Installer Hash PR #9011 head bab296a70fbbfc6a823adb287d8091fa9880f8f5 base 105c1dfb2710e3fbdcbd9411ae0c3c07c3d1e4bf gate true #39680
Workflow file for this run
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| # SPDX-FileCopyrightText: Copyright (c) 2026 NVIDIA CORPORATION & AFFILIATES. All rights reserved. | |
| # SPDX-License-Identifier: Apache-2.0 | |
| # | |
| # Verifies pinned installer SHA-256 hashes still match upstream scripts. | |
| # Checked: allowlisted OpenShell installer and Brev release assets. | |
| # Reports the required network-backed drift check on every PR, every push to | |
| # main, and weekly. Pull requests execute checker code from their base commit. | |
| # A new release-manifest allowlist entry must land on main in a prerequisite PR | |
| # before a later PR changes runtime selectors to that release. | |
| name: Security / Installer Hash Check | |
| run-name: >- | |
| ${{ github.event_name == 'pull_request' && | |
| format('Installer Hash PR #{0} head {1} base {2} gate true', | |
| github.event.pull_request.number, github.event.pull_request.head.sha, | |
| github.event.pull_request.base.sha) || | |
| format('Installer Hash {0} {1}', github.event_name, github.sha) }} | |
| on: | |
| pull_request: | |
| types: [opened, synchronize, reopened, edited] | |
| push: | |
| branches: [main] | |
| schedule: | |
| # Weekly fallback in case upstream changes between PRs | |
| - cron: "30 9 * * 1" | |
| workflow_dispatch: | |
| permissions: | |
| contents: read | |
| jobs: | |
| check-hash: | |
| if: github.repository == 'NVIDIA/NemoClaw' | |
| runs-on: ubuntu-latest | |
| timeout-minutes: 5 | |
| steps: | |
| - name: Set up trusted installer hash parser runtime | |
| uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0 | |
| with: | |
| node-version: 22.19.0 | |
| # The checkout of the latest PR commit supplies data only. The checker and | |
| # pin parser execute from the checkout of the PR base SHA below. | |
| - name: Checkout pull request head | |
| if: github.event_name == 'pull_request' | |
| uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 | |
| with: | |
| repository: ${{ github.event.pull_request.head.repo.full_name }} | |
| ref: ${{ github.event.pull_request.head.sha }} | |
| persist-credentials: false | |
| - name: Checkout trusted event | |
| if: github.event_name != 'pull_request' | |
| uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 | |
| with: | |
| persist-credentials: false | |
| - name: Checkout base-trusted installer hash action | |
| if: github.event_name == 'pull_request' | |
| uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 | |
| with: | |
| ref: ${{ github.event.pull_request.base.sha }} | |
| path: .trusted-installer-hash | |
| persist-credentials: false | |
| sparse-checkout: | | |
| .github/actions/ci-installer-hash-check | |
| scripts/check-installer-hash.sh | |
| scripts/checks/extract-installer-pins.mts | |
| sparse-checkout-cone-mode: false | |
| - name: Verify pull request installer hashes from base-trusted code | |
| if: github.event_name == 'pull_request' | |
| uses: ./.trusted-installer-hash/.github/actions/ci-installer-hash-check | |
| with: | |
| repo-root: ${{ github.workspace }} | |
| - name: Verify trusted event installer hashes | |
| if: github.event_name != 'pull_request' | |
| uses: ./.github/actions/ci-installer-hash-check | |
| with: | |
| repo-root: ${{ github.workspace }} |