Repository navigation
[no-ci] CI: cover internal self-hosted runners in the runner trust probe - #3268
Merged
juenglin merged 3 commits intoOct 28, 2026
Merged
Conversation
Derive the probe's runner-label matrix from each branch's own workflows and guard on fork status, so the probe self-adapts across main and the private development branch without diverging. Reproduces the current main label set exactly (16 host, 17 Linux-GPU).
Contributor
juenglin
changed the title
Tighten the riscv64 regex branch to require a hardware suffix (-[a-z0-9][a-z0-9-]*[a-z0-9]), preventing HOST_PLATFORM strings (linux-riscv64) and artifact name prefixes (linux-riscv64-) from matching as phantom runner labels and queuing until timeout.
Contributor
Author
|
/ok to test ff39a12 |
juenglin
marked this pull request as ready for review
October 28, 2026 18:41
|
No actionable comments were generated in the recent review.
 |
| Layer / File(s) | Summary |
|---|---|
Job eligibility and runner labels .github/workflows/runner-trust-probe.yml |
The job skips fork repositories instead of checking whether the repository owner is nvidia. It combines hosted labels, matching labels discovered in other workflow files, and GPU labels derived from ci/test-matrix.yml. Linux/WSL GPU-pattern matches go to linux_gpu; other discovered labels go to host. The optional filter remains applied to both lists. |
Possibly related PRs
- NVIDIA/cuda-python#3251: Adds the runner trust probe workflow that this change modifies.
- NVIDIA/cuda-python#3265: Also modifies the runner trust probe workflow, including its schedule and summary formatting.
Priority:
Change: Feature
Merge Risk: 
a5ecf
-
The probe can select labels from unrelated workflow text and wait for an unavailable runner; constrain extraction before merging.
Comment @coderabbitai help to get the list of available commands.
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 1
-
-
- Source mode: Auto
- Repository: NVIDIA/cuda-python
- Branch: main
- File: .coderabbit.yaml
- Commit: 8079296
- Layers: Repository YAML
- Review profile: CHILL
- Plan: Enterprise
- Run ID:
5723f2e0-88d8-47e8-af04-acc9166f8622
-
.github/workflows/runner-trust-probe.yml
Included review availability: This review used your included allowance. Your plan provides up to 12 included reviews per hour; 11 remain after this review.
-
Exclude the probe workflow itself from the grep scan so description-string examples do not produce phantom runner labels. Also filter extracted tokens ending in '-' as a defensive guard against artifact-name suffixes.
rwgk
approved these changes
Oct 28, 2026
Contributor
Author
|
/ok to test a5ecf75 |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Description
The runner trust probe (#3251) exists to prove which runners still trust the compromised eMudhra/emSign chain (CVE-2026-111943) rather than relying on version claims, but it hard-codes its label matrix to the public label set and its job guard evaluates false on the private development repository, so it never runs there or exercises the additional runners that branch uses. Because
mainmerges into the private branch frequently, the fix should live in a single identical copy of this workflow.This change makes the probe self-configure from each branch's own CI definitions:
!github.event.repository.forkreplaces the owner-name check. Both this repository and the private one are non-forks; personal forks still cannot reach self-hosted runners.grepscan ofruns-onreferences across this branch's own.github/workflows/, using a grammar that matches runner-label tokens and excludes host-platform strings (e.g.linux-64) and artifact-name fragments. GPU labels that appear only as computed matrix outputs are still derived fromci/test-matrix.yml. The host-vs-container split is preserved.No change to what gets probed on
main— the derivation reproduces the current label set exactly (16 host, 17 Linux-GPU; verified against the latest scheduled run). On the private branch, the same logic picks up its extra labels because that branch's own workflows reference them.Follow-up (private branch)
Confirm whether
runs-on: <label>alone routes to the internal runner pools, or whether an explicitgroup:is also required; if the latter, the probe matrix step will need to emit the map form for those labels.Checklist