Skip to content

chore: harden CI supply chain #517

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
andreatnvidia merged 3 commits into from
Apr 13, 2026
Merged

chore: harden CI supply chain #517

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
3 commits
Select commit Hold shift + click to select a range
cdee13b
ci: harden CI supply chain
andreatnvidia Apr 9, 2026
60a8e11
fix: add dependabot pip entries for each sub-package
andreatnvidia Apr 10, 2026
3cdfa4d
Merge branch 'main' into andreatgretel/chore/ci-supply-chain-hardening
andreatnvidia Apr 13, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
26 changes: 26 additions & 0 deletions .github/dependabot.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,26 @@
version: 2
updates:
- package-ecosystem: github-actions
directory: /
schedule:
interval: weekly
commit-message:
prefix: "ci"
- package-ecosystem: pip
directory: /packages/data-designer-config
schedule:
interval: weekly
commit-message:
prefix: "chore"
- package-ecosystem: pip
directory: /packages/data-designer-engine
schedule:
interval: weekly
commit-message:
prefix: "chore"
- package-ecosystem: pip
directory: /packages/data-designer
schedule:
interval: weekly
commit-message:
prefix: "chore"
Comment thread
andreatnvidia marked this conversation as resolved.
2 changes: 1 addition & 1 deletion .github/workflows/agentic-ci-pr-review.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -123,7 +123,7 @@ jobs:
echo "sha=$SHA" >> "$GITHUB_OUTPUT"

- name: Checkout PR branch
uses: actions/checkout@v4
uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
with:
ref: ${{ steps.head.outputs.sha }}
fetch-depth: 0
Expand Down
8 changes: 5 additions & 3 deletions .github/workflows/build-docs.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -10,6 +10,8 @@ on:
types:
- published

permissions: {}

jobs:
build-notebooks:
uses: ./.github/workflows/build-notebooks.yml
Expand All @@ -23,17 +25,17 @@ jobs:
contents: write
steps:
- name: Checkout repository
uses: actions/checkout@v6
uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
- name: Install uv
uses: astral-sh/setup-uv@v7
uses: astral-sh/setup-uv@37802adc94f370d6bfd71619e3f0bf239e1f3b78 # v7
with:
version: "0.9.5"
- name: Set up Python
run: uv python install 3.11
- name: Install dependencies for docs
run: uv sync --all-packages --group docs
- name: Download artifact from previous step
uses: actions/download-artifact@v7
uses: actions/download-artifact@37930b1c2abaa49bbe596cd826c3c89aef350131 # v7
with:
name: notebooks
path: docs/notebooks
Expand Down
10 changes: 6 additions & 4 deletions .github/workflows/build-notebooks.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -14,6 +14,8 @@ on:
schedule:
- cron: "0 12 * * MON"

permissions: {}

jobs:
build:
runs-on: ubuntu-latest
Expand All @@ -25,17 +27,17 @@ jobs:
OPENROUTER_API_KEY: ${{ secrets.TEST_OPENROUTER_API_KEY }}
steps:
- name: Checkout repository
uses: actions/checkout@v6
uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
- name: Install uv
uses: astral-sh/setup-uv@v7
uses: astral-sh/setup-uv@37802adc94f370d6bfd71619e3f0bf239e1f3b78 # v7
with:
version: "0.9.5"
- name: Set up Python
run: uv python install 3.11
- name: Restore notebook cache
if: inputs.use_cache
id: cache
uses: actions/cache@v5
uses: actions/cache@668228422ae6a00e4ad889ee87cd7109ec5666a7 # v5
with:
path: .notebook-cache
key: notebooks-${{ hashFiles('docs/notebook_source/*.py') }}
Expand Down Expand Up @@ -80,7 +82,7 @@ jobs:
- name: Convert and execute notebooks
run: make convert-execute-notebooks ${{ inputs.use_cache && 'USE_CACHE=1' || '' }}
- name: Upload notebooks as artifacts
uses: actions/upload-artifact@v6
uses: actions/upload-artifact@b7c566a772e6b6bfb58ed0dc250532a479d7789f # v6
with:
name: notebooks
path: docs/notebooks
6 changes: 4 additions & 2 deletions .github/workflows/check-colab-notebooks.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -11,17 +11,19 @@ on:
- 'docs/notebook_source/*.py'
workflow_dispatch:

permissions: {}

jobs:
check-colab-notebooks:
name: Check Colab Notebooks
runs-on: ubuntu-latest

steps:
- name: Checkout code
uses: actions/checkout@v6
uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6

- name: Install uv
uses: astral-sh/setup-uv@v7
uses: astral-sh/setup-uv@37802adc94f370d6bfd71619e3f0bf239e1f3b78 # v7
with:
version: "latest"
python-version: "3.11"
Expand Down
30 changes: 16 additions & 14 deletions .github/workflows/ci.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -7,6 +7,8 @@ on:
branches: [ main ]
workflow_dispatch:

permissions: {}

jobs:
# ===========================================================================
# Independent Package Tests
Expand All @@ -24,10 +26,10 @@ jobs:

steps:
- name: Checkout code
uses: actions/checkout@v6
uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6

- name: Install uv
uses: astral-sh/setup-uv@v7
uses: astral-sh/setup-uv@37802adc94f370d6bfd71619e3f0bf239e1f3b78 # v7
with:
version: "latest"
python-version: ${{ matrix.python-version }}
Expand Down Expand Up @@ -55,10 +57,10 @@ jobs:

steps:
- name: Checkout code
uses: actions/checkout@v6
uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6

- name: Install uv
uses: astral-sh/setup-uv@v7
uses: astral-sh/setup-uv@37802adc94f370d6bfd71619e3f0bf239e1f3b78 # v7
with:
version: "latest"
python-version: ${{ matrix.python-version }}
Expand Down Expand Up @@ -86,10 +88,10 @@ jobs:

steps:
- name: Checkout code
uses: actions/checkout@v6
uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6

- name: Install uv
uses: astral-sh/setup-uv@v7
uses: astral-sh/setup-uv@37802adc94f370d6bfd71619e3f0bf239e1f3b78 # v7
with:
version: "latest"
python-version: ${{ matrix.python-version }}
Expand Down Expand Up @@ -125,10 +127,10 @@ jobs:

steps:
- name: Checkout code
uses: actions/checkout@v6
uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6

- name: Install uv
uses: astral-sh/setup-uv@v7
uses: astral-sh/setup-uv@37802adc94f370d6bfd71619e3f0bf239e1f3b78 # v7
with:
version: "latest"
python-version: ${{ matrix.python-version }}
Expand Down Expand Up @@ -163,10 +165,10 @@ jobs:

steps:
- name: Checkout code
uses: actions/checkout@v6
uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6

- name: Install uv
uses: astral-sh/setup-uv@v7
uses: astral-sh/setup-uv@37802adc94f370d6bfd71619e3f0bf239e1f3b78 # v7
with:
version: "latest"
python-version: ${{ matrix.python-version }}
Expand All @@ -185,10 +187,10 @@ jobs:

steps:
- name: Checkout code
uses: actions/checkout@v6
uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6

- name: Install uv
uses: astral-sh/setup-uv@v7
uses: astral-sh/setup-uv@37802adc94f370d6bfd71619e3f0bf239e1f3b78 # v7
with:
version: "latest"
python-version: "3.11"
Expand All @@ -209,12 +211,12 @@ jobs:

steps:
- name: Checkout code
uses: actions/checkout@v6
uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
with:
fetch-depth: 0 # Full history needed for file creation dates

- name: Install uv
uses: astral-sh/setup-uv@v7
uses: astral-sh/setup-uv@37802adc94f370d6bfd71619e3f0bf239e1f3b78 # v7
with:
version: "latest"
python-version: "3.11"
Expand Down
12 changes: 7 additions & 5 deletions .github/workflows/docs-preview.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -8,6 +8,8 @@ on:
- "mkdocs.yml"
- ".github/workflows/docs-preview.yml"

permissions: {}

jobs:
build-and-deploy:
runs-on: ubuntu-latest
Expand All @@ -16,10 +18,10 @@ jobs:
pull-requests: write
steps:
- name: Checkout repository
uses: actions/checkout@v6
uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6

- name: Install uv
uses: astral-sh/setup-uv@v7
uses: astral-sh/setup-uv@37802adc94f370d6bfd71619e3f0bf239e1f3b78 # v7
with:
version: "0.9.5"

Expand Down Expand Up @@ -77,22 +79,22 @@ jobs:

- name: Deploy to Cloudflare Pages
id: deploy
uses: cloudflare/wrangler-action@v3
uses: cloudflare/wrangler-action@da0e0dfe58b7a431659754fdf3f186c529afbe65 # v3
with:
apiToken: ${{ secrets.CLOUDFLARE_API_TOKEN }}
accountId: ${{ secrets.CLOUDFLARE_ACCOUNT_ID }}
command: pages deploy site/ --project-name=dd-docs-preview --branch=pr-${{ github.event.pull_request.number }}

- name: Find existing comment
uses: peter-evans/find-comment@v4
uses: peter-evans/find-comment@b30e6a3c0ed37e7c023ccd3f1db5c6c0b0c23aad # v4
id: find-comment
with:
issue-number: ${{ github.event.pull_request.number }}
comment-author: "github-actions[bot]"
body-includes: "<!-- docs-preview -->"

- name: Post or update PR comment
uses: peter-evans/create-or-update-comment@v5
uses: peter-evans/create-or-update-comment@e8674b075228eee787fea43ef493e45ece1004c9 # v5
with:
comment-id: ${{ steps.find-comment.outputs.comment-id }}
issue-number: ${{ github.event.pull_request.number }}
Expand Down
6 changes: 4 additions & 2 deletions .github/workflows/health-checks.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -8,17 +8,19 @@ on:
types: [published]
workflow_dispatch:

permissions: {}

jobs:
health-checks:
name: Provider Health Checks
runs-on: ubuntu-latest

steps:
- name: Checkout code
uses: actions/checkout@v6
uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6

- name: Install uv
uses: astral-sh/setup-uv@v7
uses: astral-sh/setup-uv@37802adc94f370d6bfd71619e3f0bf239e1f3b78 # v7
with:
version: "latest"
python-version: "3.11"
Expand Down
19 changes: 9 additions & 10 deletions .github/workflows/pack-tutorials.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -5,6 +5,8 @@ on:
release:
types: [published]

permissions: {}

jobs:
build-notebooks:
uses: ./.github/workflows/build-notebooks.yml
Expand All @@ -17,7 +19,7 @@ jobs:

steps:
- name: Download artifact from previous step
uses: actions/download-artifact@v7
uses: actions/download-artifact@37930b1c2abaa49bbe596cd826c3c89aef350131 # v7
with:
name: notebooks
path: data_designer_tutorial
Expand All @@ -27,7 +29,7 @@ jobs:
run: |
echo "SOURCE_FOLDER_PATH=data_designer_tutorial" >> $GITHUB_ENV
echo "ZIP_FILE_NAME=data_designer_tutorial.zip" >> $GITHUB_ENV

- name: Check if source folder exists
run: |
if [ ! -d "${{ env.SOURCE_FOLDER_PATH }}" ]; then
Expand Down Expand Up @@ -58,20 +60,17 @@ jobs:
exit 1
fi
fi

echo "Latest release tag found: $LATEST_TAG"
echo "tag=$LATEST_TAG" >> $GITHUB_OUTPUT
env:
GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}

- name: Upload zip file as release asset
uses: softprops/action-gh-release@v2
with:
tag_name: ${{ steps.get_release.outputs.tag }}
files: ${{ env.ZIP_FILE_NAME }}
draft: false
prerelease: false

env:
GH_TOKEN: ${{ github.token }}
run: gh release upload "${{ steps.get_release.outputs.tag }}" "${{ env.ZIP_FILE_NAME }}"

- name: Cleanup
if: always()
run: rm -f ${{ env.ZIP_FILE_NAME }}
2 changes: 1 addition & 1 deletion .github/workflows/semantic-pull-requests.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -23,4 +23,4 @@ permissions:

jobs:
semantic-pull-request:
uses: NVIDIA-NeMo/FW-CI-templates/.github/workflows/_semantic_pull_request.yml@v0.65.12
uses: NVIDIA-NeMo/FW-CI-templates/.github/workflows/_semantic_pull_request.yml@21f18ae8b669fd0de1a25ff0e82a1660ec1aa517 # v0.65.12
Loading