Matthew Grossman 48fc588c3e ci(release): verify dispatched snap and wheel inputs match the release ...

A dispatched snap upload checks that its artifacts were built for the
release tag. A wheel publish first confirms the tag points to the given
commit and that each wheel is attached to that release at the given
version. artifact-run-id is declared on workflow_call so callers do not
rely on an undeclared input.

Signed-off-by: Matthew Grossman <mgrossman@nvidia.com>

2026-10-27 16:23:25 -07:00

..

branch-checks.yml

test(testkit): add the testkit library for end-to-end suites (#4724)

2026-10-22 17:11:31 +00:00

branch-docs.yml

ci(release): promote qualified prereleases to stable (#4611)

2026-10-19 11:17:21 +00:00

branch-e2e.yml

feat(network): support additional destination CAs (#3292)

2026-10-27 18:31:11 +00:00

build-binaries.yml

test(conformance): run driver suites with cargo (#3866)

2026-10-12 15:35:03 +00:00

build-images.yml

ci(release): promote qualified prereleases to stable (#4611)

2026-10-19 11:17:21 +00:00

build-rpm.yml

chore(ci): update rust-cache to include upstream fixes (#4748)

2026-10-26 13:53:37 +00:00

build-vm-driver.yml

fix(vm): codesign macOS driver-vm with hypervisor entitlement in CI (#3507)

2026-10-02 16:09:09 +00:00

cargo-deny.yml

ci: pin CI images by digest and add native architecture smoke checks (#4114)

2026-10-02 16:22:27 +00:00

ci-image.yml

chore(deps): bump docker/login-action from 4.5.2 to 4.6.0 (#2573)

2026-07-31 22:40:45 +00:00

codeql.yml

chore(deps): bump github/codeql-action/init from 4.37.7 to 4.37.9 (#3002)

2026-10-14 20:05:25 +00:00

codex-compatibility.yml

refactor(ci): extract release qualification and serialize Codex reviews (#4419)

2026-10-15 13:46:33 +00:00

codex-security.yml

refactor(ci): extract release qualification and serialize Codex reviews (#4419)

2026-10-15 13:46:33 +00:00

dco.yml

fix(dco): Fix mismatched wording that breaks initial DCO checks (#2399)

2026-07-21 21:02:37 +00:00

deb-package.yml

ci: pin CI images by digest and add native architecture smoke checks (#4114)

2026-10-02 16:22:27 +00:00

dependency-review.yml

ci(security): add informational security checks (#2930)

2026-08-27 13:32:16 +00:00

e2e-docker-test.yml

feat(network): support additional destination CAs (#3292)

2026-10-27 18:31:11 +00:00

e2e-gpu-test.yaml

test(conformance): run driver suites with cargo (#3866)

2026-10-12 15:35:03 +00:00

e2e-kubernetes-test.yml

fix(ci): restore default e2e coverage with a Kubernetes recovery waiver (#4424)

2026-10-16 17:43:11 +00:00

e2e-label-help.yml

feat(isolation): implement the RFC 0012 sandbox architecture (#2942)

2026-09-16 00:49:14 +00:00

e2e-podman-test.yml

test(conformance): run driver suites with cargo (#3866)

2026-10-12 15:35:03 +00:00

e2e-vm-test.yml

feat(network): support additional destination CAs (#3292)

2026-10-27 18:31:11 +00:00

helm-lint.yml

ci: pin CI images by digest and add native architecture smoke checks (#4114)

2026-10-02 16:22:27 +00:00

integration-runner.yml

test(tmachine): add a K3s HA conformance lane with PostgreSQL and mTLS (#4081)

2026-10-12 21:21:12 +00:00

integration-test.yml

test(tmachine): add a K3s HA conformance lane with PostgreSQL and mTLS (#4081)

2026-10-12 21:21:12 +00:00

issue-triage.yml

chore(ci): pin all GitHub Actions to SHA digests (#1233)

2026-05-18 22:36:48 -07:00

maintainer-approval.yml

fix(ci): skip maintainer approval in merge queue (#4496)

2026-10-13 19:16:00 +00:00

maintainers-change-alert.yml

feat(ci): gate merges on maintainer approval via a silent status check (#3176)

2026-10-09 17:22:15 +00:00

package-release-binaries.yml

feat(prover): add standalone policy boundary checker (#3289)

2026-09-17 17:30:03 +00:00

pr-issue-acceptance.yml

ci: require accepted issues for community pull requests (#4340)

2026-10-13 11:44:44 +00:00

prepare-integration-inputs.yml

fix(ci): retry Nix shell and app dependency preparation (#4066)

2026-10-02 11:27:20 +00:00

publish-docs-website.yml

feat(docs): publish versioned release snapshots (#3149)

2026-09-09 23:34:34 +00:00

release-auto-tag.yml

ci(release): infer optional workflow tags (#4707)

2026-10-26 12:50:45 +00:00

release-build.yml

ci(release): infer optional workflow tags (#4707)

2026-10-26 12:50:45 +00:00

release-canary.yml

fix(snap): use openshell-prover instead of openshell.prover (#4835)

2026-10-22 17:12:02 +00:00

release-dev.yml

ci(release): allow release publishers to be dispatched individually

2026-10-27 16:15:05 -07:00

release-notes.yml

ci(release): generate PR-based stable release notes (#4654)

2026-10-19 21:27:58 +00:00

release-prerelease.yml

ci(release): infer optional workflow tags (#4707)

2026-10-26 12:50:45 +00:00

release-publish.yml

ci(release): allow the Go SDK tag to be dispatched individually

2026-10-27 16:21:32 -07:00

release-qualification.yml

fix(ci): allow accepted protobuf breaks for v0.1.6 prereleases (#4976)

2026-10-27 15:44:53 +00:00

release-vm-kernel.yml

chore(deps): bump actions/attest from 4.2.1 to 4.2.2 (#2625)

2026-10-14 20:05:08 +00:00

release.yml

ci(release): infer optional workflow tags (#4707)

2026-10-26 12:50:45 +00:00

required-ci-gates.yml

fix(ci): paginate required gate job lookups (#4663)

2026-10-16 22:40:09 +00:00

rpm-package.yml

feat(prover): add standalone policy boundary checker (#3289)

2026-09-17 17:30:03 +00:00

rust-cache.yml

ci: keep rust caches warm on main and stop saving binary caches on branches (#4881)

2026-10-23 21:15:15 +00:00

sdk-go-tag.yml

ci(release): allow the Go SDK tag to be dispatched individually

2026-10-27 16:21:32 -07:00

sdk-typescript-publish.yml

ci(release): allow release publishers to be dispatched individually

2026-10-27 16:15:05 -07:00

security-scan.yml

ci(security): temporarily remove Codex from release scans (#4469)

2026-10-13 15:44:26 +00:00

snap-package.yml

fix(ci): gate tagged publication on qualification (#4198)

2026-10-05 14:00:00 +00:00

snap-publish.yml

ci(release): verify dispatched snap and wheel inputs match the release

2026-10-27 16:23:25 -07:00

stale.yml

chore(ci): extend issue stale window and exempt roadmap issues (#4962)

2026-10-27 14:11:02 +00:00

sync-docs.yml

chore(deps): bump astral-sh/setup-uv from 10.0.0 to 10.0.1 (#2767)

2026-10-12 23:11:36 +00:00

trivy-changes.yml

fix(ci): retry Nix shell and app dependency preparation (#4066)

2026-10-02 11:27:20 +00:00

trivy-scan.yml

chore(deps): bump github/codeql-action/upload-sarif (#4552)

2026-10-14 18:41:04 +00:00

vouch-check.yml

chore(ci): pin all GitHub Actions to SHA digests (#1233)

2026-05-18 22:36:48 -07:00

vouch-command.yml

ci(vouch): close approved request discussions (#2929)

2026-08-26 06:31:42 +00:00

wheel-publish.yml

ci(release): verify dispatched snap and wheel inputs match the release

2026-10-27 16:23:25 -07:00

windows-msvc.yml

chore(ci): update rust-cache to include upstream fixes (#4748)

2026-10-26 13:53:37 +00:00

workflow-security.yml

chore(deps): bump github/codeql-action/upload-sarif (#4552)

2026-10-14 18:41:04 +00:00