Skip to content

CI: use patched PBS Python builds on Windows - #451

Merged
atmnp merged 1 commit into
NVIDIA:mainfrom
atmnp:atmn/harden-windows-python
Nov 10, 2026
Merged

CI: use patched PBS Python builds on Windows#451
atmnp merged 1 commit into
NVIDIA:mainfrom
atmnp:atmn/harden-windows-python

Conversation

@atmnp

@atmnp atmnp commented Nov 9, 2026

Copy link
Copy Markdown
Collaborator

Close the Windows interpreter gap left by #413. setup-python cannot provide the patched maintenance releases without upstream Windows installers, as confirmed in actions/setup-python#1383.

Add setup-hardened-python using SHA-pinned setup-uv and checksum-verified python-build-standalone distributions. Create a venv and verify the interpreter before upgrading pip.

Share the security-release guard with update-pip and the Windows LLVM container installer. Replace NuGet provisioning and its pinned pip bootstrap, and remove the tolerated guard failures in Windows tests.

Keep cibuildwheel for wheel builds and pass the host interpreter explicitly. Track the nested setup-uv action pin with Dependabot.

@atmnp
CI: use patched PBS Python builds on Windows
1bb93e6 
Close the Windows interpreter gap left by NVIDIA#413. setup-python cannot
provide the patched maintenance releases without upstream Windows
installers, as confirmed in actions/setup-python#1383.

Add setup-hardened-python using SHA-pinned setup-uv and checksum-verified
python-build-standalone distributions. Create a venv and verify the
interpreter before upgrading pip.

Share the security-release guard with update-pip and the Windows LLVM
container installer. Replace NuGet provisioning and its pinned pip
bootstrap, and remove the tolerated guard failures in Windows tests.

Keep cibuildwheel for wheel builds and pass the host interpreter
explicitly. Track the nested setup-uv action pin with Dependabot.
@copy-pr-bot

copy-pr-bot Bot commented Nov 9, 2026

Copy link
Copy Markdown
Contributor

Auto-sync is disabled for draft pull requests in this repository. Workflows must be run manually.

Contributors can view more details about this message here.

@atmnp

atmnp commented Nov 9, 2026

Copy link
Copy Markdown
Collaborator Author

/ok to test 1bb93e6

@github-actions

This comment has been minimized.

Sign in to view
@atmnp
atmnp requested a review from leofang November 9, 2026 21:14
@atmnp
atmnp marked this pull request as ready for review November 9, 2026 21:14
@copy-pr-bot

copy-pr-bot Bot commented Nov 9, 2026

Copy link
Copy Markdown
Contributor

Auto-sync is disabled for ready for review pull requests in this repository. Workflows must be run manually.

Contributors can view more details about this message here.

@atmnp atmnp assigned atmnp and unassigned brandon-b-miller Nov 9, 2026
@coderabbitai

coderabbitai Bot commented Nov 9, 2026

Copy link
Copy Markdown

Explain Change →

No actionable comments were generated in the recent review.

Walkthrough

important: The changes add a shared Python security check and a composite action that provisions managed Python environments. CI workflows and Windows LLVM container builds now use hardened Python setup.

Changes: Hardened Python setup

Layer / File(s) Summary
Python security policy and pip action
ci/tools/check_python_security.py, .github/actions/update-pip/action.yml		 The security script checks supported Python patch floors, final releases, and an optional expected virtual-environment interpreter. The update-pip action runs the script and uses stricter Bash options for its pip upgrade.
Composite hardened-Python action
.github/actions/setup-hardened-python/action.yml, .github/dependabot.yml		 The new composite action installs uv and a requested managed Python, creates a virtual environment, exposes the interpreter path and version, and calls update-pip. Dependabot now checks the action directory.
Workflow Python setup
.github/workflows/build-wheel.yml, .github/workflows/test-wheel-windows.yml, .github/workflows/build-llvm.yml		 Wheel workflows use the hardened setup action for Windows Python. The wheel build passes the selected host interpreter path to cibuildwheel. The Windows ARM64 LLVM workflow also uses the action.
Windows LLVM container provisioning
.github/workflows/build-llvm.yml, ci/windows-common.ps1, ci/windows-llvm-container-build.ps1		 The Windows x64 workflow passes uv into the container. The container script uses Install-HardenedPython and exits on nonzero status from the listed native commands.

Possibly related PRs

  • NVIDIA/numba-cuda-mlir#413: Adds hash-pinned pip bootstrapping to CI and the Windows LLVM container; this PR replaces the Windows pip bootstrap with managed Python provisioning and the shared security check.

Suggested labels: enhancement, github_actions

Change: Bug fix

Merge Risk: Minimal · up to 1bb93

This change moves CI Python setup to a shared hardened provisioning path. No concrete merge-blocking issue was identified; the Windows runs in CI will confirm the behavior.

Security architecture risk: Low · up to 1bb93

The change strengthens interpreter checks and removes tolerated security-check failures. No introduced security vulnerability was established, but the new interpreter supply chain and removal of the pinned pip bootstrap leave assurance gaps around the exact downloaded distributions and their certificate-handling behavior.

Retained concerns
No architecture-level concerns identified.

Security review details

Security Blast Radius

  • inferred — A compromised provisioning dependency could execute with the adopting CI job's authority and affect build artifacts. Windows x64 LLVM jobs already configure an AWS role on the host before provisioning; the shown Docker invocation does not explicitly forward AWS credentials. The role's effective resource scope is not established by the workflow.

Trust Boundaries and Controls

  • observed — The interpreter-origin chain is established for current callers: workflow-selected Python request, managed interpreter, venv-reported executable, expected-path guard, then package installation. Inputs are passed through environment variables or argument values rather than inserted into the new action's shell source. The read-only uv mount preserves the intended host-to-container tool boundary, subject to trusting the host producer.

Resilience and Maintainability Implications

  • observed — Provisioning and package failures stop current callers before normal downstream execution. The container installer checks uv, venv, and guard failures explicitly; subsequent pip and build commands also check exit status. Container removal bounds container-local partial state. The composite action has no PATH rollback, and custom venv paths are cleared without locking, but current callers use isolated defaults and do not continue after failure.

Hardening Proposals

  • proposed — Validate and record the exact setup-uv/PBS integrity guarantees and bundled pip/ssl certificate behavior that justify replacing the hash-pinned pip bootstrap. This would close the remaining assurance gap without treating version metadata alone as a behavioral certificate test.
- [ ] Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts
Recent review info

Run configuration

Commits

Reviewing files that changed from the base of the PR and between 9ac43be and 1bb93e6.

Files selected for processing: 9

  • .github/actions/setup-hardened-python/action.yml
  • .github/actions/update-pip/action.yml
  • .github/dependabot.yml
  • .github/workflows/build-llvm.yml
  • .github/workflows/build-wheel.yml
  • .github/workflows/test-wheel-windows.yml
  • ci/tools/check_python_security.py
  • ci/windows-common.ps1
  • ci/windows-llvm-container-build.ps1

Included review availability: This review used your included allowance. Your plan provides up to 12 included reviews per hour; 11 remain after this review.

@atmnp
atmnp requested a review from juenglin November 10, 2026 16:15
juenglin
juenglin approved these changes Nov 10, 2026
View reviewed changes

@juenglin juenglin left a comment

Copy link
Copy Markdown
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

LGTM.

@atmnp
atmnp merged commit ed91c43 into NVIDIA:main Nov 10, 2026
346 of 349 checks passed
@github-actions

github-actions Bot commented Nov 10, 2026

Copy link
Copy Markdown
Doc Preview CI
Preview removed because the pull request was closed or merged.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@juenglin juenglin juenglin approved these changes
@leofang leofang Awaiting requested review from leofang
@brandon-b-miller brandon-b-miller Awaiting requested review from brandon-b-miller

Assignees

@atmnp atmnp

Labels

None yet

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

3 participants

@atmnp @juenglin @brandon-b-miller