pytest-gpu-proof 0.1.0__tar.gz

pytest_gpu_proof-0.1.0/.github/workflows/ci.yml

@@ -0,0 +1,27 @@
+name: CI
+
+on:
+  push:
+    branches: [main]
+  pull_request:
+
+jobs:
+  test:
+    runs-on: ubuntu-latest
+    strategy:
+      fail-fast: false
+      matrix:
+        python-version: ["3.11", "3.12"]
+
+    steps:
+      - uses: actions/checkout@v4
+
+      - uses: actions/setup-python@v5
+        with:
+          python-version: ${{ matrix.python-version }}
+
+      - name: Install package with dev extras
+        run: pip install -e ".[dev]"
+
+      - name: Run test suite (CPU-only)
+        run: python -m pytest tests/ -q

pytest_gpu_proof-0.1.0/.github/workflows/docs.yml

@@ -0,0 +1,29 @@
+name: Docs
+
+on:
+  push:
+    branches: [main]
+
+permissions:
+  contents: write
+
+jobs:
+  deploy:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+
+      - uses: actions/setup-python@v5
+        with:
+          python-version: "3.12"
+
+      - name: Install mkdocs
+        run: pip install mkdocs-material
+
+      - name: Configure git author
+        run: |
+          git config user.name "github-actions[bot]"
+          git config user.email "github-actions[bot]@users.noreply.github.com"
+
+      - name: Deploy to gh-pages
+        run: mkdocs gh-deploy --force

pytest_gpu_proof-0.1.0/.github/workflows/publish-testpypi.yml

@@ -0,0 +1,49 @@
+name: Publish (TestPyPI)
+
+# Dry-run lane ONLY — manual dispatch, publishes to test.pypi.org via OIDC
+# trusted publishing. Cannot touch real PyPI: this workflow contains no pypi
+# environment and no pypi publisher matches its filename. The real-PyPI lane
+# is publish.yml (GitHub release). One-time setup: RELEASING.md.
+
+on:
+  workflow_dispatch:
+
+jobs:
+  build:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+      - uses: actions/setup-python@v5
+        with:
+          python-version: "3.12"
+      - name: Build sdist + wheel
+        run: |
+          python -m pip install --upgrade build twine
+          python -m build
+          python -m twine check --strict dist/*
+      - name: Smoke-test the wheel
+        run: |
+          python -m venv /tmp/wheeltest
+          /tmp/wheeltest/bin/pip install -q dist/*.whl
+          /tmp/wheeltest/bin/gpu-proof --help
+          /tmp/wheeltest/bin/python -c "import pytest_gpu_proof"
+          /tmp/wheeltest/bin/python -m pytest -p pytest_gpu_proof --version
+      - uses: actions/upload-artifact@v4
+        with:
+          name: dist
+          path: dist/
+
+  publish-testpypi:
+    needs: build
+    runs-on: ubuntu-latest
+    environment: testpypi
+    permissions:
+      id-token: write   # OIDC trusted publishing
+    steps:
+      - uses: actions/download-artifact@v4
+        with:
+          name: dist
+          path: dist/
+      - uses: pypa/gh-action-pypi-publish@release/v1
+        with:
+          repository-url: https://test.pypi.org/legacy/

pytest_gpu_proof-0.1.0/.github/workflows/publish.yml

@@ -0,0 +1,48 @@
+name: Publish
+
+# Real-PyPI lane ONLY — runs exclusively on a published GitHub release, via
+# OIDC trusted publishing (no tokens). The TestPyPI dry-run lane is the
+# separate publish-testpypi.yml workflow (manual dispatch), so a dispatch run
+# never shows a PyPI job. One-time setup: RELEASING.md.
+
+on:
+  release:
+    types: [published]
+
+jobs:
+  build:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+      - uses: actions/setup-python@v5
+        with:
+          python-version: "3.12"
+      - name: Build sdist + wheel
+        run: |
+          python -m pip install --upgrade build twine
+          python -m build
+          python -m twine check --strict dist/*
+      - name: Smoke-test the wheel
+        run: |
+          python -m venv /tmp/wheeltest
+          /tmp/wheeltest/bin/pip install -q dist/*.whl
+          /tmp/wheeltest/bin/gpu-proof --help
+          /tmp/wheeltest/bin/python -c "import pytest_gpu_proof"
+          /tmp/wheeltest/bin/python -m pytest -p pytest_gpu_proof --version
+      - uses: actions/upload-artifact@v4
+        with:
+          name: dist
+          path: dist/
+
+  publish-pypi:
+    needs: build
+    runs-on: ubuntu-latest
+    environment: pypi
+    permissions:
+      id-token: write   # OIDC trusted publishing
+    steps:
+      - uses: actions/download-artifact@v4
+        with:
+          name: dist
+          path: dist/
+      - uses: pypa/gh-action-pypi-publish@release/v1

pytest_gpu_proof-0.1.0/.gitignore

@@ -0,0 +1,302 @@
+# Byte-compiled / optimized / DLL files
+__pycache__/
+*.py[codz]
+*$py.class
+
+# C extensions
+*.so
+
+# Distribution / packaging
+.Python
+build/
+develop-eggs/
+dist/
+downloads/
+eggs/
+.eggs/
+lib/
+lib64/
+parts/
+sdist/
+var/
+wheels/
+share/python-wheels/
+*.egg-info/
+.installed.cfg
+*.egg
+MANIFEST
+
+# PyInstaller
+#   Usually these files are written by a python script from a template
+#   before PyInstaller builds the exe, so as to inject date/other infos into it.
+*.manifest
+*.spec
+
+# Installer logs
+pip-log.txt
+pip-delete-this-directory.txt
+
+# Unit test / coverage reports
+htmlcov/
+.tox/
+.nox/
+.coverage
+.coverage.*
+.cache
+nosetests.xml
+coverage.xml
+*.cover
+*.py.cover
+*.lcov
+.hypothesis/
+.pytest_cache/
+cover/
+
+# Translations
+*.mo
+*.pot
+
+# Django stuff:
+*.log
+local_settings.py
+db.sqlite3
+db.sqlite3-journal
+
+# Flask stuff:
+instance/
+.webassets-cache
+
+# Scrapy stuff:
+.scrapy
+
+# Sphinx documentation
+docs/_build/
+
+# PyBuilder
+.pybuilder/
+target/
+
+# Jupyter Notebook
+.ipynb_checkpoints
+
+# IPython
+profile_default/
+ipython_config.py
+
+# pyenv
+#   For a library or package, you might want to ignore these files since the code is
+#   intended to run in multiple environments; otherwise, check them in:
+# .python-version
+
+# pipenv
+#   According to pypa/pipenv#598, it is recommended to include Pipfile.lock in version control.
+#   However, in case of collaboration, if having platform-specific dependencies or dependencies
+#   having no cross-platform support, pipenv may install dependencies that don't work, or not
+#   install all needed dependencies.
+# Pipfile.lock
+
+# UV
+#   Similar to Pipfile.lock, it is generally recommended to include uv.lock in version control.
+#   This is especially recommended for binary packages to ensure reproducibility, and is more
+#   commonly ignored for libraries.
+# uv.lock
+
+# poetry
+#   Similar to Pipfile.lock, it is generally recommended to include poetry.lock in version control.
+#   This is especially recommended for binary packages to ensure reproducibility, and is more
+#   commonly ignored for libraries.
+#   https://python-poetry.org/docs/basic-usage/#commit-your-poetrylock-file-to-version-control
+# poetry.lock
+# poetry.toml
+
+# pdm
+#   Similar to Pipfile.lock, it is generally recommended to include pdm.lock in version control.
+#   pdm recommends including project-wide configuration in pdm.toml, but excluding .pdm-python.
+#   https://pdm-project.org/en/latest/usage/project/#working-with-version-control
+# pdm.lock
+# pdm.toml
+.pdm-python
+.pdm-build/
+
+# pixi
+#   Similar to Pipfile.lock, it is generally recommended to include pixi.lock in version control.
+# pixi.lock
+#   Pixi creates a virtual environment in the .pixi directory, just like venv module creates one
+#   in the .venv directory. It is recommended not to include this directory in version control.
+.pixi/*
+!.pixi/config.toml
+
+# PEP 582; used by e.g. github.com/David-OConnor/pyflow and github.com/pdm-project/pdm
+__pypackages__/
+
+# Celery stuff
+celerybeat-schedule*
+celerybeat.pid
+
+# Redis
+*.rdb
+*.aof
+*.pid
+
+# RabbitMQ
+mnesia/
+rabbitmq/
+rabbitmq-data/
+
+# ActiveMQ
+activemq-data/
+
+# SageMath parsed files
+*.sage.py
+
+# Environments
+.env
+.envrc
+.venv
+env/
+venv/
+ENV/
+env.bak/
+venv.bak/
+
+# Spyder project settings
+.spyderproject
+.spyproject
+
+# Rope project settings
+.ropeproject
+
+# mkdocs documentation
+/site
+
+# mypy
+.mypy_cache/
+.dmypy.json
+dmypy.json
+
+# Pyre type checker
+.pyre/
+
+# pytype static type analyzer
+.pytype/
+
+# Cython debug symbols
+cython_debug/
+
+# PyCharm
+#   JetBrains specific template is maintained in a separate JetBrains.gitignore that can
+#   be found at https://github.com/github/gitignore/blob/main/Global/JetBrains.gitignore
+#   and can be added to the global gitignore or merged into this file.  For a more nuclear
+#   option (not recommended) you can uncomment the following to ignore the entire idea folder.
+# .idea/
+
+# Abstra
+#   Abstra is an AI-powered process automation framework.
+#   Ignore directories containing user credentials, local state, and settings.
+#   Learn more at https://abstra.io/docs
+.abstra/
+
+# Visual Studio Code
+#   Visual Studio Code specific template is maintained in a separate VisualStudioCode.gitignore 
+#   that can be found at https://github.com/github/gitignore/blob/main/Global/VisualStudioCode.gitignore
+#   and can be added to the global gitignore or merged into this file. However, if you prefer, 
+#   you could uncomment the following to ignore the entire vscode folder
+# .vscode/
+# Temporary file for partial code execution
+tempCodeRunnerFile.py
+
+# Ruff stuff:
+.ruff_cache/
+
+# PyPI configuration file
+.pypirc
+
+# Marimo
+marimo/_static/
+marimo/_lsp/
+__marimo__/
+
+# Streamlit
+.streamlit/secrets.toml
+
+# Prerequisites
+*.d
+
+# Compiled Object files
+*.slo
+*.lo
+*.o
+*.obj
+
+# Precompiled Headers
+*.gch
+*.pch
+
+# Linker files
+*.ilk
+
+# Debugger Files
+*.pdb
+
+# Compiled Dynamic libraries
+*.so
+*.dylib
+*.dll
+*.so.*
+
+
+# Fortran module files
+*.mod
+*.smod
+
+# Compiled Static libraries
+*.lai
+*.la
+*.a
+*.lib
+
+# Executables
+*.exe
+*.out
+*.app
+
+# Build directories
+build/
+Build/
+build-*/
+
+# CMake generated files
+CMakeFiles/
+CMakeCache.txt
+cmake_install.cmake
+Makefile
+!examples/cuda_ctypes_matmul/Makefile
+install_manifest.txt
+compile_commands.json
+
+# Temporary files
+*.tmp
+*.log
+*.bak
+*.swp
+
+# vcpkg
+vcpkg_installed/
+
+# debug information files
+*.dwo
+
+# test output & cache
+Testing/
+.cache/
+
+# CUDA
+*.i
+*.ii
+*.gpu
+*.ptx
+*.cubin
+*.fatbin
+
+# Specifics
+gpu-proof.json

pytest_gpu_proof-0.1.0/CHANGELOG.md

@@ -0,0 +1,34 @@
+# Changelog
+
+All notable changes to pytest-gpu-proof are documented here. The format is
+based on [Keep a Changelog](https://keepachangelog.com/); versions follow
+[SemVer](https://semver.org/) (pre-1.0: minor bumps may break).
+
+## [0.1.0] — 2026-07-07
+
+First public release.
+
+### Added
+- pytest plugin (`-p` auto-loaded via the `pytest11` entry point): captures
+  per-test outcomes and skips, git SHA, a SHA-256 source fingerprint over
+  configured paths, and self-reported GPU info; emits a signed JSON receipt at
+  session end (`--gpu-proof-enable`).
+- Ed25519 SSH-key signing; signature covers the canonical (compact,
+  sorted-key) JSON without the signature block. `none` backend for unsigned
+  receipts.
+- CPU-only verifier `gpu-proof verify`: signature against the signer's public
+  `github.com/<user>.keys`, fingerprint match, commit SHA, outcome + skip
+  policy, `--require-gpu`, freshness (`--max-age-days`, `0` = today only),
+  dirty policy.
+- Skip policies: `--allow-skipped` (any) or `--expected-skips FILE` (exact-set
+  baseline — unexpected AND stale entries both fail); mutually exclusive.
+  Also `[tool.gpu_proof] expected_skips`.
+- Signer resolution: explicit flag/config → `gh` CLI login (keyholder) →
+  origin-remote owner with a printed warning (org remotes have no SSH keys).
+- `is_dirty` ignores untracked content inside submodules (pin moves and
+  tracked edits still count).
+- Receipt diffing (`compare.py`), `[tool.gpu_proof]` pyproject configuration,
+  docs site (mkdocs), honest trust-model statement in
+  `docs/security_model.md`.
+
+[0.1.0]: https://github.com/A2R-Lab/pytest-gpu-proof/releases/tag/v0.1.0

pytest_gpu_proof-0.1.0/CLAUDE.md

@@ -0,0 +1,73 @@
+# CLAUDE.md — orientation for AI agents (and humans) working on pytest-gpu-proof
+
+pytest-gpu-proof is a **pytest plugin that emits a signed JSON receipt of a GPU
+test run** (git SHA + source fingerprint + per-test outcomes + GPU info), plus a
+**CPU-only verifier** (`gpu-proof verify`) that checks the signature against the
+signer's public `github.com/<user>.keys`. The point: run GPU tests on your own
+hardware, let CI prove who attested them — no cloud-GPU fees, no secrets in CI.
+
+**Trust model — never oversell it:** a receipt is a **signed attestation by a
+keyholder, NOT cryptographic proof of GPU execution**. `gpu_info` is
+self-reported; `--require-gpu` is modest hardening against accidents, not
+against a dishonest signer. `docs/security_model.md` is the honest statement of
+what is and isn't proven — keep every README/docs claim consistent with it.
+
+## Source layout (`src/pytest_gpu_proof/`)
+
+| Module | Role |
+|---|---|
+| `plugin.py` | pytest hooks: options, `gpu_proof` marker, `gpu_proof_check` fixture, outcome+skip capture, receipt emission at session end |
+| `receipt.py` | payload build (repo/fingerprint/tests/env), canonical JSON, sign+write. Signer resolution: flag/config → `gh` CLI login (keyholder) → origin-remote owner (warned — orgs have no SSH keys) |
+| `verify.py` | the 7 verification checks (signature, fingerprint, commit SHA, outcomes+skip policy, gpu_info, freshness, dirty policy). Expected-skips baseline = EXACT set match |
+| `cli.py` | `gpu-proof verify` argument surface |
+| `config.py` | `GpuProofConfig`; CLI flags override `[tool.gpu_proof]` in pyproject.toml |
+| `fingerprint.py` | SHA-256 digest over configured paths |
+| `gitutils.py` | git/gh shell-outs, all failure-tolerant (return `None`) |
+| `signers/` | `base.py` protocol + `ed25519.py` SSH-key signing / GitHub-keys verification; backend `none` emits unsigned receipts |
+| `compare.py` | receipt diffing |
+
+Signing covers the canonical (compact, sorted-key) JSON **without** the
+`signature` field; the sig block carries `signer`, key fingerprint, algorithm
+(derived from actual key type — don't hardcode ed25519).
+
+## Behavioral invariants (test-enforced — don't regress)
+
+- **Skips prove nothing.** Verifier rejects receipts with skips unless
+  `--allow-skipped` (any skips) or `--expected-skips` (EXACT baseline: a new
+  skip fails, a stale baseline entry fails). The two are mutually exclusive.
+- **Unsigned receipts** verify only with `--allow-unsigned`, loudly.
+- **`--max-age-days 0`** means "today only", not "disabled".
+- The signer recorded at signing time must be the **keyholder**, never
+  silently the repo owner.
+
+## Dev workflow
+
+```bash
+.venv/bin/python -m pytest tests/ -q      # full suite, ~2s, no GPU needed
+.venv/bin/mkdocs build --strict           # docs must stay warning-clean
+```
+
+- Tests are **hermetic**: `tests/conftest.py` has an autouse fixture nulling
+  `get_gh_cli_login` (a dev box with authenticated `gh` would otherwise hit the
+  network). Signer tests re-patch explicitly. Keep new shell-outs mockable and
+  wrapped in try/except like `gitutils._git`.
+- `tests/conftest.py` uses `pytest_plugins = ["pytester"]`; keypairs are
+  generated in-memory (no real SSH keys touched).
+- requires-python ≥ 3.11 (`datetime.UTC`).
+- CI (`.github/workflows/`): tests on 3.11/3.12 + mkdocs gh-pages deploy.
+
+## Conventions & state
+
+- Short single-line commit messages; no Co-Authored-By footer.
+- Flow: feature branch → PR → CI green → merge to `main`. Consumers install
+  from git (`pip install -e` on a submodule) or PyPI. **Releases**: OIDC
+  trusted publishing via `.github/workflows/publish.yml` (TestPyPI on manual
+  dispatch, PyPI on GitHub release) — process in `RELEASING.md`; keep
+  `CHANGELOG.md` current and bump `pyproject.toml` version in the same PR.
+- Reference integration: **GLASS** (github.com/A2R-Lab/GLASS) —
+  `test/run_gpu_proof.sh`, `test/expected_skips.txt`,
+  `.github/workflows/verify-gpu-proof.yml`. If you change plugin/verifier
+  flags, check GLASS's usage still works and note it in the PR.
+- Consumer-side gotcha worth remembering: a repo that submodules this project
+  under its pytest rootdir must `collect_ignore = ["pytest-gpu-proof"]` in its
+  conftest, or this repo's `tests/conftest.py` will shadow theirs.

pytest_gpu_proof-0.1.0/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 A2R Lab
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.