[yifeif-nv]

Background

Dev runs for PRs #1558 and #1636 stopped before CPU tests because Docker Hub returned HTTP 429 while resolving the pinned CUDA base. NVIDIA's public NGC registry serves the exact same manifest, architecture manifests, configuration and layer descriptors.

Exit Criteria

• Resolve this existing immutable CUDA reference through NGC in the Dev CPU job.
• Preserve the tested PR's Dockerfile, source snapshot, test command and passing criteria.
• Require no additional registry credential or VM allocation.

Implementation

The CPU job writes a BuildKit source policy that converts only the complete, pinned Docker Hub reference to the NGC reference with the same digest. The policy is supplied through Docker's EXPERIMENTAL_BUILDKIT_SOURCE_POLICY setting; BuildKit is explicitly enabled. No PR file is rewritten and other image references are unaffected.

Validation

• python3 -m pytest -q tools/tests/test_community_ci.py: 257 passed.
• Ruff, actionlint and git diff --check: passed.
• Anonymous manifest reads from both registries returned the same pinned digest and identical linux/amd64 descriptors.
• Real local Docker/BuildKit experiment: denying the original source failed as expected; conversion plus that denial succeeded and resolved the NGC source; the production conversion-only policy also succeeded. The workflow generates the identical tested policy.
• This local experiment was an amd64 FROM build on an ARM64 host. Full hosted CPU and cloud GPU runs remain to be validated after the Dev merge.

Notes For Future Readers

This PR targets ci/developer; it does not update Stable. The source policy deliberately matches one verified immutable reference. A future CUDA pin requires its own mirror verification. See the Docker source policy documentation.

[coderabbitai]

Important

Review skipped

Auto reviews are disabled on base/target branches other than the default branch.

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

• Configuration used: Repository: NVIDIA/TensorRT-Model-Connect/.coderabbit.yaml
• Review profile: CHILL
• Plan: Enterprise
• Run ID: 56a174dd-8e76-44d0-8ab4-b178730c784e

---

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

---

_{Comment @coderabbitai help to get the list of available commands.}