src/bootstrap/mod.rs
• crates/cli/tests/coverage/shared/bootstrap_tests.rs
• crates/cli/tests/cli_tests.rs

**/*.{rs,py,go,js,jsx,ts,tsx,c,h,html,md,mdx,toml}

📄 CodeRabbit inference engine (CONTRIBUTING.md)

Include the appropriate SPDX copyright and Apache-2.0 license header in every source file.

Files:

• crates/cli/src/bootstrap/mod.rs
• crates/cli/tests/coverage/shared/bootstrap_tests.rs
• crates/cli/tests/cli_tests.rs

**/{test,tests}/**/*

📄 CodeRabbit inference engine (CONTRIBUTING.md)

When adding functionality, include tests in the appropriate test files for each affected language binding.

Files:

• crates/cli/tests/coverage/shared/bootstrap_tests.rs
• crates/cli/tests/cli_tests.rs

{crates/**/tests/**,python/tests/**,go/nemo_relay/**/*_test.go}

⚙️ CodeRabbit configuration file

{crates/**/tests/**,python/tests/**,go/nemo_relay/**/*_test.go}: Tests should cover the behavior promised by the changed API surface, including error paths and cross-request isolation where relevant.
Prefer assertions on lifecycle events, scope stacks, middleware ordering, and binding parity over shallow smoke tests.

Files:

• crates/cli/tests/coverage/shared/bootstrap_tests.rs
• crates/cli/tests/cli_tests.rs

{justfile,codecov.yml,codecov.yaml,.github/workflows/**/*.yml,.github/workflows/**/*.yaml}

📄 CodeRabbit inference engine (.agents/skills/maintain-dynamic-plugins/SKILL.md)

justfile, Codecov, and CI package/test workflows must include new plugin crates and packages.

Files:

• justfile
• .github/workflows/ci_rust.yml

justfile

📄 CodeRabbit inference engine (.agents/skills/maintain-packaging/SKILL.md)

Keep justfile build, test, clean, version, and package recipes for plugin crates and packages aligned with the current packaging layout.

Files:

• justfile

{.github/**,.gitlab-ci.yml,.pre-commit-config.yaml,justfile,scripts/**}

⚙️ CodeRabbit configuration file

{.github/**,.gitlab-ci.yml,.pre-commit-config.yaml,justfile,scripts/**}: Review automation changes for reproducibility, pinned versions where appropriate, secret handling, and consistency with the documented validation matrix.
Pay attention to commands that need generated native artifacts, FFI libraries, or platform-specific environment variables.

Files:

• justfile
• .github/workflows/ci_rust.yml

.github/workflows/*.{yml,yaml}

📄 CodeRabbit inference engine (.agents/skills/maintain-ci/SKILL.md)

.github/workflows/*.{yml,yaml}: Put permissions: on each job that needs token access.
Avoid workflow-level permissions: unless the repository intentionally centralizes them and the inheritance tradeoff is documented.
Keep third-party actions pinned to full commit SHAs and preserve the readable version comment after the SHA.
Prefer action-native or ecosystem-native caching over generic actions/cache.
Use lockfiles or dependency manifests to drive cache invalidation.
Keep deploy and publish permissions isolated to the jobs that need them.
Read both caller and callee when a workflow uses workflow_call.
Put release-tag validation in the earliest practical caller job when the pipeline has tag-based publish behavior.
Keep pure-Python plugin SDK packaging as a single wheel artifact instead of duplicating it across every platform matrix entry.
contents: read is the default minimum for checkout-based build, test, docs, and packaging jobs.
pull-requests: read is required for PR metadata lookup jobs.
pages: write and id-token: write should be limited to Pages deployment jobs and any caller that invokes them through a reusable workflow.
For reusable workflows, the caller must grant every permission the called jobs require; the callee cannot elevate beyond what the caller provides.
Prefer astral-sh/setup-uv cache support with cache-dependency-glob anchored to uv.lock.
Prefer Swatinem/rust-cache with explicit shared-key and workspaces instead of ad hoc target-directory caching.
Avoid caching generated outputs that can hide stale behavior unless the repo already relies on them deliberately.

Keep CI workflow commands and package references in GitHub Actions workflows aligned with the current install, build, and example commands.

Files:

• .github/workflows/ci_rust.yml

🧠 Learnings (2)

📚 Learning: 2026-08-03T19:55:03.931Z

Learnt from: afourniernv
Repo: NVIDIA/NeMo-Relay PR: 558
File: crates/pii-redaction/src/rampart/mod.rs:265-274
Timestamp: 2026-08-03T19:55:03.931Z
Learning: In NeMo Relay first-party plugin registration helpers, treat the documented duplicate-registration `PluginError::RegistrationFailed` result from `register_plugin` as success when registration is intended to be idempotent. Do not locally reclassify this as `PluginError::Conflict`; changing the classification requires a core-wide review of the public API and FFI behavior.

Applied to files:

• crates/cli/src/bootstrap/mod.rs
• crates/cli/tests/coverage/shared/bootstrap_tests.rs
• crates/cli/tests/cli_tests.rs

📚 Learning: 2026-05-03T04:23:07.497Z

Learnt from: willkill07
Repo: NVIDIA/NeMo-Flow PR: 46
File: .github/workflows/ci_rust.yml:31-64
Timestamp: 2026-05-03T04:23:07.497Z
Learning: In GitHub Actions workflow YAML, it’s valid to conditionally disable a service container by setting the service container’s `image` to an empty string (`''`) via a matrix variable (e.g., `redis_service_image: ''`). This intentionally makes the runner skip service initialization for that matrix entry rather than failing the job. When reviewing workflows, don’t flag this as an error if the workflow uses an empty `image` to disable the service on specific matrix entries (e.g., OS-specific setups); verify the `image` is sourced from the matrix variable and that the service is only expected to be available when a non-empty image is provided.

Applied to files:

• .github/workflows/ci_rust.yml

🪛 zizmor (1.28.0)

.github/workflows/ci_rust.yml

[warning] 326-326: code injection via template expansion (template-injection): may expand into attacker-controllable code

(template-injection)

---

[warning] 328-328: code injection via template expansion (template-injection): may expand into attacker-controllable code

(template-injection)

---

[warning] 416-416: code injection via template expansion (template-injection): may expand into attacker-controllable code

(template-injection)

🔇 Additional comments (9)

justfile (1)

1495-1510: LGTM!

.github/workflows/ci_rust.yml (5)

257-278: LGTM!

---

325-334: LGTM!

---

370-370: LGTM!

---

399-404: LGTM!

---

415-427: LGTM!

crates/cli/src/bootstrap/mod.rs (1)

41-41: LGTM!

crates/cli/tests/cli_tests.rs (1)

27-27: LGTM!

Also applies to: 643-645, 1132-1134, 1177-1179, 1642-1642, 4507-4509

crates/cli/tests/coverage/shared/bootstrap_tests.rs (1)

91-105: LGTM!

[mnajafian-nv]

conditional approval upon reviewing the suggestion.

[coderabbitai]

Caution

Some comments are outside the diff and can’t be posted inline due to platform limitations.

⚠️ Outside diff range comments (2)

.github/workflows/ci_rust.yml (2)

257-260: 🚀 Performance & Scalability | 🔵 Trivial | ⚡ Quick win

Enable the setup-uv cache for this job.

Add cache support and anchor invalidation to uv.lock. This avoids repeated tool setup and follows the workflow policy.

As per coding guidelines, prefer astral-sh/setup-uv cache support with cache-dependency-glob anchored to uv.lock.

Proposed change

       - uses: astral-sh/setup-uv@cec208311dfd045dd5311cadd060b2062131d57 # v8
         with:
           version: ${{ steps.ci-config.outputs.uv_version }}
+          enable-cache: true
+          cache-dependency-glob: ${{ env.NEMO_RELAY_CI_WORKSPACE }}/uv.lock

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In @.github/workflows/ci_rust.yml around lines 257 - 260, Update the
astral-sh/setup-uv step to enable its cache and configure cache-dependency-glob
to use uv.lock, preserving the existing uv_version input.

Source: Coding guidelines

---

257-278: 🩺 Stability & Availability | 🔵 Trivial | ⚡ Quick win

Pin Python in the Windows ARM package job.

The Package job relies on the runner image’s python and does not select default_python_version or architecture: arm64, unlike Test. Add the same actions/setup-python step before the Python packaging commands.

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In @.github/workflows/ci_rust.yml around lines 257 - 278, Update the Windows ARM
Package job to add an actions/setup-python step before its Python packaging
commands, configuring it with the workflow’s default_python_version and
architecture: arm64 settings to match the Test job.

Source: Path instructions

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Outside diff comments:
In @.github/workflows/ci_rust.yml:
- Around line 257-260: Update the astral-sh/setup-uv step to enable its cache
and configure cache-dependency-glob to use uv.lock, preserving the existing
uv_version input.
- Around line 257-278: Update the Windows ARM Package job to add an
actions/setup-python step before its Python packaging commands, configuring it
with the workflow’s default_python_version and architecture: arm64 settings to
match the Test job.

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: ASSERTIVE

Plan: Enterprise

Run ID: 8589d821-7111-4a8e-834f-902b73032f22

📥 Commits

Reviewing files that changed from the base of the PR and between fe29d67 and 705dc71.

📒 Files selected for processing (1)

• .github/workflows/ci_rust.yml

📜 Review details

🧰 Additional context used

📓 Path-based instructions (3)

.github/workflows/*.{yml,yaml}

📄 CodeRabbit inference engine (.agents/skills/maintain-ci/SKILL.md)

.github/workflows/*.{yml,yaml}: Put permissions: on each job that needs token access.
Avoid workflow-level permissions: unless the repository intentionally centralizes them and the inheritance tradeoff is documented.
Keep third-party actions pinned to full commit SHAs and preserve the readable version comment after the SHA.
Prefer action-native or ecosystem-native caching over generic actions/cache.
Use lockfiles or dependency manifests to drive cache invalidation.
Keep deploy and publish permissions isolated to the jobs that need them.
Read both caller and callee when a workflow uses workflow_call.
Put release-tag validation in the earliest practical caller job when the pipeline has tag-based publish behavior.
Keep pure-Python plugin SDK packaging as a single wheel artifact instead of duplicating it across every platform matrix entry.
contents: read is the default minimum for checkout-based build, test, docs, and packaging jobs.
pull-requests: read is required for PR metadata lookup jobs.
pages: write and id-token: write should be limited to Pages deployment jobs and any caller that invokes them through a reusable workflow.
For reusable workflows, the caller must grant every permission the called jobs require; the callee cannot elevate beyond what the caller provides.
Prefer astral-sh/setup-uv cache support with cache-dependency-glob anchored to uv.lock.
Prefer Swatinem/rust-cache with explicit shared-key and workspaces instead of ad hoc target-directory caching.
Avoid caching generated outputs that can hide stale behavior unless the repo already relies on them deliberately.

Keep CI workflow commands and package references in GitHub Actions workflows aligned with the current install, build, and example commands.

Files:

• .github/workflows/ci_rust.yml

{justfile,codecov.yml,codecov.yaml,.github/workflows/**/*.yml,.github/workflows/**/*.yaml}

📄 CodeRabbit inference engine (.agents/skills/maintain-dynamic-plugins/SKILL.md)

justfile, Codecov, and CI package/test workflows must include new plugin crates and packages.

Files:

• .github/workflows/ci_rust.yml

{.github/**,.gitlab-ci.yml,.pre-commit-config.yaml,justfile,scripts/**}

⚙️ CodeRabbit configuration file

{.github/**,.gitlab-ci.yml,.pre-commit-config.yaml,justfile,scripts/**}: Review automation changes for reproducibility, pinned versions where appropriate, secret handling, and consistency with the documented validation matrix.
Pay attention to commands that need generated native artifacts, FFI libraries, or platform-specific environment variables.

Files:

• .github/workflows/ci_rust.yml

🧠 Learnings (1)

📚 Learning: 2026-05-03T04:23:07.497Z

Learnt from: willkill07
Repo: NVIDIA/NeMo-Flow PR: 46
File: .github/workflows/ci_rust.yml:31-64
Timestamp: 2026-05-03T04:23:07.497Z
Learning: In GitHub Actions workflow YAML, it’s valid to conditionally disable a service container by setting the service container’s `image` to an empty string (`''`) via a matrix variable (e.g., `redis_service_image: ''`). This intentionally makes the runner skip service initialization for that matrix entry rather than failing the job. When reviewing workflows, don’t flag this as an error if the workflow uses an empty `image` to disable the service on specific matrix entries (e.g., OS-specific setups); verify the `image` is sourced from the matrix variable and that the service is only expected to be available when a non-empty image is provided.

Applied to files:

• .github/workflows/ci_rust.yml

🔇 Additional comments (4)

.github/workflows/ci_rust.yml (4)

325-335: LGTM!

---

371-371: LGTM!

---

400-405: LGTM!

---

416-428: LGTM!

[willkill07]

/merge