Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In `@tests/gpu_vllm_fakequant/torch/quantization/test_vllm_dynamic_modules.py`:
- Around line 16-17: Move the test suite file
tests/gpu_vllm_fakequant/torch/quantization/test_vllm_dynamic_modules.py into
one of the approved GPU test folders (e.g., tests/gpu or the appropriate
tests/gpu_* target) so it complies with the repository test-directory policy,
then update any CI and nox configuration entries that reference the old path
(search for occurrences of "gpu_vllm_fakequant" or the filename
"test_vllm_dynamic_modules.py" in noxfiles and workflow YAMLs) to point to the
new location and ensure the test is included in the correct GPU test collection.
- Around line 352-353: Replace the broad "except Exception as exc" that
unconditionally calls pytest.skip with a targeted check that only skips for
known environment/capability failures and re-raises all other exceptions: catch
specific exception types (e.g., ImportError, OSError, RuntimeError) or inspect
exc's message for known indicators (CUDA/vLLM model download failures) and call
pytest.skip only in those matched cases; for any other exc, re-raise the
exception so real regressions in the vLLM/model loading/quantization path
surface. Ensure this logic surrounds the same try block that currently ends with
pytest.skip and continues to use pytest.skip(...) for the allowed cases.

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In @.github/workflows/gpu_tests.yml:
- Around line 55-56: The vLLM image tag in the workflow (the line containing
"container_image: docker.io/vllm/vllm-openai:v0.21.0") is out of sync with
examples/vllm_serve/Dockerfile which uses v0.10.2; update the workflow entry to
use the same tag as the Dockerfile (change the container_image value to
docker.io/vllm/vllm-openai:v0.10.2) so the comment "Keep in sync with
examples/vllm_serve/Dockerfile" is honored, or conversely update the Dockerfile
to v0.21.0 if you intend to standardize on the newer release—ensure both places
reference the identical image tag.
- Line 56: The workflow pins the OpenAI-server image to container_image:
docker.io/vllm/vllm-openai:v0.21.0 which may be vulnerable to
GHSA-3mwp-wvh9-7528; verify whether that v0.21.0 release includes the patch and
if not either update the tag to the patched vLLM image (reference the patched
release tag) or add mitigations: enforce input validation and a max "n"
parameter and/or enable rate-limiting in the vLLM server invocation;
specifically, locate the container_image: docker.io/vllm/vllm-openai:v0.21.0
entry and either change it to the patched image tag or add environment
variables/command-line args or ingress rate-limiting configuration to bound the
`n` parameter and throttle requests.

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In `@tests/gpu_vllm/torch/quantization/test_vllm_dynamic_modules.py`:
- Around line 353-355: The test unconditionally asserts VllmMLAAttention exists
but that symbol can be None on builds without MLA; update the
test_registry_has_mla_attention function to first check if VllmMLAAttention is
None and call pytest.skip("MLA not available") (or return) when absent,
otherwise perform the existing assertions against QuantModuleRegistry; reference
the VllmMLAAttention symbol and the QuantModuleRegistry in the change.

---

Outside diff comments:
In @.github/workflows/gpu_tests.yml:
- Around line 25-33: The PR gate for the gpu_vllm lane is missing inputs so
any_changed stays false for changes to shared tiny-model builders and the vLLM
Dockerfile; update the files list in .github/workflows/gpu_tests.yml (the block
that populates any_changed) to include tests/_test_utils/** and
examples/vllm_serve/Dockerfile (and any other tiny-model builder paths if
separate) so changes to those files will trigger the gpu_vllm lane and keep the
image pin in sync with the Dockerfile referenced by the gpu_vllm job.

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Outside diff comments:
In `@examples/vllm_serve/Dockerfile`:
- Around line 1-44: The Dockerfile currently leaves processes running as root
(no USER set) which weakens isolation; create a non-root user (e.g., "appuser")
after installing packages and preparing files, chown the WORKDIR (/workspace)
and Model-Optimizer files to that user (update or replace the chmod -R 777
/workspace step with chown -R appuser:appuser /workspace and Model-Optimizer
ownership), then add USER appuser before the ENTRYPOINT/CMD lines so the
container runs as that non-root user; keep root for earlier steps (apt-get, pip
installs, extensions precompile) and only switch to the non-root account once
image setup is complete.