[PavanaSakethaRam]

Summary

Complete the five cleanup items in #1573 after importing cuTile into the CUDA Rust monorepo. cuTile's dependency policy was not being run by the root workflows, its sources were excluded from the inventory and header guards, and its GitHub configuration still lived under cutile-rs/.github.

Changes

Run the Tile dependency checks in CI

Add a cargo-deny job to .github/workflows/cutile-rs.yml. It uses cutile-rs/deny.toml and the committed Tile lockfile to check advisories, licenses, banned dependencies, and dependency sources.

The command uses --workspace to include all eight members, including cuda-tile-rs, which is outside default-members. It uses --locked so a stale lockfile fails instead of being updated during the check. The configured audit checks the default feature graph.

The job also runs the dependency inventory and source-header guards. It runs on Ubuntu without CUDA or a GPU and follows the existing Tile/shared-host change gate, including manual dispatch and the fallback for mirrored pushes with no detectable diff.

Add and enforce the Tile dependency inventory

Add cutile-rs/dependency-licenses.csv with 43 unique workspace-member and direct-dependency names. Coverage includes the main Tile workspace and the four standalone paper benchmark workspaces: bimodal GEMMs, elementwise safety overhead, GEMM safety overhead, and launch overhead.

Extend the existing inventory guard to check the Tile CSV alongside the Oxide inventory and remove the blanket Tile exclusion. Workspace discovery now requires each Tile workspace to be listed explicitly, so a newly added nested workspace cannot silently escape the check.

Use cargo metadata --no-deps from each manifest's directory to inspect normal, development, build, optional, and target-specific dependency declarations with the owning toolchain. This checks inventory presence; it does not compare snapshot versions or build the historical paper benchmarks. Metadata failures stop the guard. Update CONTRIBUTING.md to explain which inventory contributors should maintain.

Include Tile sources in the header guard

Remove the blanket cutile-rs/ exclusion. Apply the repository's existing standard notices to 13 files that lacked them, covering Rust examples and UI fixtures, book styles/templates, and the Nix configuration.

Adjust five UI diagnostic snapshots for the added header lines. Preserve the imported NVIDIA Sphinx theme's existing proprietary notice and check that notice explicitly. Existing third-party exceptions remain in place.

Move GitHub configuration to the repository root

• Move the setup action to .github/actions/setup-cutile/action.yml and update all six workflow references.
• Add the moved action and shared guard files to the Tile change filter so edits to them run the affected jobs.
• Move the custom-runner configuration to .github/actionlint.yaml for automatic discovery by actionlint.
• Move Dependabot to .github/dependabot.yml, where GitHub can discover its weekly, grouped GitHub Actions updates. Preserve the exclusions for taiki-e/install-action and swatinem/rust-cache, whose exact commits are managed through the organization's allowlist.

These moves remove the remaining tracked files under cutile-rs/.github.

Validation

Validated locally on macOS ARM64 with Rust 1.98.0, cargo-deny 0.20.2, and actionlint 1.7.12:

• Lint passes for every root GitHub Actions workflow; Tile workspace formatting passes.
• Thirteen scheduling scenarios pass, covering Tile/shared-host edits, moved action and guard edits, manual dispatch, empty-diff mirror fallback, and skipping unrelated SIMT source changes.
• The exact configured Tile dependency audit passes. Separate controls confirm rejection of a stale lockfile and a disallowed Git dependency in the non-default workspace member.
• Both inventories pass: 67 Oxide/host declarations and 43 Tile declarations, together with the existing Oxide example-lockfile checks.
• The header guard passes with Tile included. Isolated controls verify rejection of missing inventory rows, an unlisted workspace, failed metadata reads, missing source headers, and a changed theme license identifier.
• Both modified Tile IR examples compile and their test harnesses run successfully; those harnesses contain no unit tests. Changed UI diagnostic excerpts match their corresponding source lines.
• All 252 tracked Cargo.lock files are unchanged.

Remaining validation and existing findings

CUDA-dependent compilation, the trybuild UI suite, assembler tests, and GPU tests still require the Linux CUDA environment. The UI snapshots have been checked for their line-number changes but have not been regenerated through the CUDA-dependent suite on this Mac.

An additional audit with --all-features reports three existing advisories in zip 7.2.0, pulled in by the optional Candle examples through candle-core 0.9.2: RUSTSEC-2026-0367, RUSTSEC-2026-0368, and RUSTSEC-2026-0369. The configured default-feature audit passes. No advisory exceptions or dependency-policy changes were added.

Fixes #1573.

[copy-pr-bot]

This pull request requires additional validation before any workflows can run on NVIDIA's runners.

Pull request vetters can view their responsibilities here.

Contributors can view more details about this message here.