ci: cache the embed model for the k8s smoke tests

[crookedstorm]

Down loading the qdrant/all-MiniLM model for every PR is causing 429s. Using the cache makes sense for this, and it likely needs exactly one cache, period, not something that is keyed to a particular PR or commit.

Summary by CodeRabbit

• Chores
  • Improved the Docker CPU smoke build pipeline by introducing FastEmbed model snapshot caching with automatic restore on cache hit and save on cache miss.
  • Reduced build times by preloading a shared cache and only downloading the ONNX model when it’s not already present.
  • Simplified the build/publish flow by separating image loading vs pushing based on the publish setting, and avoiding token wiring in those steps.
  • Removed the Hugging Face token from the local kind CPU smoke setup.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Enterprise

Run ID: a3d909dd-d0c0-4a92-9f63-628b492a113d

📥 Commits

Reviewing files that changed from the base of the PR and between e49041f and 426ce5c.

📒 Files selected for processing (1)

• .github/workflows/ci.yaml

🚧 Files skipped from review as they are similar to previous changes (1)

• .github/workflows/ci.yaml

---

📝 Walkthrough

Walkthrough

Replaces HF_TOKEN secret injection in the CPU smoke Docker build with a GitHub Actions-managed FastEmbed model cache. The cache is restored before the build, populated on miss via hf download, passed to Docker as a build context, and saved afterward. The Dockerfile copies from the context and skips downloading when the snapshot already exists.

Changes

FastEmbed Cache Integration

Layer / File(s)	Summary
Docker build contract docker-bake.hcl, docker/Dockerfile.nmp-api	FASTEMBED_CACHE_CONTEXT variable added and wired into nmp-api-docker contexts; maybe_hf_token_secret function and secret stanza removed. Dockerfile copies from fastembed-cache context and conditionally skips snapshot_download when the model directory exists.
CI cache lifecycle .github/workflows/ci.yaml	Defines fastembed_cache_dir, exports FastEmbed env vars to bake, adds steps to prepare/restore/populate/verify the model cache. Separates Docker load/push steps, removes HF_TOKEN from both the docker publish path and the Kind smoke job setup. Saves cache post-build.

Possibly related PRs

• NVIDIA-NeMo/nemo-platform#345: Modifies the same CPU smoke CI path in .github/workflows/ci.yaml, including the image build and kind-based smoke job steps.

Suggested reviewers

• matthewgrossman
• svvarom
• a2bondar
• philipmattingly

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title accurately summarizes the main change: implementing caching for the embed model used in k8s smoke tests, which is the core purpose of the PR.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

_{✏️ Tip: You can configure your own custom pre-merge checks in the settings.}

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch cache-hf-embed-model/crookedstorm

---

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

[coderabbitai]

Actionable comments posted: 1

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In @.github/workflows/ci.yaml:
- Around line 251-260: The cache save condition in the "Save fastembed model
cache" step is too restrictive by excluding pull_request events, which prevents
cache persistence on PRs and causes repeated re-downloads. Update the event_name
check in the if condition to also include pull_request events alongside push and
workflow_dispatch events, allowing the cache to be saved during PR runs when
there is a cache miss. Additionally, ensure you have Write permissions before
editing files in folders starting with a dot like .github/workflows/.

🪄 Autofix (Beta)

Fix all unresolved CodeRabbit comments on this PR:

• Push a commit to this branch (recommended)
• Create a new PR with the fixes

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Enterprise

Run ID: 2c92544a-ee0b-475c-bb73-ac42fc29589a

📥 Commits

Reviewing files that changed from the base of the PR and between c48f52c and c07f614.

📒 Files selected for processing (3)

• .github/workflows/ci.yaml
• docker-bake.hcl
• docker/Dockerfile.nmp-api

[github-actions]

Suite	Lines Covered	Line Rate	Branch Rate
Unit Tests	20036/26510	75.6%	60.9%
Integration Tests	11692/25282	46.2%	19.8%