ci(workflows): reuse compiled outputs across CI and E2E - #11285
Conversation
Signed-off-by: Carlos Villela <cvillela@nvidia.com>
|
Auto-sync is disabled for draft pull requests in this repository. Workflows must be run manually. Contributors can view more details about this message here. |
|
Important Draft PR not reviewedDraft PRs are not automatically reviewed by default.
To automatically review draft PRs, update your CodeRabbit configuration: reviews:
auto_review:
drafts: trueComment |
Code Coverage OverviewLanguages: TypeScript TypeScript / code-coverage/pluginThe overall line coverage in commit bc6ddf9 in the TypeScript / code-coverage/cliThe overall line coverage in commit bc6ddf9 in the Show a line coverage summary of the most impacted files.
Updated |
| if: steps.cache.outputs.cache-hit != 'true' | ||
| shell: bash | ||
| run: | | ||
| node -e 'for (const p of ["dist", "nemoclaw/dist"]) require("node:fs").rmSync(p, { recursive: true, force: true });' |
There was a problem hiding this comment.
Why not rm -rf, since using bash already?
|
PR Review Advisor finished for commit |
1 participant
Outcome
Main CI, PR CI, and E2E candidate preparation use one action to restore or build the complete CLI and plugin. A matching compiled cache skips dependency installation and compilation. Manual PR E2E accepts source branches only in
NVIDIA/NemoClaw.Reason
The workflows currently repeat compilation and disagree about the output they prepare. A shared native cache reduces repeated work and gives preparation failures consistent step names. Restricting manual PR E2E to repository branches makes repository writers the explicit trust boundary for default-branch cache producers.
Changes
ci-compile-artifacts. Main, PR, and E2E use the same fixed Node version and full output. The key includes the source SHA, trusted recipe revision, action content, Node version, and runner platform.compiled-artifact.test.tsexercises actual shell steps for hits, misses, invalid output, and shared identity.compiled-test-inputsfor coverage merging. PRs retain the old upload only while their base action still reads it;pr-workflow-contract.test.tscovers both base-reader versions.Cache expiry, branch scoping, and concurrent misses can cause another build. The cache does not coordinate producers or guarantee one build per SHA.
Verification
prekpre-commit and pre-push hooks: passed.npm run test:projects:check: passed.npm run validate:prin a credential-free container: passed (exit 0; no tracked changes).Focused test command
npm exec --yes --package=node@22.23.2 -- npx vitest run \ --project integration \ test/automation/pull-requests/compiled-artifact.test.ts \ test/automation/pull-requests/pr-workflow-contract.test.ts \ --project e2e-support \ test/e2e/support/manual-pr-credential-authorization.test.ts \ test/e2e/support/e2e-operations-workflow-boundary.test.ts \ test/e2e/support/prepare-e2e-workflow-boundary.test.ts \ test/e2e/support/cli-artifact-workflow-boundary.test.ts \ test/e2e/support/shared-e2e-workflow-boundary.test.ts \ test/e2e/support/e2e-report-to-pr-workflow-boundary.test.tsNative GitHub cache reuse remains unverified. PR CI loads shared actions from the base, so this PR's required checks alone cannot prove the new action's production cache behavior.
Review notes
Initial CI: the growth guard failed because it compares the candidate snapshot with the newer base snapshot.
Dockerfile,ci/e2e-assertion-budget.json, andtest/e2e/live/llama-cpp-generic-gpu.test.tsare byte-for-byte unchanged from branch point5d4ac392c471de5323496a0d1df6d0118851d7d7; main reduced those budgets in #11164 and #11078. This check remains failing, with no waiver requested. Other CI and Advisor evaluation are pending. CodeRabbit skipped this draft.Self-review of
NVIDIA/NemoClawcommit47279b465c4ded8339107d8a6fc469dfb30a9222covered the complete diff, API authorization before execution, trusted action loading, cache identity and validation, token exposure, and the coverage-artifact transition. No unresolved implementation findings were identified. The review used source inspection, executable shell-step tests, and workflow boundary tests.Sensitive paths awaiting independent review:
.github/workflows/{main,pr,e2e}.yaml,.github/actions/ci-compile-artifacts/,.github/actions/ci-cli-coverage-merge/action.yaml,tools/e2e/{operations,prepare-e2e}-workflow-boundary.mts, and.agents/skills/nemoclaw-maintainer-e2e/references/manual-pr.md.The publication container uses canonical npm/prek entrypoints and lockfiles from
38b5e3cabdff3efe71663a2bbeeffb39e89bd942, with recorded executable hashes. The two changed E2E validators run as candidate code, without host credentials or network access; that run is not independent review.Repository writers are intentionally trusted before merge. Fork contributions require maintainer review and adoption onto a repository branch before manual E2E. This PR is a draft pending independent review and CI; the self-review does not authorize merge.
Signed-off-by: Carlos Villela cvillela@nvidia.com