Remove unused diffusers/cache_diffusion/pipeline and cuda-python dependency

[kevalmorabia97]

cuda-python has mixed license and needs EStaff approval for usage. And till 0.42, it was only used in examples/diffusers/cache_diffusion/pipeline which has not been updated in 9 months and not used anymore hence removing.

Also cherry-picked to release/0.42.0 branch: #984

Summary by CodeRabbit

• Chores
  • Removed TensorRT/ONNX deployment and inference tooling, related model export/configuration, and runtime helpers from the cache-optimized diffusion examples; removed the cuda-python example dependency.
• Tests
  • Removed the example benchmarking script and its associated benchmark test.
• Documentation
  • Strengthened dependency-review, security, and PR guidance; updated PR template and contributing documentation.

[coderabbitai]

Note

Reviews paused

It looks like this branch is under active development. To avoid overwhelming you with review comments due to an influx of new commits, CodeRabbit has automatically paused this review. You can configure this behavior by changing the reviews.auto_review.auto_pause_after_reviewed_commits setting.

Use the following commands to manage reviews:

• @coderabbitai resume to resume automatic reviews.
• @coderabbitai review to trigger a single review.

Use the checkboxes below for quick actions:

• ▶️ Resume reviews
• 🔍 Trigger review

📝 Walkthrough

Walkthrough

Removes the cache_diffusion ONNX/TensorRT deployment stack and related artifacts: ONNX export config, TensorRT deploy/runtime code, SD3/SDXL forward helpers, benchmark script and its test, and cuda-python requirement; adds dependency/license review and PR pre-merge checks.

Changes

Cohort / File(s)	Summary
ONNX export config examples/diffusers/cache_diffusion/pipeline/config.py	Deleted ONNX export configuration constants and mappings (ONNX_CONFIG, sd3_common_transformer_block_config) describing per-block dummy inputs, outputs, and dynamic axes.
TensorRT deployment & orchestration examples/diffusers/cache_diffusion/pipeline/deploy.py	Removed full TensorRT/ONNX orchestration: export, engine compilation, profile/memory handling, engine caching, warm-up, teardown, and lifecycle helpers.
TensorRT runtime wrapper examples/diffusers/cache_diffusion/pipeline/utils.py	Deleted Engine class and cuassert helper that managed engine loading, context/stream, buffer allocation, async inference, and optional CUDA graph capture/reuse.
Model forward helpers — SD3 examples/diffusers/cache_diffusion/pipeline/models/sd3.py	Removed sd3_forward implementation and its PEFT/checkpointing/TRT/controlnet-handling logic and output construction.
Model forward helpers — SDXL / UNet examples/diffusers/cache_diffusion/pipeline/models/sdxl.py	Removed UNet/SDXL forward helpers (cacheunet_forward, cacheupblock2d_forward, cachecrossattnupblock2d_forward) including down/up block flows, cross-attention, and TRT branches.
Benchmarks script examples/diffusers/cache_diffusion/benchmarks.py	Deleted benchmarking CLI that ran TRT-disabled/enabled latency tests, model loading/compilation, and timing logic.
Tests tests/examples/diffusers/test_cache_diffusion.py	Removed test_sdxl_benchmarks which invoked the external benchmark script; other tests unchanged.
Requirements examples/diffusers/requirements.txt	Removed cuda-python<13 dependency line.
Security / contribution docs & PR template .coderabbit.yaml, .github/PULL_REQUEST_TEMPLATE.md, CONTRIBUTING.md	Added dependency/license review rule and a PR-description pre-merge check; updated PR template and contributing guidance to require justification and review for non-permissive PIP deps and security-related exceptions.

Estimated code review effort

🎯 4 (Complex) | ⏱️ ~45 minutes

---

Important

Pre-merge checks failed

Please resolve all errors before merging. Addressing warnings is optional.

❌ Failed checks (2 inconclusive)

Check name	Status	Explanation	Resolution
Pr Description Filled Out Correctly	❓ Inconclusive	The actual PR description body for PR #996 is not accessible in the current repository context.	Provide the actual PR description text or verify at #996 directly.
Security Anti-Patterns	❓ Inconclusive	Security analysis of pull request requires examining torch.load() changes and dependency modifications for anti-patterns. Unable to verify specific changes without access to actual diff content and file state.	Provide git diff output showing torch.load() modifications and requirements.txt changes to assess security impact and validate weights_only parameter usage.

✅ Passed checks (3 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title accurately summarizes the main changes: removing the unused cache_diffusion pipeline directory and the cuda-python dependency.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Post copyable unit tests in a comment
• Commit unit tests in branch kmorabia/remove-unused-cuda-python

---

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 72.13%. Comparing base (42482b1) to head (4bfc05f).
⚠️ Report is 3 commits behind head on main.

Additional details and impacted files

@@           Coverage Diff           @@
##             main     #996   +/-   ##
=======================================
  Coverage   72.13%   72.13%           
=======================================
  Files         209      209           
  Lines       23631    23631           
=======================================
  Hits        17046    17046           
  Misses       6585     6585           

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.

[coderabbitai]

Actionable comments posted: 1

🤖 Prompt for all review comments with AI agents

Verify each finding against the current code and only fix it if needed.

Inline comments:
In `@CONTRIBUTING.md`:
- Line 46: Update the sentence in CONTRIBUTING.md that reads "If its not a
permissive license (e.g. MIT, Apache 2), you need to provide a justification for
the use of the dependency in the PR and wait check with
`@NVIDIA/modelopt-setup-codeowners` if its allowed or not." to explicitly
require review and approval: state that contributors must provide a
justification in the PR and obtain explicit approval from
`@NVIDIA/modelopt-setup-codeowners` before merging any dependency with a
non-permissive license, and replace the ambiguous phrase "wait check ... if its
allowed or not" with clear wording such as "must obtain approval from
`@NVIDIA/modelopt-setup-codeowners`."

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Pro

Run ID: 42f78470-8780-4438-bf36-9711cfe49a3b

📥 Commits

Reviewing files that changed from the base of the PR and between d12d166 and 7c29f80.

📒 Files selected for processing (3)

• .coderabbit.yaml
• .github/PULL_REQUEST_TEMPLATE.md
• CONTRIBUTING.md

[coderabbitai]

♻️ Duplicate comments (1)

CONTRIBUTING.md (1)

46-46: ⚠️ Potential issue | 🟠 Major

Clarify and require explicit approval for non-permissive dependency licenses before merge.

Line 46 is still ambiguous (“wait check … if its allowed or not”). Please make this explicit: contributors must include PR justification and obtain review and approval from @NVIDIA/modelopt-setup-codeowners before merging.

Suggested wording

-If adding a new PIP dependency to any of these, make sure to verify the LICENSE of the dependency. If its not a permissive license (e.g. MIT, Apache 2), you need to provide a justification for the use of the dependency in the PR and wait check with `@NVIDIA/modelopt-setup-codeowners` if its allowed or not.
+If adding a new PIP dependency to any of these, verify the dependency license first.
+If it is not a permissive license (e.g., MIT, Apache 2), include justification in the PR description and obtain review and approval from `@NVIDIA/modelopt-setup-codeowners` before merge.

Based on learnings: Any security-sensitive exception requires review and approval from NVIDIA/modelopt-setup-codeowners.

🤖 Prompt for AI Agents

Verify each finding against the current code and only fix it if needed.

In `@CONTRIBUTING.md` at line 46, Update the dependency policy sentence that
begins "If adding a new PIP dependency to any of these..." to require
contributors to both add a justification for non-permissive licenses in the PR
and obtain explicit review and approval from `@NVIDIA/modelopt-setup-codeowners`
before merging; ensure the updated wording mentions verifying the LICENSE, lists
permissive examples (MIT, Apache 2), and states that non-permissive licenses
require PR justification plus documented approval from the codeowners prior to
merge.

🤖 Prompt for all review comments with AI agents

Verify each finding against the current code and only fix it if needed.

Duplicate comments:
In `@CONTRIBUTING.md`:
- Line 46: Update the dependency policy sentence that begins "If adding a new
PIP dependency to any of these..." to require contributors to both add a
justification for non-permissive licenses in the PR and obtain explicit review
and approval from `@NVIDIA/modelopt-setup-codeowners` before merging; ensure the
updated wording mentions verifying the LICENSE, lists permissive examples (MIT,
Apache 2), and states that non-permissive licenses require PR justification plus
documented approval from the codeowners prior to merge.

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Pro

Run ID: deee3412-3aff-4029-bb60-abd2b3028cde

📥 Commits

Reviewing files that changed from the base of the PR and between 7c29f80 and 05bc557.

📒 Files selected for processing (3)

• .coderabbit.yaml
• .github/PULL_REQUEST_TEMPLATE.md
• CONTRIBUTING.md

🚧 Files skipped from review as they are similar to previous changes (2)

• .github/PULL_REQUEST_TEMPLATE.md
• .coderabbit.yaml