Repository navigation
feat(ci): opt into OSRB License Risk Triage workflow - #3
Closed
dhaval2025 wants to merge 1 commit into
Closed
dhaval2025 wants to merge 1 commit into
dhaval2025 wants to merge 1 commit into
Conversation
Adds the 6-line OSRB triage workflow from NVIDIA-Omniverse/sectools-skills@v1. Running in advisory-only mode (gate-on-high: 'false') during initial adoption — the PR comment and Job Summary land on every PR, but the gate never blocks merge. Note: this workflow only runs for PRs opened from branches within the NVIDIA enterprise (i.e., from the nvidia or NVIDIA-Omniverse orgs). External-contributor fork PRs cannot fetch the internal-visibility reusable workflow and will silently skip the OSRB job. Filing nspect/OSRB review for those changes remains a manual maintainer action.
Author
|
Closing — opening this on the internal mirror instead, where the reusable workflow's enterprise-visibility works natively (no fork-PR auth limitation). |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Adds
.github/workflows/osrb.ymlto opt this repo into the OSRB License Risk Triage GitHub Action (NVIDIA-Omniverse/sectools-skills@v1).After this lands, future PRs to
mainopened by NVIDIA-org contributors get:osrb-out/artifact bundle (OSRB packet, NVBug draft, written source offer when applicable)Running in advisory-only mode (
gate-on-high: 'false') during initial adoption — the comment posts but the gate never blocks the merge. Flip to'true'once known high-risk deps are resolved.Two GitHub-fundamental reasons:
sectools-skillsis internal-visibility within the NVIDIA enterprise; the GITHUB_TOKEN on a fork PR doesn't carry enterprise auth.Once merged, all PRs to
mainopened from branches within thenvidiaorNVIDIA-Omniverseorgs will trigger OSRB triage normally. External-contributor (non-NVIDIA) fork PRs will silently skip the OSRB job — those changes require manual OSRB review by a maintainer at merge time.Pre-merge verification
If you want to confirm the workflow actually runs before merging, the cleanest way is:
nvidia/simready-foundation(not a fork) with any trivial changeOSRB License Risk Triage / triage / triageand… / triage / commentchecks fire on that PRReference
LGPLdependency (psycopg2-binary)🤖 Generated with Claude Code