NVIDIA / nodewright / 42279768698
84%

DEFAULT BRANCH: main
Ran
Jobs 1
Files 60
Run time 1min
Badge
Embed ▾
README BADGES
x

If you need to use a raster PNG badge, change the '.svg' to '.png' in the link

Markdown

Textile

RDoc

HTML

Rst
coverage: 84.195% (+0.02%) from 84.171%
42279768698

push

github

web-flow 
ci: replace OpenVEX on released images and cover agent v7.0.0's findings (#1000)

nSpect imports the OpenVEX attestation a release publishes as
source-managed and rejects manual VEX for that image, so a statement
written after the tag never reached the released image.

vex-reattest.yaml replaces that attestation without rebuilding the
image. It runs only on the tag's release branch, at that branch's tip
(so re-running an old run cannot roll a newer document back), for a tag
on the branch, and only on an index carrying the release signature of
that exact tag ref and commit. It records each platform's OpenVEX
attestations (by signed predicate type, scripts/openvex-referrers.sh),
attests the document through cosign-attest-multiplatform in a new
vex-only mode, verifies it against the exact branch identity, and
requires exactly one new attestation per platform before removing
anything. On GHCR, which has no referrers API, it first rewrites the
sha256-<hex> fallback index without the replaced attestations
(scripts/oci-drop-referrers.sh) so nothing meets a dangling descriptor,
then deletes their package versions and checks only the new one is
listed. An ngc-publish job copies the manifests to NGC staging again
with `oras cp -r` and removes every other OpenVEX attestation NGC
holds, read from NGC itself so a re-dispatch converges.

cosign-verify-release gains an openvex-identity-regexp input, and the
release workflows' NGC verify steps accept the re-attest identity on
the component's own release branches, so they can still be re-run after
a re-attest. The runbook documents the identity, the procedure, the
branch prerequisites and the ngc-publish branch policy; the OpenVEX
skill documents the nSpect-only exceptions to its rules.

Add not_affected statements for the 18 findings nSpect lists against
agent v7.0.0, pinned to pkg:golang/stdlib@1.27.1 or
golang.org/x/text@v0.38.0. The vulnerable packages are not linked into
./cmd/agent (go list -deps and govulncheck... (continued)

10457 of 12420 relevant lines covered (84.19%)

7.76 hits per line

Coverage Regressions

Lines Coverage ∆ File
8
78.65
-2.16% operator/internal/cli/utils/utils.go
5
78.34
-3.18% operator/cmd/cli/app/lifecycle.go
Jobs
ID Job ID Ran Files Coverage
1 42279768698.1 60
84.19
GitHub Action Run
Source Files on build 42279768698