chore(deps): bump actions/setup-node from 6 to 7 - #7161
Merged
Conversation
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Signed-off-by: Apurv Kumaria <akumaria@nvidia.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Signed-off-by: Apurv Kumaria <akumaria@nvidia.com>
apurvvkumaria
added
dependencies
Contributor
📝 WalkthroughWalkthroughChangesThe PR repins CI and workflow references to CI action pin refresh
Estimated code review effort: 2 (Simple) | ~10 minutes Suggested labels: Suggested reviewers: 🚥 Pre-merge checks | ✅ 4 | ❌ 1❌ Failed checks (1 warning)
✅ Passed checks (4 passed)
✨ Finishing Touches📝 Generate docstrings
🧪 Generate unit tests (beta)
Comment |
Contributor
|
🌿 Preview your docs: https://nvidia-preview-pr-7161.docs.buildwithfern.com/nemoclaw |
Contributor
Code Coverage OverviewLanguages: TypeScript TypeScript / code-coverage/pluginThe overall coverage in commit 8ffb799 in the TypeScript / code-coverage/cliThe overall coverage in commit 8ffb799 in the Show a code coverage summary of the most impacted files.
Updated |
Contributor
PR Review Advisor — InformationalAdvisor assessment: Informational / high confidence Model lanes
Nemotron output stays in workflow artifacts and does not change the assessment above. E2E guidanceAdvisory only. E2E / PR Gate selects and runs jobs independently. Recommended E2E: This automated review informs maintainers. Warnings and suggestions do not require a response. A maintainer decides whether to merge. |
Preserve the trusted advisor helper ordering introduced on main. Keep the official v7 pin and refresh its boundary-test fixture. Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Signed-off-by: Apurv Kumaria <akumaria@nvidia.com>
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
Contributor
There was a problem hiding this comment.
🧹 Nitpick comments (1)
test/pr-review-advisor-workflow-boundary.test.ts (1)
1245-1246: 📐 Maintainability & Code Quality | 🔵 Trivial | ⚡ Quick winMutate the workflow structurally instead of replacing serialized YAML.
This assertion is coupled to the exact formatting and quoting of the workflow text. Use
mutateWorkflowSource()to locateSetup Node for trusted publisherand change onlywith.node-version, so the test continues to validate the boundary behavior after harmless YAML formatting changes.As per path instructions, tests should favor behavioral confidence over implementation lock-in.
Proposed refactor
- const downgradedPublisherNode = validateMutation((source) => - source.replace( - ' - name: Setup Node for trusted publisher\n uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0\n with:\n node-version: "22"', - ' - name: Setup Node for trusted publisher\n uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0\n with:\n node-version: "20"', - ), - ); + const downgradedPublisherNode = validateMutation((source) => + mutateWorkflowSource(source, (workflow) => { + const step = workflow.jobs.publish.steps.find( + (candidate: { name?: string }) => + candidate.name === "Setup Node for trusted publisher", + ); + expect(step).toBeDefined(); + step.with = { ...(step.with ?? {}), "node-version": "20" }; + }), + );🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@test/pr-review-advisor-workflow-boundary.test.ts` around lines 1245 - 1246, Update the test setup around the trusted publisher workflow fixture to use mutateWorkflowSource() and target the step named “Setup Node for trusted publisher,” changing only its with.node-version value from 22 to 20. Remove the exact serialized YAML string replacement so the assertion remains independent of formatting and quoting while preserving the existing boundary-behavior validation.Source: Path instructions
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Nitpick comments:
In `@test/pr-review-advisor-workflow-boundary.test.ts`:
- Around line 1245-1246: Update the test setup around the trusted publisher
workflow fixture to use mutateWorkflowSource() and target the step named “Setup
Node for trusted publisher,” changing only its with.node-version value from 22
to 20. Remove the exact serialized YAML string replacement so the assertion
remains independent of formatting and quoting while preserving the existing
boundary-behavior validation.
ℹ️ Review info
⚙️ Run configuration
Configuration used: Path: .coderabbit.yaml
Review profile: CHILL
Plan: Enterprise
Run ID: e4969609-0e7f-4b23-b7fb-be0e62babbff
📒 Files selected for processing (2)
.github/workflows/pr-review-advisor.yamltest/pr-review-advisor-workflow-boundary.test.ts
Collaborator
Author
|
Exact-head maintainer audit on
Because this PR is authored by the assignee, I requested independent review from @laitingsheng and did not self-approve. |
Preserve setup-node v7. Retain the current-main workflow and runner-pressure changes. Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Signed-off-by: Apurv Kumaria <akumaria@nvidia.com>
Collaborator
Author
|
Current-main refresh pushed as
Validation passed:
Fresh exact-head CI and advisor checks are now running. |
laitingsheng
approved these changes
Jul 20, 2026
laitingsheng
left a comment
laitingsheng
left a comment
Contributor
There was a problem hiding this comment.
Verified against the project criteria at head 5765e2807d:
- Pin authenticity — upstream
actions/setup-nodev7.0.0and thev7major tag both resolve to the same commit820762786026740c76f36085b0efc47a31fe5020. All 40 production references are pinned to that immutable full SHA (not a mutable tag). - prepare-e2e boundary — the 77 trusted
prepare-e2econsumers are repinned to the branch bootstrap commitf6304bc25f, whoseaction.yamlalready carries the v7 update. The enforcedcontentSha256constant (1283c2ea…dfbc) matches the file's SHA-256 exactly, and the content is byte-identical fromf6304bc25fto head, so the supply-chain provenance boundary holds. - Scope — every changed line is a setup-node pin, a
prepare-e2epin, or an aligned boundary constant / hash / test assertion. No logic changes, no scope creep, no stray markers, SPDX headers intact. - Tests — workflow-boundary tests and provenance tools are realigned to the v7 SHA and new hash; the
pr-workflow-contractassertion is tightened from.toContain(...)to.toBe(trustedSetupNodeAction). Boundary suites and macOS/WSL E2E exercise the newprepare-e2epin and pass. - CI — all other required checks are green. The two red
E2E / PR GateandE2E / PR Gate Coordinationchecks stem from a single transient GitHub API503 No server is currently availableduring coordination ("Run could not start"); they are unrelated to this change and clear on re-run.
Preserve current-main workflow telemetry and runner-pressure behavior. Repin every new setup-node and trusted prepare-e2e consumer. Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Signed-off-by: Apurv Kumaria <akumaria@nvidia.com>
Contributor
There was a problem hiding this comment.
🧹 Nitpick comments (1)
.github/workflows/e2e.yaml (1)
5892-5892: 🔒 Security & Privacy | 🔵 Trivial | ⚡ Quick winPre-existing template-injection pattern flagged by zizmor (not introduced by this PR).
const needs = ${{ toJSON(needs) }};interpolates theneedscontext directly into the script's JS source text rather than passing it as data (e.g., viaenv:+JSON.parse(process.env.NEEDS_JSON)), which is the same pattern zizmor'stemplate-injectionrule flags. The identical construct already exists unchanged in this file'sreport-to-prjob, so this predates the pin refresh — flagging for awareness/future hardening rather than as a regression from this PR.🛡️ Example hardening for future consideration
- env: + env: + NEEDS_JSON: ${{ toJSON(needs) }} EXPLICIT_ONLY_JOBS: ${{ needs.generate-matrix.outputs.explicit_only_jobs }} JOBS: ${{ inputs.jobs }} RUNTIME_ARTIFACTS: ${{ runner.temp }}/e2e-runtime-audit RUNTIME_SUMMARY_FILE: ${{ runner.temp }}/e2e-runtime-summary.json with: script: | - const needs = ${{ toJSON(needs) }}; + const needs = JSON.parse(process.env.NEEDS_JSON);🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In @.github/workflows/e2e.yaml at line 5892, Harden the workflow’s needs data handling in the affected job and the identical report-to-pr construct by removing direct ${{ toJSON(needs) }} interpolation from JavaScript source. Pass the serialized needs context through the step’s env and parse that environment value inside the script, preserving the existing needs data behavior.Source: Linters/SAST tools
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Nitpick comments:
In @.github/workflows/e2e.yaml:
- Line 5892: Harden the workflow’s needs data handling in the affected job and
the identical report-to-pr construct by removing direct ${{ toJSON(needs) }}
interpolation from JavaScript source. Pass the serialized needs context through
the step’s env and parse that environment value inside the script, preserving
the existing needs data behavior.
ℹ️ Review info
⚙️ Run configuration
Configuration used: Path: .coderabbit.yaml
Review profile: CHILL
Plan: Enterprise
Run ID: 3442d821-0602-4b56-8569-7b03d144e602
📒 Files selected for processing (13)
.github/actions/ci-reviewed-npm-audit/action.yaml.github/workflows/candidate-compatibility.yaml.github/workflows/code-scanning.yaml.github/workflows/docs-publish-staging.yaml.github/workflows/docs-review-receipt.yaml.github/workflows/e2e-branch-validation.yaml.github/workflows/e2e.yaml.github/workflows/main.yaml.github/workflows/platform-vitest-main.yaml.github/workflows/pr-e2e-gate.yaml.github/workflows/pr.yaml.github/workflows/regression-e2e.yaml.github/workflows/sandbox-images-and-e2e.yaml
🚧 Files skipped from review as they are similar to previous changes (8)
- .github/actions/ci-reviewed-npm-audit/action.yaml
- .github/workflows/e2e-branch-validation.yaml
- .github/workflows/candidate-compatibility.yaml
- .github/workflows/sandbox-images-and-e2e.yaml
- .github/workflows/platform-vitest-main.yaml
- .github/workflows/main.yaml
- .github/workflows/code-scanning.yaml
- .github/workflows/pr.yaml
Collaborator
Author
|
Exact-head CI is green at |
Signed-off-by: Apurv Kumaria <akumaria@nvidia.com>
Collaborator
Author
|
Fix-forward update: exact-head E2E passed cloud-onboard, credential sanitization, and Hermes security posture, but OpenClaw security posture failed. Current |
Collaborator
Author
|
All ordinary and self-hosted checks are green at exact head |
apurvvkumaria
pushed a commit
that referenced
this pull request
Jul 27, 2026
<!-- markdownlint-disable MD041 --> ## Summary Add the canonical `docs/changelog/2026-07-25.mdx` release entry with the exact `## v0.0.96` heading. The entry reconciles all 90 first-parent commits since v0.0.95 with all 92 merged PRs in the live `v0.0.96` label ledger and groups the user-visible changes by operator journey. ## Changes - Add the parser-safe dated MDX changelog entry for v0.0.96 with root-absolute links to the focused user guides. - Source summary: - [#7194](#7194) -> `docs/changelog/2026-07-25.mdx`: Document persistent baseline network policy exclusions and their inspection, rebuild, and snapshot behavior. - [#7188](#7188), [#7427](#7427), and [#7546](#7546) -> `docs/changelog/2026-07-25.mdx`: Document DNS-backed HTTPS inference routing, keyless loopback endpoints, and provider-marker isolation. - [#7238](#7238) -> `docs/changelog/2026-07-25.mdx`: Document blueprint sandbox and provider identifier validation before state writes or OpenShell calls, with bounded terminal-safe rejection previews. - [#7319](#7319), [#7274](#7274), [#7528](#7528), [#7353](#7353), and [#7560](#7560) -> `docs/changelog/2026-07-25.mdx`: Document the managed default gateway service, onboarding readiness, and container-runtime identity safeguards. - [#7349](#7349), [#7498](#7498), [#7406](#7406), [#7196](#7196), [#7559](#7559), [#7421](#7421), [#7510](#7510), [#7295](#7295), and [#7565](#7565) -> `docs/changelog/2026-07-25.mdx`: Document gateway-scoped status, lifecycle diagnostics, managed MCP recovery, delete-edge safeguards, and fail-closed CLI prompt and command output. - [#7591](#7591) -> `docs/changelog/2026-07-25.mdx`: Document opt-in authenticated MCP tool-name discovery, its bounded and names-only contract, probe interaction, and rebuild requirement. - [#7305](#7305), [#7480](#7480), [#7471](#7471), [#7365](#7365), and [#7541](#7541) -> `docs/changelog/2026-07-25.mdx`: Document installer version checks, version-tag reporting, license guidance, WSL Ollama selection, and DGX Station vLLM detection. - [#7482](#7482), [#7466](#7466), [#7208](#7208), [#7434](#7434), and [#7586](#7586) -> `docs/changelog/2026-07-25.mdx`: Document Ollama resource details, reasoning precedence, Hermes onboarding behavior, and preserved managed Hermes BuildKit failures. - [#6830](#6830), [#7492](#7492), [#7563](#7563), and [#7582](#7582) -> `docs/changelog/2026-07-25.mdx`: Document the authoritative OpenClaw production lock, fixed managed-image dependencies, immutable Hermes base adoption, and Hermes image-size reduction. - [#7505](#7505), [#7530](#7530), [#7547](#7547), [#7508](#7508), [#7548](#7548), [#7549](#7549), [#7537](#7537), [#7534](#7534), [#7515](#7515), [#7511](#7511), [#7551](#7551), [#7562](#7562), [#7575](#7575), [#7496](#7496), [#7594](#7594), [#7595](#7595), and [#7599](#7599) -> `docs/changelog/2026-07-25.mdx`: Summarize release validation, transient and bounded dispatch reconciliation, exact pre-tag qualification, identity revalidation, npm-audit retry, sharding, image reuse, timeout, telemetry, and workflow-hardening changes. - Reconciled without separate changelog prose: - [#7539](#7539), [#7526](#7526), [#7507](#7507), [#7506](#7506), [#7519](#7519), [#7516](#7516), [#7396](#7396), [#7254](#7254), [#7583](#7583), [#7596](#7596), and [#7598](#7598): Test-harness or fixture-only changes. - [#7403](#7403), [#7161](#7161), [#6877](#6877), [#7531](#7531), [#7525](#7525), [#7522](#7522), [#7536](#7536), [#7552](#7552), [#7566](#7566), [#7553](#7553), [#7561](#7561), [#7577](#7577), [#7569](#7569), [#7585](#7585), [#7584](#7584), [#7592](#7592), [#7580](#7580), [#7571](#7571), [#7517](#7517), [#7589](#7589), [#7402](#7402), [#7558](#7558), [#7544](#7544), and [#7601](#7601): Dependency, internal recovery, validation, contributor-workflow, E2E optimization, telemetry, or CI trust changes with no separate user-facing release claim. - [#7556](#7556), [#7573](#7573), [#7576](#7576), and [#7578](#7578): Experimental repository-maintainer conflict automation with no canonical user documentation surface. ## Type of Change - [ ] Code change (feature, bug fix, or refactor) - [ ] Code change with doc updates - [x] Doc only (prose changes, no code sample modifications) - [ ] Doc only (includes code sample changes) ## Quality Gates - [ ] Tests added or updated for changed behavior - [x] Existing tests cover changed behavior — justification: `test/changelog-docs.test.ts` validates dated changelog structure, version headings, and published links. - [ ] Tests not applicable — justification: - [x] Docs updated for user-facing behavior changes - [ ] Docs not applicable — justification: - [ ] Sensitive paths changed (security, policy, credentials, preflight, onboarding, inference, runner, sandbox, or messaging) - [ ] Sensitive-path review completed or maintainer-approved waiver recorded — reviewer/approval link/justification: - [ ] Non-success, skipped, or missing CI check accepted by maintainer — check name, approval link, and follow-up issue: ## Documentation Writer Review - [x] Documentation writer subagent reviewed the completed changes - Result: `docs-updated` - Evidence: Reviewed `docs/changelog/2026-07-25.mdx` at exact head `0f5dedb47` against 90 first-parent release commits and 92 merged PRs labeled `v0.0.96`. Verified parser-safe MDX SPDX, the exact version heading, literal CLI names, writing style, skip terms, all 20 root-absolute published links, and the accepted #7591 opt-in authenticated discovery bounds. #7544, #7599, and #7601 remain internal or CI-only release-ledger entries. Changelog tests passed 6/6, the docs build passed with 0 errors and two pre-existing Fern warnings, and `npm run check:diff` plus the final diff check passed. - Agent: Codex Desktop documentation-writer subagent <!-- docs-review-head-sha: 0f5dedb --> <!-- docs-review-agents-blob-sha: be20a09 --> ## DGX Station Hardware Evidence - [ ] Tested on DGX Station - Tested commit: - Station profile/scenario: - Result: - Supporting evidence: ## Verification - [x] PR description includes a `Signed-off-by:` line and every commit appears as `Verified` in GitHub - [x] Normal `pre-commit`, `commit-msg`, and `pre-push` hooks passed, or `npm run check:diff` passed when hooks were skipped or unavailable - [x] Targeted behavior tests pass for the current change set, or tests are marked not applicable above — `npx vitest run test/changelog-docs.test.ts`: 6/6 passed. - [ ] Applicable broad gate passed — `npm test` for broad runtime/test-harness changes; `npm run check` for repo-wide validation/coverage changes — command/result: Not applicable to this prose-only changelog entry. - [x] Quality Gates section completed with required justifications or waivers - [x] No secrets, API keys, or credentials committed - [ ] `npm run docs` builds without warnings (doc changes only) — the build passed with 0 errors and 2 existing Fern warnings; the published-route check passed. - [x] Doc pages follow the [style guide](https://github.com/NVIDIA/NemoClaw/blob/main/docs/CONTRIBUTING.md) (doc changes only) - [ ] New doc pages include SPDX header and frontmatter (new pages only) — native changelog files use the required parser-safe MDX SPDX comment and no frontmatter. --- Signed-off-by: Carlos Villela <cvillela@nvidia.com> <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **New Features** * Persistent network policy exclusions with consistent restore/exclusion reporting across rebuilds/snapshots. * Opt-in MCP tool discovery via `mcp status --tools` with bounded, redacted authenticated traffic. * Improved HTTPS inference switching for custom endpoints and refreshed onboarding/model menu details. * Refined OpenShell gateway defaults for port `8080`, including more reliable readiness checks. * **Bug Fixes** * Prevent incorrect provider/model restoration after compatible-provider update failures. * Preserve managed MCP state after exec loss and tighten gateway/doctor status scoping. * **Tests** * Stronger, fail-closed release validation with hardened evidence/artifact handoff and bounded timeouts/retries. <!-- end of auto-generated comment: release notes by coderabbit.ai --> --------- Signed-off-by: Prekshi Vyas <prekshiv@nvidia.com> Co-authored-by: Prekshi Vyas <prekshiv@nvidia.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Updates every production
actions/setup-nodereference from v6 to the official immutable v7.0.0 commit. This is a fresh, maintainable replacement for #6976; the original Dependabot author is credited throughout the branch history.Changes
actions/setup-nodereferences to820762786026740c76f36085b0efc47a31fe5020(v7.0.0).prepare-e2eboundary by pinning all 78 consumers to the first commit in this branch, whose action content already contains the v7 update.Type of Change
Quality Gates
Verification
Signed-off-by:line and every commit appears asVerifiedin GitHubpre-commit,commit-msg, andpre-pushhooks passed, ornpm run check:diffpassed when hooks were skipped or unavailablegit diff --checkis clean.npm testfor broad runtime/test-harness changes;npm run checkfor repo-wide validation/coverage changes — command/result: not run; focused workflow and security-contract coverage was used for this pin-only change.npm run docsbuilds without warnings (doc changes only)Documentation Writer Review
no-docs-neededSigned-off-by: Apurv Kumaria akumaria@nvidia.com
Summary by CodeRabbit
Chores
actions/setup-nodereference aligned with v7.0.0 for improved consistency and stronger supply-chain pinning.Tests
actions/setup-nodereferences and the refreshed trusted E2E preparation action pins.