Skip to content

Commit 611393f

Browse files
authored
Merge branch 'main' into docs/single-source-site
2 parents 8f22ddb + 87cb118 commit 611393f

File tree

7 files changed

+63
-52
lines changed

7 files changed

+63
-52
lines changed

.github/workflows/build-attested.yaml

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -59,7 +59,7 @@ jobs:
5959
cache: true
6060

6161
- name: Install Cosign
62-
uses: sigstore/cosign-installer@faadad0cce49287aee09b3a48701e75088a2c6ad # v4.0.0
62+
uses: sigstore/cosign-installer@ba7bc0a3fef59531c69a25acd34668d6d3fe6f22 # v4.1.0
6363

6464
- name: Install GoReleaser
6565
uses: goreleaser/goreleaser-action@ec59f474b9834571250b370d4735c50f8e2d1e29 # v7.0.0

.github/workflows/gh-pages.yaml

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -74,7 +74,7 @@ jobs:
7474

7575
- name: Upload artifact
7676
if: github.event_name != 'pull_request'
77-
uses: actions/upload-pages-artifact@56afc609e74202658d3ffba0e8f6dda462b719fa # v3.0.1
77+
uses: actions/upload-pages-artifact@7b1f4a764d45c48632c6b24a0339c27f5614fb0b # v4.0.0
7878
with:
7979
path: site/.vitepress/dist
8080

.github/workflows/on-tag.yaml

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -77,7 +77,7 @@ jobs:
7777
cache: true
7878

7979
- name: Install Cosign
80-
uses: sigstore/cosign-installer@faadad0cce49287aee09b3a48701e75088a2c6ad # v4.0.0
80+
uses: sigstore/cosign-installer@ba7bc0a3fef59531c69a25acd34668d6d3fe6f22 # v4.1.0
8181

8282
- name: Generate SLSA predicate
8383
uses: ./.github/actions/generate-slsa-predicate

.github/workflows/stale.yaml

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -49,7 +49,7 @@ jobs:
4949
timeout-minutes: 10
5050

5151
steps:
52-
- uses: actions/stale@997185467fa4f803885201cee163a9f38240193d # v10.1.0
52+
- uses: actions/stale@b5d41d4e1d5dceea10e7104786b73624c18a190f # v10.1.0
5353
with:
5454
# Issue settings
5555
stale-issue-message: |

.goreleaser.yaml

Lines changed: 5 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -187,11 +187,11 @@ brews:
187187
caveats: |
188188
To verify supply-chain provenance (requires cosign):
189189
190-
cosign verify-blob-attestation \
191-
--bundle #{opt_bin}/aicr-attestation.sigstore.json \
192-
--type https://slsa.dev/provenance/v1 \
193-
--certificate-oidc-issuer https://token.actions.githubusercontent.com \
194-
--certificate-identity-regexp "https://github.com/NVIDIA/aicr/.github/workflows/on-tag\\.yaml@refs/tags/.*" \
190+
cosign verify-blob-attestation \\
191+
--bundle #{opt_bin}/aicr-attestation.sigstore.json \\
192+
--type https://slsa.dev/provenance/v1 \\
193+
--certificate-oidc-issuer https://token.actions.githubusercontent.com \\
194+
--certificate-identity-regexp "https://github.com/NVIDIA/aicr/.github/workflows/on-tag\\.yaml@refs/tags/.*" \\
195195
#{opt_bin}/aicr
196196
197197
To update the trust root for bundle attestation:

pkg/bundler/deployer/helm/templates/undeploy.sh.tmpl

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -164,6 +164,10 @@ fi
164164
delete_orphaned_webhooks_for_ns "{{ . }}"
165165
delete_namespace "{{ . }}"
166166
{{ end }}
167+
# Clean up companion namespaces created at runtime by components.
168+
# These are not in the bundle's namespace list but are created by operators.
169+
delete_namespace "kai-resource-reservation"
170+
167171
# Wait for terminating namespaces to finish
168172
echo "Waiting for namespaces to terminate..."
169173
for i in $(seq 1 60); do

pkg/evidence/scripts/collect-evidence.sh

Lines changed: 50 additions & 43 deletions
Original file line numberDiff line numberDiff line change
@@ -110,6 +110,29 @@ wait_for_port() {
110110
return 1
111111
}
112112

113+
# Runtime results tracker — records check name and status as they execute.
114+
# Format: "name:status" entries separated by newlines.
115+
CHECK_RESULTS=""
116+
117+
# Run a collector and record its result based on the evidence file it produces.
118+
# Usage: run_check "DRA Support" "dra-support" collect_dra
119+
run_check() {
120+
local display_name="$1" file_key="$2" collector_fn="$3"
121+
local evidence_path="${EVIDENCE_DIR}/${file_key}.md"
122+
123+
"${collector_fn}"
124+
125+
if [ ! -f "${evidence_path}" ]; then
126+
CHECK_RESULTS="${CHECK_RESULTS}${display_name}:SKIP\n"
127+
elif grep -q "Result: PASS" "${evidence_path}" 2>/dev/null; then
128+
CHECK_RESULTS="${CHECK_RESULTS}${display_name}:PASS\n"
129+
elif grep -q "Result: FAIL" "${evidence_path}" 2>/dev/null; then
130+
CHECK_RESULTS="${CHECK_RESULTS}${display_name}:FAIL\n"
131+
else
132+
CHECK_RESULTS="${CHECK_RESULTS}${display_name}:UNKNOWN\n"
133+
fi
134+
}
135+
113136
# Clean up a test namespace properly: pods → resourceclaims → namespace
114137
# This order prevents stale DRA kubelet checkpoint issues caused by
115138
# orphaned ResourceClaims with delete-protection finalizers.
@@ -1438,38 +1461,38 @@ main() {
14381461

14391462
case "${SECTION}" in
14401463
dra)
1441-
collect_dra
1464+
run_check "DRA Support" "dra-support" collect_dra
14421465
;;
14431466
gang)
1444-
collect_gang
1467+
run_check "Gang Scheduling" "gang-scheduling" collect_gang
14451468
;;
14461469
secure)
1447-
collect_secure
1470+
run_check "Secure Accelerator Access" "secure-accelerator-access" collect_secure
14481471
;;
14491472
metrics)
1450-
collect_metrics
1473+
run_check "Accelerator Metrics" "accelerator-metrics" collect_metrics
14511474
;;
14521475
gateway)
1453-
collect_gateway
1476+
run_check "Inference Gateway" "inference-gateway" collect_gateway
14541477
;;
14551478
operator)
1456-
collect_operator
1479+
run_check "Robust AI Operator" "robust-operator" collect_operator
14571480
;;
14581481
hpa)
1459-
collect_hpa
1482+
run_check "Pod Autoscaling (HPA)" "pod-autoscaling" collect_hpa
14601483
;;
14611484
cluster-autoscaling)
1462-
collect_cluster_autoscaling
1485+
run_check "Cluster Autoscaling" "cluster-autoscaling" collect_cluster_autoscaling
14631486
;;
14641487
all)
1465-
collect_dra
1466-
collect_gang
1467-
collect_secure
1468-
collect_metrics
1469-
collect_gateway
1470-
collect_operator
1471-
collect_hpa
1472-
collect_cluster_autoscaling
1488+
run_check "DRA Support" "dra-support" collect_dra
1489+
run_check "Gang Scheduling" "gang-scheduling" collect_gang
1490+
run_check "Secure Accelerator Access" "secure-accelerator-access" collect_secure
1491+
run_check "Accelerator Metrics" "accelerator-metrics" collect_metrics
1492+
run_check "Inference Gateway" "inference-gateway" collect_gateway
1493+
run_check "Robust AI Operator" "robust-operator" collect_operator
1494+
run_check "Pod Autoscaling (HPA)" "pod-autoscaling" collect_hpa
1495+
run_check "Cluster Autoscaling" "cluster-autoscaling" collect_cluster_autoscaling
14731496
;;
14741497
*)
14751498
log_error "Unknown section: ${SECTION}"
@@ -1496,36 +1519,20 @@ main() {
14961519
echo " OS: ${CLUSTER_OS_IMAGE}"
14971520
echo " Evidence: ${EVIDENCE_DIR}/"
14981521
echo ""
1499-
local checks=(
1500-
"dra-support:DRA Support"
1501-
"gang-scheduling:Gang Scheduling"
1502-
"secure-accelerator-access:Secure Accelerator Access"
1503-
"accelerator-metrics:Accelerator Metrics"
1504-
"inference-gateway:Inference Gateway"
1505-
"robust-operator:Robust AI Operator"
1506-
"pod-autoscaling:Pod Autoscaling (HPA)"
1507-
"cluster-autoscaling:Cluster Autoscaling"
1508-
)
15091522
local passed=0 failed=0 skipped=0
15101523
printf " %-30s %s\n" "Check" "Status"
15111524
printf " %-30s %s\n" "-----" "------"
1512-
for entry in "${checks[@]}"; do
1513-
local file="${entry%%:*}"
1514-
local name="${entry#*:}"
1515-
local evidence_path="${EVIDENCE_DIR}/${file}.md"
1516-
if [ ! -f "${evidence_path}" ]; then
1517-
printf " %-30s %s\n" "${name}" "SKIP"
1518-
skipped=$((skipped + 1))
1519-
elif grep -q "Result: PASS" "${evidence_path}" 2>/dev/null; then
1520-
printf " %-30s %s\n" "${name}" "PASS"
1521-
passed=$((passed + 1))
1522-
elif grep -q "Result: FAIL" "${evidence_path}" 2>/dev/null; then
1523-
printf " %-30s %s\n" "${name}" "FAIL"
1524-
failed=$((failed + 1))
1525-
else
1526-
printf " %-30s %s\n" "${name}" "UNKNOWN"
1527-
fi
1528-
done
1525+
while IFS= read -r line; do
1526+
[ -z "${line}" ] && continue
1527+
local name="${line%%:*}"
1528+
local status="${line#*:}"
1529+
printf " %-30s %s\n" "${name}" "${status}"
1530+
case "${status}" in
1531+
PASS*) passed=$((passed + 1)) ;;
1532+
FAIL*) failed=$((failed + 1)) ;;
1533+
SKIP) skipped=$((skipped + 1)) ;;
1534+
esac
1535+
done < <(printf '%b' "${CHECK_RESULTS}")
15291536
echo ""
15301537
echo " Total: $((passed + failed + skipped)) | Passed: ${passed} | Failed: ${failed} | Skipped: ${skipped}"
15311538
echo ""

0 commit comments

Comments
 (0)