Add stable HF PyPI release dispatch

[charlesbluca]

Description

Adds a stable release mode to the Hugging Face package workflow so maintainers can manually dispatch an OCR v2 PyPI release without producing a 2.0.0.dev* version.

• Adds package, release_type, and release_version workflow dispatch inputs.
• Requires stable releases to select a single package and provide an exact version.
• Teaches ci/scripts/nightly_build_publish.py to patch exact stable versions via --release-version.
• Keeps nightly behavior unchanged and adds focused tests for the release-version path.

Dry-run workflow dispatch with upload_to=none: https://github.com/NVIDIA/NeMo-Retriever/actions/runs/26187815548

Checklist

• I am familiar with the Contributing Guidelines.
• New or existing tests cover these changes.
• The documentation is up to date with these changes.
• If adjusting docker-compose.yaml environment variables have you ensured those are mimicked in the Helm values.yaml file.

[greptile-apps]

Greptile Summary

This PR extends the Hugging Face nightly workflow with a stable release mode that lets maintainers manually dispatch an exact-versioned PyPI release for OCR v2, without generating a .dev* suffix. The Python build script gains a --release-version argument backed by _pep440_stable_release (regex-validated) and a _target_version helper that dispatches between nightly and stable paths.

• New package, release_type, and release_version workflow dispatch inputs are validated in nightly_coordinate before any build job runs; per-job if: conditions skip irrelevant matrix legs when a single package is selected.
• _patch_pyproject_version / _patch_setup_cfg_version accept an optional release_version kwarg; the inline Python post-build verifier switches from a startswith prefix check to an exact equality check for stable releases.
• The new test file covers happy paths for both config formats, parametrized rejection of invalid version strings, and the mutual-exclusivity guard — all with the required SPDX header.

Confidence Score: 5/5

Safe to merge — changes are additive, nightly behavior is unchanged, user-controlled dispatch inputs are correctly routed through environment variables rather than direct shell interpolation, and validation gates in nightly_coordinate prevent misconfigured stable releases from reaching the build jobs.

The stable-release path is entirely new and isolated from the existing nightly path. The mutual-exclusivity guard, version-regex validation, and job-level if: filters all behave correctly. The inline post-build verifier properly switches to exact-match semantics for stable releases. Tests cover the happy paths and the main error paths. No logic defects were found in the changed code.

No files require special attention beyond the pre-existing third-party action pinning concern already flagged in the previous review round.

Important Files Changed

Filename	Overview
.github/workflows/huggingface-nightly.yml	Adds package, release_type, and release_version dispatch inputs; adds validation in nightly_coordinate; adds per-job if: guards; passes stable release args to the OCR CUDA build step via env vars — secure pattern. Third-party actions still on mutable version tags (pre-existing, already flagged).
ci/scripts/nightly_build_publish.py	Adds _pep440_stable_release, _target_version helpers and --release-version CLI arg; updates _patch_pyproject_version and _patch_setup_cfg_version to accept the new parameter; correctly uses is not None for the version-mode label and in the target-version dispatch.
ci/tests/test_huggingface_release_workflow.py	New test file with SPDX header; covers happy paths for both pyproject.toml and setup.cfg patching, parametrized error-path tests for invalid version strings, mutual-exclusivity rejection, and a YAML content smoke-test.
.gitignore	Adds .worktrees/ to the ignore list for local git worktrees.

Flowchart

%%{init: {'theme': 'neutral'}}%%
flowchart TD
    A[workflow_dispatch trigger] --> B{nightly_coordinate validation}
    B -->|release_type=stable AND release_version empty| ERR1[exit 1: release_version required]
    B -->|release_type=stable AND package=all| ERR2[exit 1: must select single package]
    B -->|release_type=nightly AND release_version set| ERR3[exit 1: release_version only valid for stable]
    B -->|valid| C{package input}
    C -->|package=all or schedule| D[build job - non-OCR packages nightly only]
    C -->|package=all or nemotron-ocr-v2 or schedule| E[build_ocr_cuda job]
    E --> F{release_type?}
    F -->|nightly| G[version_args = --nightly-base-version expected_version = base.dev*]
    F -->|stable| H[version_args = --release-version INPUT_RELEASE_VERSION expected_version = INPUT_RELEASE_VERSION]
    G --> I[nightly_build_publish.py _patch_pyproject_version / _patch_setup_cfg_version -> _pep440_nightly]
    H --> J[nightly_build_publish.py _patch_pyproject_version / _patch_setup_cfg_version -> _pep440_stable_release validates regex]
    I --> K[Build wheel & verify metadata_version.startswith expected]
    J --> L[Build wheel & verify metadata_version == expected exact match]

Loading

_{Reviews (2): Last reviewed commit: "Add stable HF PyPI release dispatch" | Re-trigger Greptile}