ci(rest): Parallelize REST PR CI jobs reduce overall runtime

[thossain-nv]

REST CI runs ~14m. Mostly waiting as the Docker images and Go binaries are gated behind the test jobs even though they take less time to build than the tests take to run. This PR unblocks them and moves two trivial jobs off the self-hosted pool, bringing the pipeline to the ~7m range.

Related issues

#4572

Type of Change

• Internal - Internal changes (refactoring, tests, docs, etc.)

Breaking Changes

• This PR contains breaking changes

Testing

• No testing required (docs, internal refactor, etc.)

Additional Notes

• Pull request image builds no longer receive the registry secrets, every step that consumed them is already gated on push_enabled (hard-coded false)
• PR with failing tests can waste image builds that get discarded. But total self-hosted demand is unchanged and compressed into a narrower window, so we need to check REST CI time after merge

[coderabbitai]

Summary by CodeRabbit

• CI/CD Improvements
  • Pull requests now receive dedicated Docker image build validation without publishing images or requiring deployment credentials.
  • Required checks now include pull-request image builds, improving confidence before merging.
  • Build and summary tasks use consistent hosted runners for more reliable execution.
  • Docker publishing remains limited to appropriate non-pull-request workflows.
  • Build metadata preparation now uses complete repository history for more dependable version information.

Walkthrough

The CI workflows now use hosted runners for selected jobs, separate Docker publishing from pull-request image builds, include the pull-request build in required checks, and avoid recursive submodule checkout.

Changes

CI workflow updates

Layer / File(s)	Summary
Checkout and build execution .github/workflows/rest-prepare-build-info.yml, .github/workflows/rest-ci.yml, .github/workflows/rest-build-push-docker.yml	The preparation checkout keeps full history without submodules. Binary builds and summary generation use ubuntu-latest. The binary build no longer waits for lint-and-test.
Docker job routing and required checks .github/workflows/rest-ci.yml	Push-based Docker builds exclude pull-request refs. Pull requests use build-and-push-pr with pushing disabled and no secrets. The aggregator requires the pull-request build job and documents the mutually exclusive Docker jobs.

Estimated code review effort: 3 (Moderate) | ~20 minutes

Possibly related PRs

• NVIDIA/infra-controller#4596: Modifies REST CI workflows, including the build-summary job.
• NVIDIA/infra-controller#4618: Modifies the same build-binaries orchestration and preparation workflow integration.

Suggested labels: rest-api

Sequence Diagram(s)

sequenceDiagram
  participant prepare
  participant build_and_push
  participant build_and_push_pr
  participant rest_ci_pass
  prepare->>build_and_push: Provide preparation outputs
  prepare->>build_and_push_pr: Provide preparation outputs
  alt Non-pull-request ref
    build_and_push->>rest_ci_pass: Report publishing job result
  else Pull-request ref
    build_and_push_pr->>rest_ci_pass: Report non-publishing build result
  end

Loading

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Title check	✅ Passed	The title clearly describes parallelizing REST CI jobs to reduce runtime, which matches the main changeset.
Description check	✅ Passed	The description explains the CI parallelization, runtime reduction, self-hosted runner changes, and Docker image build behavior.

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests

---

_{Comment @coderabbitai help to get the list of available commands.}

[github-actions]

🔐 TruffleHog Secret Scan

✅ No secrets or credentials found!

Your code has been scanned for 700+ types of secrets and credentials. All clear! 🎉

🔗 View scan details

_{🕐 Last updated: 2026-08-05 21:37:34 UTC | Commit: 5eeb68a}

[coderabbitai]

Actionable comments posted: 1

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In @.github/workflows/rest-ci.yml:
- Around line 182-186: Restrict the build-and-push-pr job permissions to only
contents: read, removing packages: write, pull-requests: write, and
security-events: write because the PR path has push_enabled disabled.

🪄 Autofix

Fix all unresolved CodeRabbit comments on this PR:

• Push a commit to this branch (recommended)
• Create a new PR with the fixes

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Enterprise

Run ID: 81f0a56f-995e-4040-8e4e-7669c8eb2ceb

📥 Commits

Reviewing files that changed from the base of the PR and between 045a4cf and 5eeb68a.

📒 Files selected for processing (3)

• .github/workflows/rest-build-push-docker.yml
• .github/workflows/rest-ci.yml
• .github/workflows/rest-prepare-build-info.yml

[nv-dmendoza]

LGTM, speeds up the CI

[coderabbitai]

Note

GitHub couldn't provide a complete incremental comparison for this pull request, so CodeRabbit is performing a full review instead. This review may take a little longer.

[github-actions]

🌿 Preview your docs: https://nvidia-preview-pull-request-4629.docs.buildwithfern.com/infra-controller