Skip to content

validate-pr: accept context-only cherry-picks#479

Open
nirmoy wants to merge 1 commit into
NVIDIA:github-actionsfrom
nirmoy:codex/validate-pr-context-equivalence
Open

validate-pr: accept context-only cherry-picks#479
nirmoy wants to merge 1 commit into
NVIDIA:github-actionsfrom
nirmoy:codex/validate-pr-context-equivalence

Conversation

@nirmoy

@nirmoy nirmoy commented Jun 30, 2026

Copy link
Copy Markdown
Collaborator

Summary

  • require native three-way replay to produce the exact local tree for both matching and context-only patch IDs
  • use zero-context patch IDs to identify context-only candidates while keeping acceptance fail-closed
  • C-style quote alternate object paths and report replay tool or environment failures
  • add black-box regression tests and an unprivileged workflow with third-party actions pinned to immutable SHAs

Root cause

NVIDIA/NV-Kernels#476 applies two independent upstream commits that touch adjacent lines. The second local commit therefore has different diff context even though its changed lines are identical to upstream, causing git patch-id --stable to report a mismatch.

Patch IDs also ignore hunk line numbers, so an equal patch ID alone cannot prove that a change was applied to the correct one of two byte-identical occurrences. Both equal and context-only candidates now replay the upstream change onto the local parent and require the resulting tree to exactly match the local commit.

The check remains fail-closed: changed content, relocation to another occurrence, replay conflicts or errors, malformed Git output, and unequal trees fail validation.

Validation

  • python3 .github/scripts/test_validate_pr.py -v — 12/12 passed
  • post-push Validate PR self-tests passed
  • exact range daccaf10eb077..50594a932608 passed with:
    • 50594a932608: context
    • ddc654b5fbd0: match
  • regression coverage includes equal patch IDs at different occurrences, colon-containing object paths, malformed Git output, and replay failures
  • workflow YAML parsing and git diff --check passed
  • independent task and whole-branch reviews found no blocking issues

Fork workflow replay

@nirmoy

nirmoy commented Jun 30, 2026

Copy link
Copy Markdown
Collaborator Author

BaseOS Kernel Review

Summary

No issues found across the reviewed commits.

Findings: no problems found

Latest watcher review: open review

Generated test plan: open test plan

Kernel deb build: failed (failure log, build artifacts)

Head: eec9a13f8a13

This comment is maintained by nv-pr-bot. It is updated when the GitHub watcher publishes a newer review.

@nirmoy
nirmoy force-pushed the codex/validate-pr-context-equivalence branch from 397c7cd to 8ebd0ca Compare July 1, 2026 11:28
@nirmoy
nirmoy requested a review from ianm-nv July 2, 2026 09:46
@nirmoy
nirmoy marked this pull request as ready for review July 2, 2026 09:47
@nirmoy nirmoy added the help wanted Extra attention is needed label Jul 2, 2026
Stable patch IDs include context lines, so legitimate cherry-picks can
differ when nearby lines change. Compare zero-context patch IDs, then
replay the upstream commit onto the local parent with merge-tree and
require the resulting tree to match the local commit.

Replay ordinary patch-ID matches too so identical changes applied at a
different occurrence are rejected.
@nirmoy
nirmoy force-pushed the codex/validate-pr-context-equivalence branch from 8ebd0ca to eec9a13 Compare July 17, 2026 16:17
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

help wanted Extra attention is needed

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant