validate-pr: accept context-only cherry-picks

[nirmoy]

Summary

• keep the existing full-context patch-ID check as the fast path
• accept a mismatch only when zero-context patch IDs match and native three-way replay produces exactly the local commit tree
• add black-box regression tests and an unprivileged self-test workflow for github-actions changes

Root cause

NVIDIA/NV-Kernels#476 applies two independent upstream commits that touch adjacent lines. The second local commit therefore has different diff context even though its changed lines are identical to upstream, causing git patch-id --stable to report a mismatch.

The fallback remains fail-closed: changed content, relocation to another occurrence, replay conflicts/errors, malformed Git output, and unequal trees still fail validation.

Validation

• python3 .github/scripts/test_validate_pr.py -v — 8/8 passed
• Python syntax and workflow YAML parsing passed
• exact range daccaf10eb077..50594a932608 passed with:
  • 50594a932608: context
  • ddc654b5fbd0: match
• git diff --check passed
• independent task and whole-branch reviews found no blocking issues

Fork workflow replay

• exact clone: nirmoy/NV-Kernels#20
• workflow run: PR Validation #28458780210
• report: all checks passed
• base/head: daccaf10eb077 / 50594a932608, matching upstream PR [26.04_linux-nvidia] Pull Request - vlan and log fixes to lan743x driver #476
• digest: 50594a932608 = context; ddc654b5fbd0 = match

[nirmoy]

BaseOS Kernel Review

Summary

CI actions in validate-pr-tests.yml are pinned to the floating tag @v6 instead of an immutable SHA, risking execution of injected code if the tag is hijacked. In validate-pr, a bare except in is_context_only_replay silently turns any bug into a spurious MISMATCH with no diagnostics, and an unsanitized object_dir could inject an extra object store via a colon-containing path.

Findings: Critical: 0, High: 1, Medium: 2, Low: 2

Latest watcher review: open review

Generated test plan: open test plan

Kernel deb build: failed (failure log, build artifacts)

Head: 397c7cd7eb85

This comment is maintained by nv-pr-bot. It is updated when the GitHub watcher publishes a newer review.