# Copyright (c) 2026, NVIDIA CORPORATION & AFFILIATES. All rights reserved.

#

# Licensed under the Apache License, Version 2.0 (the "License");

# you may not use this file except in compliance with the License.

# You may obtain a copy of the License at

#

# http://www.apache.org/licenses/LICENSE-2.0

#

# Unless required by applicable law or agreed to in writing, software

# distributed under the License is distributed on an "AS IS" BASIS,

# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.

# See the License for the specific language governing permissions and

# limitations under the License.

name: On Push Qualification

on:

push:

branches:

- main

paths-ignore:

- '**.md'

- 'docs/**'

- 'LICENSE'

workflow_dispatch: {} # Allow manual runs

permissions:

contents: read

env:

VALIDATOR_IMAGE_PREFIX: ghcr.io/nvidia/aicr-validators

# Keep in sync with build-docker matrix.phase. `aiperf-bench` is an ancillary

# image (Python-based, not a Go validator) required by the inference-perf

# check; it uses an alternate Dockerfile via matrix overrides.

VALIDATOR_PHASES: "deployment performance conformance aiperf-bench"

EXPECTED_PLATFORMS: "linux/amd64 linux/arm64"

concurrency:

group: ${{ github.workflow }}-${{ github.ref }}

# Never cancel main pushes — every merge must complete to produce its

# immutable sha-<commit> image tag.

cancel-in-progress: false

jobs:

tests:

uses: ./.github/workflows/qualification.yaml

permissions:

actions: read

contents: read

id-token: write

security-events: write

with:

coverage_report: true

# =============================================================================

# Validator Image Build: publish :edge and sha-<commit> on merge to main

# Keeps validator images testable from main without requiring a release.

# :latest is reserved for the on-tag release pipeline (vuln scan + attestation).

# Skipped for pull requests — only runs on push to main.

# =============================================================================

build-docker:

name: Docker Validator (${{ matrix.phase }}/${{ matrix.arch }})

if: github.event_name == 'push' && github.ref == 'refs/heads/main'

runs-on: ${{ matrix.runner }}

needs: [tests]

timeout-minutes: 15

permissions:

contents: read

packages: write

strategy:

fail-fast: false

matrix:

phase: [deployment, performance, conformance, aiperf-bench] # keep in sync with VALIDATOR_PHASES

arch: [amd64, arm64]

include:

- arch: amd64

runner: ubuntu-latest

platform: linux/amd64

- arch: arm64

runner: ubuntu-24.04-arm

platform: linux/arm64

# Ancillary (non-Go-validator) images override the default

# validators/<phase>/Dockerfile path and image title.

- phase: aiperf-bench

dockerfile: validators/performance/aiperf-bench.Dockerfile

image_title: aicr-aiperf-bench

steps:

- name: Checkout Code

uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0

with:

persist-credentials: false

- name: Setup Docker Buildx

uses: docker/setup-buildx-action@bb05f3f5519dd87d3ba754cc423b652a5edd6d2c # v4.2.0

- name: Authenticate to registry

uses: ./.github/actions/ghcr-login

- name: Read Go version

id: go

shell: bash

run: echo "version=$(cat .go-version)" >> "$GITHUB_OUTPUT"

- name: Build and push

uses: docker/build-push-action@53b7df96c91f9c12dcc8a07bcb9ccacbed38856a # v7.3.0

with:

context: .

file: ${{ matrix.dockerfile || format('validators/{0}/Dockerfile', matrix.phase) }}

platforms: ${{ matrix.platform }}

push: true

# CHAINSAW_* args were dropped in #1236 — the deployment validator

# no longer ships /usr/local/bin/chainsaw; it executes Chainsaw

# Test format in-process via validators/chainsaw/inprocess.go.

build-args: |

GO_VERSION=${{ steps.go.outputs.version }}

tags: |

${{ env.VALIDATOR_IMAGE_PREFIX }}/${{ matrix.phase }}:sha-${{ github.sha }}-${{ matrix.arch }}

${{ env.VALIDATOR_IMAGE_PREFIX }}/${{ matrix.phase }}:edge-${{ matrix.arch }}

provenance: false

cache-from: type=gha

cache-to: type=gha,mode=max

labels: |

org.opencontainers.image.created=${{ github.event.head_commit.timestamp }}

org.opencontainers.image.title=${{ matrix.image_title || format('aicr-validator-{0}', matrix.phase) }}

org.opencontainers.image.revision=${{ github.sha }}

org.opencontainers.image.version=main-${{ github.sha }}

org.opencontainers.image.source=${{ github.server_url }}/${{ github.repository }}

docker-manifest:

name: Docker Manifest

if: github.event_name == 'push' && github.ref == 'refs/heads/main'

runs-on: ubuntu-latest

needs: [build-docker]

timeout-minutes: 5

permissions:

contents: read

packages: write

steps:

- name: Checkout Code

uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0

with:

persist-credentials: false

- name: Authenticate to registry

uses: ./.github/actions/ghcr-login

- name: Setup Docker Buildx

uses: docker/setup-buildx-action@bb05f3f5519dd87d3ba754cc423b652a5edd6d2c # v4.2.0

- name: Create multi-arch manifests for validator images

env:

SHA: ${{ github.sha }}

run: |

set -euo pipefail

for phase in ${VALIDATOR_PHASES}; do

IMAGE="${VALIDATOR_IMAGE_PREFIX}/${phase}"

# Immutable per-commit tag for rollback and provenance

docker buildx imagetools create \

-t "${IMAGE}:sha-${SHA}" \

"${IMAGE}:sha-${SHA}-amd64" \

"${IMAGE}:sha-${SHA}-arm64"

# Mutable :edge tag (tracks latest main, recreated fresh)

docker buildx imagetools create \

-t "${IMAGE}:edge" \

"${IMAGE}:sha-${SHA}-amd64" \

"${IMAGE}:sha-${SHA}-arm64"

done

- name: Verify multi-arch manifests

env:

SHA: ${{ github.sha }}

run: |

set -euo pipefail

for phase in ${VALIDATOR_PHASES}; do

IMAGE="${VALIDATOR_IMAGE_PREFIX}/${phase}"

for alias in "sha-${SHA}" "edge"; do

MANIFEST=$(docker buildx imagetools inspect --raw "${IMAGE}:${alias}")

PLATFORMS=$(echo "${MANIFEST}" | jq -r \

'[.manifests[] | select(.platform.os != "unknown") | "\(.platform.os)/\(.platform.architecture)"] | sort | .[]')

for expected in ${EXPECTED_PLATFORMS}; do

if ! echo "${PLATFORMS}" | grep -qx "${expected}"; then

echo "::error::${IMAGE}:${alias} missing platform ${expected}"

exit 1

fi

done

if echo "${MANIFEST}" | jq -e '.manifests[] | select(.platform.os == "unknown")' >/dev/null 2>&1; then

echo "::error::${IMAGE}:${alias} contains unknown/unknown descriptor"

exit 1

fi

done

done