Installer Hash PR #9395 head a94787c570579dd8d58877fe5084237b2dfe5cad base fb01aff8ed67596dcdfe38cb6f5dccdcba301a33 gate true #42697
Workflow file for this run
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| # SPDX-FileCopyrightText: Copyright (c) 2026 NVIDIA CORPORATION & AFFILIATES. All rights reserved. | |
| # SPDX-License-Identifier: Apache-2.0 | |
| # | |
| # Verifies pinned installer SHA-256 hashes still match upstream scripts. | |
| # Checked: allowlisted OpenShell installer and Brev release assets. | |
| # Reports the required network-backed drift check on every PR, every push to | |
| # main, and weekly. Pull requests execute checker code from their base commit. | |
| # A new release-manifest allowlist entry must land on main in a prerequisite PR | |
| # before a later PR changes runtime selectors to that release. | |
| name: Security / Installer Hash Check | |
| run-name: >- | |
| ${{ github.event_name == 'pull_request' && | |
| format('Installer Hash PR #{0} head {1} base {2} gate true', | |
| github.event.pull_request.number, github.event.pull_request.head.sha, | |
| github.event.pull_request.base.sha) || | |
| format('Installer Hash {0} {1}', github.event_name, github.sha) }} | |
| on: | |
| pull_request: | |
| types: [opened, synchronize, reopened, edited] | |
| push: | |
| branches: [main] | |
| schedule: | |
| # Weekly fallback in case upstream changes between PRs | |
| - cron: "30 9 * * 1" | |
| workflow_dispatch: | |
| permissions: | |
| contents: read | |
| jobs: | |
| check-hash: | |
| if: github.repository == 'NVIDIA/NemoClaw' | |
| runs-on: ubuntu-latest | |
| timeout-minutes: 5 | |
| steps: | |
| - name: Set up trusted installer hash parser runtime | |
| uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0 | |
| with: | |
| node-version: 22.19.0 | |
| # The checkout of the latest PR commit supplies data only. The checker and | |
| # pin parser execute from the checkout of the PR base SHA below. | |
| - name: Checkout pull request head | |
| if: github.event_name == 'pull_request' | |
| uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 | |
| with: | |
| repository: ${{ github.event.pull_request.head.repo.full_name }} | |
| ref: ${{ github.event.pull_request.head.sha }} | |
| persist-credentials: false | |
| - name: Checkout trusted event | |
| if: github.event_name != 'pull_request' | |
| uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 | |
| with: | |
| persist-credentials: false | |
| - name: Checkout base-trusted installer hash action | |
| if: github.event_name == 'pull_request' | |
| uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 | |
| with: | |
| ref: ${{ github.event.pull_request.base.sha }} | |
| path: .trusted-installer-hash | |
| persist-credentials: false | |
| sparse-checkout: | | |
| .github/actions/ci-installer-hash-check | |
| scripts/check-installer-hash.sh | |
| scripts/checks/extract-installer-pins.mts | |
| sparse-checkout-cone-mode: false | |
| - name: Verify pull request installer hashes from base-trusted code | |
| if: github.event_name == 'pull_request' | |
| uses: ./.trusted-installer-hash/.github/actions/ci-installer-hash-check | |
| with: | |
| repo-root: ${{ github.workspace }} | |
| - name: Verify trusted event installer hashes | |
| if: github.event_name != 'pull_request' | |
| uses: ./.github/actions/ci-installer-hash-check | |
| with: | |
| repo-root: ${{ github.workspace }} |