Skip to content

fix(ci): keep PR E2E authorization pending - #6914

Merged
cv merged 4 commits into
mainfrom
codex/keep-native-e2e-gate-pending
Jul 15, 2026
Merged

fix(ci): keep PR E2E authorization pending#6914
cv merged 4 commits into
mainfrom
codex/keep-native-e2e-gate-pending

Conversation

@cv

@cv cv commented Jul 15, 2026

Copy link
Copy Markdown
Collaborator

Summary

Keep control-plane E2E authorization in progress so GitHub can advance the same coordination check from authorization to running and then to its terminal verdict. This fixes the lifecycle observed on #6904, where GitHub preserved the completed failure conclusion even after the controller changed the check title to Running 9 E2E jobs, causing the native required job to fail while E2E was still running.

Changes

  • Leave an internal control-plane authorization checkpoint in_progress, validate that pending state during manual authorization, and restore it after a retryable controller failure.
  • Reject completed authorization checks instead of reinterpreting them; older builds require a fresh exact-diff revision and PR-CI run before authorization.
  • Fail closed after any child dispatch: request cancellation, publish a terminal reconciliation result, and require a fresh exact diff rather than risk duplicate credential-bearing execution.
  • Update controller and native-observer lifecycle coverage for the pending authorization-to-running-to-success sequence, plus the E2E operator guide for pending authorization and retry restoration.

Type of Change

  • Code change (feature, bug fix, or refactor)
  • Code change with doc updates
  • Doc only (prose changes, no code sample modifications)
  • Doc only (includes code sample changes)

Quality Gates

  • Tests added or updated for changed behavior
  • Existing tests cover changed behavior — justification:
  • Tests not applicable — justification:
  • Docs updated for user-facing behavior changes
  • Docs not applicable — justification:
  • Sensitive paths changed (security, policy, credentials, preflight, onboarding, inference, runner, sandbox, or messaging)
  • Sensitive-path review completed or maintainer-approved waiver recorded — reviewer/approval link/justification: Required before merge; this changes the trusted controller state machine around credential-bearing E2E authorization while preserving exact head/base, maintainer-role, and risk-plan validation.
  • Non-success, skipped, or missing CI check accepted by maintainer — check name, approval link, and follow-up issue:

Verification

  • PR description includes a Signed-off-by: line and every commit appears as Verified in GitHub
  • Normal pre-commit, commit-msg, and pre-push hooks passed, or npm run check:diff passed when hooks were skipped or unavailable
  • Targeted behavior tests pass for the current change set, or tests are marked not applicable above — npx vitest run test/pr-e2e-gate-fork-skip.test.ts test/pr-e2e-required.test.ts test/pr-e2e-gate-workflow.test.ts test/pr-e2e-gate-lifecycle.test.ts test/pr-e2e-gate.test.ts (5 files, 108 tests passed); npm run typecheck:cli; npm run source-shape:check; npm run test:projects:check; npm run test-size:check
  • Applicable broad gate passed — not applicable; this is a focused controller/observer lifecycle correction covered by the targeted controller, native-observer, workflow, and lifecycle suites above
  • Quality Gates section completed with required justifications or waivers — pending sensitive-path review above
  • No secrets, API keys, or credentials committed
  • npm run docs builds without warnings (doc changes only) — build passed with the same two hidden Fern warnings
  • Doc pages follow the style guide (doc changes only) — not applicable; only the E2E operator README changed
  • New doc pages include SPDX header and frontmatter (new pages only)

Signed-off-by: Carlos Villela cvillela@nvidia.com

Summary by CodeRabbit

  • New Features

    • Added a dedicated pending authorization check state for credentialed E2E runs, including clearer workflow instructions and required validation inputs.
    • Added reconciliation behavior when dispatched E2E jobs can’t be cancelled or completed reliably.
  • Bug Fixes

    • Prevented authorization checks from being misinterpreted as retryable waiting states after failures.
    • Required fresh authorization when base/head revisions change.
    • Improved restoration and strict handling of intermediate authorization/observer states.
  • Documentation

    • Updated E2E gate guidance to reflect the in-progress authorization and reconciliation flows.
  • Tests

    • Expanded E2E coverage for fork-skip approval and authorization-close scenarios.

Signed-off-by: Carlos Villela <cvillela@nvidia.com>
@cv cv self-assigned this Jul 15, 2026
@coderabbitai

coderabbitai Bot commented Jul 15, 2026

Copy link
Copy Markdown
Contributor

Review Change Stack

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info
⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Enterprise

Run ID: e7e9b22b-6e13-4a95-a0ca-2e7e2b6a6406

📥 Commits

Reviewing files that changed from the base of the PR and between ad2850c and 593af00.

📒 Files selected for processing (1)
  • test/pr-e2e-gate-fork-skip.test.ts
🚧 Files skipped from review as they are similar to previous changes (1)
  • test/pr-e2e-gate-fork-skip.test.ts

📝 Walkthrough

Walkthrough

The PR changes credentialed E2E authorization checks from terminal failures to pending states, restores pending coordination after pre-dispatch errors, records post-dispatch reconciliation failures, narrows completed-failure classification, and updates tests and documentation.

Changes

E2E authorization coordination

Layer / File(s) Summary
Pending authorization handoff and recovery
tools/e2e/pr-e2e-gate.mts, test/pr-e2e-gate-fork-skip.test.ts
Authorization-required checks remain in_progress, control-plane dispatch requires the matching pending state, pre-dispatch errors restore retryable authorization, and dispatched-child errors produce reconciliation failure. Tests cover these transitions.
Coordination observation and terminal semantics
tools/e2e/pr-e2e-required.mts, test/pr-e2e-required.test.ts
Completed failures with the legacy authorization title are no longer classified as waiting; tests cover pending authorization, running, and successful observations.
Authorization contract and lifecycle documentation
test/e2e/README.md
Documentation defines exact manual authorization inputs, revalidation requirements, dispatch failure handling, and terminal-state rules.

Estimated code review effort: 3 (Moderate) | ~25 minutes

Sequence Diagram(s)

sequenceDiagram
  participant startPrGate
  participant GitHubCheckRun
  participant startControlPlanePrGate
  participant ChildWorkflow
  startPrGate->>GitHubCheckRun: mark authorization check in_progress
  startControlPlanePrGate->>GitHubCheckRun: validate matching pending state
  startControlPlanePrGate->>ChildWorkflow: dispatch child E2E run
  ChildWorkflow->>startControlPlanePrGate: report dispatch or reconciliation error
  startControlPlanePrGate->>GitHubCheckRun: restore pending state or record reconciliation failure
Loading

Possibly related PRs

Suggested labels: bug-fix, area: ci, area: e2e

🚥 Pre-merge checks | ✅ 5
✅ Passed checks (5 passed)
Check name Status Explanation
Description Check ✅ Passed Check skipped - CodeRabbit’s high-level summary is enabled.
Title check ✅ Passed The title accurately summarizes the main change: keeping PR E2E authorization in a pending state instead of closing it as a failure.
Docstring Coverage ✅ Passed No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check ✅ Passed Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check ✅ Passed Check skipped because no linked issues were found for this pull request.
✨ Finishing Touches
📝 Generate docstrings
  • Create stacked PR
  • Commit on current branch
🧪 Generate unit tests (beta)
  • Create PR with unit tests
  • Commit unit tests in branch codex/keep-native-e2e-gate-pending

Comment @coderabbitai help to get the list of available commands.

@github-code-quality

github-code-quality Bot commented Jul 15, 2026

Copy link
Copy Markdown
Contributor

Code Coverage Overview

Languages: TypeScript

TypeScript / code-coverage/plugin

The overall coverage remains at 96%, unchanged from the main branch.

TypeScript / code-coverage/cli

The overall coverage in the codex/keep-native-e2... branch remains at 79%, unchanged from the main branch.

Show a code coverage summary of the most impacted files.
File main 55fdc3f codex/keep-native-e2... 593af00 +/-
src/lib/messagi...ate-resolver.ts 89% 67% -22%
src/lib/messagi...ate-resolver.ts 94% 82% -12%
src/lib/messagi...parser-utils.ts 95% 86% -9%
src/lib/messagi...onfig-parser.ts 100% 93% -7%
src/lib/shields/audit.ts 97% 92% -5%
src/lib/messagi...nes/template.ts 100% 95% -5%
src/lib/adapter.../docker/pull.ts 86% 83% -3%
src/lib/state/gateway.ts 91% 93% +2%
src/lib/adapter...ocker/volume.ts 70% 85% +15%
src/lib/messagi...onfig-parser.ts 77% 92% +15%

Updated July 15, 2026 10:21 UTC
Code Coverage is in Public Preview. Learn more and provide us with your feedback.

@coderabbitai coderabbitai Bot left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Actionable comments posted: 1

🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In `@tools/e2e/pr-e2e-gate.mts`:
- Around line 2037-2045: Update the authorization validation around
pendingAuthorization and legacyAuthorization so completed legacy checks do not
enter the markCheckInProgress reopen path. Either route legacyAuthorization
through a completed-check-compatible handoff before dispatch, or remove it from
the accepted states until that handoff is implemented; preserve the existing
pending authorization flow.
🪄 Autofix (Beta)

Fix all unresolved CodeRabbit comments on this PR:

  • Push a commit to this branch (recommended)
  • Create a new PR with the fixes

ℹ️ Review info
⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Enterprise

Run ID: 6e9c28cb-c519-43cd-b376-8150b2868857

📥 Commits

Reviewing files that changed from the base of the PR and between 55fdc3f and 997b46a.

📒 Files selected for processing (5)
  • test/e2e/README.md
  • test/pr-e2e-gate-fork-skip.test.ts
  • test/pr-e2e-required.test.ts
  • tools/e2e/pr-e2e-gate.mts
  • tools/e2e/pr-e2e-required.mts

Comment thread tools/e2e/pr-e2e-gate.mts
@github-actions

github-actions Bot commented Jul 15, 2026

Copy link
Copy Markdown
Contributor

PR Review Advisor — Informational

Advisor assessment: Informational / low confidence
Next action: No advisor follow-up needed.
Findings: 0 blockers · 0 warnings · 0 suggestions
Status: PR review advisor failed: PR review advisor SDK execution failed: session: tests-regressions-analysis omitted required analysis; turn: tests-regressions-analysis: tests-regressions-analysis omitted required analysis

Model lanes

  • GPT-5.6 Terra (primary): Failed
  • Nemotron 3 Ultra (second opinion): Completed · high confidence · 0 blockers · 0 warnings · 0 suggestions

Nemotron output stays in workflow artifacts and does not change the assessment above.

E2E guidance

Advisory only. E2E / PR Gate selects and runs jobs independently.

Recommended E2E: cloud-onboard, credential-sanitization, security-posture

Workflow run details

This automated review informs maintainers. Warnings and suggestions do not require a response. A maintainer decides whether to merge.

Signed-off-by: Carlos Villela <cvillela@nvidia.com>

@coderabbitai coderabbitai Bot left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Actionable comments posted: 1

Caution

Some comments are outside the diff and can’t be posted inline due to platform limitations.

⚠️ Outside diff range comments (1)
tools/e2e/pr-e2e-gate.mts (1)

2071-2087: 🩺 Stability & Availability | 🟡 Minor | ⚡ Quick win

Don't restore authorization on ambiguous dispatch failures. If dispatchSelectedPrGate times out or returns 5xx after GitHub has already accepted the workflow dispatch, reopening the check to pending can let a retry launch duplicate E2E work. Reconcile the child run first, or only restore for failures known to occur before dispatch is accepted.

🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@tools/e2e/pr-e2e-gate.mts` around lines 2071 - 2087, Update the
controller-error handling around dispatchSelectedPrGate so it does not call
markCheckInProgress for ambiguous timeout or 5xx failures that may follow an
accepted GitHub workflow dispatch. Reconcile the child run first, or restrict
authorization restoration to failures definitively confirmed to occur before
dispatch acceptance, while preserving the existing error reporting for
non-restored cases.
🧹 Nitpick comments (1)
test/pr-e2e-required.test.ts (1)

195-195: 📐 Maintainability & Code Quality | 🔵 Trivial | ⚡ Quick win

Avoid locking this test to exactly three polling calls.

toBe(3) asserts mock invocation count rather than the behavioral contract. Record the observed coordination states/titles and assert that pending authorization and running states were tolerated before the final success, allowing polling cadence to change.

As per path instructions, this test should favor behavioral confidence over mock-call-count assertions.

🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@test/pr-e2e-required.test.ts` at line 195, Update the polling assertions in
the end-to-end test around coordinationQueries to validate observed coordination
states or titles instead of requiring exactly three calls. Assert that pending
authorization and running states are tolerated before the final success, while
allowing the polling cadence and invocation count to change.

Source: Path instructions

🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In `@tools/e2e/pr-e2e-required.mts`:
- Line 17: Update the classifier in pr-e2e-required.mts to recognize only exact
trusted titles matching “Running <count> E2E job” or “Running <count> E2E jobs”
as transitional, including completed checks with failure conclusions, while
leaving other terminal failures unchanged. Add a regression case covering a
completed failure titled “Running 3 E2E jobs” and verify it remains
transitional.

---

Outside diff comments:
In `@tools/e2e/pr-e2e-gate.mts`:
- Around line 2071-2087: Update the controller-error handling around
dispatchSelectedPrGate so it does not call markCheckInProgress for ambiguous
timeout or 5xx failures that may follow an accepted GitHub workflow dispatch.
Reconcile the child run first, or restrict authorization restoration to failures
definitively confirmed to occur before dispatch acceptance, while preserving the
existing error reporting for non-restored cases.

---

Nitpick comments:
In `@test/pr-e2e-required.test.ts`:
- Line 195: Update the polling assertions in the end-to-end test around
coordinationQueries to validate observed coordination states or titles instead
of requiring exactly three calls. Assert that pending authorization and running
states are tolerated before the final success, while allowing the polling
cadence and invocation count to change.
🪄 Autofix (Beta)

Fix all unresolved CodeRabbit comments on this PR:

  • Push a commit to this branch (recommended)
  • Create a new PR with the fixes

ℹ️ Review info
⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Enterprise

Run ID: 3f9702df-b202-49e4-b3a0-5ee97a7b4bc5

📥 Commits

Reviewing files that changed from the base of the PR and between 997b46a and 100db25.

📒 Files selected for processing (5)
  • test/e2e/README.md
  • test/pr-e2e-gate-fork-skip.test.ts
  • test/pr-e2e-required.test.ts
  • tools/e2e/pr-e2e-gate.mts
  • tools/e2e/pr-e2e-required.mts
🚧 Files skipped from review as they are similar to previous changes (2)
  • test/pr-e2e-gate-fork-skip.test.ts
  • test/e2e/README.md

Comment thread tools/e2e/pr-e2e-required.mts
cv added 2 commits July 15, 2026 03:06
Signed-off-by: Carlos Villela <cvillela@nvidia.com>
Signed-off-by: Carlos Villela <cvillela@nvidia.com>
@cv
cv merged commit 6ef2df9 into main Jul 15, 2026
79 of 83 checks passed
@cv
cv deleted the codex/keep-native-e2e-gate-pending branch July 15, 2026 15:13
@wscurran wscurran added area: ci CI workflows, checks, release automation, or GitHub Actions area: e2e End-to-end tests, nightly failures, or validation infrastructure bug-fix PR fixes a bug or regression labels Jul 15, 2026
@coderabbitai coderabbitai Bot mentioned this pull request Jul 28, 2026
23 tasks
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

area: ci CI workflows, checks, release automation, or GitHub Actions area: e2e End-to-end tests, nightly failures, or validation infrastructure bug-fix PR fixes a bug or regression

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants