Add attested provenance workflow for the Gemini Nano demo bundle#9
Conversation
![chatgpt-codex-connector[bot]](https://avatars.githubusercontent.com/in/1144995?s=60&v=4){kind=small}
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 7aeba81f02
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
| chrome-bridge/package.json \ | ||
| chrome-bridge/package-lock.json \ | ||
| chrome-demo/index.html \ | ||
| python-mediapipe/requirements.txt |
There was a problem hiding this comment.
When a change only touches python-mediapipe/run_nano.py, this workflow still runs because python-mediapipe/** is in the path filter, but the archive only includes python-mediapipe/requirements.txt. The bundled README/docs tell users to run python-mediapipe/run_nano.py, so the published and attested demo archive omits the MediaPipe demo code it claims to cover; add run_nano.py or the whole directory to the tarball so those changes are actually shipped and attested.
Useful? React with 👍 / 👎.
Replace brittle pytest collection on the manual smoke script with a real unit suite for alias resolution and model catalog exposure. Align CI and provenance verification so both workflows use the same non-Ollama Python checks.
Update the chrome-bridge CI job to the current setup-node pin already used by the provenance workflow so GitHub stops forcing the deprecated Node 20 action runtime.
Align the CI Python setup step with the current action pin already used in the provenance workflow to remove the remaining deprecated Node 20 runtime warning.
1 participant
Summary
This PR adds a dedicated provenance workflow for
gemini-nanothat validates the existing demo surfaces, builds the docs site, packages a deterministic demo bundle, attests it, verifies the attestation in the same run, and publishes the bundle artifacts.Changes
.github/workflows/provenance.ymlapi-server/server.pyfileWhy
The portfolio provenance ledger currently marks
Coding-Autopilot-System/gemini-nanoasevidence-onlywith no attestation workflow. This PR upgrades one clean repo to real attestation coverage instead of leaving the root ledger to describe future intent.Validation
.github/workflows/provenance.ymlRisks
Related
OgeonX-Ai/cas-workstationReviewer notes
Start with
.github/workflows/provenance.yml. The key review points are the bundle contents, the attestation verification step, and whether the chosen artifact is the right provenance boundary for this repo.