Merge branch 'main' into feat/1172-consolidate-kwok-workflows

Author: mohityadav8

.claude/CLAUDE.md

@@ -248,6 +248,7 @@ slog.Error("operation failed", "error", err, "component", "gpu-collector")
   helm:
     defaultRepository: https://charts.example.com
     defaultChart: example/my-operator
+    defaultVersion: v1.0.0  # required: an unpinned Helm chart fails recipe resolution
   nodeScheduling:
     system:
       nodeSelectorPaths: [operator.nodeSelector]

.github/CODEOWNERS

@@ -38,6 +38,12 @@ pkg/health/** @nvidia/aicr-maintainer
 tools/health/** @nvidia/aicr-maintainer
 docs/user/recipe-health.md @nvidia/aicr-maintainer
 
+# NodeWright tuning status (ADR-009 sibling): the generated component tuning
+# coverage table and its extractor/generator.
+pkg/tuning/** @nvidia/aicr-maintainer
+tools/tuning/** @nvidia/aicr-maintainer
+tools/internal/docgen/** @nvidia/aicr-maintainer
+
 # Recipe-quality surfaces (RQ): the CUJ/CLI coverage matrix generator
 tools/coverage/** @nvidia/aicr-maintainer
 

.github/actions/README.md

@@ -311,6 +311,7 @@ jobs:
       - uses: ./.github/actions/go-test
         with:
           go_version: ${{ steps.versions.outputs.go }}
+          helm_version: ${{ steps.versions.outputs.helm }}
           coverage_report: 'true'
       - uses: ./.github/actions/go-lint
         with:
@@ -331,6 +332,7 @@ jobs:
       - uses: ./.github/actions/go-test
         with:
           go_version: ${{ steps.versions.outputs.go }}
+          helm_version: ${{ steps.versions.outputs.helm }}
       - uses: ./.github/actions/go-build-release
         id: release
         with:
@@ -395,5 +397,6 @@ To use these actions in other repositories:
 - uses: NVIDIA/aicr/.github/actions/go-test@main
   with:
     go_version: '1.26'
+    helm_version: 'v4.2.2'
     coverage_report: 'true'
 ```

.github/actions/cli-e2e/action.yml

@@ -34,10 +34,21 @@ inputs:
   helmfile_sha256:
     description: 'Helmfile SHA256 checksum for linux/amd64 (from .settings.yaml)'
     required: true
+  cosign_version:
+    description: 'Cosign version (from .settings.yaml via load-versions; must be >= v3.1.0 so DSSE attestations are logged to Rekor v2 as hashedrekord/PAE)'
+    required: true
 
 runs:
   using: 'composite'
   steps:
+    # `required: true` on composite-action inputs is not enforced at runtime, so
+    # a caller that omits cosign_version would silently get the cosign-installer
+    # default (which lags the v3.1.0 floor DSSE-on-v2 needs). Fail closed. See #1650.
+    - name: Require cosign_version
+      shell: bash
+      env:
+        COSIGN_VERSION: ${{ inputs.cosign_version }}
+      run: '[ -n "$COSIGN_VERSION" ] || { echo "cosign_version input is required (>= v3.1.0 for Rekor v2)" >&2; exit 1; }'
     - name: Setup Go
       uses: actions/setup-go@7a3fe6cf4cb3a834922a1244abfce67bcef6a0c5  # v6.2.0
       with:
@@ -46,6 +57,11 @@ runs:
 
     - name: Install Cosign
       uses: sigstore/cosign-installer@faadad0cce49287aee09b3a48701e75088a2c6ad  # v4.0.0
+      with:
+        # Pin from .settings.yaml (>= v3.1.0) so cosign logs DSSE attestations to
+        # Rekor v2 as hashedrekord/PAE. The installer default (v3.0.2) writes the
+        # legacy dsse entry type, which sigstore-go cannot verify. See #1650.
+        cosign-release: '${{ inputs.cosign_version }}'
 
     - name: Install GoReleaser
       uses: goreleaser/goreleaser-action@ec59f474b9834571250b370d4735c50f8e2d1e29  # v7.0.0

.github/actions/generate-slsa-predicate/action.yml

@@ -52,3 +52,30 @@ runs:
         }
         EOF
         echo "SLSA_PREDICATE=${PREDICATE}" >> "$GITHUB_ENV"
+
+        # AICR signs release attestations to Rekor v2 (NVIDIA/aicr#1650). Fetch
+        # the TUF-distributed v2 SigningConfig (Rekor v2 endpoint + timestamp
+        # authority) so the goreleaser cosign + sign-catalog hooks can point
+        # --signing-config at it. Co-located with SLSA_PREDICATE so the invariant
+        # "signing enabled (SLSA_PREDICATE set) => signing config present" holds
+        # for every signing workflow, not just the release. go run compiles aicr
+        # from source (the built binaries do not exist yet). Requires Go, which
+        # every caller sets up before this action.
+        SC="${RUNNER_TEMP}/aicr-signing-config.json"
+        # Retry the TUF fetch (3 attempts, 5s/10s backoff) to absorb transient
+        # Sigstore TUF CDN blips, mirroring the goreleaser cosign hook — this is a
+        # hard prerequisite for the whole signing flow, which fails closed if the
+        # config is missing. The `-s` check treats an exit-0-but-empty-file result
+        # as a failure so a truncated write is retried, not silently exported.
+        for n in 1 2 3; do
+          GOFLAGS=-mod=vendor go run ./cmd/aicr trust update --emit-signing-config "${SC}" && [ -s "${SC}" ] && break
+          if [ "$n" -lt 3 ]; then
+            echo "trust update attempt $n failed; retrying" >&2
+            sleep $((n * 5))
+          else
+            echo "trust update failed after 3 attempts" >&2
+            exit 1
+          fi
+        done
+        echo "AICR_SIGNING_CONFIG=${SC}" >> "$GITHUB_ENV"
+        echo "Rekor v2 signing config written to ${SC}"

.github/actions/go-build-release/action.yml

@@ -75,6 +75,10 @@ runs:
       with:
         registry: ${{ inputs.registry }}
 
+    # Note: the Rekor v2 signing config (AICR_SIGNING_CONFIG) is fetched and
+    # exported by the generate-slsa-predicate action, co-located with
+    # SLSA_PREDICATE, so it is present here without a separate step. See #1650.
+
     - name: Build and Release
       id: release
       shell: bash

.github/actions/go-test/action.yml

@@ -27,6 +27,9 @@ inputs:
     description: 'Minimum coverage percentage required'
     required: false
     default: ''
+  helm_version:
+    description: 'Helm version pinned in .settings.yaml (testing_tools.helm, via load-versions) — required by the argocd-helm live-render tests, which fail (not skip) in CI when helm is missing'
+    required: true
 
 runs:
   using: 'composite'
@@ -47,6 +50,17 @@ runs:
         go mod vendor
         git diff --exit-code vendor/ || (echo "vendor/ is out of sync with go.mod/go.sum; run 'make tidy' and commit go.mod, go.sum, and vendor/" && exit 1)
 
+    # The ubuntu-latest runner image bundles Helm 3; the unit tests that
+    # shell out to helm (pkg/bundler/deployer/argocdhelm live-render tests)
+    # must run against the Helm major pinned in .settings.yaml. The
+    # setup-build-tools step replaces any preinstalled binary that does not
+    # match the pin and fails the job if the install fails.
+    - name: Install Helm
+      uses: ./.github/actions/setup-build-tools
+      with:
+        install_helm: 'true'
+        helm_version: '${{ inputs.helm_version }}'
+
     - name: Install envtest binaries
       shell: bash
       run: |

.github/actions/install-aicr-release/action.yml

@@ -27,15 +27,32 @@ inputs:
   aicr-version:
     description: 'Released aicr version tag to install (e.g. v1.2.3).'
     required: true
+  cosign_version:
+    description: 'Cosign version (from .settings.yaml via load-versions; must be >= v3.1.0 to verify release provenance logged to Rekor v2 as hashedrekord/PAE).'
+    required: true
 
 runs:
   using: composite
   steps:
+    # GitHub does not enforce `required: true` on composite-action inputs at
+    # runtime, so a caller that omits cosign_version would pass '' to
+    # cosign-release and silently get the installer default (which lags the
+    # v3.1.0 floor). Fail closed instead. See #1650.
+    - name: Require cosign_version
+      shell: bash
+      env:
+        COSIGN_VERSION: ${{ inputs.cosign_version }}
+      run: '[ -n "$COSIGN_VERSION" ] || { echo "cosign_version input is required (>= v3.1.0 for Rekor v2)" >&2; exit 1; }'
     # verify-blob-attestation needs no OIDC token (verification, not signing);
     # it fetches only the Sigstore trusted root, so the caller's contents:read
     # ceiling suffices. Pinned to the same SHA the release/build workflows use.
     - name: Install Cosign
       uses: sigstore/cosign-installer@6f9f17788090df1f26f669e9d70d6ae9567deba6  # v4.1.2
+      with:
+        # Pin from .settings.yaml (>= v3.1.0). The release binary provenance is
+        # logged to Rekor v2 as hashedrekord/PAE; keep the verifier in lockstep
+        # with the signer rather than the installer default (v3.0.6). See #1650.
+        cosign-release: '${{ inputs.cosign_version }}'
     - name: Download, verify, and install released aicr
       shell: bash
       env:

.github/actions/load-versions/action.yml

@@ -64,12 +64,18 @@ outputs:
   grype:
     description: 'Grype version'
     value: ${{ steps.versions.outputs.grype }}
+  cosign:
+    description: 'Cosign version (must be >= v3.1.0 so DSSE attestations are logged to Rekor v2 as hashedrekord/PAE, not the legacy dsse entry type)'
+    value: ${{ steps.versions.outputs.cosign }}
   yamllint:
     description: 'yamllint version'
     value: ${{ steps.versions.outputs.yamllint }}
   kubectl:
     description: 'kubectl version'
     value: ${{ steps.versions.outputs.kubectl }}
+  kubelogin:
+    description: 'kubelogin version'
+    value: ${{ steps.versions.outputs.kubelogin }}
   kwok:
     description: 'KWOK version'
     value: ${{ steps.versions.outputs.kwok }}
@@ -165,9 +171,11 @@ runs:
 
         # Security tools
         echo "grype=$(yq eval '.security_tools.grype' .settings.yaml)" >> $GITHUB_OUTPUT
+        echo "cosign=$(yq eval '.security_tools.cosign' .settings.yaml)" >> $GITHUB_OUTPUT
 
         # Testing tools
         echo "kubectl=$(yq eval '.testing_tools.kubectl' .settings.yaml)" >> $GITHUB_OUTPUT
+        echo "kubelogin=$(yq eval '.testing_tools.kubelogin' .settings.yaml)" >> $GITHUB_OUTPUT
         echo "kind=$(yq eval '.testing_tools.kind' .settings.yaml)" >> $GITHUB_OUTPUT
         echo "nvkind=$(yq eval '.testing_tools.nvkind' .settings.yaml)" >> $GITHUB_OUTPUT
         echo "ctlptl=$(yq eval '.testing_tools.ctlptl' .settings.yaml)" >> $GITHUB_OUTPUT
@@ -218,7 +226,9 @@ runs:
         echo "  addlicense: ${{ steps.versions.outputs.addlicense }}"
         echo "  go_licenses: ${{ steps.versions.outputs.go_licenses }}"
         echo "  grype: ${{ steps.versions.outputs.grype }}"
+        echo "  cosign: ${{ steps.versions.outputs.cosign }}"
         echo "  kubectl: ${{ steps.versions.outputs.kubectl }}"
+        echo "  kubelogin: ${{ steps.versions.outputs.kubelogin }}"
         echo "  kind: ${{ steps.versions.outputs.kind }}"
         echo "  nvkind: ${{ steps.versions.outputs.nvkind }}"
         echo "  ctlptl: ${{ steps.versions.outputs.ctlptl }}"

.github/copy-pr-bot.yaml

@@ -32,3 +32,4 @@ additional_trustees:
   - yuanchen8911
   - JRosenboimNVIDIA
   - hkii
+  - tjrasche