Add nvskills ci workflow#1246
Conversation
Adds the NVSkills CI request workflow from the upstream template (NVIDIA/nvskills-ci) to enable signature validation on PRs touching skills/. Excludes the new workflow from pr.yaml change-filters and allows NVIDIA/nvskills-ci references in zizmor (matching the existing rapidsai exemption). Onboarding still requires manual steps: NVCARPS team to add the repo to the policy, install the nv-nvskill-ci GitHub App, and provide the NVSKILLS_CI_DISPATCH_TOKEN secret. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com> Signed-off-by: Ramakrishna Prabhu <ramakrishnap@nvidia.com>
Adds a brief CONTRIBUTING.md note and a header comment on the workflow file describing how to trigger NVSkills CI on PRs touching skills/. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com> Signed-off-by: Ramakrishna Prabhu <ramakrishnap@nvidia.com>
Replaces the NVIDIA/nvskills-ci allowlist entry with NVIDIA/skills to match the reusable workflow path used by request-nvskills-ci.yml. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com> Signed-off-by: Ramakrishna Prabhu <ramakrishnap@nvidia.com>
|
Auto-sync is disabled for draft pull requests in this repository. Workflows must be run manually. Contributors can view more details about this message here. |
|
/nvskills-ci |
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com> Signed-off-by: Ramakrishna Prabhu <ramakrishnap@nvidia.com>
|
/nvskills-ci |
|
/nvskills-ci |
📝 WalkthroughWalkthroughThis PR introduces NVSkills CI integration to validate skill-directory changes. A new GitHub Actions workflow accepts ChangesNVSkills CI Integration
Estimated code review effort🎯 2 (Simple) | ⏱️ ~8 minutes Possibly related PRs
Suggested labels
Suggested reviewers
🚥 Pre-merge checks | ✅ 5✅ Passed checks (5 passed)
✏️ Tip: You can configure your own custom pre-merge checks in the settings. ✨ Finishing Touches🧪 Generate unit tests (beta)
Warning Review ran into problems🔥 ProblemsStopped waiting for pipeline failures after 30000ms. One of your pipelines takes longer than our 30000ms fetch window to run, so review may not consider pipeline-failure results for inline comments if any failures occurred after the fetch window. Increase the timeout if you want to wait longer or run a Comment |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 2
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In @.github/workflows/request-nvskills-ci.yml:
- Around line 17-23: The issue is that the issue_comment branch accepts any PR
comment starting with /nvskills-ci without checking commenter permissions;
update the if condition so the issue_comment path also requires the commenter to
be a repo maintainer/admin by adding a check on
github.event.comment.author_association (e.g. require it to be one of OWNER,
MEMBER, MAINTAINER, or COLLABORATOR) alongside the existing
startsWith(github.event.comment.body, '/nvskills-ci') and
github.event.issue.pull_request tests; locate the condition containing
startsWith(github.event.comment.body, '/nvskills-ci') and add the
author_association membership check to restrict who can trigger the workflow.
In @.github/zizmor.yml:
- Line 9: Replace the broad repository pattern "NVIDIA/skills/*": any with a
precise workflow path that matches the imported file; update the policy entry to
"NVIDIA/skills/.github/workflows/team-request.yml": any so the allowance only
covers the exact workflow used (locate the key "NVIDIA/skills/*" in
.github/zizmor.yml and change it to the full path
"NVIDIA/skills/.github/workflows/team-request.yml").
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Path: .coderabbit.yaml
Review profile: CHILL
Plan: Enterprise
Run ID: c9414a27-c59c-4089-b2bc-76529cc28071
📒 Files selected for processing (5)
.github/workflows/pr.yaml.github/workflows/request-nvskills-ci.yml.github/zizmor.ymlCONTRIBUTING.mdskills/cuopt-developer/SKILL.md
| if: > | ||
| (github.event_name == 'issue_comment' && | ||
| github.event.issue.pull_request && | ||
| startsWith(github.event.comment.body, '/nvskills-ci')) || | ||
| (github.event_name == 'push' && | ||
| github.actor == (vars.NVSKILLS_SIGNATURE_PUSH_ACTOR || 'nv-nvskill-ci[bot]') && | ||
| startsWith(github.event.head_commit.message, vars.NVSKILLS_SIGNATURE_COMMIT_TITLE || 'Attach NVSkills validation signatures')) |
There was a problem hiding this comment.
Add commenter authorization to the issue_comment trigger path.
The condition currently accepts any PR comment starting with /nvskills-ci, but it does not enforce maintainer/admin permissions as described in the header comment. That allows unauthorized users to trigger this workflow.
Suggested fix
if: >
(github.event_name == 'issue_comment' &&
github.event.issue.pull_request &&
- startsWith(github.event.comment.body, '/nvskills-ci')) ||
+ contains(fromJSON('["OWNER","MEMBER","COLLABORATOR"]'), github.event.comment.author_association) &&
+ startsWith(github.event.comment.body, '/nvskills-ci')) ||
(github.event_name == 'push' &&
github.actor == (vars.NVSKILLS_SIGNATURE_PUSH_ACTOR || 'nv-nvskill-ci[bot]') &&
startsWith(github.event.head_commit.message, vars.NVSKILLS_SIGNATURE_COMMIT_TITLE || 'Attach NVSkills validation signatures'))📝 Committable suggestion
‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.
| if: > | |
| (github.event_name == 'issue_comment' && | |
| github.event.issue.pull_request && | |
| startsWith(github.event.comment.body, '/nvskills-ci')) || | |
| (github.event_name == 'push' && | |
| github.actor == (vars.NVSKILLS_SIGNATURE_PUSH_ACTOR || 'nv-nvskill-ci[bot]') && | |
| startsWith(github.event.head_commit.message, vars.NVSKILLS_SIGNATURE_COMMIT_TITLE || 'Attach NVSkills validation signatures')) | |
| if: > | |
| (github.event_name == 'issue_comment' && | |
| github.event.issue.pull_request && | |
| contains(fromJSON('["OWNER","MEMBER","COLLABORATOR"]'), github.event.comment.author_association) && | |
| startsWith(github.event.comment.body, '/nvskills-ci')) || | |
| (github.event_name == 'push' && | |
| github.actor == (vars.NVSKILLS_SIGNATURE_PUSH_ACTOR || 'nv-nvskill-ci[bot]') && | |
| startsWith(github.event.head_commit.message, vars.NVSKILLS_SIGNATURE_COMMIT_TITLE || 'Attach NVSkills validation signatures')) |
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In @.github/workflows/request-nvskills-ci.yml around lines 17 - 23, The issue is
that the issue_comment branch accepts any PR comment starting with /nvskills-ci
without checking commenter permissions; update the if condition so the
issue_comment path also requires the commenter to be a repo maintainer/admin by
adding a check on github.event.comment.author_association (e.g. require it to be
one of OWNER, MEMBER, MAINTAINER, or COLLABORATOR) alongside the existing
startsWith(github.event.comment.body, '/nvskills-ci') and
github.event.issue.pull_request tests; locate the condition containing
startsWith(github.event.comment.body, '/nvskills-ci') and add the
author_association membership check to restrict who can trigger the workflow.
| # rapidsai/shared-workflows and rapidsai/shared-actions | ||
| "rapidsai/shared-workflows/*": any | ||
| "rapidsai/shared-actions/*": any | ||
| "NVIDIA/skills/*": any |
There was a problem hiding this comment.
🧩 Analysis chain
🏁 Script executed:
cat -n .github/zizmor.yml | head -20Repository: NVIDIA/cuopt
Length of output: 466
🏁 Script executed:
# Get full context of the zizmor.yml file
wc -l .github/zizmor.ymlRepository: NVIDIA/cuopt
Length of output: 78
🏁 Script executed:
# Search for any references to NVIDIA/skills in the codebase
rg "NVIDIA/skills" --type yaml --type ymlRepository: NVIDIA/cuopt
Length of output: 84
🏁 Script executed:
# Check git history to understand what changed
git diff HEAD~1 .github/zizmor.yml 2>/dev/null || git log --oneline -5 .github/zizmor.yml 2>/dev/nullRepository: NVIDIA/cuopt
Length of output: 114
🏁 Script executed:
# Search for NVIDIA/skills usage in workflow files
rg "NVIDIA/skills" .github/workflows/Repository: NVIDIA/cuopt
Length of output: 162
🏁 Script executed:
# Get the diff for this file to see what changed
git diff -- .github/zizmor.yml || git show HEAD:.github/zizmor.ymlRepository: NVIDIA/cuopt
Length of output: 38
🏁 Script executed:
# List all workflow files to understand the context
find .github/workflows -type f -name "*.yml" -o -name "*.yaml"Repository: NVIDIA/cuopt
Length of output: 587
🏁 Script executed:
# Check if there are multiple NVIDIA/skills workflows referenced
rg "uses:.*NVIDIA/skills" .github/ -A 2Repository: NVIDIA/cuopt
Length of output: 335
🏁 Script executed:
# Check git status to see if this file is modified in current PR
git status .github/zizmor.ymlRepository: NVIDIA/cuopt
Length of output: 122
🏁 Script executed:
# Get the actual diff for the PR
git diff .github/zizmor.ymlRepository: NVIDIA/cuopt
Length of output: 38
🏁 Script executed:
# Check the git log to see when this line was added
git log -p --all -- .github/zizmor.yml | grep -A 5 -B 5 "NVIDIA/skills" | head -30Repository: NVIDIA/cuopt
Length of output: 38
🏁 Script executed:
# Check the complete git history to understand when this line was introduced
git log --all --oneline .github/zizmor.ymlRepository: NVIDIA/cuopt
Length of output: 200
🏁 Script executed:
# Check if maybe this is a new file in the PR
git show HEAD:.github/zizmor.yml 2>/dev/null | head -15Repository: NVIDIA/cuopt
Length of output: 396
🏁 Script executed:
# Let's check all branches to see the change context
git branch -aRepository: NVIDIA/cuopt
Length of output: 154
🏁 Script executed:
# Search for any other NVIDIA references that might justify the wildcard
rg "NVIDIA/" .github/workflows/ | grep -v "^Binary"Repository: NVIDIA/cuopt
Length of output: 314
🏁 Script executed:
# Check if this line was added in the recent commit
git show 73c9903:.github/zizmor.yml | grep -A 3 -B 3 "NVIDIA/skills"Repository: NVIDIA/cuopt
Length of output: 38
🏁 Script executed:
# Check the parent commit to see if it existed before
git show 73c9903^:.github/zizmor.yml 2>/dev/null | grep "NVIDIA/skills" || echo "Line did not exist in parent"Repository: NVIDIA/cuopt
Length of output: 85
🏁 Script executed:
# Verify the exact change in that commit
git show 73c9903 -- .github/zizmor.yml | head -50Repository: NVIDIA/cuopt
Length of output: 1330
🏁 Script executed:
# Double-check what commit is currently at HEAD
git log -1 --onelineRepository: NVIDIA/cuopt
Length of output: 114
🏁 Script executed:
# Check if there were changes to zizmor.yml after the initial commit
git log --all --oneline -- .github/zizmor.ymlRepository: NVIDIA/cuopt
Length of output: 200
🏁 Script executed:
# Verify the current state is different from the initial commit
git diff 73c9903 HEAD -- .github/zizmor.ymlRepository: NVIDIA/cuopt
Length of output: 418
Scope the unpinned exception to the exact NVIDIA/skills workflow path.
The policy "NVIDIA/skills/*": any is broader than needed—only NVIDIA/skills/.github/workflows/team-request.yml is imported. Narrow this to the specific workflow to enforce least privilege and prevent future unpinned imports from other paths in that repository.
Suggested fix
- "NVIDIA/skills/*": any
+ "NVIDIA/skills/.github/workflows/team-request.yml": any📝 Committable suggestion
‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.
| "NVIDIA/skills/*": any | |
| "NVIDIA/skills/.github/workflows/team-request.yml": any |
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In @.github/zizmor.yml at line 9, Replace the broad repository pattern
"NVIDIA/skills/*": any with a precise workflow path that matches the imported
file; update the policy entry to
"NVIDIA/skills/.github/workflows/team-request.yml": any so the allowance only
covers the exact workflow used (locate the key "NVIDIA/skills/*" in
.github/zizmor.yml and change it to the full path
"NVIDIA/skills/.github/workflows/team-request.yml").
1 participant
Description
Issue
Checklist