feat(ci): add SDK proto sync CI with drift detection and dashboard

.github/workflows/sdk-proto-check.yml

@@ -0,0 +1,83 @@
+name: SDK Proto Check
+
+on:
+  push:
+    branches:
+      - "pull-request/[0-9]+"
+  workflow_dispatch:
+
+permissions:
+  contents: read
+  packages: read
+
+concurrency:
+  group: ${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: true
+
+jobs:
+  pr_metadata:
+    name: Resolve PR metadata
+    runs-on: ubuntu-latest
+    permissions:
+      contents: read
+      pull-requests: read
+    outputs:
+      should_run: ${{ steps.gate.outputs.should_run }}
+    steps:
+      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+
+      - id: gate
+        uses: ./.github/actions/pr-gate
+
+  sdk_proto_drift:
+    name: Proto Drift (${{ matrix.sdk.name }})
+    needs: pr_metadata
+    if: needs.pr_metadata.outputs.should_run == 'true'
+    runs-on: ubuntu-latest
+    container:
+      image: ghcr.io/nvidia/openshell/ci:latest
+      credentials:
+        username: ${{ github.actor }}
+        password: ${{ secrets.GITHUB_TOKEN }}
+    strategy:
+      fail-fast: false
+      matrix:
+        sdk:
+          - name: go
+            drift_task: "go:proto:drift"
+    steps:
+      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+
+      - name: Install tools
+        run: mise install --locked
+
+      - name: Check proto drift
+        id: drift
+        run: |
+          REPORT=$(uv run python tasks/scripts/sdk_sync.py drift-report \
+            --sdk ${{ matrix.sdk.name }} \
+            --upstream-path proto \
+            --sdk-path sdk/${{ matrix.sdk.name }}/proto 2>&1) || true
+
+          if echo "$REPORT" | jq -e '.synced' >/dev/null 2>&1; then
+            SYNCED=$(echo "$REPORT" | jq -r '.synced')
+            {
+              echo "report<<REPORT_EOF"
+              echo "$REPORT"
+              echo "REPORT_EOF"
+            } >> "$GITHUB_OUTPUT"
+            echo "synced=$SYNCED" >> "$GITHUB_OUTPUT"
+          else
+            echo "::warning::Proto drift check failed: $REPORT"
+            echo "synced=error" >> "$GITHUB_OUTPUT"
+          fi
+
+      - name: Annotate drift warning
+        if: steps.drift.outputs.synced == 'false'
+        env:
+          DRIFT_REPORT: ${{ steps.drift.outputs.report }}
+          SDK_NAME: ${{ matrix.sdk.name }}
+        run: |
+          SUMMARY=$(echo "$DRIFT_REPORT" | jq -r '.summary')
+          FILES=$(echo "$DRIFT_REPORT" | jq -r '.files[] | select(.status != "synced") | "  - \(.name) (\(.status), \(.diff_lines) lines changed)"' | sed ':a;N;$!ba;s/\n/%0A/g')
+          echo "::warning::SDK proto drift detected for ${SDK_NAME}: ${SUMMARY}%0A${FILES}"

.github/workflows/sdk-sync-dashboard.yml

@@ -0,0 +1,148 @@
+name: SDK Sync Dashboard
+
+on:
+  schedule:
+    - cron: "0 6 * * *"
+  workflow_dispatch:
+
+permissions:
+  actions: read
+  contents: write
+  packages: read
+  issues: write
+
+concurrency:
+  group: sdk-sync-dashboard
+  cancel-in-progress: true
+
+jobs:
+  sdk_sync_check:
+    name: Sync Check (${{ matrix.sdk.name }})
+    runs-on: ubuntu-latest
+    container:
+      image: ghcr.io/nvidia/openshell/ci:latest
+      credentials:
+        username: ${{ github.actor }}
+        password: ${{ secrets.GITHUB_TOKEN }}
+    strategy:
+      fail-fast: false
+      matrix:
+        sdk:
+          - name: go
+            build_task: "go:proto:build-check"
+            label: "sdk-sync:go"
+    outputs:
+      drift_report: ${{ steps.drift.outputs.report }}
+      has_drift: ${{ steps.drift.outputs.has_drift }}
+      build_report: ${{ steps.build.outputs.report || '' }}
+      build_failed: ${{ steps.build.outputs.build_failed || 'false' }}
+    steps:
+      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+
+      - name: Install tools
+        run: mise install --locked
+
+      - name: Check proto drift
+        id: drift
+        run: |
+          REPORT=$(uv run python tasks/scripts/sdk_sync.py drift-report \
+            --sdk ${{ matrix.sdk.name }} \
+            --upstream-path proto \
+            --sdk-path sdk/${{ matrix.sdk.name }}/proto 2>/dev/null) || true
+
+          if echo "$REPORT" | jq -e '.synced' >/dev/null 2>&1; then
+            SYNCED=$(echo "$REPORT" | jq -r '.synced')
+            {
+              echo "report<<REPORT_EOF"
+              echo "$REPORT"
+              echo "REPORT_EOF"
+            } >> "$GITHUB_OUTPUT"
+            [ "$SYNCED" = "true" ] && echo "has_drift=false" >> "$GITHUB_OUTPUT" || echo "has_drift=true" >> "$GITHUB_OUTPUT"
+          else
+            echo "::error::Proto drift check failed"
+            echo "report={}" >> "$GITHUB_OUTPUT"
+            echo "has_drift=error" >> "$GITHUB_OUTPUT"
+          fi
+
+      - name: Run build check
+        id: build
+        if: steps.drift.outputs.has_drift == 'true'
+        env:
+          BUILD_TASK: ${{ matrix.sdk.build_task }}
+        run: |
+          REPORT=$(mise run "$BUILD_TASK" 2>&1) && BUILD_OK=true || BUILD_OK=false
+          if echo "$REPORT" | jq -e '.sdk' >/dev/null 2>&1; then
+            { echo "report<<REPORT_EOF"; echo "$REPORT"; echo "REPORT_EOF"; } >> "$GITHUB_OUTPUT"
+          else
+            echo "report={}" >> "$GITHUB_OUTPUT"
+          fi
+          [ "$BUILD_OK" = "true" ] && echo "build_failed=false" >> "$GITHUB_OUTPUT" || echo "build_failed=true" >> "$GITHUB_OUTPUT"
+
+  wiki_dashboard:
+    name: Update Wiki Dashboard
+    needs: sdk_sync_check
+    if: always() && needs.sdk_sync_check.result != 'cancelled'
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+
+      - name: Install tools
+        run: mise install --locked
+
+      - name: Generate and push dashboard
+        env:
+          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+          DRIFT_REPORT: ${{ needs.sdk_sync_check.outputs.drift_report }}
+          BUILD_REPORT: ${{ needs.sdk_sync_check.outputs.build_report }}
+        run: |
+          DASHBOARD=$(mktemp)
+          uv run python tasks/scripts/sdk_sync.py dashboard \
+            --drift-report "${DRIFT_REPORT:-{}}" \
+            --build-report "${BUILD_REPORT:-{}}" \
+            --output "$DASHBOARD"
+
+          uv run python tasks/scripts/sdk_sync.py wiki-push \
+            --content "$DASHBOARD" \
+            --page-name SDK-Sync-Status \
+            --repo "$GITHUB_REPOSITORY"
+
+  issue_management:
+    name: Manage Drift Issues
+    needs: sdk_sync_check
+    if: needs.sdk_sync_check.outputs.has_drift == 'true' && needs.sdk_sync_check.outputs.build_failed == 'true'
+    runs-on: ubuntu-latest
+    outputs:
+      issue_url: ${{ steps.issue.outputs.issue_url }}
+    steps:
+      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+
+      - name: Install tools
+        run: mise install --locked
+
+      - name: Create or update drift issue
+        id: issue
+        env:
+          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+          DRIFT_REPORT: ${{ needs.sdk_sync_check.outputs.drift_report }}
+          BUILD_REPORT: ${{ needs.sdk_sync_check.outputs.build_report }}
+        run: |
+          RESULT=$(uv run python tasks/scripts/sdk_sync.py manage-issue \
+            --drift-report "${DRIFT_REPORT:-{}}" \
+            --build-report "${BUILD_REPORT:-{}}" \
+            --sdk go \
+            --repo "$GITHUB_REPOSITORY" \
+            --label "sdk-sync:go")
+          echo "issue_url=$(echo "$RESULT" | jq -r '.issue_url')" >> "$GITHUB_OUTPUT"
+
+      - name: Fire repository_dispatch
+        if: steps.issue.outputs.issue_url != ''
+        env:
+          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+          DRIFT_REPORT: ${{ needs.sdk_sync_check.outputs.drift_report }}
+        run: |
+          DRIFT_SUMMARY=$(echo "${DRIFT_REPORT:-{}}" | jq -r '.summary // "unknown"')
+          uv run python tasks/scripts/sdk_sync.py dispatch \
+            --repo "$GITHUB_REPOSITORY" \
+            --issue-url "${{ steps.issue.outputs.issue_url }}" \
+            --sdk go \
+            --drift-summary "$DRIFT_SUMMARY"

tasks/go.toml

@@ -0,0 +1,47 @@
+# SPDX-FileCopyrightText: Copyright (c) 2025-2026 NVIDIA CORPORATION & AFFILIATES. All rights reserved.
+# SPDX-License-Identifier: Apache-2.0
+
+# Go SDK proto drift detection tasks
+# NOTE: This file is merged with the full tasks/go.toml from PR #2271.
+# The drift and build-check tasks below extend the Go SDK task set.
+
+["go:proto:drift"]
+description = "Check Go SDK proto files for drift against root proto definitions"
+run = "uv run python tasks/scripts/sdk_sync.py drift-report --sdk go --upstream-path proto --sdk-path sdk/go/proto"
+hide = true
+
+["go:proto:build-check"]
+description = "Run full Go SDK proto sync, generate, build, and test pipeline"
+dir = "sdk/go"
+run = '''
+#!/usr/bin/env bash
+set -euo pipefail
+
+STEP_NAMES=("sync" "gen" "build" "test")
+STEP_TASKS=("go:proto:sync" "go:proto:gen" "go:build" "go:test")
+LOG_FILE=$(mktemp)
+trap 'rm -f "$LOG_FILE"' EXIT
+
+FAILED_STEP=""
+for i in "${!STEP_NAMES[@]}"; do
+  STEP="${STEP_NAMES[$i]}"
+  TASK="${STEP_TASKS[$i]}"
+
+  if ! mise run "$TASK" > "$LOG_FILE" 2>&1; then
+    FAILED_STEP="$STEP"
+    break
+  fi
+done
+
+LOG_CONTENT=$(tail -500 "$LOG_FILE")
+
+if [ -z "$FAILED_STEP" ]; then
+  jq -n -c --arg sdk "go" \
+    '{sdk: $sdk, success: true, failed_step: null, log: ""}'
+else
+  jq -n -c --arg sdk "go" --arg step "$FAILED_STEP" --arg log "$LOG_CONTENT" \
+    '{sdk: $sdk, success: false, failed_step: $step, log: $log}'
+  exit 1
+fi
+'''
+hide = true