[curnane-lab]

Motivation

Follow-up to #1078. Its unit-test fix left these problems in the CI dependency path, each reproduced locally before the fix:

• A failed flash-attn wheel stays cached for good. ensure_flash_attention.sh built the patched wheel straight into the persistent SPECFORGE_CI_CACHE/flash-attn/<build_key>/wheels/, before installing it or running the ABI check. A wheel that fails the check, or a truncated one left when bdist_wheel is killed by the 30-minute step timeout, is reused by every later run with no rebuild, until someone deletes it on the runner. Reproduced with the existing stubs: after an ABI failure the wheel was still cached and the next run downloaded nothing.
• The sdist is not checksummed. The script downloads the sdist from the URL in PyPI's JSON and patches it without checking the digests.sha256 from the same JSON. uv checked it when it fetched the sdist itself.
• FLASH_ATTENTION_FORCE_BUILD is no longer covered by tests. Before ci: unbreak unit-test with the pinned SGLang toolchain #1078 a test asserted it on the uv command. Now it is only passed to setup.py and nothing checks it. Without it, flash-attn's setup.py downloads a prebuilt wheel built against another torch, and the tests still pass.
• safe.directory grows every run. /github/home persists across jobs on this runner (that is what keeps SPECFORGE_CI_CACHE alive), so git config --global --add appends another identical entry on every unit-test run.

Modifications

• ensure_flash_attention.sh
  • Build into the temporary source directory. Publish to the cache only after the wheel installs and passes check_flash_attention, by copying to a hidden staging file in the cache directory and renaming it atomically.
  • If a cached wheel fails to install or fails the check, delete it so the next run rebuilds.
  • Verify the sdist with sha256sum -c before extracting.
• test.yaml: add the safe.directory entry only when git config --fixed-value --get does not already find it (the container has git 2.43).
• test_ci_dependencies.py
  • The curl stub serves a byte-stable tarball plus its sha256, and its setup.py asserts FLASH_ATTENTION_FORCE_BUILD=TRUE.
  • New cases cover: no wheel cached after a failed ABI check; a cached wheel that fails is dropped and rebuilt; a checksum mismatch stops before any install; trusting the workspace twice leaves one entry.

This branch also tried running unit-test on pull_request: edited so that stacked PRs retargeted to main (#1065, #1066) would be tested, and then reverted it. GitHub does not evaluate a job's name expression when the job is skipped, so every description edit added checks named after the raw expression. Keeping the skipped jobs named unit-test instead would hide the real result and satisfy a required check. Making unit-test a required check in the repository settings covers that case without a workflow change: a retargeted PR with no unit-test run cannot merge until a push triggers one.

Related Issues

Follow-up to #1078.

Accuracy Test

Not applicable. CI scripts and tests only.

Benchmark & Profiling

Not applicable. CI scripts and tests only.

Testing

• python -m unittest tests.test_scripts.test_ci_dependencies: 13 tests pass.
• With the script and workflow reverted to ci: unbreak unit-test with the pinned SGLang toolchain #1078 and the new tests kept, the 4 new cases fail.
• With FLASH_ATTENTION_FORCE_BUILD=TRUE removed from the script, 6 cases fail.
• pre-commit run on the changed files passes.
• unit-test passed on this PR. On the GPU runner, a passing wheel is already cached for the current build_key, so unit-test reuses it and does not exercise the new build path until torch or flash-attn changes.

Checklist

• Format your code according to the Code Formatting with Pre-Commit.
• Add unit tests as outlined in the Running Unit Tests.
• Update documentation / docstrings / example tutorials as needed, according to Writing Documentation.
• Provide throughput / latency benchmark results and accuracy evaluation results as needed, according to Benchmark and Profiling and Accuracy Results.
• For reviewers: If you haven't made any contributions to this PR and are only assisting with merging the main branch, please remove yourself as a co-author when merging the PR.
• Please feel free to join our Slack channel at https://sgl-fru7574.slack.com/archives/C09784E3EN6 to discuss your PR.