CI: run the Windows runner trust probe under Windows PowerShell 5.1 by juenglin · Pull Request #3340 · NVIDIA/cuda-python

juenglin · 2026-11-03T16:54:03Z

Description

pwsh is not installed on every Windows runner label, but Windows PowerShell (powershell) is. This switches the Windows step of the runner trust probe to shell: powershell and makes the scripts it runs compatible with both Windows PowerShell 5.1 and PowerShell 7+.

.github/workflows/runner-trust-probe.yml: the Windows probe step uses shell: powershell.
.github/actions/upgrade-ca-certificates/emudhra_intermediates.ps1 (shared helper): certificates are built from the decoded PEM body instead of X509Certificate2.CreateFromPem (.NET 5+ only), SHA-256 is computed from RawData via a new Get-CertificateSha256 instead of GetCertHashString('SHA256'), and ChainPolicy.DisableCertificateDownloads is only set when the property exists.
ci/tools/runner_trust_probe.ps1: Invoke-WebRequest -SkipHttpErrorCheck (PowerShell 7+ only) is dropped, and any HTTP response, including an error status, is reported as a successful connection (FAIL). The step summary is appended as BOM-less UTF-8 because -Encoding utf8 writes a BOM on 5.1.

Behavior on PowerShell 7+ is unchanged. The upgrade-ca-certificates action still runs under pwsh and dot-sources the same helper, which now works on either shell.

Known limitation: on 5.1, a TrustFailure WebException does not distinguish a chain failure from a hostname mismatch, so a hostname-only failure would be reported as PASS rather than FAIL. Capturing the TLS policy errors would need a compiled validation callback, which is left out of this change. This only matters if the test endpoints' certificates stop matching their hostnames.

Checklist

I have read the Contributing Guidelines.
New or existing tests cover these changes.
The documentation is up to date with these changes.

pwsh is not installed on every Windows runner label, while Windows PowerShell (powershell) is. Switch the probe step to `shell: powershell` and make the probe script and the shared eMudhra helper compatible with both Windows PowerShell 5.1 and PowerShell 7+: - Build certificates from the PEM body instead of CreateFromPem (.NET 5+). - Compute SHA-256 from RawData instead of GetCertHashString('SHA256'). - Set ChainPolicy.DisableCertificateDownloads only when it exists. - Drop Invoke-WebRequest -SkipHttpErrorCheck and treat any HTTP response as a successful connection. - Append the step summary as BOM-less UTF-8.

copy-pr-bot · 2026-11-03T16:54:09Z

This pull request requires additional validation before any workflows can run on NVIDIA's runners.

Pull request vetters can view their responsibilities here.

Contributors can view more details about this message here.

juenglin · 2026-11-03T16:56:54Z

/ok to test 84edc69

juenglin · 2026-11-03T17:08:13Z

/ok to test aa052a7

coderabbitai · 2026-11-03T17:31:07Z

Summary

Summary by CodeRabbit

Bug Fixes
- Improved certificate validation and trust-store checks on Windows across PowerShell 5.1 and PowerShell 7+.
- Windows trust probes now handle HTTP certificate errors consistently and generate summaries with reliable UTF-8 encoding.
- Certificate chain checks work with both .NET Framework and newer .NET versions.
- Improved compatibility across supported PowerShell versions helps certificate checks run consistently on Windows.

The certificate update script and trust-store probe change certificate handling and endpoint checks for Windows PowerShell compatibility. The workflow now selects Windows PowerShell for the trust-store probe.

Changes: Windows PowerShell compatibility

Layer / File(s)	Summary
Certificate loading and chain validation `.github/actions/upgrade-ca-certificates/emudhra_intermediates.ps1`	Certificate loading enumerates JSON entries across PowerShell versions, decodes PEM data without `CreateFromPem`, and validates DER SHA-256 digests. Chain certificate downloads are disabled only when the policy supports that property.
Trust probe and workflow invocation `.github/workflows/runner-trust-probe.yml`, `ci/tools/runner_trust_probe.ps1`	The workflow step selects `powershell`. The probe writes BOM-less UTF-8 summaries, compares certificates using `Get-CertificateSha256`, and handles HTTP responses without `-SkipHttpErrorCheck`.

Change: Bug fix

Merge Risk: Moderate · up to deb1b

The probe can produce incorrect trust decisions for proxy failures or network-fetched certificate chains, so these issues should be resolved before merging.

- [ ] Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Tip

🎯 Customize your risk assessments

Guide how CodeRabbit assesses merge risk and security architecture risk. Highlight sensitive changes and explain your security boundaries using Merge Risk Instructions and Security Risk Instructions in your review settings. Security architecture risk assessments require the Advanced plan or above.

✅ Automatic approvals, with your rules

Let CodeRabbit approve pull requests once required threads are resolved, pre-merge checks pass, and your risk limits are met. Enable Automatic approvals in review settings, with overrides for teams or file paths.

CodeRabbit Verify

Run CodeRabbit Verify to test the changes in this pull request.

github-actions · 2026-11-03T17:32:21Z

Doc Preview CI
Preview removed because the pull request was closed or merged.

…st probe

juenglin · 2026-11-03T17:40:21Z

/ok to test deb1b4a

coderabbitai

Follow-up Comments

important: Classify proxy responses separately from target responses.

77-79: Minor · Functional Correctness · Quick win

important: Classify proxy responses separately from target responses.

When Invoke-WebRequest uses a system proxy, a failed HTTPS CONNECT, such as HTTP 407, can return a non-null Exception.Response before the target certificate is checked. This branch then reports certificate was trusted and fails the probe for a proxy failure. Distinguish proxy responses from target responses, or classify proxy-only failures as INCONCLUSIVE.

Open the source location

Review info

Run configuration

Source mode: Auto

Repository: NVIDIA/cuda-python

Branch: main

File: .coderabbit.yaml

Commit: 0d3cc26

Layers: Repository YAML

Review profile: CHILL

Plan: Enterprise

Run ID: `07bac830-b58d-49c5-8190-6eb6f49aa650`

Commits

Reviewing files that changed from the base of the PR and between `aa052a7` and `deb1b4a`.

Files selected for processing: 1

`ci/tools/runner_trust_probe.ps1`

Included review availability: This review used your included allowance. Your plan provides up to 12 included reviews per hour; 10 remain after this review.

rwgk

Known limitation: on 5.1, a TrustFailure WebException does not distinguish ...

That looks like a reasonable compromise to me.

codex GPT-6.1-Sol ultra (with small edits):

[P3] Proxy rejection can cause a false failure — runner_trust_probe.ps1:77–80: On 5.1, a proxy’s 407 rejection can populate Exception.Response before target TLS, causing “certificate was trusted” and a failed probe. This confirms CodeRabbit’s remaining concern; classify proxy failures as INCONCLUSIVE. See .NET’s CONNECT handling.

Regarding the known limitation explained in the PR description: The independent gating check still verifies explicit distrust of all 16 compromised certificates, so the hostname ambiguity is an acceptable compromise.

Removed preview folders for the following PRs: - PR #3324 - PR #3334 - PR #3339 - PR #3340 - PR #3346 - PR #3347 - PR #3348

juenglin added this to the cuda.bindings next milestone Nov 3, 2026

juenglin added the CI/CD CI/CD infrastructure label Nov 3, 2026

juenglin self-assigned this Nov 3, 2026

juenglin added the github_actions Pull requests that update GitHub Actions code label Nov 3, 2026

CI: enumerate ConvertFrom-Json arrays on Windows PowerShell 5.1

aa052a7

juenglin requested review from jpascucci-nv and rwgk November 3, 2026 17:21

juenglin marked this pull request as ready for review November 3, 2026 17:21

jpascucci-nv approved these changes Nov 3, 2026

View reviewed changes

coderabbitai Bot reviewed Nov 3, 2026

View reviewed changes

Comment thread ci/tools/runner_trust_probe.ps1 Resolved

CI: drop the broad 'remote certificate is invalid' match from the tru…

deb1b4a

…st probe

coderabbitai Bot reviewed Nov 3, 2026

View reviewed changes

rwgk approved these changes Nov 3, 2026

View reviewed changes

juenglin enabled auto-merge (squash) November 3, 2026 19:12

juenglin merged commit 7602af8 into NVIDIA:main Nov 3, 2026
252 of 260 checks passed

github-actions Bot pushed a commit that referenced this pull request Nov 4, 2026

Clean up PR preview folders for 7 closed/merged PRs

c65e763

Removed preview folders for the following PRs: - PR #3324 - PR #3334 - PR #3339 - PR #3340 - PR #3346 - PR #3347 - PR #3348

Navigation Menu

Repository navigation

CI: run the Windows runner trust probe under Windows PowerShell 5.1 - #3340

CI: run the Windows runner trust probe under Windows PowerShell 5.1#3340
juenglin merged 3 commits into
NVIDIA:mainfrom
juenglin:windows-trust-probe-powershell-5.1

juenglin commented Nov 3, 2026 •

edited

Loading

Uh oh!

copy-pr-bot Bot commented Nov 3, 2026

Uh oh!

juenglin commented Nov 3, 2026

Uh oh!

juenglin commented Nov 3, 2026

Uh oh!

coderabbitai Bot commented Nov 3, 2026 •

edited

Loading

Summary by CodeRabbit

Uh oh!

Uh oh!

github-actions Bot commented Nov 3, 2026 •

edited

Loading

Uh oh!

juenglin commented Nov 3, 2026

Uh oh!

coderabbitai Bot left a comment

Uh oh!

rwgk left a comment

Uh oh!

Uh oh!

Reviewers

Uh oh!

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

Conversation

juenglin commented Nov 3, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Description

Checklist

Uh oh!

copy-pr-bot Bot commented Nov 3, 2026

Uh oh!

juenglin commented Nov 3, 2026

Uh oh!

juenglin commented Nov 3, 2026

Uh oh!

coderabbitai Bot commented Nov 3, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Summary by CodeRabbit

CodeRabbit Verify

Uh oh!

Uh oh!

github-actions Bot commented Nov 3, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

juenglin commented Nov 3, 2026

Uh oh!

coderabbitai Bot left a comment

Choose a reason for hiding this comment

Follow-up Comments

Uh oh!

rwgk left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Reviewers

Uh oh!

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

juenglin commented Nov 3, 2026 •

edited

Loading

coderabbitai Bot commented Nov 3, 2026 •

edited

Loading

github-actions Bot commented Nov 3, 2026 •

edited

Loading