From e10d06870d3416957864062b74fc7c44e6e0f361 Mon Sep 17 00:00:00 2001 From: Ramakrishna Prabhu Date: Fri, 7 Aug 2026 09:58:56 -0500 Subject: [PATCH 1/3] ci: update NVSkills CI request template and add require-nvskills-status workflow --- .github/workflows/request-nvskills-ci.yml | 196 ++++++++++- .github/workflows/require-nvskills-status.yml | 307 ++++++++++++++++++ 2 files changed, 495 insertions(+), 8 deletions(-) create mode 100644 .github/workflows/require-nvskills-status.yml diff --git a/.github/workflows/request-nvskills-ci.yml b/.github/workflows/request-nvskills-ci.yml index 036fcf653b..f7cd01f8cb 100644 --- a/.github/workflows/request-nvskills-ci.yml +++ b/.github/workflows/request-nvskills-ci.yml @@ -10,21 +10,201 @@ name: Request NVSkills CI on: issue_comment: types: [created] + pull_request: + types: [opened, synchronize, reopened] push: +permissions: + contents: read + pull-requests: read + statuses: read + jobs: + require-nvskills-ci: + if: github.event_name == 'pull_request' + permissions: + contents: read + pull-requests: read + statuses: read + uses: ./.github/workflows/require-nvskills-status.yml + request: if: > (github.event_name == 'issue_comment' && github.event.issue.pull_request && - contains(fromJSON('["OWNER","MEMBER","COLLABORATOR"]'), github.event.comment.author_association) && startsWith(github.event.comment.body, '/nvskills-ci')) || (github.event_name == 'push' && - github.actor == (vars.NVSKILLS_SIGNATURE_PUSH_ACTOR || 'nv-nvskill-ci[bot]') && + github.actor == (vars.NVSKILLS_SIGNATURE_PUSH_ACTOR || 'nv-skills-ci[bot]') && startsWith(github.event.head_commit.message, vars.NVSKILLS_SIGNATURE_COMMIT_TITLE || 'Attach NVSkills validation signatures')) - permissions: - contents: read - pull-requests: read - uses: NVIDIA/skills/.github/workflows/team-request.yml@main - secrets: - NVSKILLS_CI_DISPATCH_TOKEN: ${{ secrets.NVSKILLS_CI_DISPATCH_TOKEN }} + runs-on: ubuntu-latest + concurrency: + group: nvskills-ci-request-${{ github.repository }}-${{ github.event.issue.number || github.sha }} + cancel-in-progress: true + steps: + - name: Validate requester permission + if: ${{ github.event_name == 'issue_comment' }} + env: + GH_TOKEN: ${{ github.token }} + REPO: ${{ github.repository }} + ACTOR: ${{ github.actor }} + run: | + set -euo pipefail + role_name="$(curl -fsSL \ + -H "Authorization: Bearer ${GH_TOKEN}" \ + -H "Accept: application/vnd.github+json" \ + "https://api.github.com/repos/${REPO}/collaborators/${ACTOR}/permission" \ + | jq -r '.role_name // ""')" + case "${role_name}" in + admin|maintain) ;; + *) echo "Requester must have maintain or admin permission"; exit 1 ;; + esac + + - name: Resolve request context + id: context + env: + GH_TOKEN: ${{ github.token }} + EVENT_NAME: ${{ github.event_name }} + REPO: ${{ github.repository }} + ISSUE_PR_NUMBER: ${{ github.event.issue.number || '' }} + HEAD_SHA: ${{ github.sha }} + HEAD_COMMIT_MESSAGE: ${{ github.event.head_commit.message || '' }} + SIGNATURE_COMMIT_TITLE: ${{ vars.NVSKILLS_SIGNATURE_COMMIT_TITLE || 'Attach NVSkills validation signatures' }} + SIGNATURE_PUSH_ACTOR: ${{ vars.NVSKILLS_SIGNATURE_PUSH_ACTOR || 'nv-skills-ci[bot]' }} + ACTOR: ${{ github.actor }} + run: | + set -euo pipefail + owner="${REPO%%/*}" + repo="${REPO#*/}" + pr_number="${ISSUE_PR_NUMBER}" + commit_title="$(printf '%s' "${HEAD_COMMIT_MESSAGE}" | sed -n '1p')" + + if [ "${EVENT_NAME}" = "push" ]; then + if [ "${commit_title}" != "${SIGNATURE_COMMIT_TITLE}" ]; then + echo "Push is not the configured NVSkills signature commit; skipping dispatch." + exit 0 + fi + if [ "${ACTOR}" != "${SIGNATURE_PUSH_ACTOR}" ]; then + echo "Push actor ${ACTOR} is not the configured NVSkills signing actor; skipping dispatch." + exit 0 + fi + + prs_json="$(curl -fsSL \ + -H "Authorization: Bearer ${GH_TOKEN}" \ + -H "Accept: application/vnd.github+json" \ + "https://api.github.com/repos/${owner}/${repo}/commits/${HEAD_SHA}/pulls")" + pr_number="$(printf '%s' "${prs_json}" | jq -r '[.[] | select(.state == "open")][0].number // empty')" + if [ -z "${pr_number}" ]; then + echo "No open pull request is associated with the signature commit; skipping dispatch." + exit 0 + fi + fi + + if [ -z "${pr_number}" ]; then + echo "Pull request number could not be resolved." + exit 1 + fi + + pr_json="$(curl -fsSL \ + -H "Authorization: Bearer ${GH_TOKEN}" \ + -H "Accept: application/vnd.github+json" \ + "https://api.github.com/repos/${owner}/${repo}/pulls/${pr_number}")" + head_sha="$(printf '%s' "${pr_json}" | jq -r '.head.sha')" + base_ref="$(printf '%s' "${pr_json}" | jq -r '.base.ref')" + + if [ "${EVENT_NAME}" != "push" ]; then + commit_json="$(curl -fsSL \ + -H "Authorization: Bearer ${GH_TOKEN}" \ + -H "Accept: application/vnd.github+json" \ + "https://api.github.com/repos/${owner}/${repo}/commits/${head_sha}")" + commit_title="$(printf '%s' "${commit_json}" | jq -r '.commit.message | split("\n")[0]')" + fi + + has_watched_change=false + page=1 + while true; do + files_json="$(curl -fsSL \ + -H "Authorization: Bearer ${GH_TOKEN}" \ + -H "Accept: application/vnd.github+json" \ + "https://api.github.com/repos/${owner}/${repo}/pulls/${pr_number}/files?per_page=100&page=${page}")" + if printf '%s' "${files_json}" | jq -e ' + any(.[]; .filename | + startswith("skills/") or + startswith("team-skills/") or + startswith("rules/team-rules/") or + startswith("plugins/") + ) + ' >/dev/null; then + has_watched_change=true + break + fi + if [ "$(printf '%s' "${files_json}" | jq 'length')" -lt 100 ]; then + break + fi + page=$((page + 1)) + done + + if [ "${has_watched_change}" != "true" ]; then + { + echo "## NVSkills CI request" + echo + echo "Skipped: no changes under \`skills/\`, \`team-skills/\`, \`rules/team-rules/\`, or \`plugins/\`." + } >> "${GITHUB_STEP_SUMMARY}" + exit 0 + fi + + { + echo "should_dispatch=true" + echo "pr_number=${pr_number}" + echo "head_sha=${head_sha}" + echo "base_ref=${base_ref}" + echo "commit_title=${commit_title}" + } >> "${GITHUB_OUTPUT}" + + - name: Dispatch NVSkills CI + if: steps.context.outputs.should_dispatch == 'true' + env: + DISPATCH_TOKEN: ${{ secrets.NVSKILLS_CI_DISPATCH_TOKEN }} + REPO: ${{ github.repository }} + PR_NUMBER: ${{ steps.context.outputs.pr_number }} + REQUEST_HEAD_SHA: ${{ steps.context.outputs.head_sha }} + REQUEST_BASE_REF: ${{ steps.context.outputs.base_ref }} + REQUEST_COMMIT_TITLE: ${{ steps.context.outputs.commit_title }} + REQUEST_COMMENT_ID: ${{ github.event.comment.id || '' }} + REQUEST_RUN_ID: ${{ github.run_id }} + REQUESTED_BY: ${{ github.actor }} + run: | + set -euo pipefail + if [ -z "${DISPATCH_TOKEN}" ]; then + echo "Missing NVSKILLS_CI_DISPATCH_TOKEN secret." + exit 1 + fi + + owner="${REPO%%/*}" + repo="${REPO#*/}" + + curl -fsSL -X POST \ + -H "Authorization: Bearer ${DISPATCH_TOKEN}" \ + -H "Accept: application/vnd.github+json" \ + "https://api.github.com/repos/NVIDIA/nvskills-ci/actions/workflows/nvskills-ci.yml/dispatches" \ + -d "$(jq -n \ + --arg ref "main" \ + --arg source_owner "${owner}" \ + --arg source_repo "${repo}" \ + --arg pr_number "${PR_NUMBER}" \ + --arg request_run_id "${REQUEST_RUN_ID}" \ + --arg request_head_sha "${REQUEST_HEAD_SHA}" \ + --arg request_base_ref "${REQUEST_BASE_REF}" \ + --arg request_commit_title "${REQUEST_COMMIT_TITLE}" \ + --arg request_comment_id "${REQUEST_COMMENT_ID}" \ + --arg requested_by "${REQUESTED_BY}" \ + '{ref: $ref, inputs: { + source_owner: $source_owner, + source_repo: $source_repo, + pr_number: $pr_number, + request_run_id: $request_run_id, + request_head_sha: $request_head_sha, + request_base_ref: $request_base_ref, + request_commit_title: $request_commit_title, + request_comment_id: $request_comment_id, + requested_by: $requested_by + }}')" diff --git a/.github/workflows/require-nvskills-status.yml b/.github/workflows/require-nvskills-status.yml new file mode 100644 index 0000000000..08faca7e88 --- /dev/null +++ b/.github/workflows/require-nvskills-status.yml @@ -0,0 +1,307 @@ +# SPDX-FileCopyrightText: Copyright (c) 2026, NVIDIA CORPORATION & AFFILIATES. All rights reserved. +# SPDX-License-Identifier: Apache-2.0 + +name: Require NVSkills CI status + +on: + workflow_call: + +permissions: + contents: read + pull-requests: read + statuses: read + +jobs: + require-nvskills-ci: + runs-on: ubuntu-latest + timeout-minutes: 65 + permissions: + contents: read + pull-requests: read + statuses: read + concurrency: + group: nvskills-ci-required-${{ github.repository }}-${{ github.event.pull_request.number || github.event.sha || github.sha }} + cancel-in-progress: true + steps: + - name: Require NVSkills CI for watched changes + env: + GH_TOKEN: ${{ github.token }} + REPO: ${{ github.repository }} + PR_NUMBER: ${{ github.event.pull_request.number || '' }} + HEAD_REF: ${{ github.event.pull_request.head.ref || '' }} + HEAD_SHA: ${{ github.event.pull_request.head.sha || github.event.sha || github.sha }} + STATUS_CONTEXT: ${{ vars.NVSKILLS_STATUS_CONTEXT || 'NVSkills CI' }} + STATUS_POLL_SECONDS: ${{ vars.NVSKILLS_STATUS_POLL_SECONDS || '30' }} + MISSING_STATUS_GRACE_SECONDS: ${{ vars.NVSKILLS_MISSING_STATUS_GRACE_SECONDS || '120' }} + MAX_STATUS_WAIT_SECONDS: ${{ vars.NVSKILLS_MAX_STATUS_WAIT_SECONDS || '3600' }} + run: | + set -euo pipefail + + owner="${REPO%%/*}" + repo="${REPO#*/}" + head_sha="$(printf '%s' "${HEAD_SHA}" | tr '[:upper:]' '[:lower:]')" + pr_number="${PR_NUMBER}" + + append_summary() { + printf '%s\n' "$@" | tee -a "${GITHUB_STEP_SUMMARY}" + } + + positive_integer() { + case "$1" in + ''|*[!0-9]*|0) printf '%s' "$2" ;; + *) printf '%s' "$1" ;; + esac + } + + case "${HEAD_REF}" in + automated/sync-skills|bot/regenerate-skill-metadata) + append_summary \ + "## NVSkills CI required status" \ + "" \ + "Skipped: bot-managed branch \`${HEAD_REF}\` is exempt from this check." + exit 0 + ;; + esac + + github_get() { + curl --fail --silent --show-error --location \ + --retry 3 \ + --retry-delay 2 \ + -H "Authorization: Bearer ${GH_TOKEN}" \ + -H "Accept: application/vnd.github+json" \ + -H "X-GitHub-Api-Version: 2022-11-28" \ + "$1" + } + + get_commit_json() { + local commit_sha="$1" + local page=1 + local response + local first_response="" + local page_files + local all_files='[]' + local page_count + + while true; do + response="$(github_get "https://api.github.com/repos/${owner}/${repo}/commits/${commit_sha}?per_page=100&page=${page}")" + if [ "${page}" -eq 1 ]; then + first_response="${response}" + fi + page_files="$(printf '%s' "${response}" | jq -c '.files // []')" + page_count="$(printf '%s' "${page_files}" | jq 'length')" + all_files="$(jq -cn \ + --argjson existing "${all_files}" \ + --argjson current "${page_files}" \ + '$existing + $current')" + + if [ "${page_count}" -lt 100 ]; then + break + fi + if [ "${page}" -ge 30 ]; then + echo "Commit ${commit_sha} has too many files to classify safely." >&2 + return 1 + fi + page=$((page + 1)) + done + + printf '%s' "${first_response}" | jq -c --argjson files "${all_files}" '.files = $files' + } + + first_watched_path() { + printf '%s' "$1" | jq -r ' + def watched: + (. // "") | + startswith("skills/") or + startswith("team-skills/") or + startswith("rules/team-rules/") or + startswith("plugins/"); + [ + .files[]? | + select((.filename | watched) or (.previous_filename? | watched)) | + if (.filename | watched) then .filename else .previous_filename end + ][0] // empty + ' + } + + if [ -z "${pr_number}" ] || [ -z "${head_sha}" ]; then + echo "Pull request metadata is incomplete." + exit 1 + fi + + pr_json="$(github_get "https://api.github.com/repos/${owner}/${repo}/pulls/${pr_number}")" + current_head_sha="$(printf '%s' "${pr_json}" | jq -r '.head.sha | ascii_downcase')" + if [ "${current_head_sha}" != "${head_sha}" ]; then + append_summary \ + "## NVSkills CI required status" \ + "" \ + "Skipped: this workflow run is for stale head \`${head_sha}\`; PR #${pr_number} is now at \`${current_head_sha}\`." + exit 0 + fi + + has_watched_change=false + page=1 + while true; do + files_json="$(github_get "https://api.github.com/repos/${owner}/${repo}/pulls/${pr_number}/files?per_page=100&page=${page}")" + if printf '%s' "${files_json}" | jq -e ' + def watched: + (. // "") | + startswith("skills/") or + startswith("team-skills/") or + startswith("rules/team-rules/") or + startswith("plugins/"); + any(.[]; (.filename | watched) or (.previous_filename? | watched)) + ' >/dev/null; then + has_watched_change=true + break + fi + if [ "$(printf '%s' "${files_json}" | jq 'length')" -lt 100 ]; then + break + fi + page=$((page + 1)) + done + + if [ "${has_watched_change}" != "true" ]; then + append_summary \ + "## NVSkills CI required status" \ + "" \ + "Skipped: PR #${pr_number} has no changes under watched NVSkills paths." + exit 0 + fi + + head_commit_json="$(get_commit_json "${head_sha}")" + + commit_shas_file="$(mktemp)" + trap 'rm -f "${commit_shas_file}"' EXIT + + page=1 + while true; do + commits_json="$(github_get "https://api.github.com/repos/${owner}/${repo}/pulls/${pr_number}/commits?per_page=100&page=${page}")" + printf '%s' "${commits_json}" | jq -r '.[].sha | ascii_downcase' >> "${commit_shas_file}" + if [ "$(printf '%s' "${commits_json}" | jq 'length')" -lt 100 ]; then + break + fi + page=$((page + 1)) + done + + mapfile -t commit_shas < "${commit_shas_file}" + if [ "${#commit_shas[@]}" -eq 0 ]; then + echo "Pull request commits could not be resolved." + exit 1 + fi + + latest_watched_sha="" + latest_watched_path="" + for ((idx=${#commit_shas[@]} - 1; idx >= 0; idx--)); do + commit_sha="${commit_shas[idx]}" + if [ "${commit_sha}" = "${head_sha}" ]; then + commit_json="${head_commit_json}" + else + commit_json="$(get_commit_json "${commit_sha}")" + fi + watched_path="$(first_watched_path "${commit_json}")" + if [ -n "${watched_path}" ]; then + latest_watched_sha="${commit_sha}" + latest_watched_path="${watched_path}" + break + fi + done + + if [ -z "${latest_watched_sha}" ]; then + append_summary \ + "## NVSkills CI required status" \ + "" \ + "Skipped: PR #${pr_number} has no commits that changed watched NVSkills paths." + exit 0 + fi + + poll_seconds="$(positive_integer "${STATUS_POLL_SECONDS}" 30)" + missing_grace_seconds="$(positive_integer "${MISSING_STATUS_GRACE_SECONDS}" 120)" + max_wait_seconds="$(positive_integer "${MAX_STATUS_WAIT_SECONDS}" 3600)" + elapsed_seconds=0 + status_sha="" + status_state="missing" + target_url="" + + while true; do + status_sha="" + status_state="missing" + target_url="" + for ((idx=${#commit_shas[@]} - 1; idx >= 0; idx--)); do + commit_sha="${commit_shas[idx]}" + statuses_json="$(github_get "https://api.github.com/repos/${owner}/${repo}/commits/${commit_sha}/statuses?per_page=100")" + candidate_state="$(printf '%s' "${statuses_json}" | jq -r \ + --arg context "${STATUS_CONTEXT}" \ + '[.[] | select(.context == $context)][0].state // "missing"')" + if [ "${candidate_state}" != "missing" ]; then + status_sha="${commit_sha}" + status_state="${candidate_state}" + target_url="$(printf '%s' "${statuses_json}" | jq -r \ + --arg context "${STATUS_CONTEXT}" \ + '[.[] | select(.context == $context)][0].target_url // ""')" + break + fi + if [ "${commit_sha}" = "${latest_watched_sha}" ]; then + break + fi + done + + case "${status_state}" in + success|failure|error) + break + ;; + missing) + if [ "${elapsed_seconds}" -ge "${missing_grace_seconds}" ]; then + break + fi + ;; + pending) + if [ "${elapsed_seconds}" -ge "${max_wait_seconds}" ]; then + status_state="timeout" + break + fi + ;; + *) + echo "Unexpected ${STATUS_CONTEXT} state: ${status_state}" + exit 1 + ;; + esac + + echo "Waiting for ${STATUS_CONTEXT} at or after ${latest_watched_sha} (state: ${status_state}, elapsed: ${elapsed_seconds}s)." + sleep "${poll_seconds}" + elapsed_seconds=$((elapsed_seconds + poll_seconds)) + done + + if [ "${status_state}" = "success" ]; then + append_summary \ + "## NVSkills CI required status" \ + "" \ + "Passed: \`${STATUS_CONTEXT}\` succeeded for validation evidence commit \`${status_sha}\`." \ + "" \ + "Latest watched-path change: \`${latest_watched_path}\` at \`${latest_watched_sha}\`." + if [ "${status_sha}" != "${head_sha}" ]; then + append_summary \ + "" \ + "PR head \`${head_sha}\` contains only trailing changes outside watched NVSkills paths after the validated tree." + fi + exit 0 + fi + + append_summary \ + "## NVSkills CI required status" \ + "" \ + "Failed: no successful \`${STATUS_CONTEXT}\` status was found at or after latest watched commit \`${latest_watched_sha}\` (state: \`${status_state}\`)." \ + "" \ + "Latest watched-path change: \`${latest_watched_path}\`." \ + "" \ + "Comment \`/nvskills-ci\` on this PR after every commit that changes" \ + "\`skills/\`, \`team-skills/\`, \`rules/team-rules/\`, or \`plugins/\`." \ + "" \ + "\`/nvskills-ci\` only works on branches in \`NVIDIA/skills\`, not forks." \ + "If this PR is from a fork, move the changes to a branch in \`NVIDIA/skills\` first." + if [ -n "${status_sha}" ]; then + append_summary "" "Latest NVSkills CI status checked: \`${status_state}\` on \`${status_sha}\`." + fi + if [ -n "${target_url}" ]; then + append_summary "" "Current NVSkills CI run: ${target_url}" + fi + exit 1 From 95cbd1e9e1d2edeb7a2f963e767488313495f0d0 Mon Sep 17 00:00:00 2001 From: Ramakrishna Prabhu Date: Fri, 7 Aug 2026 10:19:45 -0500 Subject: [PATCH 2/3] fix: align title prefix check and add previous_filename to watched-path detection --- .github/workflows/request-nvskills-ci.yml | 13 ++++++++----- 1 file changed, 8 insertions(+), 5 deletions(-) diff --git a/.github/workflows/request-nvskills-ci.yml b/.github/workflows/request-nvskills-ci.yml index f7cd01f8cb..8142c5fbcc 100644 --- a/.github/workflows/request-nvskills-ci.yml +++ b/.github/workflows/request-nvskills-ci.yml @@ -79,10 +79,13 @@ jobs: commit_title="$(printf '%s' "${HEAD_COMMIT_MESSAGE}" | sed -n '1p')" if [ "${EVENT_NAME}" = "push" ]; then - if [ "${commit_title}" != "${SIGNATURE_COMMIT_TITLE}" ]; then - echo "Push is not the configured NVSkills signature commit; skipping dispatch." - exit 0 - fi + case "${commit_title}" in + "${SIGNATURE_COMMIT_TITLE}"*) ;; + *) + echo "Push is not the configured NVSkills signature commit; skipping dispatch." + exit 0 + ;; + esac if [ "${ACTOR}" != "${SIGNATURE_PUSH_ACTOR}" ]; then echo "Push actor ${ACTOR} is not the configured NVSkills signing actor; skipping dispatch." exit 0 @@ -127,7 +130,7 @@ jobs: -H "Accept: application/vnd.github+json" \ "https://api.github.com/repos/${owner}/${repo}/pulls/${pr_number}/files?per_page=100&page=${page}")" if printf '%s' "${files_json}" | jq -e ' - any(.[]; .filename | + any(.[]; (.filename, .previous_filename // "") | startswith("skills/") or startswith("team-skills/") or startswith("rules/team-rules/") or From 3302395dd58db8cd081e4e59c7a391162d100f76 Mon Sep 17 00:00:00 2001 From: Ramakrishna Prabhu Date: Fri, 7 Aug 2026 11:06:12 -0500 Subject: [PATCH 3/3] fix: revert title-match fix (intentional), use central require-nvskills-status from NVIDIA/skills --- .github/workflows/request-nvskills-ci.yml | 13 +- .github/workflows/require-nvskills-status.yml | 307 ------------------ 2 files changed, 5 insertions(+), 315 deletions(-) delete mode 100644 .github/workflows/require-nvskills-status.yml diff --git a/.github/workflows/request-nvskills-ci.yml b/.github/workflows/request-nvskills-ci.yml index 8142c5fbcc..da28f21ded 100644 --- a/.github/workflows/request-nvskills-ci.yml +++ b/.github/workflows/request-nvskills-ci.yml @@ -26,7 +26,7 @@ jobs: contents: read pull-requests: read statuses: read - uses: ./.github/workflows/require-nvskills-status.yml + uses: NVIDIA/skills/.github/workflows/require-nvskills-status.yml@main request: if: > @@ -79,13 +79,10 @@ jobs: commit_title="$(printf '%s' "${HEAD_COMMIT_MESSAGE}" | sed -n '1p')" if [ "${EVENT_NAME}" = "push" ]; then - case "${commit_title}" in - "${SIGNATURE_COMMIT_TITLE}"*) ;; - *) - echo "Push is not the configured NVSkills signature commit; skipping dispatch." - exit 0 - ;; - esac + if [ "${commit_title}" != "${SIGNATURE_COMMIT_TITLE}" ]; then + echo "Push is not the configured NVSkills signature commit; skipping dispatch." + exit 0 + fi if [ "${ACTOR}" != "${SIGNATURE_PUSH_ACTOR}" ]; then echo "Push actor ${ACTOR} is not the configured NVSkills signing actor; skipping dispatch." exit 0 diff --git a/.github/workflows/require-nvskills-status.yml b/.github/workflows/require-nvskills-status.yml deleted file mode 100644 index 08faca7e88..0000000000 --- a/.github/workflows/require-nvskills-status.yml +++ /dev/null @@ -1,307 +0,0 @@ -# SPDX-FileCopyrightText: Copyright (c) 2026, NVIDIA CORPORATION & AFFILIATES. All rights reserved. -# SPDX-License-Identifier: Apache-2.0 - -name: Require NVSkills CI status - -on: - workflow_call: - -permissions: - contents: read - pull-requests: read - statuses: read - -jobs: - require-nvskills-ci: - runs-on: ubuntu-latest - timeout-minutes: 65 - permissions: - contents: read - pull-requests: read - statuses: read - concurrency: - group: nvskills-ci-required-${{ github.repository }}-${{ github.event.pull_request.number || github.event.sha || github.sha }} - cancel-in-progress: true - steps: - - name: Require NVSkills CI for watched changes - env: - GH_TOKEN: ${{ github.token }} - REPO: ${{ github.repository }} - PR_NUMBER: ${{ github.event.pull_request.number || '' }} - HEAD_REF: ${{ github.event.pull_request.head.ref || '' }} - HEAD_SHA: ${{ github.event.pull_request.head.sha || github.event.sha || github.sha }} - STATUS_CONTEXT: ${{ vars.NVSKILLS_STATUS_CONTEXT || 'NVSkills CI' }} - STATUS_POLL_SECONDS: ${{ vars.NVSKILLS_STATUS_POLL_SECONDS || '30' }} - MISSING_STATUS_GRACE_SECONDS: ${{ vars.NVSKILLS_MISSING_STATUS_GRACE_SECONDS || '120' }} - MAX_STATUS_WAIT_SECONDS: ${{ vars.NVSKILLS_MAX_STATUS_WAIT_SECONDS || '3600' }} - run: | - set -euo pipefail - - owner="${REPO%%/*}" - repo="${REPO#*/}" - head_sha="$(printf '%s' "${HEAD_SHA}" | tr '[:upper:]' '[:lower:]')" - pr_number="${PR_NUMBER}" - - append_summary() { - printf '%s\n' "$@" | tee -a "${GITHUB_STEP_SUMMARY}" - } - - positive_integer() { - case "$1" in - ''|*[!0-9]*|0) printf '%s' "$2" ;; - *) printf '%s' "$1" ;; - esac - } - - case "${HEAD_REF}" in - automated/sync-skills|bot/regenerate-skill-metadata) - append_summary \ - "## NVSkills CI required status" \ - "" \ - "Skipped: bot-managed branch \`${HEAD_REF}\` is exempt from this check." - exit 0 - ;; - esac - - github_get() { - curl --fail --silent --show-error --location \ - --retry 3 \ - --retry-delay 2 \ - -H "Authorization: Bearer ${GH_TOKEN}" \ - -H "Accept: application/vnd.github+json" \ - -H "X-GitHub-Api-Version: 2022-11-28" \ - "$1" - } - - get_commit_json() { - local commit_sha="$1" - local page=1 - local response - local first_response="" - local page_files - local all_files='[]' - local page_count - - while true; do - response="$(github_get "https://api.github.com/repos/${owner}/${repo}/commits/${commit_sha}?per_page=100&page=${page}")" - if [ "${page}" -eq 1 ]; then - first_response="${response}" - fi - page_files="$(printf '%s' "${response}" | jq -c '.files // []')" - page_count="$(printf '%s' "${page_files}" | jq 'length')" - all_files="$(jq -cn \ - --argjson existing "${all_files}" \ - --argjson current "${page_files}" \ - '$existing + $current')" - - if [ "${page_count}" -lt 100 ]; then - break - fi - if [ "${page}" -ge 30 ]; then - echo "Commit ${commit_sha} has too many files to classify safely." >&2 - return 1 - fi - page=$((page + 1)) - done - - printf '%s' "${first_response}" | jq -c --argjson files "${all_files}" '.files = $files' - } - - first_watched_path() { - printf '%s' "$1" | jq -r ' - def watched: - (. // "") | - startswith("skills/") or - startswith("team-skills/") or - startswith("rules/team-rules/") or - startswith("plugins/"); - [ - .files[]? | - select((.filename | watched) or (.previous_filename? | watched)) | - if (.filename | watched) then .filename else .previous_filename end - ][0] // empty - ' - } - - if [ -z "${pr_number}" ] || [ -z "${head_sha}" ]; then - echo "Pull request metadata is incomplete." - exit 1 - fi - - pr_json="$(github_get "https://api.github.com/repos/${owner}/${repo}/pulls/${pr_number}")" - current_head_sha="$(printf '%s' "${pr_json}" | jq -r '.head.sha | ascii_downcase')" - if [ "${current_head_sha}" != "${head_sha}" ]; then - append_summary \ - "## NVSkills CI required status" \ - "" \ - "Skipped: this workflow run is for stale head \`${head_sha}\`; PR #${pr_number} is now at \`${current_head_sha}\`." - exit 0 - fi - - has_watched_change=false - page=1 - while true; do - files_json="$(github_get "https://api.github.com/repos/${owner}/${repo}/pulls/${pr_number}/files?per_page=100&page=${page}")" - if printf '%s' "${files_json}" | jq -e ' - def watched: - (. // "") | - startswith("skills/") or - startswith("team-skills/") or - startswith("rules/team-rules/") or - startswith("plugins/"); - any(.[]; (.filename | watched) or (.previous_filename? | watched)) - ' >/dev/null; then - has_watched_change=true - break - fi - if [ "$(printf '%s' "${files_json}" | jq 'length')" -lt 100 ]; then - break - fi - page=$((page + 1)) - done - - if [ "${has_watched_change}" != "true" ]; then - append_summary \ - "## NVSkills CI required status" \ - "" \ - "Skipped: PR #${pr_number} has no changes under watched NVSkills paths." - exit 0 - fi - - head_commit_json="$(get_commit_json "${head_sha}")" - - commit_shas_file="$(mktemp)" - trap 'rm -f "${commit_shas_file}"' EXIT - - page=1 - while true; do - commits_json="$(github_get "https://api.github.com/repos/${owner}/${repo}/pulls/${pr_number}/commits?per_page=100&page=${page}")" - printf '%s' "${commits_json}" | jq -r '.[].sha | ascii_downcase' >> "${commit_shas_file}" - if [ "$(printf '%s' "${commits_json}" | jq 'length')" -lt 100 ]; then - break - fi - page=$((page + 1)) - done - - mapfile -t commit_shas < "${commit_shas_file}" - if [ "${#commit_shas[@]}" -eq 0 ]; then - echo "Pull request commits could not be resolved." - exit 1 - fi - - latest_watched_sha="" - latest_watched_path="" - for ((idx=${#commit_shas[@]} - 1; idx >= 0; idx--)); do - commit_sha="${commit_shas[idx]}" - if [ "${commit_sha}" = "${head_sha}" ]; then - commit_json="${head_commit_json}" - else - commit_json="$(get_commit_json "${commit_sha}")" - fi - watched_path="$(first_watched_path "${commit_json}")" - if [ -n "${watched_path}" ]; then - latest_watched_sha="${commit_sha}" - latest_watched_path="${watched_path}" - break - fi - done - - if [ -z "${latest_watched_sha}" ]; then - append_summary \ - "## NVSkills CI required status" \ - "" \ - "Skipped: PR #${pr_number} has no commits that changed watched NVSkills paths." - exit 0 - fi - - poll_seconds="$(positive_integer "${STATUS_POLL_SECONDS}" 30)" - missing_grace_seconds="$(positive_integer "${MISSING_STATUS_GRACE_SECONDS}" 120)" - max_wait_seconds="$(positive_integer "${MAX_STATUS_WAIT_SECONDS}" 3600)" - elapsed_seconds=0 - status_sha="" - status_state="missing" - target_url="" - - while true; do - status_sha="" - status_state="missing" - target_url="" - for ((idx=${#commit_shas[@]} - 1; idx >= 0; idx--)); do - commit_sha="${commit_shas[idx]}" - statuses_json="$(github_get "https://api.github.com/repos/${owner}/${repo}/commits/${commit_sha}/statuses?per_page=100")" - candidate_state="$(printf '%s' "${statuses_json}" | jq -r \ - --arg context "${STATUS_CONTEXT}" \ - '[.[] | select(.context == $context)][0].state // "missing"')" - if [ "${candidate_state}" != "missing" ]; then - status_sha="${commit_sha}" - status_state="${candidate_state}" - target_url="$(printf '%s' "${statuses_json}" | jq -r \ - --arg context "${STATUS_CONTEXT}" \ - '[.[] | select(.context == $context)][0].target_url // ""')" - break - fi - if [ "${commit_sha}" = "${latest_watched_sha}" ]; then - break - fi - done - - case "${status_state}" in - success|failure|error) - break - ;; - missing) - if [ "${elapsed_seconds}" -ge "${missing_grace_seconds}" ]; then - break - fi - ;; - pending) - if [ "${elapsed_seconds}" -ge "${max_wait_seconds}" ]; then - status_state="timeout" - break - fi - ;; - *) - echo "Unexpected ${STATUS_CONTEXT} state: ${status_state}" - exit 1 - ;; - esac - - echo "Waiting for ${STATUS_CONTEXT} at or after ${latest_watched_sha} (state: ${status_state}, elapsed: ${elapsed_seconds}s)." - sleep "${poll_seconds}" - elapsed_seconds=$((elapsed_seconds + poll_seconds)) - done - - if [ "${status_state}" = "success" ]; then - append_summary \ - "## NVSkills CI required status" \ - "" \ - "Passed: \`${STATUS_CONTEXT}\` succeeded for validation evidence commit \`${status_sha}\`." \ - "" \ - "Latest watched-path change: \`${latest_watched_path}\` at \`${latest_watched_sha}\`." - if [ "${status_sha}" != "${head_sha}" ]; then - append_summary \ - "" \ - "PR head \`${head_sha}\` contains only trailing changes outside watched NVSkills paths after the validated tree." - fi - exit 0 - fi - - append_summary \ - "## NVSkills CI required status" \ - "" \ - "Failed: no successful \`${STATUS_CONTEXT}\` status was found at or after latest watched commit \`${latest_watched_sha}\` (state: \`${status_state}\`)." \ - "" \ - "Latest watched-path change: \`${latest_watched_path}\`." \ - "" \ - "Comment \`/nvskills-ci\` on this PR after every commit that changes" \ - "\`skills/\`, \`team-skills/\`, \`rules/team-rules/\`, or \`plugins/\`." \ - "" \ - "\`/nvskills-ci\` only works on branches in \`NVIDIA/skills\`, not forks." \ - "If this PR is from a fork, move the changes to a branch in \`NVIDIA/skills\` first." - if [ -n "${status_sha}" ]; then - append_summary "" "Latest NVSkills CI status checked: \`${status_state}\` on \`${status_sha}\`." - fi - if [ -n "${target_url}" ]; then - append_summary "" "Current NVSkills CI run: ${target_url}" - fi - exit 1