Correct the file headers and LICENSE preamble to match the OSS CC-BY-4.0/Apache-2.0
dual-license template (nvidia.atlassian.net OSS page 3151960247):
- File headers now use 'SPDX-License-Identifier: CC-BY-4.0 AND Apache-2.0' (was Apache-2.0)
with SPDX-FileCopyrightText form, across the 7 catalog-owned files.
- LICENSE opens with the prescribed two-line dual-license preamble.
Signed-off-by: mosheabr <257371078+mosheabr@users.noreply.github.com>
Addresses OSS review (Bernd Weber):
- LICENSE: replace CC-BY-4.0 deed with full legal text (all 8 sections); fix copyright entity to NVIDIA CORPORATION & AFFILIATES.
- CONTRIBUTING.md: reproduce full DCO v1.1 text (a-d) in Signing Your Work.
- Add SPDX-License-Identifier headers to 5 catalog-owned scripts (.github/scripts/).
- Fix entity (NVIDIA Corporation -> NVIDIA CORPORATION & AFFILIATES.) in verify_content_integrity.py and generate-skill-metadata.py.
Note: the remaining 14 flagged files live under skills/ (synced from product source repos) and must be fixed at source; routed to owning teams separately.
Signed-off-by: mosheabr <257371078+mosheabr@users.noreply.github.com>
The plugin-versioning-mini-prd.md design doc captured the rollout
decisions and rationale during development, but it's a working
document for the NVIDIA team, not something to land in the upstream
NVIDIA/skills repository. Removing from the branch tree so it doesn't
leak via the PR.
Also drops the three inline "See plugin-versioning-mini-prd.md"
pointers (sync-skills.yml, validate-plugins.yml, version-plugins.py
docstring) and replaces them with self-contained explanations of the
relevant policy:
- version-plugins.py docstring now explicitly states the three
validation rules (monotonic, no pre-release, no oversized major
skip) and points readers at _hash_plugin_tree / _excluded for
the exact hashing rules.
- validate-plugins.yml comment now includes the self-serve fix
command for contributors who hit the policy check
(run --apply --base origin/main locally).
- sync-skills.yml comment now mentions that builders own x bumps
explicitly, so the role split is clear in-place.
After this commit, the branch is self-documenting via code comments
and docstrings; no separate design doc needs to ride along.
Signed-off-by: Jason Dudash <jdudash@nvidia.com>
The earlier policy gated structural changes (skill add/remove, capability
change) on a builder-applied y or x bump, with a separate --auto-structural
escape hatch for machine-driven flows. In practice the strict rule added
friction without adding signal: reviewers see the proposed bump in the
PR diff alongside the change that triggered it, so CI rejecting the PR
for "wrong magnitude" duplicated work the reviewer already does.
Simplifies to:
- content change -> auto z
- structural change -> auto y
- builder set version -> validate (monotonic, no pre-release, no oversized
major skip) and accept; magnitude-vs-change-shape is no longer enforced
- major (x) bumps remain builder-only (encodes a downstream-breaking
claim that automation cannot infer from a diff)
Removes:
- version_policy field (was always 'auto' in practice; 'manual' was
just opt-into-self-flagellation under the new model)
- --auto-structural CLI flag (the strict rule it worked around is gone)
- structural-requires-y/x validation rule
- PluginAnalysis.policy field and related code paths
Smoke-tested against origin/main on the live tree:
content edit -> 1.0.0 -> 1.0.1 (content-only)
skill removal -> 1.0.0 -> 1.1.0 (structural)
builder set 2.0.0 -> accept
builder set 1.0.1 on
a structural change -> accept (would have failed under old policy)
clean tree -> no-op
Net diff: -84 lines across script, workflow, defaults, and PRD.
Signed-off-by: Jason Dudash <jdudash@nvidia.com>
sync-skills.yml: after the existing plugin rebuild, run
version-plugins.sh --apply --auto-structural --base HEAD. This auto-
bumps any plugin whose curated content moved during the sync, including
the structural cases (compliance-driven skill drops, upstream renames)
that would otherwise have no human to make the decision.
validate-plugins.yml: add a read-only --check step after the existing
drift guard, and fetch-depth: 0 so git worktree can materialize the PR
base. Contributor PRs that change plugin payloads without a version
bump now fail loudly with an actionable message.
--auto-structural is a new flag on version-plugins.py that downgrades
structural-without-builder-bump from a failure to a y-bump. Off by
default; only sync uses it. PRD updated to document the rationale.
Signed-off-by: Jason Dudash <jdudash@nvidia.com>
Adds an independent-SemVer-per-plugin policy: builders own x.y, automation
owns z. New .github/scripts/version-plugins.py compares head against a
base ref, classifies the change (none / content / structural), validates
builder-set versions, and auto-bumps z under version_policy: auto. Writes
back to plugins.d/<name>.yml via ruamel.yaml so the diff is one quoted
line and comments + key order survive.
plugin-versioning-mini-prd.md captures the design (ownership, validation
rules, payload-hash spec, CI writeback mechanism).
_defaults.yml grows version_policy: auto so every catalog plugin opts in
by default; override per-plugin to manual when needed.
Signed-off-by: Jason Dudash <jdudash@nvidia.com>
mosheabr