Merge branch 'main' into fix/tg5-explicit-evidence-dispatch

Author: mchmarny

.claude/CLAUDE.md

@@ -28,7 +28,7 @@ NVIDIA AI Cluster Runtime (AICR) generates validated GPU-accelerated Kubernetes
  state         config         vs actual     manifests
 ```
 
-**Tech Stack:** Go 1.26, Kubernetes 1.33+, golangci-lint, Ko for images (pinned versions in `.settings.yaml`)
+**Tech Stack:** Go 1.26, Kubernetes, golangci-lint, Ko for images (pinned versions in `.settings.yaml`)
 
 ## Commands
 
@@ -116,7 +116,7 @@ workspace paths. Use local file paths only when explicitly requested.
 | `pkg/snapshotter` | System state snapshot orchestration | Yes |
 | `pkg/k8s/client` | Singleton Kubernetes client | Yes |
 | `pkg/k8s/pod` | Shared K8s Job/Pod utilities (wait, logs, ConfigMap URIs) | Yes |
-| `pkg/validator/helper` | Shared validator helpers (PodLifecycle, test context) | Yes |
+| `validators/helper` | Shared validator helpers (PodLifecycle, GPU/resource utilities) | Yes |
 | `pkg/defaults` | Centralized timeout and configuration constants | Yes |
 
 **Critical Architecture Principle:**

.github/workflows/codeql.yaml

@@ -40,10 +40,10 @@ jobs:
         with:
           go-version: ${{ steps.versions.outputs.go }}
           cache: true
-      - uses: github/codeql-action/init@ff2f1c621b7f889edc0d3c761ac2e6a3f8cdb0dd  # v4.37.7
+      - uses: github/codeql-action/init@db488ddef3bf6cb639b32c2e9a7c0a7ea8271d28  # v4.37.8
         with:
           languages: go
       - run: go build ./...
         env:
           GOFLAGS: -mod=vendor
-      - uses: github/codeql-action/analyze@ff2f1c621b7f889edc0d3c761ac2e6a3f8cdb0dd  # v4.37.7
+      - uses: github/codeql-action/analyze@db488ddef3bf6cb639b32c2e9a7c0a7ea8271d28  # v4.37.8

.github/workflows/merge-gate.yaml

@@ -297,13 +297,13 @@ jobs:
         with:
           go-version: ${{ steps.versions.outputs.go }}
           cache: true
-      - uses: github/codeql-action/init@ff2f1c621b7f889edc0d3c761ac2e6a3f8cdb0dd  # v4.37.7
+      - uses: github/codeql-action/init@db488ddef3bf6cb639b32c2e9a7c0a7ea8271d28  # v4.37.8
         with:
           languages: go
       - run: go build ./...
         env:
           GOFLAGS: -mod=vendor
-      - uses: github/codeql-action/analyze@ff2f1c621b7f889edc0d3c761ac2e6a3f8cdb0dd  # v4.37.7
+      - uses: github/codeql-action/analyze@db488ddef3bf6cb639b32c2e9a7c0a7ea8271d28  # v4.37.8
 
   analyze-skip:
     needs: [check-paths]

.github/workflows/on-tag.yaml

@@ -545,7 +545,7 @@ jobs:
 
       - name: Upload SARIF to GitHub Security
         if: hashFiles('results.sarif') != '' || steps.scan.outputs.sarif != ''
-        uses: github/codeql-action/upload-sarif@ff2f1c621b7f889edc0d3c761ac2e6a3f8cdb0dd  # v4.37.7
+        uses: github/codeql-action/upload-sarif@db488ddef3bf6cb639b32c2e9a7c0a7ea8271d28  # v4.37.8
         with:
           sarif_file: ${{ steps.scan.outputs.sarif }}
           category: 'anchore-image-${{ matrix.image.key }}-${{ matrix.platform.arch }}'

.go-version

@@ -1 +1 @@
-1.26.6
+1.27.0

.settings.yaml

@@ -19,7 +19,7 @@
 # Build Tools
 build_tools:
   # renovate: datasource=github-releases depName=goreleaser/goreleaser depType=build_tools
-  goreleaser: 'v2.17.1'
+  goreleaser: 'v2.18.0'
   # renovate: datasource=github-releases depName=ko-build/ko depType=build_tools
   ko: 'v0.19.1'
   # renovate: datasource=github-releases depName=google/go-containerregistry depType=build_tools
@@ -30,9 +30,9 @@ build_tools:
 # Linting
 linting:
   # renovate: datasource=go depName=golang.org/x/exp depType=linting
-  apidiff: 'v0.0.0-20260813180055-c1d0aacb2297'
+  apidiff: 'v0.0.0-20260820142414-ca536658362e'
   # renovate: datasource=github-releases depName=golangci/golangci-lint depType=linting
-  golangci_lint: 'v2.12.2'
+  golangci_lint: 'v2.13.1'
   # renovate: datasource=pypi depName=yamllint depType=linting
   yamllint: '1.38.0'
   # renovate: datasource=github-releases depName=google/addlicense depType=linting
@@ -61,13 +61,13 @@ security_tools:
   #
   # Stored WITHOUT the leading 'v', unlike cosign/syft/grype above:
   # oras-project/setup-oras looks the version up against bare release keys and
-  # throws on 'v1.3.0'. tools/setup-tools re-adds the prefix for the download URL.
-  oras: '1.3.0'
+  # throws on 'v1.3.3'. tools/setup-tools re-adds the prefix for the download URL.
+  oras: '1.3.3'
 
 # E2E Testing Tools
 testing_tools:
   # renovate: datasource=github-releases depName=kubernetes/kubernetes depType=testing_tools
-  kubectl: 'v1.36.3'
+  kubectl: 'v1.36.4'
   # kubelogin: Entra exec-plugin for AKS kubeconfigs, installed by uat-azure.yaml
   # via `az aks install-cli` (which defaults to latest without an explicit pin).
   # renovate: datasource=github-releases depName=Azure/kubelogin depType=testing_tools
@@ -124,14 +124,14 @@ testing_tools:
   # Run with USE_SSL=1: sigstore's awskms signer hardcodes https://, so the e2e
   # serves TLS with a mkcert cert (see mkcert below).
   # renovate: datasource=docker depName=ministackorg/ministack depType=testing_tools
-  ministack_image: 'ministackorg/ministack:1.4.19'
+  ministack_image: 'ministackorg/ministack:1.4.21'
   # OpenBAO: the Linux Foundation Apache-2.0 fork of HashiCorp Vault, used by the
   # Vault KMS e2e to exercise the hashivault:// signing/verification path against
   # a real Transit secrets engine. API-identical to Vault; the sigstore hashivault
   # provider drives it over plain HTTP in dev mode (no TLS needed). Pinned (never
   # :latest) for reproducibility.
   # renovate: datasource=docker depName=openbao/openbao depType=testing_tools
-  openbao_image: 'openbao/openbao:2.6.1'
+  openbao_image: 'openbao/openbao:2.6.2'
   # mkcert issues a trusted localhost cert for MiniStack's TLS and installs its CA
   # into the system trust store, so the Go AWS SDK accepts the awskms:// endpoint.
   # renovate: datasource=github-releases depName=FiloSottile/mkcert depType=testing_tools
@@ -176,7 +176,7 @@ testing_tools:
   # renovate: datasource=github-releases depName=hauler-dev/hauler depType=testing_tools
   hauler: 'v2.0.3'
   # renovate: datasource=github-releases depName=zarf-dev/zarf depType=testing_tools
-  zarf: 'v0.83.0'
+  zarf: 'v0.84.0'
 # Quality Thresholds
 quality:
   coverage_threshold: '80'

AGENTS.md

@@ -28,7 +28,7 @@ NVIDIA AI Cluster Runtime (AICR) generates validated GPU-accelerated Kubernetes
  state         config         vs actual     manifests
 ```
 
-**Tech Stack:** Go 1.26, Kubernetes 1.33+, golangci-lint, Ko for images (pinned versions in `.settings.yaml`)
+**Tech Stack:** Go 1.26, Kubernetes, golangci-lint, Ko for images (pinned versions in `.settings.yaml`)
 
 ## Commands
 
@@ -116,7 +116,7 @@ workspace paths. Use local file paths only when explicitly requested.
 | `pkg/snapshotter` | System state snapshot orchestration | Yes |
 | `pkg/k8s/client` | Singleton Kubernetes client | Yes |
 | `pkg/k8s/pod` | Shared K8s Job/Pod utilities (wait, logs, ConfigMap URIs) | Yes |
-| `pkg/validator/helper` | Shared validator helpers (PodLifecycle, test context) | Yes |
+| `validators/helper` | Shared validator helpers (PodLifecycle, GPU/resource utilities) | Yes |
 | `pkg/defaults` | Centralized timeout and configuration constants | Yes |
 
 **Critical Architecture Principle:**

README.md

@@ -72,7 +72,7 @@ AICR recipes compose components from the following groups:
 | Group | Examples |
 |-------|----------|
 | **GPU stack** | GPU Operator, DRA GPU Driver, Network Operator, NFD, NVSentinel |
-| **Cloud integration** | AWS EFA, AWS EBS CSI, GKE NCCL TCPxO |
+| **Cloud integration** | AWS EFA, AWS EBS CSI, GKE NCCL TCPXO |
 | **Node tuning** | Nodewright Operator and customizations, cert-manager |
 | **Observability** | kube-prometheus-stack, Prometheus Operator CRDs, Prometheus Adapter, ephemeral-storage metrics |
 | **Training platforms** | Kubeflow Trainer, Slinky Slurm Operator, KAI Scheduler, Kueue |

ROADMAP.md

@@ -74,7 +74,7 @@ so future changes can warn before they break.
 **Bundle output as a stable surface.** The bundle is what downstream consumers
 integrate against; v1 hardens it as a first-class contract. This includes a generic
 Helm bundle format that is deployer-neutral, deferring teardown to the deployer's
-native uninstall path (helm, ArgoCD, Flux) rather than shipping bundle-side
+native uninstall path (helm, Argo CD, Flux) rather than shipping bundle-side
 scripts, and decoupling environment specifics (e.g., StorageClass) from recipe
 content so bundles are portable.
 

docs/README.md

@@ -15,7 +15,7 @@ overview, see the [repository README](https://github.com/NVIDIA/aicr).
 | If you are a... | Start here |
 |-----------------|-----------|
 | **User** — operator deploying AICR to provision or validate a cluster | [User Guide](user/index.md) |
-| **Integrator** — engineer embedding AICR in a CI/CD pipeline, GitOps flow, or larger platform | [Integrator Guide](integrator/automation.md) |
+| **Integrator** — engineer embedding AICR in a CI/CD pipeline, GitOps flow, or larger platform | [Integrator Guide](integrator/index.md) |
 | **Contributor** — developer extending AICR or shipping recipes | [Contributor Guide](contributor/index.md) |
 
 ### User Guide