[None][infra] Fix node list query failing on tcsh login nodes#15623
[None][infra] Fix node list query failing on tcsh login nodes#15623yiqingy0 wants to merge 1 commit into
Conversation
Signed-off-by: yiqingy <yiqingy@tensorrt-llm-infra-debug-vm-01.nvidia.com>
|
/bot run --stage-list "DGX_H100-PyTorch-1" |
|
PR_Github #55753 [ run ] triggered by Bot. Commit: |
📝 WalkthroughWalkthroughThe PR updates two remote SLURM ChangesSLURM NodeList command quoting
Estimated code review effort🎯 1 (Trivial) | ⏱️ ~2 minutes 🚥 Pre-merge checks | ✅ 4 | ❌ 1❌ Failed checks (1 warning)
✅ Passed checks (4 passed)
✏️ Tip: You can configure your own custom pre-merge checks in the settings. ✨ Finishing Touches🧪 Generate unit tests (beta)
Comment |
There was a problem hiding this comment.
Caution
Some comments are outside the diff and can’t be posted inline due to platform limitations.
⚠️ Outside diff range comments (1)
jenkins/L0_Test.groovy (1)
2133-2143: 🔒 Security & Privacy | 🔴 Critical | ⚡ Quick winValidate
capturedJobIDbefore shell interpolation to prevent command injection.
capturedJobIDis interpolated into remote shell commands without a numeric guard. Ifslurm_job_id.txtis tampered, this can execute arbitrary shell on the login node.Suggested fix
def captureSlurmJobNodeList(def pipeline, SlurmCluster cluster, String clusterName, String slurmJobID, Map placementContext, String stageName, String jobWorkspace=null) { @@ - if (!capturedJobID) { + if (!capturedJobID) { return } + if (!(capturedJobID.toString() ==~ /\d+/)) { + echo "[INFRA-RETRY] ${stageName}: invalid SLURM job id '${capturedJobID}', skipping node-list capture" + return + }🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@jenkins/L0_Test.groovy` around lines 2133 - 2143, The remote Slurm lookup in the job-node discovery logic interpolates capturedJobID directly into Utils.sshUserCmd/Utils.exec shell commands, so validate that value is strictly numeric before building the sacct and scontrol commands. Add a guard in the same flow that reads capturedJobID and only proceed when it matches an expected job-id format; otherwise fail fast or skip lookup. Keep the fix local to the node resolution block that uses capturedJobID so the shell interpolation remains safe.
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Outside diff comments:
In `@jenkins/L0_Test.groovy`:
- Around line 2133-2143: The remote Slurm lookup in the job-node discovery logic
interpolates capturedJobID directly into Utils.sshUserCmd/Utils.exec shell
commands, so validate that value is strictly numeric before building the sacct
and scontrol commands. Add a guard in the same flow that reads capturedJobID and
only proceed when it matches an expected job-id format; otherwise fail fast or
skip lookup. Keep the fix local to the node resolution block that uses
capturedJobID so the shell interpolation remains safe.
ℹ️ Review info
⚙️ Run configuration
Configuration used: Path: .coderabbit.yaml
Review profile: CHILL
Plan: Enterprise
Run ID: 685eadf3-5e6a-4a50-83fc-f33c46baa6ce
📒 Files selected for processing (1)
jenkins/L0_Test.groovy
|
PR_Github #55753 [ run ] completed with state |
|
/bot reuse-pipeline |
|
PR_Github #55798 [ reuse-pipeline ] triggered by Bot. Commit: |
Summary by CodeRabbit
Description
Test Coverage
PR Checklist
Please review the following before submitting your PR:
PR description clearly explains what and why. If using CodeRabbit's summary, please make sure it makes sense.
PR Follows TRT-LLM CODING GUIDELINES to the best of your knowledge.
Test cases are provided for new code paths (see test instructions)
If PR introduces API changes, an appropriate PR label is added - either
api-compatibleorapi-breaking. Forapi-breaking, includeBREAKINGin the PR title.Any new dependencies have been scanned for license and vulnerabilities
CODEOWNERS updated if ownership changes
Documentation updated as needed
Update tava architecture diagram if there is a significant design change in PR.
The reviewers assigned automatically/manually are appropriate for the PR.
Please check this after reviewing the above items as appropriate for this PR.
GitHub Bot Help
To see a list of available CI bot commands, please comment
/bot help.