Merge pull request #37 from A2R-Lab/feature/nvidia-thread-backend #113
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| # CPU-only verification of the locally-generated GPU test receipt. | |
| # | |
| # The GPU suite runs on the lab box via test/run_gpu_proof.sh, which writes a | |
| # SIGNED receipt (test/gpu-proof.json) binding the git SHA, a fingerprint of | |
| # the library + test sources, per-test outcomes, and the GPU info. This job | |
| # verifies that receipt on every push — signature checked against the signer's | |
| # public keys at github.com/<user>.keys — so the repo carries an auditable | |
| # "the GPU suite passed on this code" check without any cloud GPU. | |
| # | |
| # Trust model: this is an attestation by a keyholder, not cryptographic proof | |
| # of GPU execution — see the pytest-gpu-proof security docs. | |
| name: verify-gpu-proof | |
| permissions: | |
| contents: read | |
| on: | |
| push: | |
| branches: [main] | |
| pull_request: | |
| jobs: | |
| verify: | |
| runs-on: ubuntu-latest | |
| steps: | |
| - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 | |
| with: | |
| fetch-depth: 0 # ancestor-commit check needs history | |
| - name: Check for a receipt | |
| id: receipt | |
| run: | | |
| if [ -f test/gpu-proof.json ]; then echo "present=true" >> "$GITHUB_OUTPUT"; | |
| else echo "present=false" >> "$GITHUB_OUTPUT"; echo "::notice::no test/gpu-proof.json yet — run test/run_gpu_proof.sh on the GPU box and commit the receipt"; fi | |
| - uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0 | |
| if: steps.receipt.outputs.present == 'true' | |
| with: | |
| python-version: '3.12' | |
| - name: Install pytest-gpu-proof (PyPI, pinned in test/requirements.txt) | |
| if: steps.receipt.outputs.present == 'true' | |
| run: pip install "$(grep -o '^pytest-gpu-proof==[0-9.]*' test/requirements.txt)" | |
| - name: Verify receipt | |
| if: steps.receipt.outputs.present == 'true' | |
| run: gpu-proof verify --receipt test/gpu-proof.json --require-gpu --expected-skips test/expected_skips.txt --policy test/gpu-proof-policy.json |