From 9c3b2e34cf7511f899b997fb8374add1c4467ecc Mon Sep 17 00:00:00 2001 From: aliencaocao <20109683+aliencaocao@users.noreply.github.com> Date: Mon, 26 Oct 2026 09:46:58 +0000 Subject: [PATCH] test(audit): read the NVIDIA driver fixture from the minimum table The security policy helper hardcoded driver 580.159.03. NVIDIA bulletin 5861 raised the 580 floor to 580.178.04, so the refresh job's offline tests failed and the refresh PR was never opened. Default the driver to the table's 580-branch minimum, as runc and docker already do. --- tests/audit/test_audit_common.py | 17 ++++++++++++++--- 1 file changed, 14 insertions(+), 3 deletions(-) diff --git a/tests/audit/test_audit_common.py b/tests/audit/test_audit_common.py index c43ed2d..632969f 100644 --- a/tests/audit/test_audit_common.py +++ b/tests/audit/test_audit_common.py @@ -1023,11 +1023,22 @@ def test_enroot_import_without_timeout_receives_worker_scratch_and_status(self) class ContainerWorkerCheckTests(unittest.TestCase): - def security_policy(self, check: str, *, runc: str = "1.3.3", docker: str = "29.4.3") -> dict: + def security_policy( + self, + check: str, + *, + driver: str | None = None, + runc: str = "1.3.3", + docker: str = "29.4.3", + ) -> dict: + # Read the driver from the minimum table so a refreshed NVIDIA + # bulletin does not leave this fixture below the new floor. + if driver is None: + driver = minimum_versions.get("components.nvidiaDriver.branches")["580"] run = bashtest.run_bash( f'source "{COMMON_PATH}"; WORKLOAD_DIR="{AUDIT_SCRIPTS}"; ' - 'build_security_version_audit "$CHECK" 580.159.03 1.19.1 "$RUNC" "$DOCKER"', - env={"CHECK": check, "RUNC": runc, "DOCKER": docker}, + 'build_security_version_audit "$CHECK" "$DRIVER" 1.19.1 "$RUNC" "$DOCKER"', + env={"CHECK": check, "DRIVER": driver, "RUNC": runc, "DOCKER": docker}, ) self.assertEqual(run.returncode, 0, run.stderr) return json.loads(run.stdout)