Skip to content

Merge pull request #37 from A2R-Lab/feature/nvidia-thread-backend #113

Merge pull request #37 from A2R-Lab/feature/nvidia-thread-backend

Merge pull request #37 from A2R-Lab/feature/nvidia-thread-backend #113

# CPU-only verification of the locally-generated GPU test receipt.
#
# The GPU suite runs on the lab box via test/run_gpu_proof.sh, which writes a
# SIGNED receipt (test/gpu-proof.json) binding the git SHA, a fingerprint of
# the library + test sources, per-test outcomes, and the GPU info. This job
# verifies that receipt on every push — signature checked against the signer's
# public keys at github.com/<user>.keys — so the repo carries an auditable
# "the GPU suite passed on this code" check without any cloud GPU.
#
# Trust model: this is an attestation by a keyholder, not cryptographic proof
# of GPU execution — see the pytest-gpu-proof security docs.
name: verify-gpu-proof
permissions:
contents: read
on:
push:
branches: [main]
pull_request:
jobs:
verify:
runs-on: ubuntu-latest
steps:
- uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
with:
fetch-depth: 0 # ancestor-commit check needs history
- name: Check for a receipt
id: receipt
run: |
if [ -f test/gpu-proof.json ]; then echo "present=true" >> "$GITHUB_OUTPUT";
else echo "present=false" >> "$GITHUB_OUTPUT"; echo "::notice::no test/gpu-proof.json yet — run test/run_gpu_proof.sh on the GPU box and commit the receipt"; fi
- uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0
if: steps.receipt.outputs.present == 'true'
with:
python-version: '3.12'
- name: Install pytest-gpu-proof (PyPI, pinned in test/requirements.txt)
if: steps.receipt.outputs.present == 'true'
run: pip install "$(grep -o '^pytest-gpu-proof==[0-9.]*' test/requirements.txt)"
- name: Verify receipt
if: steps.receipt.outputs.present == 'true'
run: gpu-proof verify --receipt test/gpu-proof.json --require-gpu --expected-skips test/expected_skips.txt --policy test/gpu-proof-policy.json