Allow to configure assets, packages and updates from CUDA-Q repo

.github/workflows/ci.yml

@@ -31,6 +31,7 @@ jobs:
     runs-on: ubuntu-latest
     permissions:
       pull-requests: read
+      contents: read
 
     outputs:
       pull_request_number: ${{ steps.pr_info.outputs.pr_number }}

.github/workflows/codeql.yml

@@ -16,6 +16,9 @@ on:
       - 'releases/*'
       - 'experimental/*'
       - 'features/*'
+  merge_group:
+    types: 
+      - checks_requested
   schedule:
     - cron: '37 9 * * 2'
 

.github/workflows/command_dispatch.yml

@@ -39,6 +39,7 @@ jobs:
     name: Dispatch slash commands
     needs: preprocessing
     runs-on: ubuntu-latest
+
     steps:
       - name: Checkout repository
         uses: actions/checkout@v4

.github/workflows/dev_environment.yml

@@ -134,7 +134,7 @@ jobs:
           build_target=${{ inputs.build_target }}
           image_id=`basename ${{ inputs.dockerfile }} .Dockerfile`${build_target:+.$build_target}
           image_title=cuda-quantum-`echo $image_id | cut -d "." -f 1`
-          image_name=$registry/${repo_owner,,}/$image_title
+          image_name=$registry/${repo_owner,,}/${{ vars.packages_prefix }}$image_title
           toolchain=${{ inputs.toolchain }}
           tag_prefix=`echo $image_id | cut -s -d "." -f 2- | xargs -I "%" echo %. | tr . -`${platform_tag:+$platform_tag-}${toolchain:+$toolchain-}
           tag_suffix=""
@@ -236,7 +236,7 @@ jobs:
         id: cache
         run: |
           toolchain=${{ inputs.toolchain }}
-          registry_cache=ghcr.io/${{ needs.metadata.outputs.owner }}/buildcache-cuda-quantum
+          registry_cache=ghcr.io/${{ needs.metadata.outputs.owner }}/${{ vars.packages_prefix }}buildcache-cuda-quantum
           nvidia_registry_cache=ghcr.io/nvidia/buildcache-cuda-quantum
           registry_cache_base=$(echo ${{ inputs.registry_cache_from || github.event.pull_request.base.ref || 'main' }} | tr / -)
           cache_id=$(echo ${{ needs.metadata.outputs.image_id }}${toolchain:+-$toolchain} | tr . -)
@@ -385,7 +385,7 @@ jobs:
             # - https://stackoverflow.com/questions/61366738/how-are-the-docker-image-layer-ids-derived/69688979#69688979
             # - https://github.com/docker/cli/issues/3350.
 
-            remote_image=ghcr.io/${{ needs.metadata.outputs.owner }}/${{ needs.metadata.outputs.image_title }}
+            remote_image=ghcr.io/${{ needs.metadata.outputs.owner }}/${{ vars.packages_prefix }}${{ needs.metadata.outputs.image_title }}
             remote_tag=${{ needs.metadata.outputs.tag_prefix }}${{ steps.cache.outputs.registry_cache_base }}${{ needs.metadata.outputs.tag_suffix }}
             echo "Trying to pull remote tag $remote_image:$remote_tag."
             docker pull $remote_image:$remote_tag || true

.github/workflows/docker_images.yml

@@ -118,7 +118,7 @@ jobs:
         run: |
           repo_owner=${{ github.repository_owner }}
           registry=${{ vars.registry || 'localhost:5000' }}
-          image_name=$registry/${repo_owner,,}/open-mpi
+          image_name=$registry/${repo_owner,,}/${{ vars.packages_prefix }}open-mpi
           echo "image_name=$image_name" >> $GITHUB_OUTPUT
 
           docker pull ${{ inputs.ompidev_image }} # to get the tag
@@ -270,7 +270,7 @@ jobs:
 
           repo_owner=${{ github.repository_owner }}
           registry=${{ vars.registry || 'localhost:5000' }}
-          image_name=$registry/${repo_owner,,}/cuda-quantum-dev
+          image_name=$registry/${repo_owner,,}/${{ vars.packages_prefix }}cuda-quantum-dev
           image_tag=`docker inspect $base_image --format='{{json .Config.Labels}}' | jq -r '."org.opencontainers.image.version"'`
           docker image rm $base_image
           docker image prune --force
@@ -457,8 +457,8 @@ jobs:
           repo_owner=${{ github.repository_owner }}
           registry=${{ vars.registry || 'localhost:5000' }}/${repo_owner,,}
           ngc_registry=`${{ needs.metadata.outputs.push_to_ngc == 'true' }} && echo nvcr.io/${repo_owner,,}/nightly || echo ''`
-          dev_image_name=${registry}/cuda-quantum-dev
-          image_name=${ngc_registry:-$registry}/cuda-quantum
+          dev_image_name=${registry}/${{ vars.packages_prefix }}cuda-quantum-dev
+          image_name=${ngc_registry:-$registry}/${{ vars.packages_prefix }}cuda-quantum
           image_description="CUDA Quantum toolkit for heterogeneous quantum-classical workflows"
 
           platform_tag=${{ needs.metadata.outputs.platform_tag }}
@@ -819,7 +819,8 @@ jobs:
     # all jobs that depend on it will need to add the same condition.
     if: always() && !cancelled() && inputs.environment && needs.metadata.outputs.platform_tag == '' && !contains(needs.*.result, 'failure') && !contains(needs.*.result, 'cancelled')
     runs-on: ubuntu-latest
-    permissions: {}
+    permissions: 
+      contents: read
 
     steps:
       - name: Checkout repository

.github/workflows/gh_registry.yml

@@ -178,7 +178,7 @@ jobs:
       - name: Delete old images
         uses: actions/delete-package-versions@v4
         with: 
-          package-name: ${{ matrix.package_name }}
+          package-name: ${{ vars.packages_prefix }}${{ matrix.package_name }}
           package-type: 'container'
           min-versions-to-keep: ${{ fromJson(needs.ghcr_config.outputs.internal_images)[format('{0}', matrix.package_name)].nr_tags_to_keep }}
         continue-on-error: true

.github/workflows/integration_tests.yml

@@ -110,9 +110,14 @@ jobs:
   build_nvqc_image:
     name: Build NVQC deployment image
     runs-on: ubuntu-latest
+    if: (inputs.target == 'nvqc' || github.event_name == 'schedule' || inputs.target == 'nightly')
     needs: [setup, metadata]
+    permissions:
+      contents: read
+      packages: write
+
     environment: ghcr-deployment
-    if: (inputs.target == 'nvqc' || github.event_name == 'schedule' || inputs.target == 'nightly')
+
     steps:
       - name: Checkout repository
         uses: actions/checkout@v4
@@ -152,7 +157,7 @@ jobs:
           file: ./docker/release/cudaq.nvqc.Dockerfile
           build-args: |
             base_image=${{ needs.setup.outputs.cudaq_nvqc_deploy_image }}
-          tags: nvcr.io/${{ env.NGC_QUANTUM_ORG }}/${{ env.NGC_QUANTUM_TEAM }}/cuda-quantum:nightly
+          tags: nvcr.io/${{ env.NGC_QUANTUM_ORG }}/${{ env.NGC_QUANTUM_TEAM }}/${{ vars.packages_prefix }}cuda-quantum:nightly
           platforms: linux/amd64
           provenance: false
           push: true
@@ -162,7 +167,12 @@ jobs:
     runs-on: ubuntu-latest
     needs: [metadata, build_nvqc_image]
     if: (inputs.target == 'nvqc' || github.event_name == 'schedule' || inputs.target == 'nightly')
+    permissions:
+      contents: read
+
+    # Must have environment protection
     environment: ghcr-deployment
+
     outputs:
       nvqc_function_version_id: ${{ steps.deploy.outputs.nvqc_function_version_id }}
 
@@ -227,6 +237,11 @@ jobs:
     name: Integration test with hardware providers
     runs-on: ubuntu-latest
     needs: [setup, metadata]
+    permissions:
+      contents: read
+      packages: read
+
+    # Must have environment protection
     environment: backend-validation
     container:
       image: ${{ needs.setup.outputs.cudaq_test_image }}
@@ -603,6 +618,11 @@ jobs:
     runs-on: ubuntu-latest
     if: (inputs.target == 'nvqc' || github.event_name == 'schedule' || inputs.target == 'nightly')
     needs: [setup, metadata, build_nvqc_image, deploy_nvqc_test_function]
+    permissions:
+      contents: read
+      packages: read
+
+    # Must have environment protection
     environment: ghcr-deployment
     container:
       image: ${{ needs.setup.outputs.cudaq_test_image }}
@@ -760,9 +780,13 @@ jobs:
   nvqc_integration_wheel_test:
     name: NVQC integration test using Python wheels
     runs-on: ubuntu-latest
+    if: inputs.target == 'nvqc' || github.event_name == 'schedule' || inputs.target == 'nightly'
     needs: [metadata, build_nvqc_image, deploy_nvqc_test_function]
+    permissions:
+      contents: read
+
+    # Must have environment protection
     environment: ghcr-deployment
-    if: inputs.target == 'nvqc' || github.event_name == 'schedule' || inputs.target == 'nightly'
 
     steps:
       - name: Get code
@@ -874,9 +898,14 @@ jobs:
   cleanup_nvqc_resources:
     name: Cleanup NVQC resources
     runs-on: ubuntu-latest
-    needs: [build_nvqc_image, deploy_nvqc_test_function, nvqc_integration_docker_test, nvqc_integration_wheel_test]
     if: (success() || failure()) && (inputs.target == 'nvqc' || github.event_name == 'schedule' || inputs.target == 'nightly')
+    needs: [build_nvqc_image, deploy_nvqc_test_function, nvqc_integration_docker_test, nvqc_integration_wheel_test]
+    permissions:
+      contents: read
+
+    # Must have environment protection
     environment: ghcr-deployment
+
     steps:
       - name: Get code
         uses: actions/checkout@v4

.github/workflows/nvqc_regression_tests.yml

@@ -1,7 +1,6 @@
 name: Nvqc regression tests
 
 concurrency:
-  # only one integration tests workflow to be run at a time, since it involves pushing/cleaning up a test image (same tag).
   group: ${{ github.workflow }}${{ github.event.workflow_run.name }}
   cancel-in-progress: false
 
@@ -44,8 +43,11 @@ jobs:
   setup:
     name: Set variables
     runs-on: ubuntu-latest
+    permissions: {}
+
     outputs:
       cudaq_test_image: ${{ steps.vars.outputs.cudaq_test_image }}
+
     steps:
       - name: Set variables
         id: vars
@@ -56,12 +58,18 @@ jobs:
     name: Retrieve commit info
     runs-on: ubuntu-latest
     needs: setup
+    permissions:
+      contents: read
+      packages: read
+
     environment: backend-validation
     container:
       image: ${{ needs.setup.outputs.cudaq_test_image }}
       options: --user root
+
     outputs:
       cudaq_commit: ${{ steps.commit-sha.outputs.sha }}
+
     steps:
       - name: Get commit SHA
         id: commit-sha
@@ -76,6 +84,11 @@ jobs:
     name: NVQC integration test using Docker image
     runs-on: ubuntu-latest
     needs: [setup, metadata]
+    permissions:
+      contents: read
+      packages: read
+
+    # Must have environment protection
     environment: backend-validation
     container:
       image: ${{ needs.setup.outputs.cudaq_test_image }}
@@ -231,6 +244,10 @@ jobs:
     name: NVQC integration test using Python wheels
     runs-on: ubuntu-latest
     needs: [metadata]
+    permissions:
+      contents: read
+
+    # Must have environment protection
     environment: backend-validation
 
     steps:

.github/workflows/prebuilt_binaries.yml

@@ -84,7 +84,7 @@ jobs:
 
           repo_owner=${{ github.repository_owner }}
           registry=${{ vars.registry || 'localhost:5000' }}
-          image_name=$registry/${repo_owner,,}/cuda-quantum-assets
+          image_name=$registry/${repo_owner,,}/${{ vars.packages_prefix }}cuda-quantum-assets
           tag_prefix=$platform_tag-${{ inputs.toolchain }}-
 
           if ${{ github.event.pull_request.merged == true }}; then
@@ -473,7 +473,8 @@ jobs:
     needs: [build_installer, build_openmpi, validation]
     if: inputs.environment
     runs-on: ubuntu-latest
-    permissions: {}
+    permissions:
+      contents: read
 
     steps:
       - name: Checkout repository