[Vedaant-J]

Summary

This PR gives pull requests from forks the CI jobs that need cloud credentials. It reuses copy-pr-bot's existing pull-request/<number> branches: once a vetter approves a fork's commit, the Testing, Databricks, Snowflake, GCS and Kumo Installation workflows run on that copy with credentials, and the fork's own pull_request run skips those jobs instead of failing.

Problem. A fork pull request (#117, #122, #123) leaves reviewers unable to answer:

• Did the core pytest matrix pass on this change, or did it never run?
• Did the Snowflake, Databricks, GCS/BigQuery and S3-backed DiskGraph end-to-end tests pass?
• 52 jobs are red. Is any of them caused by the pull request?
• How do we get real results without reopening the change from an NVIDIA branch?

Today none of these can be answered. On #123, 52 jobs fail at "Configure AWS credentials" before any test starts, and 40 of them also fail at "Upload coverage artifact".

Cause. These jobs get AWS credentials through GitHub OIDC: configure-aws-credentials with role-to-assume, id-token: write and a job environment:. Their tests then read test data from S3 and test-account credentials from Secrets Manager. For a pull_request run from a fork, GitHub passes no repository, organization or environment secrets, makes GITHUB_TOKEN read-only, and issues no OIDC token. The fork job's log shows Secret source: None and the action's "Did you mean to set the id-token permission?" warning. A same-repo job shows Secret source: Actions. The settings that send secrets or write tokens to fork pull requests exist only for private repositories; this repository is public, so no setting changes this.

copy-pr-bot already has the trusted path. A vetter comments /ok to test <SHA>, the bot pushes that commit to pull-request/<number> in this repository, and pushes there run with credentials. Their checks attach to the same commit, so they show on the pull request. Before this PR only Kumo Core GPU and Test backend images listened on those branches:

fork pull_request run      -> every job; credentialed ones fail at "Configure AWS credentials"
push pull-request/<number> -> Kumo Core GPU, Test backend images

Change.

fork pull_request run      -> jobs that need no credentials; credentialed jobs skipped
push pull-request/<number> -> Kumo Core GPU, Test backend images, and
                              (fork pull requests only) the credentialed jobs of
                              Testing, Databricks, Snowflake, GCS, Kumo Installation

• _credentials-gate.yml (new, reusable). Each of the five workflows calls it as a credentials job. Its credentialed jobs need it and run only when run is 'true':

  Event	run	base
  pull_request from this repository	true	empty
  pull_request from a fork	false	empty
  push to pull-request/<number>, fork pull request	true	the pull request's merge base
  push to pull-request/<number>, same-repo pull request	false (it already ran on pull_request)	the merge base
  push to main, merge_group, workflow_dispatch, workflow_call	true	empty

  On pull-request/<number> it reads the pull request the way Test backend images does (${GITHUB_REF_NAME#pull-request/} and gh api), plus the compare API for the merge base.

• Change filters diff against the merge base. Each credentialed job fetches base (git fetch --depth=1) and passes it to tj-actions/changed-files as base_sha. A push diff would otherwise compare against the previously synced commit, or the parent commit for a new branch. With base empty on every other event, the filters behave exactly as before.

• Only pushes to main run the full suite. RUN_FULL_TEST (Testing, Databricks) and Snowflake's minimal/full conditions checked github.event_name == 'push'; they now also check github.ref == 'refs/heads/main', so a pull-request/<number> copy runs the minimal suite like its pull_request run would.

• Testing's jobs that need no credentials skip on pull-request/<number> (diskgraph-rust, diskgraph-clippy, diskgraph-python, pyarrow-range, packages, pql-public): they already ran on pull_request. diskgraph-wheel runs there only when pytest will.

• Check OpenAPI Changes skips on fork pull requests. It is built around the pull_request event (path filter, head checkout, PR comment), so it gets no push path here.

• Coverage upload runs only when its artifact name was set. After an earlier failure it used to fail a second time with "Input required and not supplied: path".

Back-compat and security

Same-repo pull requests, pushes to main, merge queues and manual runs keep their jobs and suites; they wait for one short gate job first.

Trigger	Before	After	Who can run code with credentials
Same-repo pull_request	All jobs	Unchanged	Unchanged: members with write access
Fork pull_request	Credentialed jobs fail red	Skipped; jobs without credentials unchanged	Nobody (no secrets or OIDC on this event, as before)
Push to pull-request/<number>, fork	GPU and ARM image jobs only	Plus the credentialed jobs, minimal suite, change filters against the merge base	Code a vetter approved by SHA with /ok to test. Each new commit needs a new approval.
Push to pull-request/<number>, same repo	GPU and ARM image jobs only	Unchanged; the five workflows run only the gate	Unchanged
Push to main	Full suite	Unchanged	Unchanged
merge_group, workflow_dispatch, weekly durations (workflow_call)	—	Unchanged	Unchanged

What a vetter now approves. A pull-request/<number> run uses the workflow files and code at the approved commit, with the CI test role, its Secrets Manager test credentials and the repository secrets. This is the same trust model copy-pr-bot already uses for NVIDIA's GPU runners, now covering credentials too. Before commenting /ok to test, read the whole diff, including .github/, conftest.py, build scripts and uv.lock. Approval is pinned to a SHA, so a later push cannot ride on an earlier approval. No repository or IAM setting changes: the role trusts this repository's environments, whatever the branch.

Known limitations

• A pull-request/<number> run uses the workflows at the pull request's head, so a fork pull request gets the new jobs only after it merges a main that contains this change.
• The copy tests the pull request's head, not its merge with main as pull_request does (same as Kumo Core GPU).
• The push triggers keep their paths-ignore, so a vetted update that only touches ui/** or tools/** gets no new run of these workflows. The earlier results still cover the unchanged code.
• An older pull-request/<number> run is not cancelled when a newer commit is approved (concurrency groups unchanged).
• The weekly durations run (store-durations-weekly.yml, which calls testing.yml) has failed at startup on every run since at least 10-11. Whoever fixes it must also grant the gate's pull-requests: read in that caller.

Testing Done

• actionlint 1.7.12 with shellcheck on all 7 files: no new findings (the same 22 as main, all on unchanged lines); the new gate workflow is clean.
• yamllint -c .yamllint.yml: 0 errors; 54 warnings, the same as main.
• pre-commit end-of-file-fixer, trailing-whitespace, check-yaml, yamllint, license-headers: passed.
• .github/scripts/workflow-security.cjs and its tests: passed, 0 new findings.
• Gate logic run against the live API: Add index clocks from nanoseconds to days #123 resolves to alan-kumo/kumo-engine (fork, run=true), Run eight candidate-wheel RTX task checks on code PRs #135 to this repository (run=false); both give merge base ce6acc69.
• Change filter: in a depth-5 clone of Add index clocks from nanoseconds to days #123's head that lacks the merge base, git fetch --depth=1 origin <base> followed by git diff --name-only <base>..HEAD lists exactly the 94 files the pull request's files API returns.
• Not yet run on GitHub. This pull request's own runs will exercise the same-repo cases: unchanged pull_request jobs, and a pull-request/<number> copy that runs only the gate. Add index clocks from nanoseconds to days #123 will be the first fork case, once it merges main and a vetter approves it.

Checklist

• No secrets, account identifiers or internal names in the diff or text
• Lint and the workflow security policy pass

Change map: see the kumo-pr-change-map comment.

🤖 Generated with Claude Code

[Vedaant-J]

Change map

File	Function / scope	What changed	Why
.github/workflows/_credentials-gate.yml	New reusable workflow, job gate	Outputs run (whether to run the credentialed jobs) and base (the pull request's merge base on pull-request/<number> pushes); reads the pull request with gh api like testing_arm_images.yml	One place decides fork vs same-repo for every event, so the five workflows share one job-level if:
.github/workflows/testing.yml	on.push, env.RUN_FULL_TEST, jobs credentials, diskgraph-wheel, pytest	Push trigger on pull-request/[0-9]+; full suite only on pushes to main; pytest gated on the gate; merge-base fetch and base_sha for its change filter; diskgraph-wheel runs on copies only when pytest will	Fork commits approved by a vetter run the credentialed pytest matrix on their PR's changes
.github/workflows/testing.yml	Jobs diskgraph-rust, diskgraph-clippy, diskgraph-python, pyarrow-range, packages, pql-public	Skip on pull-request/<number> pushes	They need no credentials and already ran on pull_request
.github/workflows/testing.yml	pytest step "Upload coverage artifact"	Runs only when ARTIFACT_NAME_SAFE is set	After an earlier failure it failed again with an empty path
.github/workflows/testing_databricks.yml	on.push, env.RUN_FULL_TEST, jobs credentials, pytest, step "Upload coverage artifact"	Same trigger, gate, merge-base change filter, full-suite and coverage changes as testing.yml	Same as above
.github/workflows/testing_snowflake.yml	on.push, jobs credentials, pytest ("Run minimal/full test suite" conditions)	Trigger, gate, merge-base change filter; minimal vs full now keyed on pushes to main	Same as above
.github/workflows/testing_gcs.yml	on.push, jobs credentials, pytest-gcs	Trigger, gate, merge-base change filter	Same as above
.github/workflows/install.yml	on.push, jobs credentials, import	Trigger, gate, merge-base change filter	Same as above
.github/workflows/ui-client-code-generate.yml	Job check-openapi-changes	Skips on fork pull requests	A fork's pull_request run has no OIDC token; the job has no push path

[copy-pr-bot]

This pull request requires additional validation before any workflows can run on NVIDIA's runners.

Pull request vetters can view their responsibilities here.

Contributors can view more details about this message here.

[coderabbitai]

No actionable comments were generated in the recent review.

Recent review info

Run configuration

• Source mode: Auto
• Repository: NVIDIA/kumo-engine
• Branch: vedaant/fork-pr-ci
• File: .coderabbit.yaml
• Commit: 3411cb2
• Layers: Repository YAML
• Review profile: QUIET
• Plan: Enterprise
• Run ID: c7628b44-4ae4-40b0-93cf-8b48793dfe94

Commits

Reviewing files that changed from the base of the PR and between f06a779 and 3411cb2.

Files selected for processing: 7

• .github/workflows/_credentials-gate.yml
• .github/workflows/install.yml
• .github/workflows/testing.yml
• .github/workflows/testing_databricks.yml
• .github/workflows/testing_gcs.yml
• .github/workflows/testing_snowflake.yml
• .github/workflows/ui-client-code-generate.yml

Included review availability: This review used your included allowance. Your plan provides up to 12 included reviews per hour; 11 remain after this review.

Walkthrough

The workflows add a reusable credentials gate and include pull-request/<number> branches in their push triggers. Credentialed jobs use the gate’s run output, and changed-file checks use its merge-base output when available. Several test workflows also adjust suite selection, job conditions, and coverage artifact upload conditions. The OpenAPI change-check job now runs only for pull requests from the same repository.

Priority: Normal

Merge Risk: Minimal · up to 3411c

No confirmed issue prevents merging, though the new fork and copy-branch workflow paths have not yet run on GitHub.

Pre-merge checks: 2 · 1

Failed checks: 1 inconclusive

Check name	Status	Explanation	Resolution
Change Map Design Review		The required PR conversation comment beginning with <!-- kumo-pr-change-map --> is not available in the supplied review context or repository checkout. The PR description is explicitly truncated, an…	Provide the complete authorized PR conversation comment beginning with <!-- kumo-pr-change-map -->, including its Change map and the required observed failure or release requirement, existing behavior, smallest sufficient change, focused …

Passed checks: 2 passed

Check name	Status	Explanation
Pr Size		The pull request changes 7 files. The limit is 40 files, so the check passes.
Public Resource Access		No added or modified inaccessible resource reference was found. The new gh api references in .github/workflows/_credentials-gate.yml:49-54 target the public NVIDIA/kumo-engine repository API; an…

Full details: Public Resource Access

Explanation

No added or modified inaccessible resource reference was found. The new gh api references in .github/workflows/_credentials-gate.yml:49-54 target the public NVIDIA/kumo-engine repository API; anonymous requests to the repository, pull request, and compare endpoints returned HTTP 200. The new reusable workflow references are local, and existing external action references were unchanged.

Full details: Change Map Design Review

Explanation

The required PR conversation comment beginning with <!-- kumo-pr-change-map --> is not available in the supplied review context or repository checkout. The PR description is explicitly truncated, and the available objectives only summarize the map; they do not provide its exact necessity, abstraction-layer, verification, or stopping-condition claims. The diff is available (152 additions/deletions across seven workflow files), but without the proposed Change map this check cannot assess whether each change is necessary or correctly designed.

Resolution

Provide the complete authorized PR conversation comment beginning with <!-- kumo-pr-change-map -->, including its Change map and the required observed failure or release requirement, existing behavior, smallest sufficient change, focused verification, and stopping condition. Then reassess the design against the reviewed diff.

Finishing Touches: 💡 1

🛠️ Fix failing CI checks: 💡

• Commit to this branch
• Create a new PR

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

_{Comment @coderabbitai help to get the list of available commands.}