evidence-ingest.yaml

# Copyright (c) 2026, NVIDIA CORPORATION & AFFILIATES.  All rights reserved.
#
# Licensed under the Apache License, Version 2.0 (the "License");
# you may not use this file except in compliance with the License.
# You may obtain a copy of the License at
#
#     http://www.apache.org/licenses/LICENSE-2.0
#
# Unless required by applicable law or agreed to in writing, software
# distributed under the License is distributed on an "AS IS" BASIS,
# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
# See the License for the specific language governing permissions and
# limitations under the License.

# GP2 — Evidence ingest (#1402).
#
# Verifies published, signed evidence bundles and writes the source-keyed
# evidence tree the GP4 corroborate generator consumes, then uploads that
# tree to the corroboration GCS bucket. Two triggers converge on the same
# verify -> synthesize -> upload pipeline:
#
#   1. push to main touching recipes/evidence/** — community/partner
#      pointers added/refreshed in-tree.
#   2. workflow_call / workflow_dispatch with a bundle_ref — first-party
#      UAT runs ingest directly, by bundle ref, with no repo commit.
#
# Fork safety, per hippo:reviewer-cicd norms: verification runs in a job
# that holds NO bucket-write credentials; the credentialed publish job
# runs only on the canonical repo (never a fork) in a separate job. It
# reuses the eidosx WIF provider + service account from uat-gcp.yaml and
# writes to the existing aicr-testgrid-staging bucket under a results/
# prefix. GP3 will swap in a dedicated objectCreator-only SA.

name: "Evidence: Ingest"

on:
  push:
    branches: [main]
    paths:
      - 'recipes/evidence/**'
  workflow_dispatch:
    inputs:
      bundle_ref:
        description: 'OCI ref of a signed evidence bundle to ingest (registry/repo@sha256:...)'
        required: true
        type: string
      recipe:
        description: 'Recipe name (optional; informational)'
        required: false
        type: string
  workflow_call:
    inputs:
      bundle_ref:
        description: 'OCI ref of a signed evidence bundle to ingest (registry/repo@sha256:...)'
        required: true
        type: string
      recipe:
        description: 'Recipe name (optional; informational)'
        required: false
        type: string

permissions:
  contents: read

concurrency:
  group: ${{ github.workflow }}-${{ github.ref }}
  cancel-in-progress: false

env:
  # Registry/repo prefixes a bundle ref must fall under before it is
  # pulled. Overridable via the EVIDENCE_TRUSTED_REGISTRIES repo var.
  TRUSTED_REGISTRIES: ${{ vars.EVIDENCE_TRUSTED_REGISTRIES || 'ghcr.io/nvidia' }}
  # Allowed OIDC issuer for first-party (UAT) bundles.
  FIRST_PARTY_ISSUER: 'https://token.actions.githubusercontent.com'
  # Identity regexp pinning first-party signatures to the NVIDIA/aicr
  # evidence-producing UAT lanes. Fully anchored so the verifier's signer
  # match is exact (matches what each lane pins in its own verify step): the
  # cloud lanes (uat-aws/gcp/azure) plus the real-silicon nvkind lane
  # (uat-kind, DC5 #1278). Keep in lockstep with the firstParty
  # identityPattern entries in recipes/evidence/allowlist.yaml.
  FIRST_PARTY_IDENTITY: '^https://github\.com/NVIDIA/aicr/\.github/workflows/uat-(aws|gcp|azure|kind)\.yaml@refs/heads/.+$'

jobs:
  # ---------------------------------------------------------------------
  # Job 1: verify + synthesize. Holds NO GCS credentials. Its only output
  # is the local source-keyed tree, uploaded as an artifact.
  # ---------------------------------------------------------------------
  verify:
    name: Verify and synthesize
    # Never runs on a fork (push to main on a fork would still lack the
    # bundles; the publish job is the real credential gate).
    if: github.repository == 'nvidia/aicr'
    runs-on: ubuntu-latest
    timeout-minutes: 20
    permissions:
      contents: read
      packages: read
    outputs:
      # 'true' only when the ingest actually produced a tree. The push
      # trigger legitimately ingests nothing (allowlist-only change, a
      # deleted pointer, no changed pointers); publish keys off this so it
      # does not run and fail on a missing artifact.
      produced: ${{ steps.detect.outputs.produced }}
    steps:
      - name: Checkout
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7.0.1
        with:
          persist-credentials: false
          # Full history: the push diff compares github.event.before..HEAD,
          # and a single push can span more than one commit (before is then
          # older than HEAD~1). A shallow fetch-depth: 2 would miss the base
          # and the diff would silently match nothing.
          fetch-depth: 0

      - name: Load versions
        id: versions
        uses: ./.github/actions/load-versions

      - name: Set up Go
        uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e  # v7.0.0
        with:
          go-version: ${{ steps.versions.outputs.go }}
          cache: false

      - name: Build evidence-project
        env:
          GOFLAGS: -mod=vendor
        run: go build -o ./bin/evidence-project ./tools/evidence-project

      - name: Authenticate to GHCR
        uses: ./.github/actions/ghcr-login

      - name: Ingest
        env:
          INGEST: ${{ github.workspace }}/bin/evidence-project
          BUNDLE_REF: ${{ inputs.bundle_ref }}
          # First-party runId. On a workflow_call from UAT, github.run_id
          # is the SAME run that pushed the bundle (the run_id embedded in
          # the OCI artifact name), so the tree entry is unique and traces
          # back to both. Used only in the single-bundle (BUNDLE_REF) path;
          # the push path derives a per-pointer runId from attestedAt.
          FIRST_PARTY_RUN_ID: run-${{ github.run_id }}
          BEFORE_SHA: ${{ github.event.before }}
          HEAD_SHA: ${{ github.sha }}
          OUT_DIR: ${{ github.workspace }}/out
        run: .github/scripts/evidence-ingest.sh

      - name: Detect produced tree
        id: detect
        run: |
          set -euo pipefail
          if [ -d "${{ github.workspace }}/out/results" ] \
            && [ -n "$(find "${{ github.workspace }}/out/results" -type f -print -quit)" ]; then
            echo "produced=true" >> "$GITHUB_OUTPUT"
          else
            echo "produced=false" >> "$GITHUB_OUTPUT"
            echo "no evidence tree produced — publish will be skipped"
          fi

      - name: Upload evidence tree
        if: ${{ steps.detect.outputs.produced == 'true' }}
        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a  # v7.0.1
        with:
          name: evidence-tree
          path: ${{ github.workspace }}/out
          if-no-files-found: ignore
          retention-days: 7

  # ---------------------------------------------------------------------
  # Job 2: publish to GCS. Separate job that holds the GCP credentials —
  # the verify job above holds none. Reuses the WIF provider + service
  # account from uat-gcp.yaml (eidosx project) and writes to the existing
  # aicr-testgrid-staging bucket under its own results/ prefix, which does
  # not collide with the bucket's other top-level paths (config, grid/,
  # groups/, queue/, summary/, tabs/).
  #
  # GP3 hardening: swap GCP_WIF_SERVICE_ACCOUNT for a dedicated
  # objectCreator-only identity scoped to gs://aicr-testgrid-staging/results
  # rather than the shared github-actions@eidosx SA.
  # ---------------------------------------------------------------------
  publish:
    name: Publish to GCS
    needs: verify
    # Only when verify actually produced a tree — an empty push-mode ingest
    # uploads no artifact, and download-artifact would otherwise fail hard.
    if: github.repository == 'nvidia/aicr' && needs.verify.outputs.produced == 'true'
    runs-on: ubuntu-latest
    timeout-minutes: 15
    permissions:
      contents: read
      id-token: write  # WIF only; no bucket creds in the verify job
    env:
      GCP_WIF_PROVIDER: "projects/116689922666/locations/global/workloadIdentityPools/github-actions-pool/providers/github-actions-provider"
      GCP_WIF_SERVICE_ACCOUNT: "github-actions@eidosx.iam.gserviceaccount.com"
      BUCKET: "aicr-testgrid-staging"
    steps:
      - name: Download evidence tree
        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c  # v8.0.1
        with:
          name: evidence-tree
          path: out

      - name: Authenticate to GCP
        uses: google-github-actions/auth@7c6bc770dae815cd3e89ee6cdf493a5fab2cc093  # v3.0.0
        with:
          workload_identity_provider: ${{ env.GCP_WIF_PROVIDER }}
          service_account: ${{ env.GCP_WIF_SERVICE_ACCOUNT }}

      - name: Set up gcloud
        uses: google-github-actions/setup-gcloud@aa5489c8933f4cc7a4f7d45035b3b1440c9c10db  # v3.0.1

      - name: Sync source-keyed tree to GCS
        run: |
          set -euo pipefail
          if [ ! -d out/results ]; then
            echo "no results to publish"
            exit 0
          fi
          # Each leaf run directory (the one holding meta.json) is replaced
          # in place with a delete-aware rsync scoped to that run's prefix,
          # so a re-ingest of the same run drops stale ctrf/*.json from a
          # prior, larger run instead of leaving them behind. The delete is
          # confined to the single run prefix, so other sources, other runs,
          # and the bucket's other top-level prefixes are never touched.
          find out/results -type f -name meta.json -print0 \
            | while IFS= read -r -d '' meta; do
              run_dir="$(dirname "${meta}")"
              rel="${run_dir#out/results/}"
              echo "syncing run ${rel}"
              gcloud storage rsync -r \
                --delete-unmatched-destination-objects \
                "${run_dir}" "gs://${BUCKET}/results/${rel}"
            done

  # ---------------------------------------------------------------------
  # Job 3: refresh the published dashboard. Every successful ingest lands
  # new evidence in GCS, so the GP5 dashboard (evidence-dashboard-publish)
  # must re-render to surface it — otherwise the site is stale until the
  # next unrelated push to main. The push-to-main ingest path already
  # re-triggers the dashboard via its own `push:` trigger, but the
  # first-party UAT path is a NESTED workflow_call (up to four levels deep:
  # uat-run -> uat-{aws,gcp,azure} -> evidence-ingest), which emits no
  # top-level run event and cannot nest a fifth reusable workflow. A
  # workflow_dispatch decouples cleanly: it starts a fresh top-level run
  # regardless of how deep this ingest was invoked.
  #
  # Held in a SEPARATE job so the GCS-credentialed publish job never also
  # carries actions:write. `needs: publish` inherits the produced gate — a
  # skipped/failed publish skips this too, so the dashboard only re-renders
  # after evidence is actually in the bucket. The dashboard's own
  # concurrency group ("pages", cancel-in-progress:false) coalesces the
  # flurry from a multi-cell nightly batch into a single queued rebuild
  # that the newest dispatch supersedes.
  #
  # The refresh is BEST-EFFORT: the evidence is already in the bucket and the
  # dashboard self-heals on the next ingest or push to main, so a transient
  # dispatch failure must never fail this workflow_call chain — otherwise the
  # nightly controller would record a fully-successful, multi-hour UAT cell as
  # a failed leg. The dispatch step retries, then warns (never fails), so
  # staleness is surfaced but not fatal — the same not-cry-wolf posture as
  # uat-superseded-notice.yaml.
  # ---------------------------------------------------------------------
  trigger-dashboard:
    name: Trigger dashboard publish
    needs: publish
    if: github.repository == 'nvidia/aicr'
    runs-on: ubuntu-latest
    timeout-minutes: 5
    permissions:
      contents: read
      actions: write  # dispatch evidence-dashboard-publish.yaml
    steps:
      - name: Dispatch dashboard publish
        env:
          GH_TOKEN: ${{ github.token }}
          REPO: ${{ github.repository }}
        run: |
          set -euo pipefail
          # Always target main: the dashboard deploys only from the default
          # branch, and the evidence tree it renders is the canonical GCS
          # bucket regardless of which ref this ingest ran on.
          #
          # Bounded retry, then warn-and-succeed: the `if` guard keeps a failed
          # attempt from tripping `set -e`, and the trailing warning exits 0 so a
          # best-effort refresh cannot fail the calling UAT run.
          for attempt in 1 2 3; do
            if gh workflow run evidence-dashboard-publish.yaml \
              --repo "$REPO" --ref main; then
              echo "dispatched Evidence: Dashboard Publish on main"
              exit 0
            fi
            echo "dispatch attempt ${attempt} failed; retrying in 5s..."
            sleep 5
          done
          echo "::warning::could not dispatch Evidence: Dashboard Publish after 3 attempts; the dashboard will refresh on the next ingest or push to main"