ci: add Verify Signed Skills workflow#78
Open
codepydog wants to merge 2 commits into
Open
Conversation
Adds a CI guard that runs `model_signing verify certificate` against every `skill.oms.sig` published in the catalog. Triggers on PR, push to main, daily schedule, and manual dispatch. Trust anchor is read from `.github/trust/nv-agent-root-cert.pem` if committed, otherwise from the `NV_AGENT_ROOT_CERT_PEM` repo secret. When neither is set the job is skipped with a warning, so the workflow can land before the trust anchor distribution is decided. Motivated by NVIDIA#77: every signed cuOpt skill currently fails verification because the daily sync pipeline lands a newer SKILL.md than what was signed. A CI guard would have caught this before the mismatch shipped to the public catalog. Signed-off-by: happydog <codepydog@gmail.com>
codepydog
force-pushed
the
ci/add-signed-skills-verification
branch
from
ee1fb08 to
886521b
Compare
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Runs
model_signing verify certificateagainst everyskill.oms.sigon PR, push to main, and daily at 09:00 UTC (after the sync passes). Motivated by #77 — this would have caught the cuOptSKILL.mddrift before it shipped.Trust anchor
Lookup order (first match wins):
./nv-agent-root-cert.pemat repo root — where NVIDIA committed it inc27e3d0and documented atfd1516e..github/trust/nv-agent-root-cert.pem— committed fallback.NV_AGENT_ROOT_CERT_PEM— PEM contents, written into the fallback path at runtime.If none is present the job skips with a warning. With NVIDIA's existing
nv-agent-root-cert.pemat repo root, no additional setup is needed for this workflow to activate on merge.Local dry-run at HEAD
fd1516eThe original 9 from #77 plus three newly signed since:
cuopt-developer,cuopt-install,cuopt-numerical-optimization-api-python. The drift has expanded — this CI gate would have prevented that.Test plan
./nv-agent-root-cert.pemand reports 12 failures (matching the dry-run)