fix(ci): update Argo CI pipeline for gateway unification

- Replace compile-api-gateway + compile-web-gateway with single compile-api task
- Update detect-changes script: services/api/ instead of services/api_gateway/
- Remove web-gateway from change detection and compile targets
- Fix templateRef parameter resolution (inputs.parameters instead of workflow.parameters)
- Add SSH key setup and cluster-internal GitLab host for compile-service
- Use ci-builder image (has ssh) instead of ci-builder-cpu for service compilation
- Add compile-training and build-ci-image templates to kustomization

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

infra/k8s/argo/build-ci-image-template.yaml

@@ -0,0 +1,110 @@
+apiVersion: argoproj.io/v1alpha1
+kind: WorkflowTemplate
+metadata:
+  name: build-ci-image
+  namespace: foxhunt
+  labels:
+    app.kubernetes.io/name: build-ci-image
+    app.kubernetes.io/part-of: foxhunt
+spec:
+  activeDeadlineSeconds: 3600
+  serviceAccountName: argo-workflow
+  entrypoint: build
+  podMetadata:
+    labels:
+      app.kubernetes.io/component: ci-pipeline
+      app.kubernetes.io/part-of: foxhunt
+  ttlStrategy:
+    secondsAfterCompletion: 3600
+  arguments:
+    parameters:
+      - name: commit-sha
+        value: HEAD
+      - name: dockerfile
+        value: Dockerfile.ci-builder
+      - name: image-name
+        value: ci-builder
+  volumes:
+    - name: git-ssh-key
+      secret:
+        secretName: argo-git-ssh-key
+        defaultMode: 256
+    - name: registry-auth
+      secret:
+        secretName: scw-registry-credentials
+        optional: true
+  templates:
+    - name: build
+      inputs:
+        parameters:
+          - name: commit-sha
+            value: "{{workflow.parameters.commit-sha}}"
+          - name: dockerfile
+            value: "{{workflow.parameters.dockerfile}}"
+          - name: image-name
+            value: "{{workflow.parameters.image-name}}"
+      dag:
+        tasks:
+          - name: kaniko-build
+            template: kaniko-build
+            arguments:
+              parameters:
+                - name: commit-sha
+                  value: "{{inputs.parameters.commit-sha}}"
+                - name: dockerfile
+                  value: "{{inputs.parameters.dockerfile}}"
+                - name: image-name
+                  value: "{{inputs.parameters.image-name}}"
+
+    - name: kaniko-build
+      nodeSelector:
+        k8s.scaleway.com/pool-name: ci-compile-cpu
+      tolerations:
+        - key: node.cilium.io/agent-not-ready
+          operator: Exists
+          effect: NoSchedule
+      inputs:
+        parameters:
+          - name: commit-sha
+          - name: dockerfile
+          - name: image-name
+      container:
+        image: gcr.io/kaniko-project/executor:debug
+        command: ["/busybox/sh", "-c"]
+        env:
+          - name: DOCKER_CONFIG
+            value: /kaniko/.docker
+        resources:
+          requests:
+            cpu: "4"
+            memory: 8Gi
+          limits:
+            cpu: "8"
+            memory: 16Gi
+        volumeMounts:
+          - name: git-ssh-key
+            mountPath: /etc/git-ssh
+            readOnly: true
+          - name: registry-auth
+            mountPath: /kaniko/.docker
+            readOnly: true
+        args:
+          - |
+            mkdir -p ~/.ssh
+            cp /etc/git-ssh/ssh-privatekey ~/.ssh/id_ed25519
+            chmod 600 ~/.ssh/id_ed25519
+            echo -e "Host *\n  StrictHostKeyChecking no\n  UserKnownHostsFile /dev/null" > ~/.ssh/config
+
+            SHA="{{inputs.parameters.commit-sha}}"
+            git clone --depth=1 ssh://git@gitlab-gitlab-shell.foxhunt.svc.cluster.local:2222/root/foxhunt.git /workspace/src
+            if [ "$SHA" != "HEAD" ]; then
+              cd /workspace/src && git fetch --depth=1 origin "$SHA" && git checkout "$SHA"
+            fi
+
+            /kaniko/executor \
+              --context=/workspace/src \
+              --dockerfile=/workspace/src/infra/docker/{{inputs.parameters.dockerfile}} \
+              --destination=rg.fr-par.scw.cloud/foxhunt-ci/{{inputs.parameters.image-name}}:latest \
+              --cache=true \
+              --cache-repo=rg.fr-par.scw.cloud/foxhunt-ci/cache \
+              --snapshot-mode=redo

infra/k8s/argo/ci-pipeline-template.yaml

@@ -0,0 +1,429 @@
+apiVersion: argoproj.io/v1alpha1
+kind: WorkflowTemplate
+metadata:
+  name: ci-pipeline
+  namespace: foxhunt
+  labels:
+    app.kubernetes.io/name: ci-pipeline
+    app.kubernetes.io/part-of: foxhunt
+spec:
+  activeDeadlineSeconds: 7200
+  serviceAccountName: argo-workflow
+  entrypoint: pipeline
+  podMetadata:
+    labels:
+      app.kubernetes.io/component: ci-pipeline
+      app.kubernetes.io/part-of: foxhunt
+  ttlStrategy:
+    secondsAfterCompletion: 3600
+  arguments:
+    parameters:
+      - name: commit-sha
+        value: HEAD
+      - name: commits-json
+        value: "[]"
+  templates:
+    # ── DAG: orchestrate compile tasks ──
+    - name: pipeline
+      dag:
+        tasks:
+          - name: detect-changes
+            template: detect-changes
+
+          - name: compile-training
+            dependencies: [detect-changes]
+            templateRef:
+              name: compile-training
+              template: compile
+            arguments:
+              parameters:
+                - name: commit-sha
+                  value: "{{workflow.parameters.commit-sha}}"
+                - name: cuda-compute-cap
+                  value: "89"
+            when: "{{tasks.detect-changes.outputs.parameters.training}} == true"
+
+          - name: compile-api
+            dependencies: [detect-changes]
+            template: compile-service
+            arguments:
+              parameters:
+                - name: service-package
+                  value: api
+                - name: commit-sha
+                  value: "{{workflow.parameters.commit-sha}}"
+            when: "{{tasks.detect-changes.outputs.parameters.api}} == true"
+
+          - name: compile-trading-service
+            dependencies: [detect-changes]
+            template: compile-service
+            arguments:
+              parameters:
+                - name: service-package
+                  value: trading-service
+                - name: commit-sha
+                  value: "{{workflow.parameters.commit-sha}}"
+            when: "{{tasks.detect-changes.outputs.parameters.trading-service}} == true"
+
+          - name: compile-ml-training-service
+            dependencies: [detect-changes]
+            template: compile-service
+            arguments:
+              parameters:
+                - name: service-package
+                  value: ml-training-service
+                - name: commit-sha
+                  value: "{{workflow.parameters.commit-sha}}"
+            when: "{{tasks.detect-changes.outputs.parameters.ml-training-service}} == true"
+
+          - name: compile-backtesting-service
+            dependencies: [detect-changes]
+            template: compile-service
+            arguments:
+              parameters:
+                - name: service-package
+                  value: backtesting-service
+                - name: commit-sha
+                  value: "{{workflow.parameters.commit-sha}}"
+            when: "{{tasks.detect-changes.outputs.parameters.backtesting-service}} == true"
+
+          - name: compile-trading-agent-service
+            dependencies: [detect-changes]
+            template: compile-service
+            arguments:
+              parameters:
+                - name: service-package
+                  value: trading-agent-service
+                - name: commit-sha
+                  value: "{{workflow.parameters.commit-sha}}"
+            when: "{{tasks.detect-changes.outputs.parameters.trading-agent-service}} == true"
+
+          - name: compile-broker-gateway
+            dependencies: [detect-changes]
+            template: compile-service
+            arguments:
+              parameters:
+                - name: service-package
+                  value: broker-gateway
+                - name: commit-sha
+                  value: "{{workflow.parameters.commit-sha}}"
+            when: "{{tasks.detect-changes.outputs.parameters.broker-gateway}} == true"
+
+          - name: compile-data-acquisition-service
+            dependencies: [detect-changes]
+            template: compile-service
+            arguments:
+              parameters:
+                - name: service-package
+                  value: data-acquisition-service
+                - name: commit-sha
+                  value: "{{workflow.parameters.commit-sha}}"
+            when: "{{tasks.detect-changes.outputs.parameters.data-acquisition-service}} == true"
+
+          - name: rebuild-ci-builder
+            dependencies: [detect-changes]
+            templateRef:
+              name: build-ci-image
+              template: build
+            arguments:
+              parameters:
+                - name: commit-sha
+                  value: "{{workflow.parameters.commit-sha}}"
+                - name: dockerfile
+                  value: Dockerfile.ci-builder
+                - name: image-name
+                  value: ci-builder
+            when: "{{tasks.detect-changes.outputs.parameters.docker-images}} == true"
+
+          - name: rebuild-ci-builder-cpu
+            dependencies: [detect-changes]
+            templateRef:
+              name: build-ci-image
+              template: build
+            arguments:
+              parameters:
+                - name: commit-sha
+                  value: "{{workflow.parameters.commit-sha}}"
+                - name: dockerfile
+                  value: Dockerfile.ci-builder-cpu
+                - name: image-name
+                  value: ci-builder-cpu
+            when: "{{tasks.detect-changes.outputs.parameters.docker-images}} == true"
+
+          - name: rebuild-runtime
+            dependencies: [detect-changes]
+            templateRef:
+              name: build-ci-image
+              template: build
+            arguments:
+              parameters:
+                - name: commit-sha
+                  value: "{{workflow.parameters.commit-sha}}"
+                - name: dockerfile
+                  value: Dockerfile.foxhunt-runtime
+                - name: image-name
+                  value: foxhunt-runtime
+            when: "{{tasks.detect-changes.outputs.parameters.docker-images}} == true"
+
+          - name: rebuild-training-runtime
+            dependencies: [detect-changes]
+            templateRef:
+              name: build-ci-image
+              template: build
+            arguments:
+              parameters:
+                - name: commit-sha
+                  value: "{{workflow.parameters.commit-sha}}"
+                - name: dockerfile
+                  value: Dockerfile.foxhunt-training-runtime
+                - name: image-name
+                  value: foxhunt-training-runtime
+            when: "{{tasks.detect-changes.outputs.parameters.docker-images}} == true"
+
+    # ── detect-changes: determine which services need rebuilding ──
+    - name: detect-changes
+      nodeSelector:
+        k8s.scaleway.com/pool-name: platform
+      tolerations:
+        - key: gitlab
+          operator: Equal
+          value: "true"
+          effect: NoSchedule
+      container:
+        image: rg.fr-par.scw.cloud/foxhunt-ci/foxhunt-runtime:latest
+        command: ["/bin/sh", "-c"]
+        resources:
+          requests:
+            cpu: 100m
+            memory: 128Mi
+          limits:
+            cpu: 500m
+            memory: 256Mi
+        args:
+          - |
+            set -e
+            cat <<'SCRIPT' > /tmp/detect.sh
+            #!/bin/sh
+            set -e
+
+            COMMITS_JSON='{{workflow.parameters.commits-json}}'
+
+            # Extract all changed file paths from commits array
+            if command -v jq >/dev/null 2>&1; then
+              CHANGED_FILES=$(echo "$COMMITS_JSON" | jq -r '
+                if type == "array" then
+                  [.[].added[], .[].modified[], .[].removed[]] | unique | .[]
+                elif type == "string" then
+                  (fromjson // []) | [.[].added[], .[].modified[], .[].removed[]] | unique | .[]
+                else
+                  empty
+                end
+              ' 2>/dev/null || echo "")
+            else
+              CHANGED_FILES="Cargo.toml"
+            fi
+
+            if [ -z "$CHANGED_FILES" ]; then
+              echo "No changed files detected — triggering all builds"
+              CHANGED_FILES="Cargo.toml"
+            fi
+
+            echo "=== Changed files ==="
+            echo "$CHANGED_FILES"
+            echo "===================="
+
+            check_paths() {
+              local patterns="$1"
+              for file in $CHANGED_FILES; do
+                for pattern in $patterns; do
+                  case "$file" in
+                    ${pattern}*) echo "true"; return ;;
+                  esac
+                done
+              done
+              echo "false"
+            }
+
+            API=$(check_paths "services/api/ crates/common/ crates/config/ crates/trading_engine/ bin/fxt/ Cargo.toml Cargo.lock")
+            TRADING_SERVICE=$(check_paths "services/trading_service/ services/api/ crates/common/ crates/config/ crates/data/ crates/database/ crates/ml/ crates/risk/ crates/storage/ crates/trading_engine/ Cargo.toml Cargo.lock")
+            ML_TRAINING_SERVICE=$(check_paths "services/ml_training_service/ crates/common/ crates/config/ crates/data/ crates/ml/ crates/risk/ crates/storage/ crates/trading_engine/ Cargo.toml Cargo.lock")
+            BACKTESTING_SERVICE=$(check_paths "services/backtesting_service/ crates/common/ crates/config/ crates/data/ crates/ml/ crates/model_loader/ crates/risk/ crates/storage/ crates/trading_engine/ bin/fxt/ Cargo.toml Cargo.lock")
+            TRADING_AGENT_SERVICE=$(check_paths "services/trading_agent_service/ crates/common/ crates/config/ crates/ml/ crates/risk/ Cargo.toml Cargo.lock")
+            BROKER_GATEWAY=$(check_paths "services/broker_gateway_service/ crates/common/ crates/config/ crates/trading_engine/ vendor/ctrader-openapi/ Cargo.toml Cargo.lock")
+            DATA_ACQUISITION_SERVICE=$(check_paths "services/data_acquisition_service/ crates/common/ crates/config/ crates/storage/ Cargo.toml Cargo.lock")
+            TRAINING=$(check_paths "crates/ml/ crates/trading_engine/ crates/common/ crates/risk/ crates/data/ crates/config/ crates/storage/ services/training_uploader/ Cargo.toml Cargo.lock")
+            DOCKER_IMAGES=$(check_paths "infra/docker/")
+
+            echo "=== Build decisions ==="
+            echo "api: $API"
+            echo "trading-service: $TRADING_SERVICE"
+            echo "ml-training-service: $ML_TRAINING_SERVICE"
+            echo "backtesting-service: $BACKTESTING_SERVICE"
+            echo "trading-agent-service: $TRADING_AGENT_SERVICE"
+            echo "broker-gateway: $BROKER_GATEWAY"
+            echo "data-acquisition-service: $DATA_ACQUISITION_SERVICE"
+            echo "training: $TRAINING"
+            echo "docker-images: $DOCKER_IMAGES"
+            echo "======================"
+
+            mkdir -p /tmp/outputs
+            echo -n "$API" > /tmp/outputs/api
+            echo -n "$TRADING_SERVICE" > /tmp/outputs/trading-service
+            echo -n "$ML_TRAINING_SERVICE" > /tmp/outputs/ml-training-service
+            echo -n "$BACKTESTING_SERVICE" > /tmp/outputs/backtesting-service
+            echo -n "$TRADING_AGENT_SERVICE" > /tmp/outputs/trading-agent-service
+            echo -n "$BROKER_GATEWAY" > /tmp/outputs/broker-gateway
+            echo -n "$DATA_ACQUISITION_SERVICE" > /tmp/outputs/data-acquisition-service
+            echo -n "$TRAINING" > /tmp/outputs/training
+            echo -n "$DOCKER_IMAGES" > /tmp/outputs/docker-images
+            SCRIPT
+            chmod +x /tmp/detect.sh
+            /tmp/detect.sh
+      outputs:
+        parameters:
+          - name: api
+            valueFrom:
+              path: /tmp/outputs/api
+          - name: trading-service
+            valueFrom:
+              path: /tmp/outputs/trading-service
+          - name: ml-training-service
+            valueFrom:
+              path: /tmp/outputs/ml-training-service
+          - name: backtesting-service
+            valueFrom:
+              path: /tmp/outputs/backtesting-service
+          - name: trading-agent-service
+            valueFrom:
+              path: /tmp/outputs/trading-agent-service
+          - name: broker-gateway
+            valueFrom:
+              path: /tmp/outputs/broker-gateway
+          - name: data-acquisition-service
+            valueFrom:
+              path: /tmp/outputs/data-acquisition-service
+          - name: training
+            valueFrom:
+              path: /tmp/outputs/training
+          - name: docker-images
+            valueFrom:
+              path: /tmp/outputs/docker-images
+
+    # ── compile-service: build and upload a single service binary ──
+    - name: compile-service
+      nodeSelector:
+        k8s.scaleway.com/pool-name: ci-compile-cpu
+      tolerations:
+        - key: node.cilium.io/agent-not-ready
+          operator: Exists
+          effect: NoSchedule
+      inputs:
+        parameters:
+          - name: service-package
+          - name: commit-sha
+      volumes:
+        - name: sccache
+          persistentVolumeClaim:
+            claimName: sccache-pvc
+        - name: git-ssh-key
+          secret:
+            secretName: argo-git-ssh-key
+            defaultMode: 256
+      container:
+        image: rg.fr-par.scw.cloud/foxhunt-ci/ci-builder:latest
+        command: ["/bin/sh", "-c"]
+        env:
+          - name: SQLX_OFFLINE
+            value: "true"
+          - name: CARGO_TERM_COLOR
+            value: always
+          - name: MINIO_ACCESS_KEY
+            valueFrom:
+              secretKeyRef:
+                name: minio-credentials
+                key: access-key
+          - name: MINIO_SECRET_KEY
+            valueFrom:
+              secretKeyRef:
+                name: minio-credentials
+                key: secret-key
+        resources:
+          requests:
+            cpu: "4"
+            memory: 8Gi
+          limits:
+            cpu: "6"
+            memory: 16Gi
+        volumeMounts:
+          - name: sccache
+            mountPath: /mnt/sccache
+          - name: git-ssh-key
+            mountPath: /etc/git-ssh
+            readOnly: true
+        args:
+          - |
+            set -e
+            SERVICE="{{inputs.parameters.service-package}}"
+            SHA="{{inputs.parameters.commit-sha}}"
+
+            # Configure SSH for git clone
+            mkdir -p ~/.ssh
+            cp /etc/git-ssh/ssh-privatekey ~/.ssh/id_ed25519
+            chmod 600 ~/.ssh/id_ed25519
+            printf 'Host *\n  StrictHostKeyChecking no\n  UserKnownHostsFile /dev/null\n' > ~/.ssh/config
+            chmod 600 ~/.ssh/config
+
+            echo "=== Compiling $SERVICE at $SHA ==="
+            REPO="ssh://git@gitlab-gitlab-shell.foxhunt.svc.cluster.local:2222/root/foxhunt.git"
+            if [ "$SHA" = "HEAD" ]; then
+              git clone --depth=1 "$REPO" /workspace/src
+            else
+              git clone --depth=1 "$REPO" /workspace/src
+              cd /workspace/src
+              git fetch --depth=1 origin "$SHA"
+              git checkout "$SHA"
+            fi
+            cd /workspace/src
+            echo "Checked out $(git rev-parse --short HEAD)"
+
+            export SCCACHE_DIR="/mnt/sccache/cpu"
+            export RUSTC_WRAPPER=sccache
+            mkdir -p "$SCCACHE_DIR"
+            sccache --zero-stats || true
+
+            YEAR=$(date +%Y)
+            MONTH=$(date +%m)
+            export FOXHUNT_BUILD_VERSION="${YEAR}.${MONTH}.argo"
+
+            # Map service name to cargo package
+            case "$SERVICE" in
+              api)                      PKG=api ;;
+              trading-service)          PKG=trading_service ;;
+              ml-training-service)      PKG=ml_training_service ;;
+              backtesting-service)      PKG=backtesting_service ;;
+              trading-agent-service)    PKG=trading_agent_service ;;
+              broker-gateway)           PKG=broker_gateway_service ;;
+              data-acquisition-service) PKG=data_acquisition_service ;;
+              *) echo "Unknown service: $SERVICE"; exit 1 ;;
+            esac
+
+            cargo build --release -p "$PKG"
+            sccache --show-stats || true
+
+            mkdir -p /workspace/bin
+            cp "target/release/$PKG" /workspace/bin/ 2>/dev/null \
+              || cp "target/release/${PKG//_/-}" /workspace/bin/ 2>/dev/null \
+              || { echo "Binary not found for $PKG"; ls target/release/; exit 1; }
+            strip /workspace/bin/*
+
+            echo "=== Uploading $SERVICE binary to MinIO ==="
+            rclone copy /workspace/bin/ ":s3:foxhunt-binaries/services/" \
+              --s3-provider=Minio \
+              --s3-endpoint=https://minio.foxhunt.svc.cluster.local:9000 \
+              --s3-access-key-id="${MINIO_ACCESS_KEY}" \
+              --s3-secret-access-key="${MINIO_SECRET_KEY}" \
+              --s3-no-check-bucket \
+              --no-check-certificate
+
+            echo "=== $SERVICE compile + upload complete ==="
+            ls -lh /workspace/bin/

infra/k8s/argo/compile-training-template.yaml

@@ -0,0 +1,238 @@
+apiVersion: argoproj.io/v1alpha1
+kind: WorkflowTemplate
+metadata:
+  name: compile-training
+  namespace: foxhunt
+  labels:
+    app.kubernetes.io/name: compile-training
+    app.kubernetes.io/part-of: foxhunt
+spec:
+  activeDeadlineSeconds: 3600
+  serviceAccountName: argo-workflow
+  entrypoint: compile
+  podMetadata:
+    labels:
+      app.kubernetes.io/component: compile
+      app.kubernetes.io/part-of: foxhunt
+  ttlStrategy:
+    secondsAfterCompletion: 3600
+  arguments:
+    parameters:
+      - name: commit-sha
+        value: HEAD
+      - name: cuda-compute-cap
+        value: "89"
+  volumeClaimTemplates:
+    - metadata:
+        name: workspace
+      spec:
+        accessModes: [ReadWriteOnce]
+        resources:
+          requests:
+            storage: 20Gi
+        storageClassName: scw-bssd
+  volumes:
+    - name: sccache
+      persistentVolumeClaim:
+        claimName: sccache-pvc
+    - name: git-ssh-key
+      secret:
+        secretName: argo-git-ssh-key
+        defaultMode: 256
+  templates:
+    - name: compile
+      inputs:
+        parameters:
+          - name: commit-sha
+            value: "{{workflow.parameters.commit-sha}}"
+          - name: cuda-compute-cap
+            value: "{{workflow.parameters.cuda-compute-cap}}"
+      dag:
+        tasks:
+          - name: checkout
+            template: git-checkout
+            arguments:
+              parameters:
+                - name: commit-sha
+                  value: "{{inputs.parameters.commit-sha}}"
+          - name: build
+            dependencies: [checkout]
+            template: build-training
+            arguments:
+              parameters:
+                - name: cuda-compute-cap
+                  value: "{{inputs.parameters.cuda-compute-cap}}"
+          - name: upload
+            dependencies: [build]
+            template: upload-binaries
+
+    - name: git-checkout
+      nodeSelector:
+        k8s.scaleway.com/pool-name: ci-compile-cpu
+      tolerations:
+        - key: node.cilium.io/agent-not-ready
+          operator: Exists
+          effect: NoSchedule
+      inputs:
+        parameters:
+          - name: commit-sha
+      container:
+        image: rg.fr-par.scw.cloud/foxhunt-ci/ci-builder:latest
+        command: ["/bin/sh", "-c"]
+        resources:
+          requests:
+            cpu: 500m
+            memory: 512Mi
+          limits:
+            cpu: "2"
+            memory: 2Gi
+        volumeMounts:
+          - name: workspace
+            mountPath: /workspace
+          - name: git-ssh-key
+            mountPath: /etc/git-ssh
+            readOnly: true
+        args:
+          - |
+            set -e
+            mkdir -p ~/.ssh
+            cp /etc/git-ssh/ssh-privatekey ~/.ssh/id_ed25519
+            chmod 600 ~/.ssh/id_ed25519
+            printf 'Host *\n  StrictHostKeyChecking no\n  UserKnownHostsFile /dev/null\n' > ~/.ssh/config
+            chmod 600 ~/.ssh/config
+
+            REPO="ssh://git@gitlab-gitlab-shell.foxhunt.svc.cluster.local:2222/root/foxhunt.git"
+            SHA="{{inputs.parameters.commit-sha}}"
+            echo "Cloning foxhunt at ${SHA}..."
+            if [ "$SHA" = "HEAD" ]; then
+              git clone --depth=1 "$REPO" /workspace/src
+            else
+              git clone "$REPO" /workspace/src
+              cd /workspace/src
+              git checkout "$SHA"
+            fi
+            cd /workspace/src
+            echo "Checked out $(git rev-parse --short HEAD)"
+
+    - name: build-training
+      nodeSelector:
+        k8s.scaleway.com/pool-name: ci-compile-cpu
+      tolerations:
+        - key: node.cilium.io/agent-not-ready
+          operator: Exists
+          effect: NoSchedule
+      inputs:
+        parameters:
+          - name: cuda-compute-cap
+      container:
+        image: rg.fr-par.scw.cloud/foxhunt-ci/ci-builder:latest
+        command: ["/bin/sh", "-c"]
+        env:
+          - name: SQLX_OFFLINE
+            value: "true"
+          - name: CARGO_TERM_COLOR
+            value: always
+        resources:
+          requests:
+            cpu: "14"
+            memory: 32Gi
+          limits:
+            cpu: "30"
+            memory: 64Gi
+        volumeMounts:
+          - name: workspace
+            mountPath: /workspace
+          - name: sccache
+            mountPath: /mnt/sccache
+        args:
+          - |
+            set -e
+            cd /workspace/src
+
+            export CUDA_COMPUTE_CAP={{inputs.parameters.cuda-compute-cap}}
+            export SCCACHE_DIR="/mnt/sccache/sm_${CUDA_COMPUTE_CAP}"
+            export RUSTC_WRAPPER=sccache
+            mkdir -p "$SCCACHE_DIR"
+            sccache --zero-stats || true
+
+            YEAR=$(date +%Y)
+            MONTH=$(date +%m)
+            export FOXHUNT_BUILD_VERSION="${YEAR}.${MONTH}.argo"
+
+            echo "=== Compiling training binaries (CUDA_COMPUTE_CAP=$CUDA_COMPUTE_CAP) ==="
+            cargo build --release -p ml --features ml/cuda \
+              --example train_baseline_rl \
+              --example train_baseline_supervised \
+              --example evaluate_baseline \
+              --example evaluate_supervised \
+              --example hyperopt_baseline_rl \
+              --example hyperopt_baseline_supervised
+
+            cargo build --release -p training_uploader
+
+            sccache --show-stats || true
+
+            echo "=== Copying and stripping binaries ==="
+            mkdir -p /workspace/bin
+            for bin in train_baseline_rl train_baseline_supervised evaluate_baseline evaluate_supervised hyperopt_baseline_rl hyperopt_baseline_supervised; do
+              cp target/release/examples/$bin /workspace/bin/
+              strip /workspace/bin/$bin
+            done
+            cp target/release/training_uploader /workspace/bin/
+            strip /workspace/bin/training_uploader
+
+            echo "=== Build complete ==="
+            ls -lh /workspace/bin/
+
+    - name: upload-binaries
+      nodeSelector:
+        k8s.scaleway.com/pool-name: platform
+      tolerations:
+        - key: gitlab
+          operator: Equal
+          value: "true"
+          effect: NoSchedule
+      container:
+        image: rg.fr-par.scw.cloud/foxhunt-ci/foxhunt-runtime:latest
+        command: ["/bin/sh", "-c"]
+        env:
+          - name: MINIO_ACCESS_KEY
+            valueFrom:
+              secretKeyRef:
+                name: minio-credentials
+                key: access-key
+          - name: MINIO_SECRET_KEY
+            valueFrom:
+              secretKeyRef:
+                name: minio-credentials
+                key: secret-key
+        resources:
+          requests:
+            cpu: 100m
+            memory: 128Mi
+          limits:
+            cpu: 500m
+            memory: 256Mi
+        volumeMounts:
+          - name: workspace
+            mountPath: /workspace
+        args:
+          - |
+            set -e
+            echo "Uploading training binaries to MinIO..."
+            rclone copy /workspace/bin/ :s3:foxhunt-binaries/training/ \
+              --s3-provider=Minio \
+              --s3-endpoint=https://minio.foxhunt.svc.cluster.local:9000 \
+              --s3-access-key-id="${MINIO_ACCESS_KEY}" \
+              --s3-secret-access-key="${MINIO_SECRET_KEY}" \
+              --s3-no-check-bucket \
+              --no-check-certificate
+
+            echo "=== Uploaded binaries ==="
+            rclone ls :s3:foxhunt-binaries/training/ \
+              --s3-provider=Minio \
+              --s3-endpoint=https://minio.foxhunt.svc.cluster.local:9000 \
+              --s3-access-key-id="${MINIO_ACCESS_KEY}" \
+              --s3-secret-access-key="${MINIO_SECRET_KEY}" \
+              --s3-no-check-bucket \
+              --no-check-certificate

infra/k8s/argo/kustomization.yaml

@@ -1,5 +1,8 @@
 apiVersion: kustomize.config.k8s.io/v1beta1
 kind: Kustomization
 resources:
+  - ci-pipeline-template.yaml
+  - compile-training-template.yaml
+  - build-ci-image-template.yaml
   - training-workflow-template.yaml
   - argo-workflow-netpol.yaml