Skip to content

ci: unblock TypeScript migration release gates - #6969

Merged
cv merged 4 commits into
mainfrom
codex/ci-mts-prerequisites-v84
Jul 15, 2026
Merged

ci: unblock TypeScript migration release gates#6969
cv merged 4 commits into
mainfrom
codex/ci-mts-prerequisites-v84

Conversation

@cv

@cv cv commented Jul 15, 2026

Copy link
Copy Markdown
Collaborator

Summary

Unblocks the v0.0.84 TypeScript migration PRs whose required evidence depends on trusted workflow code from main. Coverage actions now select the available TypeScript entrypoint, and the Bedrock matrix reports the agent-specific shard expected by the E2E controller.

Changes

Type of Change

  • Code change (feature, bug fix, or refactor)
  • Code change with doc updates
  • Doc only (prose changes, no code sample modifications)
  • Doc only (includes code sample changes)

Quality Gates

  • Tests added or updated for changed behavior
  • Existing tests cover changed behavior — justification:
  • Tests not applicable — justification:
  • Docs updated for user-facing behavior changes
  • Docs not applicable — justification: internal CI compatibility and evidence routing only; the documentation-writer review found no user-facing command, default, configuration, API, policy, or supported workflow change.
  • Sensitive paths changed (security, policy, credentials, preflight, onboarding, inference, runner, sandbox, or messaging)
  • Sensitive-path review completed or maintainer-approved waiver recorded — reviewer/approval link/justification: maintainer and independent review found no secret, permission, dependency, or untrusted-input expansion; fixed paths are quoted and missing entrypoints fail closed.
  • Non-success, skipped, or missing CI check accepted by maintainer — check name, approval link, and follow-up issue:

Verification

  • PR description includes a Signed-off-by: line and every commit appears as Verified in GitHub
  • Normal pre-commit, commit-msg, and pre-push hooks passed, or npm run check:diff passed when hooks were skipped or unavailable
  • Targeted behavior tests pass for the current change set, or tests are marked not applicable above — npx vitest run test/pr-workflow-contract.test.ts test/pr-e2e-gate-shards.test.ts --project integration (22 passed); npx vitest run test/e2e/support/e2e-workflow.test.ts --project e2e-support (36 passed); workflow validator, npm run source-shape:check, and npm run checks passed.
  • Applicable broad gate passed — npm test for broad runtime/test-harness changes; npm run check for repo-wide validation/coverage changes — command/result:
  • Quality Gates section completed with required justifications or waivers
  • No secrets, API keys, or credentials committed
  • npm run docs builds without warnings (doc changes only)
  • Doc pages follow the style guide (doc changes only)
  • New doc pages include SPDX header and frontmatter (new pages only)

Signed-off-by: Carlos Villela cvillela@nvidia.com

Summary by CodeRabbit

  • CI & Build Improvements

    • Updated CLI coverage and sourcemap verification to automatically run the correct .mts vs .ts script variant when present.
  • Bug Fixes

    • Fixed Bedrock-compatible Anthropic E2E shard propagation by requiring the runtime shard to match the matrix agent and failing fast on drift/mismatch.
  • Tests

    • Added/expanded E2E and PR workflow contract tests for shard expectations and boundary validation.
    • Enhanced workflow step execution coverage with optional working-directory support and .ts/.mts entrypoint compatibility checks.

Signed-off-by: Carlos Villela <cvillela@nvidia.com>
@cv cv added area: e2e End-to-end tests, nightly failures, or validation infrastructure chore Build, CI, dependency, or tooling maintenance v0.0.84 labels Jul 15, 2026
@cv cv self-assigned this Jul 15, 2026
@coderabbitai

coderabbitai Bot commented Jul 15, 2026

Copy link
Copy Markdown
Contributor

Review Change Stack

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info
⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Enterprise

Run ID: 04cfb108-0319-4945-82aa-79befc4852b1

📥 Commits

Reviewing files that changed from the base of the PR and between 1c48bbc and 41b6235.

📒 Files selected for processing (2)
  • test/e2e/live/bedrock-runtime-compatible-anthropic.test.ts
  • test/pr-risk-plan.test.ts

📝 Walkthrough

Walkthrough

Coverage actions now support .mts and .ts script entrypoints. The Bedrock Anthropic E2E job propagates its matrix shard identity, with boundary, shard-policy, live-test, and risk-plan checks enforcing the contract.

Changes

CI entrypoint compatibility

Layer / File(s) Summary
Coverage script selection and compatibility tests
.github/actions/ci-cli-coverage-merge/action.yaml, .github/actions/ci-cli-coverage-shard/action.yaml, .github/actions/ci-plugin-coverage/action.yaml, test/pr-workflow-contract.test.ts
Coverage actions select .mts scripts when available and fall back to .ts; tests cover supported and missing entrypoint variants.

Bedrock E2E shard propagation

Layer / File(s) Summary
Matrix shard wiring and contract validation
.github/workflows/e2e.yaml, tools/e2e/workflow-boundary.mts, test/e2e/support/e2e-workflow.test.ts, test/pr-e2e-gate-shards.test.ts, test/e2e/live/bedrock-runtime-compatible-anthropic.test.ts, test/pr-risk-plan.test.ts
The Bedrock Anthropic job sets NEMOCLAW_E2E_SHARD from matrix.agent; boundary, shard-policy, live-test, and risk-plan tests validate the resulting contract.

Estimated code review effort: 3 (Moderate) | ~20 minutes

Possibly related PRs

Suggested labels: area: ci

Suggested reviewers: brandonpelfrey, cjagwani, ericksoa

🚥 Pre-merge checks | ✅ 4 | ❌ 1

❌ Failed checks (1 warning)

Check name Status Explanation Resolution
Docstring Coverage ⚠️ Warning Docstring coverage is 0.00% which is insufficient. The required threshold is 80.00%. Write docstrings for the functions missing them to satisfy the coverage threshold.
✅ Passed checks (4 passed)
Check name Status Explanation
Description Check ✅ Passed Check skipped - CodeRabbit’s high-level summary is enabled.
Title check ✅ Passed The title clearly matches the PR’s main CI and TypeScript migration gate updates.
Linked Issues check ✅ Passed Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check ✅ Passed Check skipped because no linked issues were found for this pull request.
✨ Finishing Touches
📝 Generate docstrings
  • Create stacked PR
  • Commit on current branch
🧪 Generate unit tests (beta)
  • Create PR with unit tests
  • Commit unit tests in branch codex/ci-mts-prerequisites-v84

Comment @coderabbitai help to get the list of available commands.

@github-code-quality

github-code-quality Bot commented Jul 15, 2026

Copy link
Copy Markdown
Contributor

Code Coverage Overview

Languages: TypeScript

TypeScript / code-coverage/plugin

The overall coverage remains at 96%, unchanged from the main branch.

TypeScript / code-coverage/cli

The overall coverage in the codex/ci-mts-prerequ... branch remains at 80%, unchanged from the main branch.

Show a code coverage summary of the most impacted files.
File main f1eef2c codex/ci-mts-prerequ... 43330e6 +/-
src/lib/inferen...del-registry.ts 100% 66% -34%
src/lib/inference/local.ts 84% 77% -7%
src/lib/adapter...shell/client.ts 88% 83% -5%
src/lib/agent/aliases.ts 94% 89% -5%
src/lib/securit...ntial-filter.ts 99% 98% -1%
src/lib/inferen...time-context.ts 92% 94% +2%
src/lib/agent/m...fest-readers.ts 95% 97% +2%
src/lib/shields/audit.ts 92% 97% +5%
src/lib/agent/dashboard-ui.ts 85% 91% +6%
src/lib/core/pr...mpt-activity.ts 67% 92% +25%

Updated July 15, 2026 19:42 UTC
Code Coverage is in Public Preview. Learn more and provide us with your feedback.

@github-actions

github-actions Bot commented Jul 15, 2026

Copy link
Copy Markdown
Contributor

PR Review Advisor — Informational

Advisor assessment: Informational / high confidence
Next action: No advisor follow-up needed.
Findings: 0 blockers · 0 warnings · 0 suggestions
Status: No actionable findings remain in the canonical review ledger.

Model lanes

  • GPT-5.6 Terra (primary): Completed · high confidence · 0 blockers · 0 warnings · 0 suggestions
  • Nemotron 3 Ultra (second opinion): Completed · high confidence · 0 blockers · 1 warning · 0 suggestions
  • Model comparison: normalized findings differ; normalized E2E selections match; Nemotron reported the same number of blockers, 1 more warning, the same number of suggestions.

Nemotron output stays in workflow artifacts and does not change the assessment above.

E2E guidance

Advisory only. E2E / PR Gate selects and runs jobs independently.

Recommended E2E: cloud-onboard, credential-sanitization, security-posture

1 optional E2E recommendation
  • bedrock-runtime-compatible-anthropic

Workflow run details

This automated review informs maintainers. Warnings and suggestions do not require a response. A maintainer decides whether to merge.

Signed-off-by: Carlos Villela <cvillela@nvidia.com>

@coderabbitai coderabbitai Bot left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

🧹 Nitpick comments (1)
.github/actions/ci-cli-coverage-merge/action.yaml (1)

54-58: 📐 Maintainability & Code Quality | 🔵 Trivial | ⚡ Quick win

Same .mts/.ts fallback snippet copy-pasted 4x across 3 action files.

Each site resolves an entrypoint by checking for a .mts file and falling back to .ts, using identical 4-line logic just against different script stems. This works correctly (verified npx tsx supports both extensions natively), but the duplication means the eventual migration cleanup (removing the .ts fallback) has to touch 4 separate locations instead of one.

  • .github/actions/ci-cli-coverage-merge/action.yaml#L54-L58: extract this into a shared resolver (e.g. a small script invoked as dist_sourcemap_check=$(scripts/ci/resolve-entrypoint.sh scripts/check-dist-sourcemaps)).
  • .github/actions/ci-cli-coverage-merge/action.yaml#L102-L106: use the same shared resolver for scripts/check-coverage-ratchet.
  • .github/actions/ci-cli-coverage-shard/action.yaml#L105-L109: use the same shared resolver for scripts/check-dist-sourcemaps.
  • .github/actions/ci-plugin-coverage/action.yaml#L34-L38: use the same shared resolver for scripts/check-coverage-ratchet.
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In @.github/actions/ci-cli-coverage-merge/action.yaml around lines 54 - 58,
Extract the repeated .mts/.ts entrypoint selection into a shared resolver
script, such as scripts/ci/resolve-entrypoint.sh, accepting the script stem and
outputting the existing .mts path or .ts fallback. Update all four
sites—.github/actions/ci-cli-coverage-merge/action.yaml lines 54-58 for
scripts/check-dist-sourcemaps, lines 102-106 for scripts/check-coverage-ratchet,
.github/actions/ci-cli-coverage-shard/action.yaml lines 105-109 for
scripts/check-dist-sourcemaps, and
.github/actions/ci-plugin-coverage/action.yaml lines 34-38 for
scripts/check-coverage-ratchet—to use the resolver before invoking npx tsx.
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Nitpick comments:
In @.github/actions/ci-cli-coverage-merge/action.yaml:
- Around line 54-58: Extract the repeated .mts/.ts entrypoint selection into a
shared resolver script, such as scripts/ci/resolve-entrypoint.sh, accepting the
script stem and outputting the existing .mts path or .ts fallback. Update all
four sites—.github/actions/ci-cli-coverage-merge/action.yaml lines 54-58 for
scripts/check-dist-sourcemaps, lines 102-106 for scripts/check-coverage-ratchet,
.github/actions/ci-cli-coverage-shard/action.yaml lines 105-109 for
scripts/check-dist-sourcemaps, and
.github/actions/ci-plugin-coverage/action.yaml lines 34-38 for
scripts/check-coverage-ratchet—to use the resolver before invoking npx tsx.

ℹ️ Review info
⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Enterprise

Run ID: b71debd4-aa5a-4dd9-addd-0b0d39087001

📥 Commits

Reviewing files that changed from the base of the PR and between 7d1cef9 and 7bb79ee.

📒 Files selected for processing (8)
  • .github/actions/ci-cli-coverage-merge/action.yaml
  • .github/actions/ci-cli-coverage-shard/action.yaml
  • .github/actions/ci-plugin-coverage/action.yaml
  • .github/workflows/e2e.yaml
  • test/e2e/support/e2e-workflow.test.ts
  • test/pr-e2e-gate-shards.test.ts
  • test/pr-workflow-contract.test.ts
  • tools/e2e/workflow-boundary.mts

Signed-off-by: Carlos Villela <cvillela@nvidia.com>
@cv
cv requested a review from laitingsheng July 15, 2026 19:26
Signed-off-by: Carlos Villela <cvillela@nvidia.com>
@cv

cv commented Jul 15, 2026

Copy link
Copy Markdown
Collaborator Author

Follow-up commit 43330e6 removes the live self-assertion and risk-selection test added in the prior commit. Protected E2E executes the workflow currently trusted on main, so that assertion could only observe the legacy default shard until this wiring lands; both Bedrock matrix jobs therefore stopped before runtime behavior was exercised. The checked-in workflow mapping remains covered by the E2E workflow contract tests. After this prerequisite merges, #6938 will run the OpenClaw and Hermes Bedrock variants with the new shard identity and provide the live evidence.

@cv cv mentioned this pull request Jul 27, 2026
20 tasks
cv added a commit that referenced this pull request Jul 28, 2026
<!-- markdownlint-disable MD041 -->
## Summary

Trusted coverage actions now invoke only the migrated `.mts`
entrypoints. Missing entrypoints fail at the canonical path instead of
falling back to deleted `.ts` files.

## Related Issue

Part of #6918

## Changes

- Remove four temporary coverage and sourcemap fallbacks added by #6969
for the migration window.
- Remove the matching E2E mock-parity fallback after the repository
check suite migration landed.
- Update the behavioral parity fixture to reject the retired `.ts`
entrypoint.
- Keep the existing parity missing-entrypoint diagnostic, but require
the `.mts` path.
- Update the workflow contract to accept only `.mts` entrypoints and
reject a missing canonical file.

## Type of Change

- [x] Code change (feature, bug fix, or refactor)
- [ ] Code change with doc updates
- [ ] Doc only (prose changes, no code sample modifications)
- [ ] Doc only (includes code sample changes)

## Quality Gates

- [x] Tests added or updated for changed behavior
- [ ] Existing tests cover changed behavior — justification:
- [ ] Tests not applicable — justification:
- [ ] Docs updated for user-facing behavior changes
- [x] Docs not applicable — justification: These internal CI entrypoint
paths do not change a command, configuration, output, or supported
workflow.
- [x] Sensitive paths changed (security, policy, credentials, preflight,
onboarding, inference, runner, sandbox, or messaging)
- [x] Sensitive-path review completed or maintainer-approved waiver
recorded — reviewer/approval link/justification: [Refreshed security
review](#7668 (comment))
passed on exact head `5d85df195`; the diff narrows trusted execution to
fixed `.mts` paths and updates only regression tests.
- [ ] Non-success, skipped, or missing CI check accepted by maintainer —
check name, approval link, and follow-up issue:

## Documentation Writer Review

- [x] Documentation writer subagent reviewed the completed changes
- Result: `no-docs-needed`
- Evidence: Head `5d85df195` changes only internal CI actions and
regression tests. Test titles and CI error text follow `WRITING.md`; no
user-facing documentation is affected.
- Agent: Codex Desktop
<!-- docs-review-head-sha: 5d85df1 -->
<!-- docs-review-agents-blob-sha: be20a09 -->

## DGX Station Hardware Evidence

- [ ] Tested on DGX Station
- Tested commit:
- Station profile/scenario:
- Result:
- Supporting evidence:

## Verification

Signed-off-by: Carlos Villela <cvillela@nvidia.com>

- [x] PR description includes a `Signed-off-by:` line and every commit
appears as `Verified` in GitHub
- [x] Normal `pre-commit`, `commit-msg`, and `pre-push` hooks passed, or
`npm run check:diff` passed when hooks were skipped or unavailable
- [x] Targeted behavior tests pass for the current change set, or tests
are marked not applicable above — `npx vitest run
test/e2e-mock-parity.test.ts test/pr-workflow-contract.test.ts --project
integration`: 2 files and 31 tests passed. Biome and normal commit hooks
passed.
- [ ] Applicable broad gate passed — `npm test` for broad
runtime/test-harness changes; `npm run check` for repo-wide
validation/coverage changes — command/result:
- [x] Quality Gates section completed with required justifications or
waivers
- [x] No secrets, API keys, or credentials committed


<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->

## Summary by CodeRabbit

* **CI and Validation**
* Standardized coverage, sourcemap, and E2E mock parity checks on the
migrated TypeScript entrypoints.
* Removed compatibility handling for retired script variants, enabling
faster failure when required checks are unavailable.

* **Tests**
  * Updated workflow contract tests to verify the new entrypoints.
  * Added coverage for rejecting missing or retired validation scripts.

<!-- end of auto-generated comment: release notes by coderabbit.ai -->

---------

Signed-off-by: Carlos Villela <cvillela@nvidia.com>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

area: e2e End-to-end tests, nightly failures, or validation infrastructure chore Build, CI, dependency, or tooling maintenance

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants