Skip to content
Merged
Show file tree
Hide file tree
Changes from all commits
Commits
File filter

Filter by extension

Filter by extension


Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
81 changes: 81 additions & 0 deletions .github/workflows/testgrid-link-check.yaml
Original file line number Diff line number Diff line change
@@ -0,0 +1,81 @@
# Copyright (c) 2026, NVIDIA CORPORATION & AFFILIATES. All rights reserved.
#
# Licensed under the Apache License, Version 2.0 (the "License");
# you may not use this file except in compliance with the License.
# You may obtain a copy of the License at
#
# http://www.apache.org/licenses/LICENSE-2.0
#
# Unless required by applicable law or agreed to in writing, software
# distributed under the License is distributed on an "AS IS" BASIS,
# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
# See the License for the specific language governing permissions and
# limitations under the License.

# Weekly link-integrity check for the recipe-health Evidence deep-links
# (RQ2 / #1284).
#
# Structurally a clone of bom-refresh.yaml (weekly schedule + workflow_dispatch,
# read-only GITHUB_TOKEN, ubuntu-latest, timeout-minutes) with one deliberate
# divergence: it never opens a PR and never edits a doc. Instead it runs
# tools/testgrid-link-check, which reads the committed dashboard presence
# manifest (pkg/testgrid/presence.yaml — the coordinates RQ1 deep-links) and
# fetches the live dashboard data with a bounded, origin-pinned HTTP client
# (off-origin redirects refused), then emits a Markdown report to
# $GITHUB_STEP_SUMMARY. A linked coordinate the live dashboard no longer serves
# is reported as a dead-link warning; a coordinate not yet linked is expected
# and not a warning.
#
# Advisory only, mirroring the warning-only recipe-evidence gate: it never
# blocks a merge (the job exits 0 even when warnings exist). Coordinate
# resolution against the live SPA is necessarily separate from lychee, which
# runs --offline and excludes design/ (fern-docs-ci.yaml) and so resolves no
# dynamic URLs at all — this is the right home, not a lychee tweak.

name: TestGrid Link Check

on:
schedule:
# Mondays 07:00 UTC, offset from bom-refresh (06:00) and recipe-health-refresh
# (06:30) so the three weekly jobs do not contend for runners at the same minute.
- cron: "0 7 * * 1"
workflow_dispatch: {}

# Serialize runs so a manual workflow_dispatch cannot race a scheduled run.
concurrency:
group: ${{ github.workflow }}

permissions:
contents: read

jobs:
check:
name: Verify recipe-health Evidence deep-links against the live dashboard
runs-on: ubuntu-latest
timeout-minutes: 10
steps:
- name: Checkout Code
uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
with:
persist-credentials: false

- name: Load versions
id: versions
uses: ./.github/actions/load-versions

- name: Set up Go
uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0
with:
go-version: ${{ steps.versions.outputs.go }}
cache: false

# No Helm setup: this job only reads an embedded manifest and fetches one
# JSON document — it templates no chart and touches no cluster.

- name: Check Evidence deep-links and write report to step summary
env:
GOFLAGS: -mod=vendor
# The tool exits 0 even when it finds dead links (warning-only), so the
# job never fails the weekly run; the report is the signal.
run: |
go run ./tools/testgrid-link-check -report-out "$GITHUB_STEP_SUMMARY"
20 changes: 13 additions & 7 deletions docs/user/recipe-health.md
Original file line number Diff line number Diff line change
Expand Up @@ -29,7 +29,13 @@ The matrix is computed **hermetically and offline**: every signal is a pure read

**Coverage** is a descriptor — it is *never* graded, so a deliberately minimal recipe is never penalized for declaring fewer checks. It is a compact per-phase summary of the **declared** validation checks, in the form `R:n D:n P:n C:n` — the count of named checks declared for the readiness, deployment, performance, and conformance phases respectively.

**Evidence** is a literal `pending` for every recipe today. No conformance attestations exist yet, so the column is honestly uniform: it reports the absence of evidence rather than overstating what is known. A differentiated, evidence-derived column lands once the first signed attestation does.
**Evidence** deep-links each recipe that has a live dashboard presence to its coordinate on the AICR evidence dashboard at [validation.aicr.run](https://validation.aicr.run) (`/#/<group>/<dashboard>/<tab>`, where `group` is the service, `dashboard` is `<accelerator>-<os>`, and `tab` is `<intent>[-<platform>]`). A recipe without a presence stays a literal `pending` — the column reports the absence of live posture rather than overstating what is known. Today the dashboard covers only the UAT-driven coordinates, so most rows are `pending` until real-hardware coverage broadens; this matrix does not gate on that.

The link is constructed **hermetically and deterministically** from the recipe's resolved criteria using the shared `pkg/recipe.CoordinateFor` mapping — the generator makes no network call, and the coordinate carries **no Kubernetes version**, so a link is stable across k8s-version rolls. The Evidence cell is a link and nothing more: it points at the live board and carries **no** pass/fail state or count. Which recipes are linked is driven by a committed presence manifest (`pkg/testgrid/presence.yaml`); a weekly, warning-only bot keeps it honest by reporting any link that no longer resolves against the live dashboard data (it never blocks merges or edits this doc).

> **Community-source posture is author-asserted provenance, not independently-verified correctness.** A coordinate's tab placement and any community-sourced results on the dashboard are declared by the signing author; corroboration counts agreement at the same AICR version but does not itself certify runtime correctness. Read the linked board accordingly.

The deep-link is the current Evidence rendering. It is distinct from — and coexists with — [ADR-009](../design/009-recipe-health-tracking.md)'s deferred, verify-gated *in-cell freshness* state (`unattested` vs aged, derived from a signed attestation's `AttestedAt`): the link points at the live board, and an optional freshness token can later annotate the same cell without replacing the link. See also the [coverage matrix](coverage-matrix.md) for the complementary breadth view.

{/* BEGIN AICR-HEALTH */}
## Summary
Expand All @@ -50,18 +56,18 @@ The matrix is computed **hermetically and offline**: every signal is a pure read
| rtx-pro-6000-any | — | rtx-pro-6000 | — | — | — | pass | R:0 D:4 P:0 C:0 | pending |
| monitoring-hpa | — | — | — | — | — | pass | R:0 D:0 P:0 C:0 | pending |
| a100-aks-ubuntu-training-kubeflow | aks | a100 | ubuntu | training | kubeflow | pass | R:0 D:4 P:0 C:10 | pending |
| h100-aks-ubuntu-inference-dynamo | aks | h100 | ubuntu | inference | dynamo | pass | R:0 D:4 P:1 C:11 | pending |
| h100-aks-ubuntu-training-kubeflow | aks | h100 | ubuntu | training | kubeflow | pass | R:0 D:4 P:1 C:10 | pending |
| h100-aks-ubuntu-inference-dynamo | aks | h100 | ubuntu | inference | dynamo | pass | R:0 D:4 P:1 C:11 | [aks/h100-ubuntu/inference-dynamo](https://validation.aicr.run/#/aks/h100-ubuntu/inference-dynamo) |
| h100-aks-ubuntu-training-kubeflow | aks | h100 | ubuntu | training | kubeflow | pass | R:0 D:4 P:1 C:10 | [aks/h100-ubuntu/training-kubeflow](https://validation.aicr.run/#/aks/h100-ubuntu/training-kubeflow) |
| h100-aks-ubuntu-training-slurm | aks | h100 | ubuntu | training | slurm | pass | R:0 D:4 P:0 C:11 | pending |
| bcm-inference | bcm | — | — | inference | — | pass | R:0 D:0 P:0 C:5 | pending |
| h100-bcm-ubuntu-training | bcm | h100 | ubuntu | training | — | pass | R:0 D:4 P:0 C:5 | pending |
| a100-eks-ubuntu-training-kubeflow | eks | a100 | ubuntu | training | kubeflow | pass | R:0 D:4 P:0 C:10 | pending |
| gb200-eks-ubuntu-inference-dynamo | eks | gb200 | ubuntu | inference | dynamo | pass | R:0 D:4 P:1 C:10 | pending |
| gb200-eks-ubuntu-training-kubeflow | eks | gb200 | ubuntu | training | kubeflow | pass | R:0 D:4 P:2 C:8 | pending |
| gb200-eks-ubuntu-training-slurm | eks | gb200 | ubuntu | training | slurm | pass | R:0 D:4 P:0 C:10 | pending |
| h100-eks-ubuntu-inference-dynamo | eks | h100 | ubuntu | inference | dynamo | pass | R:0 D:4 P:1 C:11 | pending |
| h100-eks-ubuntu-inference-dynamo | eks | h100 | ubuntu | inference | dynamo | pass | R:0 D:4 P:1 C:11 | [eks/h100-ubuntu/inference-dynamo](https://validation.aicr.run/#/eks/h100-ubuntu/inference-dynamo) |
| h100-eks-ubuntu-inference-nim | eks | h100 | ubuntu | inference | nim | pass | R:0 D:4 P:0 C:11 | pending |
| h100-eks-ubuntu-training-kubeflow | eks | h100 | ubuntu | training | kubeflow | pass | R:0 D:4 P:1 C:10 | pending |
| h100-eks-ubuntu-training-kubeflow | eks | h100 | ubuntu | training | kubeflow | pass | R:0 D:4 P:1 C:10 | [eks/h100-ubuntu/training-kubeflow](https://validation.aicr.run/#/eks/h100-ubuntu/training-kubeflow) |
| h100-eks-ubuntu-training-slurm | eks | h100 | ubuntu | training | slurm | pass | R:0 D:4 P:0 C:11 | pending |
| h200-eks-inference | eks | h200 | — | inference | — | pass | R:0 D:4 P:0 C:5 | pending |
| h200-eks-training | eks | h200 | — | training | — | pass | R:0 D:4 P:1 C:10 | pending |
Expand All @@ -70,8 +76,8 @@ The matrix is computed **hermetically and offline**: every signal is a pure read
| a100-gke-cos-training-kubeflow | gke | a100 | cos | training | kubeflow | pass | R:0 D:4 P:0 C:10 | pending |
| b200-gke-cos-inference-dynamo | gke | b200 | cos | inference | dynamo | pass | R:0 D:4 P:0 C:11 | pending |
| b200-gke-cos-training-kubeflow | gke | b200 | cos | training | kubeflow | pass | R:0 D:4 P:0 C:10 | pending |
| h100-gke-cos-inference-dynamo | gke | h100 | cos | inference | dynamo | pass | R:0 D:4 P:1 C:11 | pending |
| h100-gke-cos-training-kubeflow | gke | h100 | cos | training | kubeflow | pass | R:0 D:4 P:1 C:10 | pending |
| h100-gke-cos-inference-dynamo | gke | h100 | cos | inference | dynamo | pass | R:0 D:4 P:1 C:11 | [gke/h100-cos/inference-dynamo](https://validation.aicr.run/#/gke/h100-cos/inference-dynamo) |
| h100-gke-cos-training-kubeflow | gke | h100 | cos | training | kubeflow | pass | R:0 D:4 P:1 C:10 | [gke/h100-cos/training-kubeflow](https://validation.aicr.run/#/gke/h100-cos/training-kubeflow) |
| h100-gke-cos-training-slurm | gke | h100 | cos | training | slurm | pass | R:0 D:4 P:0 C:11 | pending |
| h100-kind-inference-dynamo | kind | h100 | — | inference | dynamo | pass | R:0 D:4 P:0 C:11 | pending |
| h100-kind-training-kubeflow | kind | h100 | — | training | kubeflow | pass | R:0 D:4 P:0 C:10 | pending |
Expand Down
51 changes: 27 additions & 24 deletions pkg/corroborate/generate.go
Original file line number Diff line number Diff line change
Expand Up @@ -59,16 +59,19 @@ var rendererHTML []byte
const platformNone = "(none)"

// Facet axis keys, emitted in index.json's criteria map and each tab's coord.
// Exported so external consumers that read a Tab.Coord map (e.g. pkg/testgrid)
// share this single source of truth for the key spelling rather than
// hand-writing string literals that could silently drift.
const (
axisService = "service"
axisAccelerator = "accelerator"
axisOS = "os"
axisIntent = "intent"
axisPlatform = "platform"
AxisService = "service"
AxisAccelerator = "accelerator"
AxisOS = "os"
AxisIntent = "intent"
AxisPlatform = "platform"
)

// criteriaAxes is the fixed facet-axis order emitted in index.json.
var criteriaAxes = []string{axisService, axisAccelerator, axisOS, axisIntent, axisPlatform}
var criteriaAxes = []string{AxisService, AxisAccelerator, AxisOS, AxisIntent, AxisPlatform}

// Options configures Generate.
type Options struct {
Expand Down Expand Up @@ -844,7 +847,7 @@ func assembleGroups(builts []recipeTab) []Group {
}
da := groupMap[svc][dash]
if da == nil {
da = &dashAgg{accelerator: b.tab.Coord[axisAccelerator], os: b.tab.Coord[axisOS]}
da = &dashAgg{accelerator: b.tab.Coord[AxisAccelerator], os: b.tab.Coord[AxisOS]}
groupMap[svc][dash] = da
}
da.tabs = append(da.tabs, b.tab)
Expand All @@ -869,7 +872,7 @@ func assembleGroups(builts []recipeTab) []Group {
for _, dk := range dashKeys {
da := dashes[dk]
sort.Slice(da.tabs, func(i, j int) bool {
return da.tabs[i].Coord[axisIntent]+"-"+da.tabs[i].Coord[axisPlatform] < da.tabs[j].Coord[axisIntent]+"-"+da.tabs[j].Coord[axisPlatform]
return da.tabs[i].Coord[AxisIntent]+"-"+da.tabs[i].Coord[AxisPlatform] < da.tabs[j].Coord[AxisIntent]+"-"+da.tabs[j].Coord[AxisPlatform]
})
dashboards = append(dashboards, Dashboard{Accelerator: da.accelerator, OS: da.os, Tabs: da.tabs})
}
Expand All @@ -892,25 +895,25 @@ func phaseRollup(statesByPhase map[string][]State) map[string]string {
// emitted as "" (the renderer treats it as the (none) facet).
func coordMap(c recipe.Criteria) map[string]string {
return map[string]string{
axisService: string(c.Service),
axisAccelerator: string(c.Accelerator),
axisOS: string(c.OS),
axisIntent: string(c.Intent),
axisPlatform: string(c.Platform),
AxisService: string(c.Service),
AxisAccelerator: string(c.Accelerator),
AxisOS: string(c.OS),
AxisIntent: string(c.Intent),
AxisPlatform: string(c.Platform),
}
}

// recordPresent tracks which criteria values actually appear, for the facet
// dropdowns.
func recordPresent(present map[string]map[string]struct{}, c recipe.Criteria) {
present[axisService][string(c.Service)] = struct{}{}
present[axisAccelerator][string(c.Accelerator)] = struct{}{}
present[axisOS][string(c.OS)] = struct{}{}
present[axisIntent][string(c.Intent)] = struct{}{}
present[AxisService][string(c.Service)] = struct{}{}
present[AxisAccelerator][string(c.Accelerator)] = struct{}{}
present[AxisOS][string(c.OS)] = struct{}{}
present[AxisIntent][string(c.Intent)] = struct{}{}
if p := string(c.Platform); p != "" {
present[axisPlatform][p] = struct{}{}
present[AxisPlatform][p] = struct{}{}
} else {
present[axisPlatform][platformNone] = struct{}{}
present[AxisPlatform][platformNone] = struct{}{}
}
}

Expand All @@ -922,11 +925,11 @@ func criteriaValues(present map[string]map[string]struct{}) map[string][]string
platformVals := append([]string{}, recipe.GetCriteriaPlatformTypes()...)
platformVals = append(platformVals, platformNone)
canonical := map[string][]string{
axisService: recipe.GetCriteriaServiceTypes(),
axisAccelerator: recipe.GetCriteriaAcceleratorTypes(),
axisOS: recipe.GetCriteriaOSTypes(),
axisIntent: recipe.GetCriteriaIntentTypes(),
axisPlatform: platformVals,
AxisService: recipe.GetCriteriaServiceTypes(),
AxisAccelerator: recipe.GetCriteriaAcceleratorTypes(),
AxisOS: recipe.GetCriteriaOSTypes(),
AxisIntent: recipe.GetCriteriaIntentTypes(),
AxisPlatform: platformVals,
}
out := make(map[string][]string, len(criteriaAxes))
for _, axis := range criteriaAxes {
Expand Down
34 changes: 34 additions & 0 deletions pkg/testgrid/doc.go
Original file line number Diff line number Diff line change
@@ -0,0 +1,34 @@
// Copyright (c) 2026, NVIDIA CORPORATION & AFFILIATES. All rights reserved.
//
// Licensed under the Apache License, Version 2.0 (the "License");
// you may not use this file except in compliance with the License.
// You may obtain a copy of the License at
//
// http://www.apache.org/licenses/LICENSE-2.0
//
// Unless required by applicable law or agreed to in writing, software
// distributed under the License is distributed on an "AS IS" BASIS,
// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
// See the License for the specific language governing permissions and
// limitations under the License.

// Package testgrid maps a recipe's canonical coordinate to the AICR evidence
// dashboard (validation.aicr.run) and answers "does this coordinate have a
// dashboard presence?" — the two facts RQ1 (#1283) and RQ2 (#1284) share.
//
// It is deliberately thin and owns no mapping of its own: the recipe →
// coordinate mapping is pkg/recipe.CoordinateFor (the single shared function
// consumed by GP4/GP5/TG2/RQ1). testgrid only adds the dashboard host, the
// hash-routed deep-link scheme built around Coordinate.Path, and the committed
// presence manifest.
//
// Two presence sources, one spelling of a coordinate path:
//
// - Committed (hermetic): presence.yaml, embedded here and read offline by
// the recipe-health generator so link *construction* never touches the
// network. LoadPresence exposes it as a Presence set.
// - Live: the published data/index.json the dashboard renderer boots from.
// LivePaths extracts the present coordinate paths from a parsed index so
// the warning-only link-check bot can compare the committed links against
// what the dashboard actually serves.
package testgrid
47 changes: 47 additions & 0 deletions pkg/testgrid/presence.yaml
Original file line number Diff line number Diff line change
@@ -0,0 +1,47 @@
# Copyright (c) 2026, NVIDIA CORPORATION & AFFILIATES. All rights reserved.
#
# Licensed under the Apache License, Version 2.0 (the "License");
# you may not use this file except in compliance with the License.
# You may obtain a copy of the License at
#
# http://www.apache.org/licenses/LICENSE-2.0
#
# Unless required by applicable law or agreed to in writing, software
# distributed under the License is distributed on an "AS IS" BASIS,
# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
# See the License for the specific language governing permissions and
# limitations under the License.

# Dashboard presence manifest (RQ1 / #1283).
#
# The committed set of TestGrid/validation.aicr.run coordinate paths that
# currently carry at least one real presence on the evidence dashboard. The
# recipe-health generator (tools/health) reads this list to decide which
# Evidence cells become a deterministic deep-link into the dashboard and which
# stay an honest `pending` — it stays hermetic (no network) because presence is
# read from this committed file, never fetched.
#
# Each entry is a "<group>/<dashboard>/<tab>" coordinate path, exactly as
# pkg/recipe.CoordinateFor(criteria).Path() renders it: group=service,
# dashboard=<accelerator>-<os>, tab=<intent>[-<platform>].
#
# Today the dashboard only covers the UAT-driven recipes; most recipes stay
# `pending` until real-hardware coverage broadens. This file is the single
# source of truth for "linked" — the weekly, warning-only testgrid-link-check
# bot (RQ2 / #1284) fetches the live dashboard data and warns when an entry
# here no longer resolves, keeping the manifest honest without blocking merges.
#
# To add a coordinate: confirm https://validation.aicr.run/#/<path> shows real
Comment thread
mchmarny marked this conversation as resolved.
# data, then add the path below (keep the list sorted), then run
# `make recipe-health-docs` and commit the regenerated
# docs/user/recipe-health.md in the same PR — the Evidence link only lands once
# the committed matrix is regenerated (recipe-health-check is advisory, not in
# the merge gate, so a presence-only edit would otherwise leave the doc stale
# until the weekly refresh PR picks it up).
coordinates:
- aks/h100-ubuntu/inference-dynamo
- aks/h100-ubuntu/training-kubeflow
- eks/h100-ubuntu/inference-dynamo
- eks/h100-ubuntu/training-kubeflow
- gke/h100-cos/inference-dynamo
- gke/h100-cos/training-kubeflow
Loading
Loading