Skip to content

chore(skills): refresh catalog export#4344

Open
github-actions[bot] wants to merge 1 commit into
mainfrom
automation/catalog-skills-refresh
Open

chore(skills): refresh catalog export#4344
github-actions[bot] wants to merge 1 commit into
mainfrom
automation/catalog-skills-refresh

Conversation

@github-actions
Copy link
Copy Markdown
Contributor

Catalog Skills Refresh

Summary

  • Regenerates skills/ from .agents/catalog-skills.yaml and .agents/skills/.
  • Keeps the NVIDIA Verified Skills catalog export deterministic and reviewable.

Validation

  • python3 scripts/export-catalog-skills.py --check

After maintainer review, request signing by commenting /nvskills-ci on this PR if the workflow did not do so automatically.

@github-actions github-actions Bot added documentation Improvements or additions to documentation CI/CD Use this label to identify issues with NemoClaw CI/CD pipeline or GitHub Actions. labels May 27, 2026
@copy-pr-bot
Copy link
Copy Markdown

copy-pr-bot Bot commented May 27, 2026

This pull request requires additional validation before any workflows can run on NVIDIA's runners.

Pull request vetters can view their responsibilities here.

Contributors can view more details about this message here.

@jyaunches
Copy link
Copy Markdown
Contributor

/nvskills-ci

jyaunches added a commit that referenced this pull request May 27, 2026
<!-- markdownlint-disable MD041 -->
## Summary

Install the NVSkills CI request listener so `/nvskills-ci` comments on
catalog refresh PRs actually trigger NVSkills signing. Without this
listener, comments are no-ops and merged refresh PRs ship unsigned
(which downstream `NVIDIA/skills` then drops on sync).

## Related Issue

Follow-up to #4282 / #4342. Discovered while running the post-merge
signing flow on PR #4344: the `/nvskills-ci` comment posted on that PR
produced no workflow run because NemoClaw was missing the team-request
listener.

## Changes

- **`.github/workflows/request-nvskills-ci.yml`** (new): copied
byte-for-byte from
`NVIDIA/nvskills-ci/templates/team-request-workflow.yml@main`, with a
NemoClaw SPDX header. Forwards `/nvskills-ci` PR comments (and
`nv-skills-ci[bot]` signature pushes) to
`NVIDIA/skills/.github/workflows/team-request.yml@main` via
`secrets.NVSKILLS_CI_DISPATCH_TOKEN`.
- **`.github/CODEOWNERS`**: add an explicit nemoclaw-maintainer rule for
`/.github/workflows/request-nvskills-ci.yml` so onboarding step 4
(CODEOWNERS protection) is visibly enforced; also flatten the now-stale
`/skills/nemoclaw/` rule to `/skills/` to match the post-#4342 export
layout.

## Onboarding status

Per
[`NVIDIA/nvskills-ci/docs/team-onboarding.md`](https://github.com/NVIDIA/nvskills-ci/blob/main/docs/team-onboarding.md):

| Step | What | Status |
|---|---|---|
| 1 | Add NemoClaw to `config/onboarded-repositories.json` | ✅ already
done |
| 2 | Install `templates/team-request-workflow.yml` as
`.github/workflows/request-nvskills-ci.yml` | ✅ this PR |
| 3 | Set `NVSKILLS_CI_DISPATCH_TOKEN` repo secret | ⚠️ **manual
maintainer/admin action required after merge** |
| 4 | CODEOWNERS-protect the new workflow file | ✅ this PR |
| 5 | Test by commenting `/nvskills-ci` on a PR | 🟡 unblocked once step
3 lands |

## Type of Change

- [x] Code change (feature, bug fix, or refactor)
- [ ] Code change with doc updates
- [ ] Doc only (prose changes, no code sample modifications)
- [ ] Doc only (includes code sample changes)

## Verification

- Workflow body verified byte-identical to upstream template:

  ```
  $ diff <(tail -n +13 .github/workflows/request-nvskills-ci.yml) \
         ~/Development/nvskills-ci/templates/team-request-workflow.yml
  (no output — identical)
  ```

- Listener is inert until the `NVSKILLS_CI_DISPATCH_TOKEN` secret is
set; until then `/nvskills-ci` comments will fail at the
secret-injection boundary, but they will at least produce a visible
failed workflow run instead of silently doing nothing.

- [x] No secrets, API keys, or credentials committed
- [x] Tests added or updated for new or changed behavior — N/A (single
workflow file mirrored from upstream template; behavior is exercised by
the next live `/nvskills-ci` comment)
- [ ] Docs updated for user-facing behavior changes — N/A (CI-internal)
- [ ] `npm run docs` builds without warnings — N/A
- [ ] Doc pages follow the style guide — N/A
- [ ] New doc pages include SPDX header and frontmatter — N/A

---
Signed-off-by: Justin Yaunches <jyaunches@nvidia.com>


<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit

* **Chores**
* Updated repository ownership mappings to reorganize responsibility for
the skills subtree and simplify maintainer coverage.
* Added a workflow to request NVSkills validation/signature runs: can be
triggered by a specially formatted issue comment or by specific commit
pushes from the CI signature actor, and securely forwards the dispatch
token to the centralized validation workflow.

<!-- review_stack_entry_start -->

[![Review Change
Stack](https://storage.googleapis.com/coderabbit_public_assets/review-stack-in-coderabbit-ui.svg)](https://app.coderabbit.ai/change-stack/NVIDIA/NemoClaw/pull/4345?utm_source=github_walkthrough&utm_medium=github&utm_campaign=change_stack)

<!-- review_stack_entry_end -->
<!-- end of auto-generated comment: release notes by coderabbit.ai -->

---------

Signed-off-by: Julie Yaunches <jyaunches@nvidia.com>
Co-authored-by: Carlos Villela <cvillela@nvidia.com>
@jyaunches
Copy link
Copy Markdown
Contributor

/nvskills-ci

5 similar comments
@jyaunches
Copy link
Copy Markdown
Contributor

/nvskills-ci

@jyaunches
Copy link
Copy Markdown
Contributor

/nvskills-ci

@jyaunches
Copy link
Copy Markdown
Contributor

/nvskills-ci

@jyaunches
Copy link
Copy Markdown
Contributor

/nvskills-ci

@jyaunches
Copy link
Copy Markdown
Contributor

/nvskills-ci

@jyaunches
Copy link
Copy Markdown
Contributor

NVCARPS validation results

/nvskills-ci dispatched successfully and the downstream NVCARPS pipeline completed, but validate:content failed so sign:attach-signatures-to-upstream was skipped — no signature artifacts were pushed to this branch.

Pipeline: 52849759 · Failed job: validate:content #327846904 · Per-skill reports: validation-reports/ · GitHub run: 26544745156

Per-skill outcome (11/11 failed)

Skill Crit High Med Low Issues Blocking validators
nemoclaw-skills-guide 2 0 5 7 14 LICENSE
nemoclaw-user-agent-skills 1 1 6 7 15 LICENSE, Context Deduplication
nemoclaw-user-configure-inference 1 3 8 4 16 LICENSE, QUALITY, Context Deduplication
nemoclaw-user-configure-security 1 1 6 8 16 LICENSE, Context Deduplication
nemoclaw-user-deploy-remote 1 2 5 6 14 LICENSE, Context Deduplication
nemoclaw-user-get-started 1 2 5 5 13 LICENSE, QUALITY, Context Deduplication
nemoclaw-user-manage-policy 1 2 7 4 14 LICENSE, Context Deduplication
nemoclaw-user-manage-sandboxes 1 1 5 6 13 LICENSE, Context Deduplication
nemoclaw-user-monitor-sandbox 1 0 5 4 10 LICENSE
nemoclaw-user-overview 1 1 6 7 15 LICENSE, Context Deduplication
nemoclaw-user-reference 1 5 7 6 19 SECURITY, LICENSE, Context Deduplication

Blocking finding categories

Validator / check Severity Affected Fix
LICENSE frontmatter_license_missing critical all 11 Add license: Apache-2.0 to each SKILL.md frontmatter
Context Deduplication duplicate (SPDX preamble across files) high 9 False-positive per the validator's own suggestion: "license headers are required in each file by policy and cannot be removed; exclude pure license/copyright preamble from semantic overlap analysis." No source-side action — the validator should filter SPDX blocks.
Context Deduplication duplicate (real content) high 1 (nemoclaw-user-reference) references/commands.md: dedup the two nemoclaw <name> exec sections (lines 328-347 vs 432-447); differentiate or merge "Onboarding Configuration" (1242-1243) vs "Onboarding Behavior Flags" (1285)
SECURITY External Script Fetching (SC2) high 1 (nemoclaw-user-reference) references/troubleshooting.md:90 and :479 use curl -fsSL https://www.nvidia.com/nemoclaw.sh | bash. Add SHA-256 checksum verification or rewrite as inspect-then-run.
QUALITY quality_efficiency high 2 nemoclaw-user-configure-inference (6281 tokens, max 5000) and nemoclaw-user-get-started (5083 tokens). Move detail from SKILL.md into existing references/ subdir.

Recommended fix order

  1. License frontmatter — mechanical: add license: Apache-2.0 to all 11 source .agents/skills/nemoclaw-user-*/SKILL.md (and nemoclaw-skills-guide/SKILL.md), re-run python3 scripts/export-catalog-skills.py, push to this branch. Clears 11 of 11 critical blockers.
  2. Real duplicates in nemoclaw-user-reference/references/commands.md.
  3. Two curl | bash instances in nemoclaw-user-reference/references/troubleshooting.md (lines 90, 479).
  4. Trim two oversize SKILL.md — split into references/ per validator suggestion.

After (1)–(4) land on automation/catalog-skills-refresh, re-comment /nvskills-ci to re-run validation; if the report turns clean, sign:attach-signatures-to-upstream will execute and push skill.oms.sig + skill-card.md back here.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

CI/CD Use this label to identify issues with NemoClaw CI/CD pipeline or GitHub Actions. documentation Improvements or additions to documentation

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant