Cherry pick licence header update to release branch - #57
Conversation
(cherry picked from commit f81d25c)
📝 WalkthroughWalkthroughThe pull request updates copyright and SPDX headers across the repository, adds governance and security documentation, and adds NGC authentication steps before CI and nightly E2E tests. ChangesRepository governance and licensing
Estimated code review effort: 3 (Moderate) | ~20 minutes Sequence Diagram(s)sequenceDiagram
participant CIWorkflow
participant Docker
participant NGCRegistry
participant E2ETests
CIWorkflow->>CIWorkflow: Validate NGC_API_KEY
CIWorkflow->>Docker: Login to nvcr.io with NGC token
Docker->>NGCRegistry: Authenticate
CIWorkflow->>E2ETests: Run E2E tests
Possibly related PRs
Suggested reviewers: 🚥 Pre-merge checks | ✅ 4 | ❌ 1❌ Failed checks (1 warning)
✅ Passed checks (4 passed)
✨ Finishing Touches📝 Generate docstrings
🧪 Generate unit tests (beta)
Comment |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 8
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In @.github/workflows/ci.yml:
- Around line 90-101: Update the NGC authentication workflow around the “Log in
to NGC” step to set DOCKER_CONFIG to `${{ runner.temp }}/ngc-docker` for both
docker login and all tests that pull the image, then add an `if: always()`
cleanup step to remove that directory. Apply the same ephemeral Docker
configuration and cleanup to the corresponding workflow in nightly.yml; preserve
the existing secret validation and login behavior.
In @.github/workflows/nightly.yml:
- Around line 62-73: Update the workflow around the NGC login and “Run full E2E
suite” steps to set job-scoped DOCKER_CONFIG under ${{ runner.temp }}, create
that directory before docker login, and ensure Docker uses it for the
authenticated pull. Add an immediately following cleanup step with if: always()
that removes the temporary DOCKER_CONFIG directory.
In `@CONTRIBUTING.md`:
- Around line 14-45: Normalize the Markdown fences in the DCO section: add blank
lines around each fence, retain bash as the language for the Git command, and
label the commit-message and DCO text blocks with text. Remove the $ prompt from
the bash example unless corresponding command output is added, resolving MD031,
MD014, and MD040.
- Around line 1-6: Update the headings in the contribution document: change the
top-level “Isaac AutoData Contribution Rules” heading to level 1 and the
“Signing Your Work” heading to level 2, preserving the document’s heading
hierarchy.
In `@CONTRIBUTORS.md`:
- Around line 10-11: Insert a blank line between the “Core Team” heading and its
first list item in CONTRIBUTORS.md, preserving the existing heading and
contributor entry.
In `@LICENSE.md`:
- Around line 1-4: Fix the broken license references by either adding a
root-level LICENSE target that resolves to LICENSE.md or updating the LICENSE
links in README.md and docs/index.rst to point to LICENSE.md; ensure all
references resolve consistently with the existing LICENSE.md file.
In `@SECURITY.md`:
- Line 1: Update the top-level heading in SECURITY.md from a second-level
heading to a first-level heading, changing “## Security” to “# Security” to
satisfy MD041.
- Around line 12-18: Normalize indentation in the nested reporting fields under
the PGP key bullet, using exactly four spaces before each nested “-” item.
Update only the affected list indentation so the reporting content remains at
the same nesting level.
🪄 Autofix
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Path: .coderabbit.yaml
Review profile: ASSERTIVE
Plan: Enterprise
Run ID: 5c956d1d-3963-40b6-afb8-d0f84dd6ee42
📒 Files selected for processing (118)
.coderabbit.yaml.github/LICENSE_HEADER.txt.github/workflows/ci.yml.github/workflows/nightly.yml.pre-commit-config.yamlCONTRIBUTING.mdCONTRIBUTORS.mdLICENSE.mdSECURITY.mdconda_installer.shdocker/Dockerfile.isaac_autodatadocker/run_docker.shdocker/setup/entrypoint.shdocker/setup/install_curobo.shdocs/Makefiledocs/_ext/isaac_autodata_doc_tools.pydocs/_static/custom.cssdocs/conf.pyisaac_autodata_core/__init__.pyisaac_autodata_core/algorithms.pyisaac_autodata_core/data_generator.pyisaac_autodata_core/datagen_info.pyisaac_autodata_core/pool.pyisaac_autodata_core/selection_strategy.pyisaac_autodata_core/transforms.pyisaac_autodata_core/waypoint.pyisaac_autodata_examples/__init__.pyisaac_autodata_examples/embodiments/franka_ik_rel.yamlisaac_autodata_examples/embodiments/franka_ik_rel_skillgen.yamlisaac_autodata_examples/embodiments/g1_ik_abs.yamlisaac_autodata_examples/embodiments/gr1_ik_abs.yamlisaac_autodata_examples/env_profiles/franka_bin_stack.yamlisaac_autodata_examples/tasks/franka_bin_stack_skillgen.yamlisaac_autodata_examples/tasks/franka_cube_stack.yamlisaac_autodata_examples/tasks/franka_cube_stack_skillgen.yamlisaac_autodata_examples/tasks/g1_pick_place.yamlisaac_autodata_examples/tasks/gr1_pick_place.yamlisaac_autodata_interfaces/__init__.pyisaac_autodata_interfaces/datastream/__init__.pyisaac_autodata_interfaces/datastream/datastream.pyisaac_autodata_interfaces/embodiments/__init__.pyisaac_autodata_interfaces/embodiments/bimanual_embodiment_adapter.pyisaac_autodata_interfaces/embodiments/embodiment_adapter.pyisaac_autodata_interfaces/embodiments/embodiment_types.pyisaac_autodata_interfaces/embodiments/factory.pyisaac_autodata_interfaces/embodiments/single_arm_embodiment_adapter.pyisaac_autodata_interfaces/env/__init__.pyisaac_autodata_interfaces/env/env_profile.pyisaac_autodata_interfaces/env/isaaclab_env_interface.pyisaac_autodata_interfaces/motion_planners/__init__.pyisaac_autodata_interfaces/motion_planners/curobo/__init__.pyisaac_autodata_interfaces/motion_planners/curobo/curobo_planner.pyisaac_autodata_interfaces/motion_planners/curobo/curobo_planner_cfg.pyisaac_autodata_interfaces/motion_planners/curobo/plan_visualizer.pyisaac_autodata_interfaces/motion_planners/motion_planner_base.pyisaac_autodata_interfaces/tasks/__init__.pyisaac_autodata_interfaces/tasks/generation_policy_spec.pyisaac_autodata_interfaces/tasks/subtask_constraint_spec.pyisaac_autodata_interfaces/tasks/subtask_spec.pyisaac_autodata_interfaces/tasks/task_descriptor.pyisaac_autodata_interfaces/tasks/task_descriptor_utils.pyisaac_autodata_tests/__init__.pyisaac_autodata_tests/core/__init__.pyisaac_autodata_tests/core/test_algorithms.pyisaac_autodata_tests/core/test_data_generator.pyisaac_autodata_tests/core/test_datagen_info.pyisaac_autodata_tests/core/test_pool.pyisaac_autodata_tests/core/test_selection_strategy.pyisaac_autodata_tests/core/test_transforms.pyisaac_autodata_tests/core/test_waypoint.pyisaac_autodata_tests/datagen_perf/__init__.pyisaac_autodata_tests/datagen_perf/test_dexmimicgen_g1_data_generation_success_rate.pyisaac_autodata_tests/datagen_perf/test_dexmimicgen_gr1_data_generation_success_rate.pyisaac_autodata_tests/datagen_perf/test_mimicgen_franka_data_generation_success_rate.pyisaac_autodata_tests/e2e/__init__.pyisaac_autodata_tests/e2e/test_dexmimicgen_data_generation.pyisaac_autodata_tests/e2e/test_mimicgen_data_generation.pyisaac_autodata_tests/e2e/test_skillgen_bin_data_generation.pyisaac_autodata_tests/e2e/test_skillgen_data_generation.pyisaac_autodata_tests/interfaces/__init__.pyisaac_autodata_tests/interfaces/datastream/__init__.pyisaac_autodata_tests/interfaces/datastream/test_datastream.pyisaac_autodata_tests/interfaces/embodiments/__init__.pyisaac_autodata_tests/interfaces/embodiments/test_bimanual_embodiment_adapter.pyisaac_autodata_tests/interfaces/embodiments/test_embodiment_adapter.pyisaac_autodata_tests/interfaces/embodiments/test_embodiment_types.pyisaac_autodata_tests/interfaces/embodiments/test_factory.pyisaac_autodata_tests/interfaces/embodiments/test_single_arm_embodiment_adapter.pyisaac_autodata_tests/interfaces/env/__init__.pyisaac_autodata_tests/interfaces/env/test_env_profile.pyisaac_autodata_tests/interfaces/env/test_env_profile_apply.pyisaac_autodata_tests/interfaces/mocks.pyisaac_autodata_tests/interfaces/motion_planners/__init__.pyisaac_autodata_tests/interfaces/motion_planners/test_curobo_planner_cfg.pyisaac_autodata_tests/interfaces/tasks/__init__.pyisaac_autodata_tests/interfaces/tasks/test_generation_policy_spec.pyisaac_autodata_tests/interfaces/tasks/test_subtask_constraint_spec.pyisaac_autodata_tests/interfaces/tasks/test_subtask_spec.pyisaac_autodata_tests/interfaces/tasks/test_task_descriptor.pyisaac_autodata_tests/interfaces/tasks/test_task_descriptor_utils.pyisaac_autodata_tests/utils/__init__.pyisaac_autodata_tests/utils/constants.pyisaac_autodata_tests/utils/subprocess.pyisaac_autodata_tests/utils/test_generation_result.pyisaac_autodata_tests/utils/utils.pyisaac_autodata_utils/__init__.pyisaac_autodata_utils/g1_avp_teleop.pyisaac_autodata_utils/generation_result.pyisaac_autodata_utils/isaaclab_compat.pyisaac_autodata_utils/pose_math.pyisaac_autodata_utils/tensor_utils.pyscripts/annotate_demos.pyscripts/ci/run_tests.shscripts/ci/summarize_test_results.pyscripts/generate_dataset.pyscripts/validate_dataset.pysetup.pysitecustomize.py
There was a problem hiding this comment.
Caution
Inline review comments failed to post. This is likely due to GitHub's internal server error or limits when posting large numbers of comments. If you are seeing this consistently it is likely a permissions issue. Please check "Moderation" -> "Code review limits" under your organization settings.
Actionable comments posted: 8
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In @.github/workflows/ci.yml:
- Around line 90-101: Update the NGC authentication workflow around the “Log in
to NGC” step to set DOCKER_CONFIG to `${{ runner.temp }}/ngc-docker` for both
docker login and all tests that pull the image, then add an `if: always()`
cleanup step to remove that directory. Apply the same ephemeral Docker
configuration and cleanup to the corresponding workflow in nightly.yml; preserve
the existing secret validation and login behavior.
In @.github/workflows/nightly.yml:
- Around line 62-73: Update the workflow around the NGC login and “Run full E2E
suite” steps to set job-scoped DOCKER_CONFIG under ${{ runner.temp }}, create
that directory before docker login, and ensure Docker uses it for the
authenticated pull. Add an immediately following cleanup step with if: always()
that removes the temporary DOCKER_CONFIG directory.
In `@CONTRIBUTING.md`:
- Around line 14-45: Normalize the Markdown fences in the DCO section: add blank
lines around each fence, retain bash as the language for the Git command, and
label the commit-message and DCO text blocks with text. Remove the $ prompt from
the bash example unless corresponding command output is added, resolving MD031,
MD014, and MD040.
- Around line 1-6: Update the headings in the contribution document: change the
top-level “Isaac AutoData Contribution Rules” heading to level 1 and the
“Signing Your Work” heading to level 2, preserving the document’s heading
hierarchy.
In `@CONTRIBUTORS.md`:
- Around line 10-11: Insert a blank line between the “Core Team” heading and its
first list item in CONTRIBUTORS.md, preserving the existing heading and
contributor entry.
In `@LICENSE.md`:
- Around line 1-4: Fix the broken license references by either adding a
root-level LICENSE target that resolves to LICENSE.md or updating the LICENSE
links in README.md and docs/index.rst to point to LICENSE.md; ensure all
references resolve consistently with the existing LICENSE.md file.
In `@SECURITY.md`:
- Line 1: Update the top-level heading in SECURITY.md from a second-level
heading to a first-level heading, changing “## Security” to “# Security” to
satisfy MD041.
- Around line 12-18: Normalize indentation in the nested reporting fields under
the PGP key bullet, using exactly four spaces before each nested “-” item.
Update only the affected list indentation so the reporting content remains at
the same nesting level.
🪄 Autofix
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Path: .coderabbit.yaml
Review profile: ASSERTIVE
Plan: Enterprise
Run ID: 5c956d1d-3963-40b6-afb8-d0f84dd6ee42
📒 Files selected for processing (118)
.coderabbit.yaml.github/LICENSE_HEADER.txt.github/workflows/ci.yml.github/workflows/nightly.yml.pre-commit-config.yamlCONTRIBUTING.mdCONTRIBUTORS.mdLICENSE.mdSECURITY.mdconda_installer.shdocker/Dockerfile.isaac_autodatadocker/run_docker.shdocker/setup/entrypoint.shdocker/setup/install_curobo.shdocs/Makefiledocs/_ext/isaac_autodata_doc_tools.pydocs/_static/custom.cssdocs/conf.pyisaac_autodata_core/__init__.pyisaac_autodata_core/algorithms.pyisaac_autodata_core/data_generator.pyisaac_autodata_core/datagen_info.pyisaac_autodata_core/pool.pyisaac_autodata_core/selection_strategy.pyisaac_autodata_core/transforms.pyisaac_autodata_core/waypoint.pyisaac_autodata_examples/__init__.pyisaac_autodata_examples/embodiments/franka_ik_rel.yamlisaac_autodata_examples/embodiments/franka_ik_rel_skillgen.yamlisaac_autodata_examples/embodiments/g1_ik_abs.yamlisaac_autodata_examples/embodiments/gr1_ik_abs.yamlisaac_autodata_examples/env_profiles/franka_bin_stack.yamlisaac_autodata_examples/tasks/franka_bin_stack_skillgen.yamlisaac_autodata_examples/tasks/franka_cube_stack.yamlisaac_autodata_examples/tasks/franka_cube_stack_skillgen.yamlisaac_autodata_examples/tasks/g1_pick_place.yamlisaac_autodata_examples/tasks/gr1_pick_place.yamlisaac_autodata_interfaces/__init__.pyisaac_autodata_interfaces/datastream/__init__.pyisaac_autodata_interfaces/datastream/datastream.pyisaac_autodata_interfaces/embodiments/__init__.pyisaac_autodata_interfaces/embodiments/bimanual_embodiment_adapter.pyisaac_autodata_interfaces/embodiments/embodiment_adapter.pyisaac_autodata_interfaces/embodiments/embodiment_types.pyisaac_autodata_interfaces/embodiments/factory.pyisaac_autodata_interfaces/embodiments/single_arm_embodiment_adapter.pyisaac_autodata_interfaces/env/__init__.pyisaac_autodata_interfaces/env/env_profile.pyisaac_autodata_interfaces/env/isaaclab_env_interface.pyisaac_autodata_interfaces/motion_planners/__init__.pyisaac_autodata_interfaces/motion_planners/curobo/__init__.pyisaac_autodata_interfaces/motion_planners/curobo/curobo_planner.pyisaac_autodata_interfaces/motion_planners/curobo/curobo_planner_cfg.pyisaac_autodata_interfaces/motion_planners/curobo/plan_visualizer.pyisaac_autodata_interfaces/motion_planners/motion_planner_base.pyisaac_autodata_interfaces/tasks/__init__.pyisaac_autodata_interfaces/tasks/generation_policy_spec.pyisaac_autodata_interfaces/tasks/subtask_constraint_spec.pyisaac_autodata_interfaces/tasks/subtask_spec.pyisaac_autodata_interfaces/tasks/task_descriptor.pyisaac_autodata_interfaces/tasks/task_descriptor_utils.pyisaac_autodata_tests/__init__.pyisaac_autodata_tests/core/__init__.pyisaac_autodata_tests/core/test_algorithms.pyisaac_autodata_tests/core/test_data_generator.pyisaac_autodata_tests/core/test_datagen_info.pyisaac_autodata_tests/core/test_pool.pyisaac_autodata_tests/core/test_selection_strategy.pyisaac_autodata_tests/core/test_transforms.pyisaac_autodata_tests/core/test_waypoint.pyisaac_autodata_tests/datagen_perf/__init__.pyisaac_autodata_tests/datagen_perf/test_dexmimicgen_g1_data_generation_success_rate.pyisaac_autodata_tests/datagen_perf/test_dexmimicgen_gr1_data_generation_success_rate.pyisaac_autodata_tests/datagen_perf/test_mimicgen_franka_data_generation_success_rate.pyisaac_autodata_tests/e2e/__init__.pyisaac_autodata_tests/e2e/test_dexmimicgen_data_generation.pyisaac_autodata_tests/e2e/test_mimicgen_data_generation.pyisaac_autodata_tests/e2e/test_skillgen_bin_data_generation.pyisaac_autodata_tests/e2e/test_skillgen_data_generation.pyisaac_autodata_tests/interfaces/__init__.pyisaac_autodata_tests/interfaces/datastream/__init__.pyisaac_autodata_tests/interfaces/datastream/test_datastream.pyisaac_autodata_tests/interfaces/embodiments/__init__.pyisaac_autodata_tests/interfaces/embodiments/test_bimanual_embodiment_adapter.pyisaac_autodata_tests/interfaces/embodiments/test_embodiment_adapter.pyisaac_autodata_tests/interfaces/embodiments/test_embodiment_types.pyisaac_autodata_tests/interfaces/embodiments/test_factory.pyisaac_autodata_tests/interfaces/embodiments/test_single_arm_embodiment_adapter.pyisaac_autodata_tests/interfaces/env/__init__.pyisaac_autodata_tests/interfaces/env/test_env_profile.pyisaac_autodata_tests/interfaces/env/test_env_profile_apply.pyisaac_autodata_tests/interfaces/mocks.pyisaac_autodata_tests/interfaces/motion_planners/__init__.pyisaac_autodata_tests/interfaces/motion_planners/test_curobo_planner_cfg.pyisaac_autodata_tests/interfaces/tasks/__init__.pyisaac_autodata_tests/interfaces/tasks/test_generation_policy_spec.pyisaac_autodata_tests/interfaces/tasks/test_subtask_constraint_spec.pyisaac_autodata_tests/interfaces/tasks/test_subtask_spec.pyisaac_autodata_tests/interfaces/tasks/test_task_descriptor.pyisaac_autodata_tests/interfaces/tasks/test_task_descriptor_utils.pyisaac_autodata_tests/utils/__init__.pyisaac_autodata_tests/utils/constants.pyisaac_autodata_tests/utils/subprocess.pyisaac_autodata_tests/utils/test_generation_result.pyisaac_autodata_tests/utils/utils.pyisaac_autodata_utils/__init__.pyisaac_autodata_utils/g1_avp_teleop.pyisaac_autodata_utils/generation_result.pyisaac_autodata_utils/isaaclab_compat.pyisaac_autodata_utils/pose_math.pyisaac_autodata_utils/tensor_utils.pyscripts/annotate_demos.pyscripts/ci/run_tests.shscripts/ci/summarize_test_results.pyscripts/generate_dataset.pyscripts/validate_dataset.pysetup.pysitecustomize.py
🛑 Comments failed to post (7)
.github/workflows/ci.yml (1)
90-101: 🔒 Security & Privacy | 🟠 Major | ⚡ Quick win
🧩 Analysis chain
🏁 Script executed:
#!/usr/bin/env bash set -euo pipefail rg -n -C 6 'NGC_API_KEY|DOCKER_CONFIG|docker (login|logout)|run_tests\.sh' \ .github/workflows/ci.yml .github/workflows/nightly.yml rg -n -C 6 'DOCKER_CONFIG|docker (build|pull|run|push)|sudo' \ scripts/ci/run_tests.shRepository: isaac-sim/Isaac-AutoData
Length of output: 3157
🏁 Script executed:
#!/usr/bin/env bash set -euo pipefail printf '%s\n' '--- CI workflow ---' sed -n '1,125p' .github/workflows/ci.yml printf '%s\n' '--- Nightly workflow ---' sed -n '1,105p' .github/workflows/nightly.yml printf '%s\n' '--- Test runner script ---' sed -n '1,240p' scripts/ci/run_tests.sh printf '%s\n' '--- Docker-related workflow and script references ---' rg -n -C 4 'docker|DOCKER_CONFIG|NGC_API_KEY|pull_request|fork|head_repository|repository_owner|runs-on' \ .github/workflows/ci.yml .github/workflows/nightly.yml scripts/ci/run_tests.shRepository: isaac-sim/Isaac-AutoData
Length of output: 20104
🏁 Script executed:
#!/usr/bin/env bash set -euo pipefail printf '%s\n' '--- Docker wrapper ---' sed -n '1,280p' docker/run_docker.sh printf '%s\n' '--- Repository references to Docker credential cleanup/config ---' rg -n -C 5 'DOCKER_CONFIG|docker (login|logout)|config\.json|docker system prune|docker rm|cleanup|post-job|runner.temp|self-hosted' \ .github docker scripts .gitignore 2>/dev/null || true printf '%s\n' '--- Workflow file inventory ---' git ls-files '.github/workflows/*' 'docker/*' 'scripts/ci/*'Repository: isaac-sim/Isaac-AutoData
Length of output: 11717
🏁 Script executed:
#!/usr/bin/env bash set -euo pipefail python3 - <<'PY' from pathlib import Path ci = Path(".github/workflows/ci.yml").read_text() nightly = Path(".github/workflows/nightly.yml").read_text() runner = Path("scripts/ci/run_tests.sh").read_text() wrapper = Path("docker/run_docker.sh").read_text() checks = { "CI uses a self-hosted GPU runner": "runs-on: [self-hosted, gpu]" in ci, "CI allows same-repository pull requests": "head.repo.full_name == github.repository" in ci, "CI login has no DOCKER_CONFIG": "DOCKER_CONFIG" not in ci, "CI has no Docker logout or cleanup": not any( token in ci for token in ("docker logout", "config.json", "rm -rf") ), "test script does not set DOCKER_CONFIG": "DOCKER_CONFIG" not in runner, "Docker wrapper does not set DOCKER_CONFIG": "DOCKER_CONFIG" not in wrapper, "repository-controlled test invokes Docker wrapper": "./docker/run_docker.sh" in runner, "wrapper pulls during image build": "docker build --pull" in wrapper, } for name, result in checks.items(): print(f"{'PASS' if result else 'FAIL'}: {name}") if not all(checks.values()): raise SystemExit(1) PYRepository: isaac-sim/Isaac-AutoData
Length of output: 512
🌐 Web query:
site:docs.docker.com/reference/cli/docker/login DOCKER_CONFIG credential store config.json💡 Result:
The DOCKER_CONFIG environment variable is used to specify the directory containing the Docker configuration file, which defaults to $HOME/.docker on Linux or %USERPROFILE%/.docker on Windows [1]. By setting this variable, you can override the default location where Docker looks for the config.json file [1]. To configure a credential store, you must modify the config.json file located within the directory specified by DOCKER_CONFIG [1]. Within this file, you define the credsStore property, which points to the suffix of the external credential helper binary [1]. For example, to use the osxkeychain helper, your config.json should contain [1]: { "credsStore": "osxkeychain" } If no credential store is configured, Docker defaults to storing credentials in the config.json file itself using base64 encoding, which is considered less secure [1]. Docker automatically attempts to use platform-specific defaults if available, such as osxkeychain on macOS, wincred on Windows, or pass/secretservice on Linux [1].
Citations:
🌐 Web query:
site:docs.github.com self-hosted runners security pull requests untrusted code💡 Result:
Using self-hosted runners to execute code from pull requests presents significant security risks because the runner environment is not inherently isolated or ephemeral, unlike GitHub-hosted runners [1][2]. Consequently, untrusted code executed within a workflow can compromise the host machine, potentially leading to unauthorized access to secrets, internal network resources, and other sensitive data [3][1][2]. Key security considerations and risks include: Persistent Compromise: Self-hosted runners do not provide a guarantee of a clean, isolated environment for each job [1][2]. Malicious code can persistently compromise the machine, affecting subsequent jobs or leaving backdoors [1][2]. Access to Secrets: Attackers who can trigger a workflow (e.g., by submitting a pull request) may gain access to repository secrets or the GITHUB_TOKEN [3][1]. Even if a workflow is configured with restrictive permissions, these can often be bypassed or exploited if the attacker can execute arbitrary commands on the host [3]. Limited Efficacy of "Clean" Environments: Simply attempting to destroy or clean the runner after each job is often insufficient [1][2]. An attacker might execute code faster than the cleanup process or use techniques (such as inspecting command-line arguments of other processes) to exfiltrate data from concurrent jobs [1][2]. Public Repository Risks: GitHub strongly recommends against using self-hosted runners for public repositories [4][2][5]. Because anyone can fork a public repository and open a pull request, they can effectively gain the ability to run arbitrary, malicious code on your infrastructure [4][1][2]. Recommended Mitigation Strategies: Use GitHub-Hosted Runners for Untrusted Code: The most effective security measure is to use GitHub-hosted runners for jobs that handle pull requests from external contributors, as these runners are isolated, ephemeral, and managed by GitHub [1][2]. Restrict Runner Access: If self-hosted runners must be used, organize them into runner groups and apply strict policies to limit which repositories and workflows can access them [1][5]. Isolate Infrastructure: Ensure that the host machine for the runner is properly isolated from internal resources, sensitive services (like cloud metadata endpoints), and the broader network [6][2]. Use pull_request_target Carefully: When working with pull requests, use the pull_request_target trigger only when necessary and understand that it executes code from the base branch, not the untrusted pull request branch [6]. Avoid running untrusted code from the pull request head ref [6]. Adopting a defensive posture similar to that used for highly privileged application code—including avoiding script injection vulnerabilities by sanitizing all inputs—is essential when managing self-hosted runners [7].
Citations:
- 1: https://docs.github.com/en/enterprise-server@3.21/actions/reference/security/secure-use
- 2: https://docs.github.com/en/actions/reference/security/secure-use
- 3: https://docs.github.com/en/enterprise-cloud@latest/actions/concepts/security/compromised-runners
- 4: https://docs.github.com/en/actions/how-tos/manage-runners/self-hosted-runners/add-runners
- 5: https://docs.github.com/actions/hosting-your-own-runners/managing-self-hosted-runners/managing-access-to-self-hosted-runners-using-groups
- 6: https://docs.github.com/en/actions/reference/security/securely-using-pull_request_target
- 7: https://docs.github.com/en/actions/concepts/security/script-injections
🏁 Script executed:
#!/usr/bin/env bash set -euo pipefail python3 - <<'PY' from pathlib import Path ci = Path(".github/workflows/ci.yml").read_text() nightly = Path(".github/workflows/nightly.yml").read_text() runner = Path("scripts/ci/run_tests.sh").read_text() wrapper = Path("docker/run_docker.sh").read_text() checks = { "CI login does not set DOCKER_CONFIG": "DOCKER_CONFIG" not in ci, "CI has no Docker logout": "docker logout" not in ci, "CI has no Docker-config removal": "config.json" not in ci and "DOCKER_CONFIG" not in ci, "test script does not set DOCKER_CONFIG": "DOCKER_CONFIG" not in runner, "Docker wrapper does not set DOCKER_CONFIG": "DOCKER_CONFIG" not in wrapper, "CI runs repository-controlled tests on self-hosted runner": ( "runs-on: [self-hosted, gpu]" in ci and "run: ./scripts/ci/run_tests.sh" in ci ), "same-repository pull requests can run the GPU job": ( "head.repo.full_name == github.repository" in ci ), "Docker build can pull the authenticated base image": "docker build --pull" in wrapper, "nightly login also lacks Docker credential cleanup": ( "docker logout" not in nightly and "DOCKER_CONFIG" not in nightly ), } for name, result in checks.items(): print(f"{'PASS' if result else 'FAIL'}: {name}") if not all(checks.values()): raise SystemExit(1) PYRepository: isaac-sim/Isaac-AutoData
Length of output: 599
Use an ephemeral Docker credential store.
docker logincurrently writes to the persistent runner's default Docker configuration. SetDOCKER_CONFIGto${{ runner.temp }}/ngc-dockerfor login and tests, then remove it in anif: always()cleanup step. Apply the same isolation to.github/workflows/nightly.yml.An ephemeral store does not protect credentials from untrusted code in the E2E step. If same-repository pull requests are not trusted, move the authenticated pull to a trusted job or isolate the runner.
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In @.github/workflows/ci.yml around lines 90 - 101, Update the NGC authentication workflow around the “Log in to NGC” step to set DOCKER_CONFIG to `${{ runner.temp }}/ngc-docker` for both docker login and all tests that pull the image, then add an `if: always()` cleanup step to remove that directory. Apply the same ephemeral Docker configuration and cleanup to the corresponding workflow in nightly.yml; preserve the existing secret validation and login behavior..github/workflows/nightly.yml (1)
62-73: 🔒 Security & Privacy | 🟠 Major | ⚡ Quick win
🧩 Analysis chain
🏁 Script executed:
#!/bin/bash set -eu printf '%s\n' '--- workflow files ---' git ls-files '.github/workflows/*.yml' '.github/workflows/*.yaml' printf '%s\n' '--- nightly.yml relevant sections ---' sed -n '1,130p' .github/workflows/nightly.yml printf '%s\n' '--- ci.yml relevant Docker/configuration references ---' rg -n -C 5 'DOCKER_CONFIG|docker login|NGC|E2E|runner.temp|docker build|docker run|cleanup|always' .github/workflows/ci.yml printf '%s\n' '--- nightly Docker/configuration references ---' rg -n -C 5 'DOCKER_CONFIG|docker login|NGC|E2E|runner.temp|docker build|docker run|cleanup|always' .github/workflows/nightly.yml printf '%s\n' '--- Dockerfile references ---' git ls-files | rg '(^|/)(Dockerfile[^/]*)$|docker-compose|compose'Repository: isaac-sim/Isaac-AutoData
Length of output: 6850
🏁 Script executed:
#!/bin/bash set -eu printf '%s\n' '--- ci.yml E2E job ---' sed -n '52,110p' .github/workflows/ci.yml printf '%s\n' '--- Dockerfile outline and relevant instructions ---' ast-grep outline docker/Dockerfile.isaac_autodata rg -n -C 5 'FROM|ARG|ENV|RUN|ENTRYPOINT|CMD|isaac-sim|nvcr.io' docker/Dockerfile.isaac_autodata printf '%s\n' '--- test runner script ---' sed -n '1,240p' scripts/ci/run_tests.sh printf '%s\n' '--- Docker configuration references in repository ---' rg -n -C 3 'DOCKER_CONFIG|docker (login|logout|build|pull|run)|config\.json|credsStore|credHelpers' --glob '!*.lock' .Repository: isaac-sim/Isaac-AutoData
Length of output: 12499
🏁 Script executed:
#!/bin/bash set -eu printf '%s\n' '--- docker/run_docker.sh ---' sed -n '1,210p' docker/run_docker.sh printf '%s\n' '--- workflow step ordering and environment usage ---' python3 - <<'PY' from pathlib import Path for name in (".github/workflows/nightly.yml", ".github/workflows/ci.yml"): text = Path(name).read_text() print(f"--- {name} ---") for i, line in enumerate(text.splitlines(), 1): if any(token in line for token in ( "Log in to NGC", "Run full E2E suite", "Run E2E tests", "Test results summary", "Upload test results", "DOCKER_CONFIG", "runner.temp", "always()", )): print(f"{i}: {line}") PY printf '%s\n' '--- Docker credential configuration references ---' rg -n 'HOME|DOCKER_CONFIG|docker build|docker run|docker login|docker logout' docker scripts .githubRepository: isaac-sim/Isaac-AutoData
Length of output: 9317
🌐 Web query:
Docker CLI docker login default credential storage DOCKER_CONFIG config.json official documentation💡 Result:
The Docker CLI manages authentication credentials using either a secure external credential store or a local configuration file [1]. By default, the configuration file
config.jsonis located at$HOME/.docker/config.json(Linux/macOS) or%USERPROFILE%/.docker/config.json(Windows) [1]. You can override this default location by setting theDOCKER_CONFIGenvironment variable to a custom directory path [2]. Credential Storage Mechanisms: 1. Native Credential Store (Recommended): Docker can use system-native keychains to store credentials securely [1]. To enable this, you must specify acredsStorein yourconfig.json[1][3]. The value should be the suffix of the credential helper binary (e.g.,osxkeychainfordocker-credential-osxkeychain) [1][4]. Common native helpers includeosxkeychain(macOS),wincred(Windows), andpassorsecretservice(Linux) [1][3]. 2. File-based Storage (Default): If no credential store is configured, Docker stores credentials directly in theconfig.jsonfile in a base64-encoded format [1]. This method is less secure than using a native credential store [1]. 3. Credential Helpers: For specific registries, you can configure individual credential helpers using thecredHelpersfield inconfig.json, which maps registry domains to specific helper binaries [4]. Environment Variables: - DOCKER_CONFIG: Specifies the directory containing yourconfig.jsonfile [2]. - DOCKER_AUTH_CONFIG: Allows you to provide credentials directly via an environment variable, which takes precedence over both file-based and native stores [5]. The value should be a JSON object containing anauthsfield with base64-encoded credentials [5].Citations:
- 1: https://docs.docker.com/reference/cli/docker/login/
- 2: https://docs.docker.com/reference/cli/docker/
- 3: https://github.com/docker/docker-credential-helpers
- 4: https://github.com/rancher-archives/docker-cli/blob/master/docs/reference/commandline/login.md
- 5: docker/cli#6008
🌐 Web query:
GitHub Actions runner.temp temporary directory official documentation💡 Result:
In GitHub Actions, the temporary directory is officially documented as
runner.tempwhen used within a context or as the environment variableRUNNER_TEMP[1][2]. Key technical details regarding this directory include: - Purpose: It provides a dedicated location for temporary files created during a job, such as logs or intermediate build artifacts [2][3]. - Lifecycle: The directory is automatically emptied at the beginning and the end of each job [1][2]. - Permissions: Files will not be removed if the runner's user account lacks the necessary permissions to delete them [1][4]. - Access: - You can reference it in your workflow YAML files using the context syntax:${{ runner.temp }}[2]. - It is also available as an environment variable:RUNNER_TEMP[1][5]. Note that while the directory is intended for temporary usage, some users have reported that it may not be automatically mounted or accessible in certain container-based actions depending on the environment configuration [6]. As a best practice, always verify your directory permissions and ensure your action environment is correctly set up if you encounter issues with file operations in this path [1][6].Citations:
- 1: https://docs.github.com/en/actions/reference/workflows-and-actions/variables
- 2: https://docs.github.com/en/actions/reference/workflows-and-actions/contexts
- 3: actions/toolkit#518
- 4: https://docs.github.com/en/enterprise-server@2.22/actions/reference/environment-variables
- 5: https://github.com/actions/cache/blob/main/caching-strategies.md
- 6: actions/runner#1984
Isolate and remove the NGC Docker credentials.
Without
DOCKER_CONFIG,docker logincan write the credential to the persistent runner’s default Docker configuration. The full E2E step forcesdocker build --pulland then runs repository-controlled code.Set a job-scoped
DOCKER_CONFIGunder${{ runner.temp }}. Create it before login. Add anif: always()cleanup step immediately afterRun full E2E suiteto remove it.🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In @.github/workflows/nightly.yml around lines 62 - 73, Update the workflow around the NGC login and “Run full E2E suite” steps to set job-scoped DOCKER_CONFIG under ${{ runner.temp }}, create that directory before docker login, and ensure Docker uses it for the authenticated pull. Add an immediately following cleanup step with if: always() that removes the temporary DOCKER_CONFIG directory.CONTRIBUTING.md (2)
1-6: 📐 Maintainability & Code Quality | 🟡 Minor | ⚡ Quick win
Use a top-level title and consistent heading levels.
Line 1 starts with
##, and Line 6 jumps to####. Change them to# Isaac AutoData Contribution Rulesand## Signing Your Workto preserve the document outline and clear MD041/MD001.Proposed heading fix
-## Isaac AutoData Contribution Rules +# Isaac AutoData Contribution Rules ... -#### Signing Your Work +## Signing Your Work📝 Committable suggestion
‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.# Isaac AutoData Contribution Rules This document describes the rules for contributing to Isaac AutoData ## Signing Your Work🧰 Tools
🪛 markdownlint-cli2 (0.23.2)
[warning] 1-1: First line in a file should be a top-level heading
(MD041, first-line-heading, first-line-h1)
[warning] 6-6: Heading levels should only increment by one level at a time
Expected: h3; Actual: h4(MD001, heading-increment)
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@CONTRIBUTING.md` around lines 1 - 6, Update the headings in the contribution document: change the top-level “Isaac AutoData Contribution Rules” heading to level 1 and the “Signing Your Work” heading to level 2, preserving the document’s heading hierarchy.Source: Linters/SAST tools
14-45: 📐 Maintainability & Code Quality | 🟡 Minor | ⚡ Quick win
Normalize the Markdown code fences.
Add blank lines around the fences at Lines 15, 17, and 19. Specify languages such as
bashfor the Git command andtextfor the commit-message and DCO examples. Remove the$prompt or add command output. These changes address MD031, MD014, and MD040.🧰 Tools
🪛 markdownlint-cli2 (0.23.2)
[warning] 15-15: Fenced code blocks should be surrounded by blank lines
(MD031, blanks-around-fences)
[warning] 16-16: Dollar signs used before commands without showing output
(MD014, commands-show-output)
[warning] 17-17: Fenced code blocks should be surrounded by blank lines
(MD031, blanks-around-fences)
[warning] 19-19: Fenced code blocks should be surrounded by blank lines
(MD031, blanks-around-fences)
[warning] 19-19: Fenced code blocks should have a language specified
(MD040, fenced-code-language)
[warning] 25-25: Fenced code blocks should have a language specified
(MD040, fenced-code-language)
[warning] 33-33: Fenced code blocks should have a language specified
(MD040, fenced-code-language)
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@CONTRIBUTING.md` around lines 14 - 45, Normalize the Markdown fences in the DCO section: add blank lines around each fence, retain bash as the language for the Git command, and label the commit-message and DCO text blocks with text. Remove the $ prompt from the bash example unless corresponding command output is added, resolving MD031, MD014, and MD040.Source: Linters/SAST tools
CONTRIBUTORS.md (1)
10-11: 📐 Maintainability & Code Quality | 🟡 Minor | ⚡ Quick win
Add a blank line after the
Core Teamheading.Insert an empty line between Line 10 and the first list item. The current layout triggers MD022 and can render inconsistently across Markdown tools.
🧰 Tools
🪛 markdownlint-cli2 (0.23.2)
[warning] 10-10: Headings should be surrounded by blank lines
Expected: 1; Actual: 0; Below(MD022, blanks-around-headings)
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@CONTRIBUTORS.md` around lines 10 - 11, Insert a blank line between the “Core Team” heading and its first list item in CONTRIBUTORS.md, preserving the existing heading and contributor entry.Source: Linters/SAST tools
SECURITY.md (2)
1-1: 📐 Maintainability & Code Quality | 🟡 Minor | ⚡ Quick win
Use a top-level title.
Change Line 1 from
## Securityto# Security. The current first line triggers MD041 and leaves the document without a top-level heading.🧰 Tools
🪛 markdownlint-cli2 (0.23.2)
[warning] 1-1: First line in a file should be a top-level heading
(MD041, first-line-heading, first-line-h1)
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@SECURITY.md` at line 1, Update the top-level heading in SECURITY.md from a second-level heading to a first-level heading, changing “## Security” to “# Security” to satisfy MD041.Source: Linters/SAST tools
12-18: 📐 Maintainability & Code Quality | 🟡 Minor | ⚡ Quick win
Use consistent indentation for the nested reporting fields.
Lines 14-18 mix tabs and spaces. Use exactly four spaces before each nested
-under the PGP key bullet at Line 12. Mixed indentation triggers MD005 and can change list nesting.Proposed indentation fix
- - Product/Driver name and version/branch that contains the vulnerability - - Type of vulnerability (code execution, denial of service, buffer overflow, etc.) - - Instructions to reproduce the vulnerability - - Proof-of-concept or exploit code - - Potential impact of the vulnerability, including how an attacker could exploit the vulnerability + - Product/Driver name and version/branch that contains the vulnerability + - Type of vulnerability (code execution, denial of service, buffer overflow, etc.) + - Instructions to reproduce the vulnerability + - Proof-of-concept or exploit code + - Potential impact of the vulnerability, including how an attacker could exploit the vulnerability📝 Committable suggestion
‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.- We encourage you to use the following PGP key for secure email communication: [NVIDIA public PGP Key for communication](https://www.nvidia.com/en-us/security/pgp-key) - Please include the following information: - Product/Driver name and version/branch that contains the vulnerability - Type of vulnerability (code execution, denial of service, buffer overflow, etc.) - Instructions to reproduce the vulnerability - Proof-of-concept or exploit code - Potential impact of the vulnerability, including how an attacker could exploit the vulnerability🧰 Tools
🪛 markdownlint-cli2 (0.23.2)
[warning] 14-14: Inconsistent indentation for list items at the same level
Expected: 4; Actual: 5(MD005, list-indent)
[warning] 15-15: Inconsistent indentation for list items at the same level
Expected: 4; Actual: 5(MD005, list-indent)
[warning] 16-16: Inconsistent indentation for list items at the same level
Expected: 4; Actual: 5(MD005, list-indent)
[warning] 17-17: Inconsistent indentation for list items at the same level
Expected: 4; Actual: 5(MD005, list-indent)
[warning] 18-18: Inconsistent indentation for list items at the same level
Expected: 4; Actual: 5(MD005, list-indent)
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@SECURITY.md` around lines 12 - 18, Normalize indentation in the nested reporting fields under the PGP key bullet, using exactly four spaces before each nested “-” item. Update only the affected list indentation so the reporting content remains at the same nesting level.Source: Linters/SAST tools
2 participants
Summary
cherry pick #56 to release branch
Summary by CodeRabbit
Documentation
Chores