Skip to content

feat(provenance): resolve source git SHA via a validated multi-channel chain - #491

Draft
arekay-nv wants to merge 1 commit into
mainfrom
feat/git-sha-provenance
Draft

arekay-nv wants to merge 1 commit into
mainfrom
feat/git-sha-provenance

Conversation

@arekay-nv

Copy link
Copy Markdown
Collaborator

What & why

Records the endpoints source commit in every run's report, so a
result_summary.json / report.txt is self-describing about which code produced it.

resolve_git_sha() falls through a trust-ranked channel chain, validating each
against a hex-SHA grammar ([0-9a-fA-F]{7,64}, optional -dirty):

Channel Populated by Used in
baked scripts/write_build_info.py → gitignored _build_info.py, packed by uv_build installed wheels
env ENDPOINTS_GIT_SHA (docker --build-argENV) containers
git live git rev-parse (anchored to the package, not cwd) dev checkouts
none nothing resolvable

The SHA gains a -dirty suffix when tracked files are modified (fail-to-dirty on
probe error/timeout). The report now always prints
Git SHA: <sha> (source: <channel>), and git_sha_source is recorded in
result_summary.json.

Changes

  • utils/version.py — validated resolver chain; git repo-location env family
    scrub (GIT_DIR/GIT_WORK_TREE/GIT_INDEX_FILE/…) so a stray GIT_DIR can't
    slip a foreign SHA past the toplevel guard; corrupt-bake tolerance; resolved
    once per report (no lru_cache).
  • metrics/report.py — new required git_sha_source field; unconditional
    Git SHA: display line.
  • scripts/write_build_info.py — build-time generator (toplevel + hex
    validated, own env scrub, atomic write). .dockerignore keeps a stray local
    bake out of images.
  • docs (docs/metrics/*, docs/utils/DESIGN.md) + tests.

Testing

  • Affected unit suites green (version / generator / report-builder); version.py
    at 100% coverage.
  • Reviewed across multiple multi-model rounds (Codex + Cursor/Grok + Claude);
    converged clean.
  • Local pre-commit clean except pre-existing macOS-only mypy sched_setaffinity
    false-positives (unrelated files; green on Linux CI).

Follow-ups (not in this PR)

  • Wire the generator into CI so published wheels carry the baked SHA (today
    it's a manual pre-uv build step; containers use the env channel).
  • Forward the SHA as a --build-arg in the image publish flow (companion to feat :Testing workflow to push images #405).

Notes

  • Report.git_sha_source is a new required struct field; nothing decodes Report
    back from JSON, so there is no wire/back-compat break.

🤖 Generated with Claude Code

…l chain

Record the endpoints source commit in every run's report. resolve_git_sha
falls through baked build-info (wheels) -> ENDPOINTS_GIT_SHA (containers) ->
live git (dev) -> none, validating each channel against a hex-SHA grammar
([0-9a-fA-F]{7,64}, optional -dirty) and appending -dirty for uncommitted
tracked changes. The report now always prints
`Git SHA: <sha> (source: <channel>)` and records git_sha_source in
result_summary.json.

- utils/version.py: _valid_sha grammar on all channels; git-location env
  family scrub (GIT_DIR/GIT_WORK_TREE/GIT_INDEX_FILE/...); fail-to-dirty probe;
  corrupt-bake tolerance; resolved once per report (no lru_cache)
- metrics/report.py: new required git_sha_source field; unconditional Git SHA
  display line
- scripts/write_build_info.py: build-time generator (toplevel + hex validated,
  own env scrub, atomic write); .dockerignore keeps a stray local bake out of
  images; uv_build packs it into wheels
- docs/metrics/*, docs/utils/DESIGN.md: document the field + fallback chain
- tests: version, generator, report serialization

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
@github-actions
github-actions Bot requested a review from nvzhihanj September 1, 2026 02:36
@github-actions

github-actions Bot commented Sep 1, 2026

Copy link
Copy Markdown

MLCommons CLA bot All contributors have signed the MLCommons CLA ✍️ ✅

@github-actions github-actions Bot added the size/normal PR Review Policy: <=500 non-test lines & <=20 files label Sep 1, 2026
Comment on lines +511 to +512
"from inference_endpoint.utils.version import resolve_git_sha;"
"print(resolve_git_sha()[1])",
import sys
from pathlib import Path

import inference_endpoint
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

size/normal PR Review Policy: <=500 non-test lines & <=20 files

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant