Skip to content

ci: declare contents: read on mock-nvml-e2e and tests#1126

Open
arpitjain099 wants to merge 2 commits into
kubernetes-sigs:mainfrom
arpitjain099:ci/add-permissions
Open

ci: declare contents: read on mock-nvml-e2e and tests#1126
arpitjain099 wants to merge 2 commits into
kubernetes-sigs:mainfrom
arpitjain099:ci/add-permissions

Conversation

@arpitjain099

@arpitjain099 arpitjain099 commented May 13, 2026

Copy link
Copy Markdown

Pins the default GITHUB_TOKEN to read-only on the two CI workflows that hadn't declared scope:

  • mock-nvml-e2e.yaml — emulates 8× GB200 NVL GPUs with the mock NVML from nvidia/k8s-test-infra, spins up a kind cluster with DRA, and runs the BATS suite.
  • tests.yaml — placeholder workflow that documents the Prow-driven test flow.

Neither writes to GitHub. YAML validated locally.

@k8s-ci-robot k8s-ci-robot added the do-not-merge/release-note-label-needed Indicates that a PR should not merge because it's missing one of the release note labels. label May 13, 2026
@netlify

netlify Bot commented May 13, 2026 •
edited
Loading

Copy link
Copy Markdown

✅ Deploy Preview for dra-driver-nvidia-gpu ready!

Name Link
🔨 Latest commit 730a2e0
🔍 Latest deploy log https://app.netlify.com/projects/dra-driver-nvidia-gpu/deploys/6a290f1759931a0008d0c2e0
😎 Deploy Preview https://deploy-preview-1126--dra-driver-nvidia-gpu.netlify.app
📱 Preview on mobile
Toggle QR Code...

QR Code

Use your smartphone camera to open QR code link.

To edit notification comments on pull requests, go to your Netlify project configuration.

@k8s-ci-robot k8s-ci-robot added needs-kind Indicates a PR lacks a `kind/foo` label and requires one. cncf-cla: yes Indicates the PR's author has signed the CNCF CLA. labels May 13, 2026
@k8s-ci-robot

k8s-ci-robot commented May 13, 2026

Copy link
Copy Markdown
Contributor

Welcome @arpitjain099!

It looks like this is your first PR to kubernetes-sigs/dra-driver-nvidia-gpu 🎉. Please refer to our pull request process documentation to help your PR have a smooth ride to approval.

You will be prompted by a bot to use commands during the review process. Do not be afraid to follow the prompts! It is okay to experiment. Here is the bot commands documentation.

You can also check if kubernetes-sigs/dra-driver-nvidia-gpu has its own contribution guidelines.

You may want to refer to our testing guide if you run into trouble with your tests not passing.

If you are having difficulty getting your pull request seen, please follow the recommended escalation practices. Also, for tips and tricks in the contribution process you may want to read the Kubernetes contributor cheat sheet. We want to make sure your contribution gets all the attention it needs!

Thank you, and welcome to Kubernetes. 😃

@k8s-ci-robot k8s-ci-robot added the needs-ok-to-test Indicates a PR that requires an org member to verify it is safe to test. label May 13, 2026
@k8s-ci-robot k8s-ci-robot requested a review from cdesiniotis May 13, 2026 11:30
@k8s-ci-robot

k8s-ci-robot commented May 13, 2026

Copy link
Copy Markdown
Contributor

[APPROVALNOTIFIER] This PR is NOT APPROVED

This pull-request has been approved by: arpitjain099
Once this PR has been reviewed and has the lgtm label, please assign klueska for approval. For more information see the Code Review Process.

The full list of commands accepted by this bot can be found here.

Details Needs approval from an approver in each of these files:

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

@k8s-ci-robot

k8s-ci-robot commented May 13, 2026

Copy link
Copy Markdown
Contributor

Hi @arpitjain099. Thanks for your PR.

I'm waiting for a kubernetes-sigs member to verify that this patch is reasonable to test. If it is, they should reply with /ok-to-test on its own line. Until that is done, I will not automatically test new commits in this PR, but the usual testing commands by org members will still work.

Regular contributors should join the org to skip this step.

Once the patch is verified, the new status will be reflected by the ok-to-test label.

I understand the commands that are listed here.

Details

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository.

@k8s-ci-robot k8s-ci-robot requested a review from guptaNswati May 13, 2026 11:30
@k8s-ci-robot k8s-ci-robot added the size/XS Denotes a PR that changes 0-9 lines, ignoring generated files. label May 13, 2026
@shivamerla shivamerla added this to the v0.4.1 milestone May 14, 2026
@shivamerla shivamerla moved this from Backlog to In-Review in DRA Driver for NVIDIA GPUs May 14, 2026
@arpitjain099

arpitjain099 commented May 26, 2026

Copy link
Copy Markdown
Author

Friendly ping in case this slipped off the queue - has been waiting on /ok-to-test from a kubernetes-sigs member since the 13th. Happy to rebase if anything changed in the meantime.

@visheshtanksale

visheshtanksale commented Jun 3, 2026

Copy link
Copy Markdown
Contributor

/ok-to-test

@k8s-ci-robot k8s-ci-robot added ok-to-test Indicates a non-member PR verified by an org member that is safe to test. and removed needs-ok-to-test Indicates a PR that requires an org member to verify it is safe to test. labels Jun 3, 2026
@visheshtanksale

visheshtanksale commented Jun 3, 2026

Copy link
Copy Markdown
Contributor

/release-note-none

@k8s-ci-robot k8s-ci-robot added release-note-none Denotes a PR that doesn't merit a release note. and removed do-not-merge/release-note-label-needed Indicates that a PR should not merge because it's missing one of the release note labels. labels Jun 3, 2026
@arpitjain099

arpitjain099 commented Jun 3, 2026

Copy link
Copy Markdown
Author

Thanks @visheshtanksale. For the record: this PR only adds permissions: contents: read to the two GitHub Actions workflows (mock-nvml-e2e.yaml, tests.yaml); it does not touch any Prow config, so it cannot affect the e2e-lambda-gpu / -gh200 jobs. Those failed on the Lambda GPU runners while the parallel e2e-gcp-nvkind job passed on the same commit, which points to runner/infra rather than this change. Retrying in case they are transient.

@arpitjain099

arpitjain099 commented Jun 3, 2026

Copy link
Copy Markdown
Author

/retest

@k8s-ci-robot

k8s-ci-robot commented Jun 3, 2026

Copy link
Copy Markdown
Contributor

@arpitjain099: The following tests failed, say /retest to rerun all failed tests or /retest-required to rerun all mandatory failed tests:

Test name Commit Details Required Rerun command
pull-dra-driver-nvidia-gpu-e2e-lambda-gpu-gh200 b75e142 link false /test pull-dra-driver-nvidia-gpu-e2e-lambda-gpu-gh200
pull-dra-driver-nvidia-gpu-e2e-lambda-gpu b75e142 link false /test pull-dra-driver-nvidia-gpu-e2e-lambda-gpu

Full PR test history. Your PR dashboard. Please help us cut down on flakes by linking to an open issue when you hit one in your PR.

Details

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. I understand the commands that are listed here.

@visheshtanksale

visheshtanksale commented Jun 3, 2026

Copy link
Copy Markdown
Contributor

Thanks @visheshtanksale. For the record: this PR only adds permissions: contents: read to the two GitHub Actions workflows (mock-nvml-e2e.yaml, tests.yaml); it does not touch any Prow config, so it cannot affect the e2e-lambda-gpu / -gh200 jobs. Those failed on the Lambda GPU runners while the parallel e2e-gcp-nvkind job passed on the same commit, which points to runner/infra rather than this change. Retrying in case they are transient.

Yes those failure are not related.
@shivamerla Can you please add a ok to test here. It needs approval from maintainers to start the github actions workflow.

@shivamerla

shivamerla commented Jun 4, 2026

Copy link
Copy Markdown
Contributor

@arpitjain099 can you make similar changes to other workflows too? other than release-automation and issue-triage workflows, rest should have only read permissions.

@arpitjain099

arpitjain099 commented Jun 4, 2026

Copy link
Copy Markdown
Author

@arpitjain099 can you make similar changes to other workflows too? other than release-automation and issue-triage workflows, rest should have only read permissions.

@shivamerla sure. Let me check it tomorrow.

@k8s-ci-robot k8s-ci-robot removed the size/XS Denotes a PR that changes 0-9 lines, ignoring generated files. label Jun 5, 2026
@k8s-ci-robot k8s-ci-robot added the size/S Denotes a PR that changes 10-29 lines, ignoring generated files. label Jun 5, 2026
@arpitjain099

arpitjain099 commented Jun 5, 2026

Copy link
Copy Markdown
Author

Done, @shivamerla. I extended workflow-level contents: read to the remaining read-only workflows (golang.yaml and variables.yaml are now in the PR alongside the original tests.yaml and mock-nvml-e2e.yaml). I left release-automation and issue-triage untouched as you asked since they need write scopes, and I deliberately did not cap basic-checks.yaml since it is a reusable-workflow orchestrator and a top-level block there would strip the security-events: write the CodeQL chain needs. Let me know if you'd like it handled differently.

@shivamerla

shivamerla commented Jun 5, 2026

Copy link
Copy Markdown
Contributor

/ok-to-test

@arpitjain099
ci: declare contents: read on mock-nvml-e2e and tests
b4d4dca 
Both workflows are read-only: mock-nvml-e2e spins up a kind cluster
with DRA and runs BATS suites; tests.yaml is a placeholder that
documents the Prow-driven flow. No API writes.

Signed-off-by: Arpit Jain <arpitjain099@gmail.com>
@arpitjain099
ci: declare contents: read on golang and variables reusable workflows
730a2e0 
Follow-up to the maintainer request to extend least-privilege
permissions to the remaining workflows. Both golang.yaml and
variables.yaml are reusable (on: workflow_call) and only check out
code and run read-only lint/test/build/version steps, so contents:
read is sufficient.

These are declared at the job level rather than the top level so the
reusable workflows do not cap scopes inherited from callers. The
ci.yaml -> basic-checks.yaml chain grants security-events: write for
the CodeQL job in code_scanning.yaml, and a top-level cap on the
shared reusable workflows could strip that. release-automation and
issue-triage are intentionally left untouched as they need write
access.

Signed-off-by: Arpit Jain <arpitjain099@gmail.com>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@cdesiniotis cdesiniotis Awaiting requested review from cdesiniotis

@guptaNswati guptaNswati Awaiting requested review from guptaNswati

Assignees

No one assigned

Labels

cncf-cla: yes Indicates the PR's author has signed the CNCF CLA. needs-kind Indicates a PR lacks a `kind/foo` label and requires one. ok-to-test Indicates a non-member PR verified by an org member that is safe to test. release-note-none Denotes a PR that doesn't merit a release note. size/S Denotes a PR that changes 10-29 lines, ignoring generated files.

Projects

DRA Driver for NVIDIA GPUs
Status: In-Review

Milestone

v0.4.1

Development

Successfully merging this pull request may close these issues.

4 participants

@arpitjain099 @k8s-ci-robot @visheshtanksale @shivamerla