chore(evidence): refresh gb200-eks + h100-gke-cos attestations#1427
Merged
mchmarny merged 1 commit intoJun 24, 2026
Merged
Conversation
Contributor
Recipe evidence checkAffected leaf overlays: 2
How to refresh evidenceRun on a cluster matching the recipe's aicr snapshot -o snapshot.yaml
aicr validate \
-r recipes/overlays/<slug>.yaml \
-s snapshot.yaml \
--emit-attestation ./out \
--push ghcr.io/<your-fork>/aicr-evidence
cp ./out/pointer.yaml recipes/evidence/<slug>.yamlThis gate is warning-only and never blocks merge. See ADR-007 for the trust model. |
|
No actionable comments were generated in the recent review. 🎉 ℹ️ Recent review info⚙️ Run configurationConfiguration used: Path: .coderabbit.yaml Review profile: ASSERTIVE Plan: Enterprise Run ID: 📒 Files selected for processing (2)
📝 WalkthroughWalkthroughBoth Estimated code review effort🎯 1 (Trivial) | ⏱️ ~2 minutes Possibly related PRs
Suggested reviewers
🚥 Pre-merge checks | ✅ 4✅ Passed checks (4 passed)
✏️ Tip: You can configure your own custom pre-merge checks in the settings. ✨ Finishing Touches🧪 Generate unit tests (beta)
Comment |
yuanchen8911
force-pushed
the
chore/refresh-gb200-eks-evidence
branch
from
97400d9 to
ab5233e
Compare
mchmarny
previously approved these changes
Jun 23, 2026
yuanchen8911
changed the title
yuanchen8911
force-pushed
the
chore/refresh-gb200-eks-evidence
branch
from
8c2b818 to
5a26d11
Compare
This was referenced Jun 23, 2026
Re-validated both recipes after the aws-efa v0.5.29 / eks-pin bump (NVIDIA#1418) changed their rendered digests, and refreshed the evidence pointers to the freshly signed bundles so the recipe-evidence drift gate no longer reports them stale. - gb200-eks-ubuntu-training: GB200 EKS, all phases passed; bundle ghcr.io/yuanchen8911/aicr-evidence:gb200-eks-ubuntu-training-a3fe1a7e7bcb (rekorLogIndex 1930094136) - h100-gke-cos-training: H100 GKE/COS, all phases passed (NCCL 338 GB/s); bundle ghcr.io/yuanchen8911/aicr-evidence:h100-gke-cos-training-ee1657fedd59 (rekorLogIndex 1931193974)
yuanchen8911
force-pushed
the
chore/refresh-gb200-eks-evidence
branch
from
5a26d11 to
19e71b0
Compare
njhensley
approved these changes
Jun 24, 2026
10 tasks
This was referenced Jun 24, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
3 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Refresh the conformance-evidence pointers for
gb200-eks-ubuntu-trainingandh100-gke-cos-training. The recipe-evidence drift gate flagged both as stale after #1418 (aws-efav0.5.26→v0.5.29+ EKS overlay pin) changed their rendered digests. This updates each pointer to a freshly re-validated, signed bundle.Motivation / Context
#1418 bumped aws-efa to
v0.5.29, changing the rendered digest of EKS/GKE recipes that include aws-efa. The committed evidence pointers still referenced pre-bump bundles, so the drift gate reported them stale.Re-validated on matching clusters — all phases passed:
p6e-gb200.36xlarge, Ubuntu 24.04, K8s 1.34). Subject digest5177d2ed…. Bundleghcr.io/yuanchen8911/aicr-evidence:gb200-eks-ubuntu-training-a3fe1a7e7bcb, Rekor1930094136.064f27fa…. Bundleghcr.io/yuanchen8911/aicr-evidence:h100-gke-cos-training-ee1657fedd59, Rekor1931193974.Related: #1418. Note: the GKE NCCL run surfaced a separate validator bug (JobSet staging image) tracked in #1430; the evidence here was captured with that worked around.
Type of Change
Component(s) Affected
recipes/evidence)Testing
Offline verification passes for both: signature (
[email protected]via github oauth), manifest-hash-check, and predicate-parse all green.