feat: add NVSkills CI request workflow

[ngoncharenko]

Summary

Add the GitHub Actions workflow that connects this repo to NVIDIA NVSkills validation. Reviewers can comment /nvskills-ci on a PR to dispatch the team validation workflow; the workflow also accepts signature commits from the NVSkills bot.

Linear

https://linear.app/nvidia/issue/AALGO-231/skills-publishing

Why

NeMo Platform skills is being onboarded to the NVSkills catalog (NVIDIA/skills). This workflow is the product-repo side of that integration — it does not publish skills by itself, but triggers validation runs against the catalog pipeline.

Changes

• .github/workflows/request-nvskills-ci.yml — reusable workflow dispatch to NVIDIA/skills/.github/workflows/team-request.yml@main

Test plan

• Merge and confirm workflow file is valid (Actions tab)
• On a PR that includes catalog skill paths, comment /nvskills-ci and verify dispatch (after secret is configured)

Related

• NVSkills PR
• feat: add repo-root skills for NVSkills catalog #104

Summary by CodeRabbit

• Chores
  • Added a GitHub Actions workflow to automate NVSkills CI validation. It can be triggered by specific issue comments or by commits matching the configured signature, grants read-only repo permissions for content and pull-requests, and invokes a reusable validation workflow pinned to a fixed commit. A secret token is passed to authorize the downstream workflow.

[github-actions]

Suite	Lines Covered	Line Rate	Branch Rate
Unit Tests	18417/24388	75.5%	61.9%
Integration Tests	11773/23165	50.8%	25.9%

[ngoncharenko]

/nvskills-ci

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Enterprise

Run ID: 3a5a264e-ce40-4d05-89f3-6d9bae5ef34d

📥 Commits

Reviewing files that changed from the base of the PR and between b9e93f9 and 1a76059.

📒 Files selected for processing (1)

• .github/workflows/request-nvskills-ci.yml

🚧 Files skipped from review as they are similar to previous changes (1)

• .github/workflows/request-nvskills-ci.yml

---

📝 Walkthrough

Walkthrough

Adds a GitHub Actions workflow that triggers NVSkills validation on /nvskills-ci issue comments or on pushes matching a configurable bot actor and commit-title prefix, then dispatches NVIDIA's pinned reusable team-request workflow with read-only permissions and a dispatch token secret.

Changes

NVSkills CI Workflow Integration

Layer / File(s)	Summary
NVSkills CI workflow configuration .github/workflows/request-nvskills-ci.yml	Workflow defines triggers on issue comments (/nvskills-ci) or push events with signature matching (actor + commit message), sets read-only permissions for contents and pull-requests, and dispatches to NVIDIA/skills/.github/workflows/team-request.yml (pinned SHA) passing NVSKILLS_CI_DISPATCH_TOKEN as a secret.

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title 'feat: add NVSkills CI request workflow' directly and accurately describes the main change—adding a new GitHub Actions workflow for NVSkills CI requests.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

_{✏️ Tip: You can configure your own custom pre-merge checks in the settings.}

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch ngoncharenko/nv-skills-ci-setup

---

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

[coderabbitai]

Actionable comments posted: 2

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In @.github/workflows/request-nvskills-ci.yml:
- Around line 11-13: The workflow condition that dispatches on the issue_comment
currently allows any commenter to trigger the job via
startsWith(github.event.comment.body, '/nvskills-ci'); update the job's if:
condition to also check github.event.comment.author_association against an
allowlist (e.g., oneOf(github.event.comment.author_association,
'OWNER','MEMBER','COLLABORATOR')) so only trusted associations can trigger it,
and replace the reusable workflow ref "uses:
NVIDIA/skills/.github/workflows/team-request.yml@main" with a pinned immutable
ref (a commit SHA or immutable tag) to prevent supply-chain drift.
- Line 20: The workflow currently references the reusable workflow tag
"NVIDIA/skills/.github/workflows/team-request.yml@main" which is mutable; update
that reference to a specific immutable commit SHA (replace "`@main`" with the
exact commit SHA of the upstream repo) so the reusable workflow cannot change
unexpectedly, and verify the dispatcher token/scope still functions with the
pinned commit after updating the reference.

🪄 Autofix (Beta)

Fix all unresolved CodeRabbit comments on this PR:

• Push a commit to this branch (recommended)
• Create a new PR with the fixes

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Enterprise

Run ID: 88242345-cdda-47eb-bf0b-6b40fcee7993

📥 Commits

Reviewing files that changed from the base of the PR and between d92d4e9 and b9e93f9.

📒 Files selected for processing (1)

• .github/workflows/request-nvskills-ci.yml