ci: authenticate nightly GHCR polling

[svvarom]

The nightly release run successfully pushed wheels, containers, and the Helm chart, but final artifact polling never got past the first GHCR container. The poll was anonymous because nightly GHCR artifacts were expected to be public; these packages are currently private, so docker manifest inspect received denied and retried as though the artifact had not arrived.

This PR gives only the final polling job packages: read and authenticates Docker and Helm with the repository's built-in GITHUB_TOKEN for nightly runs. Stable container and Helm polling remains anonymous, and no PAT or new secret is introduced.

Human attention needed

• Decision: accept authenticated GHCR availability as the nightly readiness contract while public access is tracked separately in AIREINF-269
• Read carefully: the job-level package permission and the two nightly-only registry logins
• Safe to skim: comment updates describing nightly versus stable access
• Proof: actionlint, act workflow_dispatch --list, and git diff --check pass locally; the failed nightly poll reproduced the anonymous denied response after the container build had pushed successfully
• Biggest risk: each private container package must grant the nemo-platform repository Actions read access; a fresh nightly is still required to prove that package-side configuration end to end

Rollout

Merge this change, then start a fresh nightly from main. Rerunning the existing workflow would reuse its original workflow revision and would not exercise this fix.

Summary by CodeRabbit

• Bug Fixes
  • Improved nightly release readiness checks by authenticating access to container images and Helm charts.
  • Added the required package-read permissions for nightly artifact validation.
  • Preserved existing behavior for stable release checks.

[github-actions]

Suite	Lines Covered	Line Rate	Branch Rate
Unit Tests	23845/31009	76.9%	61.7%
Integration Tests	13817/29658	46.6%	19.6%

[crookedstorm]

I think this covers my PR faster than I could get it up. LGTM

[coderabbitai]

📝 Walkthrough

Walkthrough

Changes

Nightly release authentication

Layer / File(s)	Summary
Polling permissions and registry context .github/workflows/release.yaml	The final release polling job adds packages: read permission and documents stable versus nightly registry access.
Nightly container authentication .github/workflows/release.yaml	Nightly container polling logs into GHCR with GITHUB_TOKEN before checking manifests.
Nightly Helm authentication .github/workflows/release.yaml	Nightly Helm polling logs into GHCR with GHCR_TOKEN; stable polling remains unchanged.

Sequence Diagram(s)

sequenceDiagram
  participant poll-final-release
  participant Docker
  participant Helm
  participant GHCR
  poll-final-release->>Docker: Login to ghcr.io for nightly containers
  Docker->>GHCR: Poll container manifests
  GHCR-->>Docker: Container readiness
  poll-final-release->>Helm: Login to ghcr.io for nightly charts
  Helm->>GHCR: Poll Helm charts
  GHCR-->>Helm: Chart readiness

Loading

Possibly related PRs

• NVIDIA-NeMo/nemo-platform#623: Introduces the related release workflow polling permissions and nightly registry login logic.

Suggested labels: ci

Suggested reviewers: crookedstorm

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly matches the main change: authenticating nightly GHCR polling in CI.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch authenticate-nightly-ghcr-polling/smuley

---

_{Comment @coderabbitai help to get the list of available commands.}

[coderabbitai]

🧹 Nitpick comments (1)

.github/workflows/release.yaml (1)

804-804: 🔒 Security & Privacy | 🔵 Trivial

Confirm GHCR package access is granted to this workflow repository.

If the nightly packages are owned by another repository or use granular permissions, packages: read plus ${{ github.token }} is not sufficient: GitHub limits GITHUB_TOKEN to the workflow repository and requires package-level Actions access. Confirm that access is configured, then run the required fresh nightly from main; otherwise both login steps can still fail with denied. (docs.github.com)

Also applies to: 862-875, 896-904

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In @.github/workflows/release.yaml at line 804, Verify that the GHCR packages
used by the nightly workflow grant Actions access to this workflow repository,
especially when packages are owned elsewhere or use granular permissions.
Configure the package-level repository access as needed, then run a fresh
nightly from main to confirm both GHCR login steps succeed with packages: read
and github.token.

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Nitpick comments:
In @.github/workflows/release.yaml:
- Line 804: Verify that the GHCR packages used by the nightly workflow grant
Actions access to this workflow repository, especially when packages are owned
elsewhere or use granular permissions. Configure the package-level repository
access as needed, then run a fresh nightly from main to confirm both GHCR login
steps succeed with packages: read and github.token.

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Enterprise

Run ID: 0c844024-3b8f-4896-8623-db13e8bcecf8

📥 Commits

Reviewing files that changed from the base of the PR and between 583b46d and b14975a.

📒 Files selected for processing (1)

• .github/workflows/release.yaml