fix(ci): update wheel constraints

[ironcommit]

Summary by CodeRabbit

• Chores

  • Updated package versions used by wheel installation smoke tests.
  • Added and refreshed constraints for AI, web framework, monitoring, and SDK packages.
  • Improved Python 3.14 compatibility by capping an incompatible package version.
  • Updated temporary wheel-check environments to Python 3.12.

• Tests

  • Added automated validation to detect differences between generated and committed wheel constraints.
  • Included wheel-constraint validation in the overall CI status checks.

[coderabbitai]

📝 Walkthrough

Walkthrough

The pull request updates wheel dependency pins, adds a litellm compatibility cap, switches constraint compilation to Python 3.12, and adds CI validation for regenerated constraints.

Changes

Wheel constraint maintenance

Layer / File(s)	Summary
Python 3.12 constraint compilation script/compile-wheel-constraints.sh	The script references Python 3.12 artifacts and creates its temporary environment with Python 3.12.
Wheel dependency constraints .github/wheel-constraints/nemo-platform-plugin.txt, .github/wheel-constraints/nemo-platform-services.txt	The files update direct dependency pins, add nemo-fabric-adapters-hermes, and constrain litellm below 1.92 because 1.92.0 lacks a Python 3.14 wheel.
Constraint reproducibility validation .github/workflows/ci.yaml	The new wheel-constraints-lint job regenerates constraints from Python 3.12 wheels and becomes required by ci-status.

Possibly related PRs

• NVIDIA-NeMo/nemo-platform#996: Modifies wheel constraints and litellm compatibility handling.
• NVIDIA-NeMo/nemo-platform#778: Adds a related CI job and updates the shared ci-status dependencies.
• NVIDIA-NeMo/nemo-platform#952: Covers related Python 3.12 wheel-build and CI compatibility changes.

Suggested labels: ci

Suggested reviewers: crookedstorm, svvarom

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly and concisely describes the CI wheel-constraint updates and related validation changes.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

✨ Finishing Touches

📝 Generate docstrings

• Create stacked PR
• Commit on current branch

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch fix-wheel-constraints/rsadler

---

_{Comment @coderabbitai help to get the list of available commands.}

[github-actions]

Suite	Lines Covered	Line Rate	Branch Rate
Unit Tests	29440/37448	78.6%	63.2%
Integration Tests	17380/36166	48.1%	20.5%

[coderabbitai]

Actionable comments posted: 1

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In @.github/workflows/ci.yaml:
- Around line 1249-1250: Update the wheel-constraint generation flow around
script/compile-wheel-constraints.sh so uv pip install resolves against an
immutable package-index snapshot or equivalent deterministic resolver input,
while constraining all required dependencies rather than only litellm. Preserve
the existing git diff --exit-code validation and ensure repeated runs produce
identical .github/wheel-constraints/*.txt output.

🪄 Autofix (Beta)

Fix all unresolved CodeRabbit comments on this PR:

• Push a commit to this branch (recommended)
• Create a new PR with the fixes

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Enterprise

Run ID: c4f78c87-4ca5-4fa4-8af7-d3f5bed1e828

📥 Commits

Reviewing files that changed from the base of the PR and between 9fa225c and 112678f.

📒 Files selected for processing (4)

• .github/wheel-constraints/nemo-platform-plugin.txt
• .github/wheel-constraints/nemo-platform-services.txt
• .github/workflows/ci.yaml
• script/compile-wheel-constraints.sh

🚧 Files skipped from review as they are similar to previous changes (1)

• script/compile-wheel-constraints.sh

[coderabbitai]

🩺 Stability & Availability | 🟠 Major | 🏗️ Heavy lift

🧩 Analysis chain

🏁 Script executed:

#!/usr/bin/env bash
set -euo pipefail
rg -n -C 3 'uv pip install|--constraint|--index|--find-links|--offline|uv\.lock' \
  script/compile-wheel-constraints.sh

Repository: NVIDIA-NeMo/nemo-platform

Length of output: 1180

---

🏁 Script executed:

#!/usr/bin/env bash
set -euo pipefail

printf '%s\n' '--- compile script ---'
cat -n script/compile-wheel-constraints.sh | sed -n '1,180p'

printf '%s\n' '--- workflow context ---'
cat -n .github/workflows/ci.yaml | sed -n '1225,1260p;1960,1985p'

printf '%s\n' '--- resolver and generated-file references ---'
rg -n -C 3 'compile-wheel-constraints|wheel-constraints|LITELLM_CAP|constraints' \
  .github/workflows/ci.yaml script .gitignore pyproject.toml uv.lock 2>/dev/null || true

Repository: NVIDIA-NeMo/nemo-platform

Length of output: 18398

---

🏁 Script executed:

#!/usr/bin/env bash
set -euo pipefail

python3 - <<'PY'
from pathlib import Path
import re

script = Path("script/compile-wheel-constraints.sh").read_text()
install = re.search(
    r"^\s*uv pip install .*$",
    script,
    re.MULTILINE,
)
if not install:
    raise SystemExit("uv pip install command not found")

command = install.group(0)
flags = {
    name: bool(re.search(pattern, command))
    for name, pattern in {
        "--offline": r"\B--offline\b",
        "--index": r"\B--index(?:-url)?\b",
        "--find-links": r"\B--find-links\b",
        "--require-hashes": r"\B--require-hashes\b",
        "--constraint": r"\B--constraint\b",
    }.items()
}
print("resolver command:", command)
print("resolver flags:", flags)
print("uses uv.lock:", bool(re.search(r"\buv\.lock\b", script)))
print("uses mutable package spec:", bool(re.search(r'"[^"]*\[[^"]*\]"', command)))
PY

printf '%s\n' '--- tracked generated constraints ---'
git ls-files .github/wheel-constraints
for file in $(git ls-files .github/wheel-constraints); do
  printf '%s\n' "--- ${file} ---"
  sed -n '1,24p' "$file"
done

Repository: NVIDIA-NeMo/nemo-platform

Length of output: 2196

---

Make wheel-constraint generation deterministic.

uv pip install uses a mutable package index and only constrains litellm. A new compatible release can change .github/wheel-constraints/*.txt, causing git diff --exit-code to fail wheel-constraints-lint on unrelated changes. Use an immutable index snapshot or another deterministic resolver input before relying on this required gate.

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In @.github/workflows/ci.yaml around lines 1249 - 1250, Update the
wheel-constraint generation flow around script/compile-wheel-constraints.sh so
uv pip install resolves against an immutable package-index snapshot or
equivalent deterministic resolver input, while constraining all required
dependencies rather than only litellm. Preserve the existing git diff
--exit-code validation and ensure repeated runs produce identical
.github/wheel-constraints/*.txt output.