[docker] migrate ROCm installation to use prebuilt deb packages

.github/actions/record-image-versions/action.yml

@@ -0,0 +1,29 @@
+# Copyright Advanced Micro Devices, Inc.
+# SPDX-License-Identifier: MIT
+
+name: Record image versions
+description: Record git HEAD and installed ROCm identity from a Docker image
+
+inputs:
+  image:
+    description: 'Docker image to inspect'
+    required: true
+  output_dir:
+    description: 'Directory for version artifacts'
+    required: false
+    default: 'versions'
+  container_name:
+    description: 'Temporary container name used for docker cp'
+    required: false
+    default: 'core'
+
+runs:
+  using: composite
+  steps:
+    - name: Record repository and ROCm versions
+      shell: bash
+      env:
+        IMAGE: ${{ inputs.image }}
+        OUTPUT_DIR: ${{ inputs.output_dir }}
+        CONTAINER_NAME: ${{ inputs.container_name }}
+      run: ${{ github.action_path }}/scripts/record-versions.sh

.github/actions/record-image-versions/scripts/record-versions.sh

@@ -0,0 +1,90 @@
+#!/usr/bin/env bash
+# Copyright Advanced Micro Devices, Inc.
+# SPDX-License-Identifier: MIT
+
+set -euo pipefail
+
+# Copy ROCm identity out of IMAGE into OUTPUT_DIR using a created container.
+# Expects env vars: IMAGE, OUTPUT_DIR, CONTAINER_NAME
+
+IMAGE="${IMAGE:?IMAGE is required}"
+OUTPUT_DIR="${OUTPUT_DIR:?OUTPUT_DIR is required}"
+CONTAINER_NAME="${CONTAINER_NAME:?CONTAINER_NAME is required}"
+
+mkdir -p "$OUTPUT_DIR"
+git rev-parse HEAD > "$OUTPUT_DIR/repository.txt"
+
+docker pull "$IMAGE"
+docker create --name "$CONTAINER_NAME" "$IMAGE"
+
+extract_dir=$(mktemp -d)
+cleanup() {
+  docker rm -f "$CONTAINER_NAME" || true
+  rm -rf "$extract_dir"
+}
+trap cleanup EXIT
+
+mkdir -p \
+  "$extract_dir/apt-sources" \
+  "$extract_dir/rocm-info" \
+  "$extract_dir/rocm-core-info"
+
+docker cp "${CONTAINER_NAME}:/var/lib/dpkg/status" "$extract_dir/dpkg-status"
+docker cp "${CONTAINER_NAME}:/etc/apt/sources.list.d/." "$extract_dir/apt-sources/" || true
+docker cp "${CONTAINER_NAME}:/opt/rocm/.info/." "$extract_dir/rocm-info/" || true
+docker cp "${CONTAINER_NAME}:/opt/rocm/core/.info/." "$extract_dir/rocm-core-info/" || true
+docker cp "${CONTAINER_NAME}:/opt/rocm/share/hip/version" "$extract_dir/hip-version" || true
+
+# TheRock debian versions encode the channel (stable X.Y.Z,
+# nightly X.Y.Z~YYYYMMDD, prerelease X.Y.Z~preN, dev X.Y.Z~devYYYYMMDD).
+# Classic ROCm apt uses rocm-* names; TheRock uses amdrocm-*.
+packages="$(awk '
+  function emit() {
+    if (pkg ~ /^(amdrocm|rocm)/ && status ~ /install ok installed/)
+      print pkg "\t" ver
+    pkg=""; ver=""; status=""
+  }
+  /^Package:/ { pkg=$2 }
+  /^Status:/ { status=$0 }
+  /^Version:/ { ver=$2 }
+  /^$/ { emit() }
+  END { emit() }
+' "$extract_dir/dpkg-status")"
+if [[ -z "${packages}" ]]; then
+  echo "(no amdrocm-* or rocm-* packages found)" >&2
+  exit 1
+fi
+
+{
+  echo "=== apt ROCm sources ==="
+  shopt -s nullglob
+  sources=("$extract_dir"/apt-sources/*rocm*)
+  if ((${#sources[@]})); then
+    cat "${sources[@]}"
+  else
+    echo "(none found)"
+  fi
+  echo
+  echo "=== installed ROCm packages ==="
+  echo "${packages}"
+  echo
+  echo "=== ROCm version files ==="
+  found=
+  version_files=(
+    "/opt/rocm/.info/version:$extract_dir/rocm-info/version"
+    "/opt/rocm/.info/version-dev:$extract_dir/rocm-info/version-dev"
+    "/opt/rocm/core/.info/version:$extract_dir/rocm-core-info/version"
+    "/opt/rocm/share/hip/version:$extract_dir/hip-version"
+  )
+  for entry in "${version_files[@]}"; do
+    src="${entry%%:*}"
+    dest="${entry#*:}"
+    if [[ -r "$dest" ]]; then
+      echo "$src: $(cat "$dest")"
+      found=1
+    fi
+  done
+  if [[ -z "${found}" ]]; then
+    echo "(none found)"
+  fi
+} > "$OUTPUT_DIR/rocm.txt"

.github/skills/create-release-notes/SKILL.md

@@ -23,7 +23,7 @@ Complete the shared [repository skill preflight](../preflight/SKILL.md) before c
    2.2. [Resolve PRs associated with each commit](./commands.md#resolve-associated-prs)
    2.3. If no public PR is associated, retain the commit SHA, subject, and changed files. Never
         convert a historical `#N` subject into a public PR link without API confirmation.
-   2.4. [Diff dependency commit values](./commands.md#diff-dependency-commits) in `docker/Dockerfile.ci`
+   2.4. [Diff dependency pins](./commands.md#diff-dependency-pins) in `docker/Dockerfile.ci`
    2.5. For each changed commit hash, [look up upstream changes](./commands.md#look-up-upstream-changes) using the repo mapping
 3. **Categorize each PR** by changed file paths per [categorization rules](./categorization.md)
    3.1. Included (affect image): New Model, Performance, Docker/Environment, Benchmark Configs, Libraries

.github/skills/create-release-notes/commands.md

@@ -46,20 +46,22 @@ For commits without an associated public PR, retain changed paths locally:
 git diff-tree --no-commit-id --name-only -r COMMIT_SHA
 ```
 
-## Diff dependency commits
+## Diff dependency pins
 
-Show which dependency commit values changed in `docker/Dockerfile.ci` between releases.
-Include `*_COMMIT` pins and non-empty `*_COMMIT_OVERRIDE` values:
+Show which dependency pins changed in `docker/Dockerfile.ci` between releases.
+Include `*_COMMIT`, `ROCM_RELEASE_ID`, and `ROCM_DEB_SERIES`:
 
 ```bash
 git diff FROM_TAG..TO_REF -- docker/Dockerfile.ci | \
-  grep -E '^[+-]ARG\s+\w+_COMMIT(_OVERRIDE)?=' | sort
+  grep -E '^[+-]ARG\s+(\w+_COMMIT|ROCM_RELEASE_ID|ROCM_DEB_SERIES)=' | sort
 ```
 
 ## Look up upstream changes
 
 For each changed commit hash (`OLD_HASH` → `NEW_HASH`), query the upstream repo
 to see what was added. Use the repo mapping below to resolve the GitHub org/repo.
+Record `ROCM_RELEASE_ID` and `ROCM_DEB_SERIES` changes as TheRock nightly deb
+snapshot updates; they are not Git commit hashes.
 
 ```bash
 gh api repos/OWNER/REPO/compare/OLD_HASH...NEW_HASH \
@@ -83,8 +85,6 @@ gh api repos/OWNER/REPO/compare/OLD_HASH...NEW_HASH \
 | XDIT_COMMIT | xdit-project/xDiT |
 | AO_COMMIT | pytorch/ao |
 | ARBITER_COMMIT | fal-ai/arbiter |
-| ROCM_LIBRARIES_COMMIT_OVERRIDE | ROCm/rocm-libraries |
-| ROCM_SYSTEMS_COMMIT_OVERRIDE | ROCm/rocm-systems |
 
 ## Release notes template
 

.github/workflows/benchmark-itt.yml

@@ -114,16 +114,10 @@ jobs:
           benchmark_image: ${{ inputs.benchmark_image }}
           staging_image: ${{ env.STAGING_IMAGE }}
 
-      - name: Pull image and extract version information
-        env:
-          BENCHMARK_IMAGE: ${{ steps.resolve.outputs.image }}
-        run: |
-          mkdir -p versions
-          git rev-parse HEAD > versions/repository.txt
-          docker pull "$BENCHMARK_IMAGE"
-          docker create --name core "$BENCHMARK_IMAGE"
-          docker cp core:/opt/rocm/share/therock/ versions/ || true
-          docker rm core
+      - name: Record repository and ROCm versions
+        uses: ./.github/actions/record-image-versions
+        with:
+          image: ${{ steps.resolve.outputs.image }}
 
       - name: Upload version artifacts
         uses: actions/upload-artifact@v7

.github/workflows/build-and-benchmark.yml

@@ -294,14 +294,10 @@ jobs:
         with:
           run_number: ${{ github.run_number }}
 
-      - name: Pull image and extract version information
-        run: |
-          mkdir -p versions
-          git rev-parse HEAD > versions/repository.txt
-          docker pull ${{ steps.metadata.outputs.working_image }}
-          docker create --name core ${{ steps.metadata.outputs.working_image }}
-          docker cp core:/opt/rocm/share/therock/ versions/ || true
-          docker rm core
+      - name: Record repository and ROCm versions
+        uses: ./.github/actions/record-image-versions
+        with:
+          image: ${{ steps.metadata.outputs.working_image }}
 
       - name: Upload version artifacts
         uses: actions/upload-artifact@v7

CONTRIBUTING.md

@@ -155,9 +155,14 @@ for various targets — see [docker/README.md](docker/README.md) for description
 To build an image locally:
 
 ```sh
-docker build -f docker/Dockerfile.ci -t pytorch-xdit-dev .
+docker build -f docker/Dockerfile.ci --target final -t pytorch-xdit-dev .
 ```
 
+This build does not require a GPU. The ROCm stack comes from the nightly deb
+snapshot pinned by `ROCM_RELEASE_ID` and `ROCM_DEB_SERIES` in the Dockerfile.
+See [docker/README.md](docker/README.md) for the ROCm package and architecture
+settings.
+
 The CI pipeline (`.github/workflows/build-and-benchmark.yml`) automates image builds
 and benchmark runs on supported hardware. The release path from staging to the public
 `rocm/pytorch-xdit` image is managed internally.