refactor: verify wheel installs in container

Signed-off-by: Aaron Gonzales <aagonzales@nvidia.com>

Author: binaryaaron

.dockerignore

@@ -24,7 +24,8 @@ __pycache__/
 .venv/
 
 # Build artifacts
-dist/
+dist/*
+!dist/*.whl
 htmlcov/
 coverage.json
 coverage.xml

.github/actions/detect-changes/action.yml

@@ -85,5 +85,6 @@ runs:
             - '.github/actions/**'
             - '.mise.toml'
             - '.mise/tasks/**'
+            - '.dockerignore'
+            - 'containers/Dockerfile.test_ci'
             - 'tools/release_version.py'
-            - 'tools/verify_wheel_install.py'

.github/workflows/ci-checks.yml

@@ -152,7 +152,7 @@ jobs:
         run: mise run build-wheel
 
       - name: Verify clean end-user wheel install
-        run: mise run release:verify-wheel -- dist/*.whl
+        run: mise run release:verify-wheel
 
   unit-test:
     name: Unit Tests

.github/workflows/release.yml

@@ -69,7 +69,7 @@ jobs:
           echo "Built: $WHEEL (version $VERSION)"
 
       - name: Verify clean end-user wheel install
-        run: mise run release:verify-wheel -- dist/*.whl
+        run: mise run release:verify-wheel
 
       - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7
         with:

.mise/tasks/release/verify-wheel

@@ -7,21 +7,19 @@ set -euo pipefail
 source "${MISE_CONFIG_ROOT}/.mise/tasks/_lib.sh"
 
 tool_root="${MISE_CONFIG_ROOT:-$(git rev-parse --show-toplevel)}"
-python_version="$(resolve_python_version)"
+container_cmd="$(resolve_container_cmd)"
 
-if (( $# > 0 )); then
-  wheel="$1"
-  shift
-else
-  shopt -s nullglob
-  wheels=("${tool_root}"/dist/*.whl)
-  if (( ${#wheels[@]} != 1 )); then
-    echo "Error: expected exactly one wheel under ${tool_root}/dist, found ${#wheels[@]}" >&2
-    exit 1
-  fi
-  wheel="${wheels[0]}"
+shopt -s nullglob
+wheels=("${tool_root}"/dist/*.whl)
+if (( ${#wheels[@]} != 1 )); then
+  echo "Error: expected exactly one wheel under ${tool_root}/dist, found ${#wheels[@]}" >&2
+  exit 1
 fi
 
-uv --no-config run --no-project --python "${python_version}" \
-  "${tool_root}/tools/verify_wheel_install.py" \
-  "${wheel}" --python "${python_version}" "$@"
+"${container_cmd}" build \
+  --platform "${CONTAINER_TEST_PLATFORM:-linux/amd64}" \
+  --progress=plain \
+  --file "${CONTAINER_TEST_FILE:-containers/Dockerfile.test_ci}" \
+  --target wheel-install \
+  --tag "${CONTAINER_WHEEL_INSTALL_IMAGE:-nss-wheel-install:latest}" \
+  "${tool_root}"

containers/Dockerfile.test_ci

@@ -24,6 +24,41 @@ RUN MISE_GPG_KEY=24853EC9F655CE80B48E6C3A8B81C9D17413A06D \
     MISE_YES=1 mise trust && \
     PYTHON_VERSION="${PYTHON_VERSION}" MISE_YES=1 mise run setup
 
+FROM setup AS wheel-install
+
+ENV UV_LINK_MODE=copy
+
+COPY dist/*.whl /tmp/dist/
+
+RUN --mount=type=cache,target=/root/.cache/uv \
+    wheel_count="$(find /tmp/dist -maxdepth 1 -type f -name '*.whl' | wc -l)" && \
+    test "${wheel_count}" -eq 1 && \
+    wheel="$(find /tmp/dist -maxdepth 1 -type f -name '*.whl')" && \
+    uv --no-config venv --clear --python /usr/local/bin/python /opt/wheel-cpu && \
+    uv --no-config pip install \
+        --python /opt/wheel-cpu/bin/python \
+        --no-sources \
+        --default-index https://pypi.org/simple \
+        --index https://download.pytorch.org/whl/cpu \
+        --index-strategy unsafe-best-match \
+        "nemo-safe-synthesizer[cpu,engine] @ file://${wheel}" && \
+    uv --no-config pip check --python /opt/wheel-cpu/bin/python && \
+    /opt/wheel-cpu/bin/python -c \
+        "from importlib.metadata import version; from nemo_safe_synthesizer.package_info import __version__; assert __version__ == version('nemo-safe-synthesizer')" && \
+    /opt/wheel-cpu/bin/safe-synthesizer --help >/dev/null && \
+    uv --no-config venv --clear --python /usr/local/bin/python /opt/wheel-cu129 && \
+    uv --no-config pip install \
+        --python /opt/wheel-cu129/bin/python \
+        --no-sources \
+        --dry-run \
+        --default-index https://pypi.org/simple \
+        --index https://flashinfer.ai/whl/cu129 \
+        --index https://download.pytorch.org/whl/cu129 \
+        --index https://wheels.vllm.ai/ee0da84ab9e04ac7610e28580af62c365e898389/cu129 \
+        --index-strategy unsafe-best-match \
+        "nemo-safe-synthesizer[cu129,engine] @ file://${wheel}" && \
+    rm -rf /opt/wheel-cpu /opt/wheel-cu129
+
 FROM setup AS install-deps
 # Install Python dependencies (cached until pyproject.toml, uv.lock, or src/ or tests/ change)
 COPY pyproject.toml .

containers/README.md

@@ -123,16 +123,22 @@ before enabling a platform in CI.
 ## CPU Test Image
 
 `Dockerfile.test_ci` provides a CPU-only image for running unit tests locally
-or in CI without a GPU. It uses a two-stage build: `setup` (system packages +
-mise-managed tools) and `install-deps` (Python environment via
-`mise run bootstrap-nss cpu`).
+or in CI without a GPU. Its `setup` stage installs system packages and
+mise-managed tools, while `install-deps` creates the Python environment with
+`mise run bootstrap-nss cpu`. The separate `wheel-install` stage installs the
+built wheel without project sources, runs CPU package and CLI checks, and
+resolves the CUDA dependency set.
 
 ```bash
 # Run CI unit tests in a container
 mise run test:ci-container
 
 # Verify mise-managed tools install correctly (fast -- setup stage only)
 mise run test:tool-install
+
+# Verify the built wheel in a clean container stage
+mise run build-wheel
+mise run release:verify-wheel
 ```
 
 ### CPU Test Mise Tasks
@@ -143,3 +149,4 @@ mise run test:tool-install
 | `container:build:test-setup` | Build only the setup stage (tools, no Python deps) |
 | `test:ci-container` | Build and run CI unit tests |
 | `test:tool-install` | Verify mise-managed tools install correctly (setup stage only) |
+| `release:verify-wheel` | Install and verify the built wheel in the clean wheel stage |