ci(skills): require NVSkills validation for skill changes

.github/CI_README.md

@@ -45,6 +45,25 @@ reusable actions, and supporting docs.
 - `semantic-pull-requests.yaml`
   Pull request title validation.
 
+- `request-nvskills-ci.yml`
+  Dispatches the internal NVSkills validation workflow when a maintainer or
+  admin comments `/nvskills-ci` on a pull request with changes under `skills/`.
+  It also handles the trusted signature push from the NVSkills signing bot.
+
+- `require-nvskills-ci.yml`
+  Merge-blocking PR check for `skills/` changes. It passes immediately when a
+  PR does not touch `skills/`. When `skills/` files changed, it requires the PR
+  head commit to be the trusted NVSkills signature commit from
+  `NVSKILLS_SIGNATURE_PUSH_ACTOR` (default `svc-nvskills-signing`) with commit
+  title prefix `NVSKILLS_SIGNATURE_COMMIT_TITLE` (default
+  `Attach NVSkills validation signatures`). If new `skills/` content is pushed
+  after signing, a maintainer or admin must rerun `/nvskills-ci`. Repository
+  admins must make `Require NVSkills CI for skill changes / require-nvskills-ci`
+  a required check in branch protection or rulesets for this workflow to block
+  merges. Internal pipeline/log lookup is documented in the NVIDIA onboarding
+  doc section:
+  <https://nvidia.atlassian.net/wiki/spaces/GAIT/pages/3483240468/Github+First+-+Outbound+Repos+Onboarding+doc+-+NVCARPS#Review-Internal-Pipeline-Logs>.
+
 - `dco-war.yaml`
   Merge queue compatibility shim for the DCO check. Normal DCO validation comes
   from the installed DCO app.

.github/workflows/request-nvskills-ci.yml

@@ -13,7 +13,7 @@ jobs:
         startsWith(github.event.comment.body, '/nvskills-ci') &&
         contains(fromJSON('["OWNER","MEMBER","COLLABORATOR"]'), github.event.comment.author_association)) ||
       (github.event_name == 'push' &&
-        github.actor == (vars.NVSKILLS_SIGNATURE_PUSH_ACTOR || 'nv-skills-ci[bot]') &&
+        github.actor == (vars.NVSKILLS_SIGNATURE_PUSH_ACTOR || 'svc-nvskills-signing') &&
         startsWith(github.event.head_commit.message, vars.NVSKILLS_SIGNATURE_COMMIT_TITLE || 'Attach NVSkills validation signatures'))
     permissions:
       contents: read

.github/workflows/require-nvskills-ci.yml

@@ -0,0 +1,60 @@
+name: Require NVSkills CI for skill changes
+
+on:
+  pull_request:
+    branches: [main]
+    types: [opened, synchronize, reopened, ready_for_review]
+
+permissions:
+  contents: read
+  pull-requests: read
+
+jobs:
+  require-nvskills-ci:
+    runs-on: ubuntu-latest
+    steps:
+      - name: Require trusted NVSkills signature for skills changes
+        uses: actions/github-script@f28e40c7f34bde8b3046d885e986cb6290c5673b # v7
+        env:
+          SIGNATURE_ACTOR: ${{ vars.NVSKILLS_SIGNATURE_PUSH_ACTOR || 'svc-nvskills-signing' }}
+          SIGNATURE_TITLE: ${{ vars.NVSKILLS_SIGNATURE_COMMIT_TITLE || 'Attach NVSkills validation signatures' }}
+          ONBOARDING_DOC: https://nvidia.atlassian.net/wiki/spaces/GAIT/pages/3483240468/Github+First+-+Outbound+Repos+Onboarding+doc+-+NVCARPS#Review-Internal-Pipeline-Logs
+        with:
+          script: |
+            const pr = context.payload.pull_request;
+            const owner = context.repo.owner;
+            const repo = context.repo.repo;
+
+            const files = await github.paginate(github.rest.pulls.listFiles, {
+              owner,
+              repo,
+              pull_number: pr.number,
+              per_page: 100,
+            });
+
+            const touchedSkills = files.some((file) => file.filename.startsWith('skills/'));
+            if (!touchedSkills) {
+              core.info('No files under skills/ changed.');
+              return;
+            }
+
+            const commit = await github.rest.repos.getCommit({
+              owner,
+              repo,
+              ref: pr.head.sha,
+            });
+
+            const actor = commit.data.author?.login || '';
+            const title = commit.data.commit.message.split('\n')[0];
+
+            const okActor = actor === process.env.SIGNATURE_ACTOR;
+            const okTitle = title.startsWith(process.env.SIGNATURE_TITLE);
+
+            if (!okActor || !okTitle) {
+              core.setFailed(
+                'Files under skills/ changed in this PR, but HEAD is not the trusted NVSkills signature commit. ' +
+                'Ask a maintainer/admin to comment /nvskills-ci. If new skills/ content was pushed after signing, rerun /nvskills-ci. ' +
+                `Expected HEAD GitHub author "${process.env.SIGNATURE_ACTOR}" and commit title prefix "${process.env.SIGNATURE_TITLE}". ` +
+                `See ${process.env.ONBOARDING_DOC}.`
+              );
+            }