fix(ci): ignore irrelevant base-image run history

[sandl99]

Summary

Manual E2E runs on main failed when the publication verifier encountered historical runs from before the base-image workflow rename. This change validates only runs on the eligible first-parent history while preserving strict provenance checks for every eligible run.

Changes

• Filter workflow runs by eligible first-parent SHA before validating current workflow metadata.
• Add regression coverage that ignores pre-rename metadata outside the eligible history and rejects it inside the eligible history.

Type of Change

• Code change (feature, bug fix, or refactor)
• Code change with doc updates
• Doc only (prose changes, no code sample modifications)
• Doc only (includes code sample changes)

Quality Gates

• Tests added or updated for changed behavior
• Existing tests cover changed behavior — justification:
• Tests not applicable — justification:
• Docs updated for user-facing behavior changes
• Docs not applicable — justification: This changes internal GitHub Actions evidence selection. It does not change the CLI, configuration, or supported runtime behavior.
• Sensitive paths changed (security, policy, credentials, preflight, onboarding, inference, runner, sandbox, or messaging)
• Sensitive-path review completed or maintainer-approved waiver recorded — reviewer/approval link/justification: Eligible runs retain exact workflow, repository, branch, event, URL, status, and job provenance validation. The regression tests prove that only ineligible history bypasses those checks.
• Non-success, skipped, or missing CI check accepted by maintainer — check name, approval link, and follow-up issue:

Documentation Writer Review

• Documentation writer subagent reviewed the completed changes
• Result: no-docs-needed
• Evidence: The change affects internal CI evidence selection only. No user-facing commands, configuration, schemas, or supported workflows change.
• Agent: Codex CLI
• PR: fix(ci): ignore irrelevant base-image run history #7426

DGX Station Hardware Evidence

• Tested on DGX Station
• Tested commit:
• Station profile/scenario:
• Result:
• Supporting evidence:

Verification

• PR description includes a Signed-off-by: line and every commit appears as Verified in GitHub
• Normal pre-commit, commit-msg, and pre-push hooks passed, or npm run check:diff passed when hooks were skipped or unavailable
• Targeted behavior tests pass for the current change set, or tests are marked not applicable above — npx vitest run --project e2e-support test/e2e/support/base-image-publication.test.ts passed 33 tests.
• Applicable broad gate passed — npm test for broad runtime/test-harness changes; npm run check for repo-wide validation/coverage changes — command/result:
• Quality Gates section completed with required justifications or waivers
• No secrets, API keys, or credentials committed
• npm run docs builds without warnings (doc changes only)
• Doc pages follow the style guide (doc changes only)
• New doc pages include SPDX header and frontmatter (new pages only)

---

Signed-off-by: San Dang sdang@nvidia.com

Summary by CodeRabbit

• Bug Fixes
  • Improved publication run selection by ignoring workflow runs outside the eligible commit history.
  • Prevented outdated pre-rename workflow metadata from being selected.
  • Added validation to reject eligible runs with an incorrect workflow name.
  • Expanded end-to-end test coverage for workflow history and metadata handling.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Enterprise

Run ID: 47b99f0f-6846-42af-83b4-99d69f7122d6

📥 Commits

Reviewing files that changed from the base of the PR and between 21e60ae and 0616729.

📒 Files selected for processing (2)

• test/e2e/support/base-image-publication.test.ts
• tools/e2e/base-image-publication.mts

---

📝 Walkthrough

Walkthrough

selectPublicationRun now validates only workflow runs whose commits are in the eligible history. End-to-end tests cover ignoring pre-rename metadata outside that history and rejecting it when it is eligible.

Changes

Publication run selection

Layer / File(s)	Summary
History-filtered run validation tools/e2e/base-image-publication.mts, test/e2e/support/base-image-publication.test.ts	selectPublicationRun filters runs by head_sha before validation, with tests covering eligible and ineligible pre-rename workflow metadata.

Estimated code review effort: 2 (Simple) | ~10 minutes

Possibly related PRs

• NVIDIA/NemoClaw#7373: Introduces the related base-image-publication gate workflow behavior affected by this run-selection logic.

Suggested labels: area: ci, area: e2e, area: packaging, bug-fix, v0.0.93

Suggested reviewers: apurvvkumaria, cv

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly matches the main change: filtering out irrelevant base-image workflow run history in CI.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

✨ Finishing Touches

📝 Generate docstrings

• Create stacked PR
• Commit on current branch

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch fix/base-image-publication-history

---

_{Comment @coderabbitai help to get the list of available commands.}

[github-code-quality]

Code Coverage Overview

Languages: TypeScript

TypeScript / code-coverage/plugin

The overall coverage in commit 0616729 in the fix/base-image-publi... branch remains at 96%, unchanged from commit 21e60ae in the main branch.

TypeScript / code-coverage/cli

The overall coverage in commit 0616729 in the fix/base-image-publi... branch remains at 80%, unchanged from commit 21e60ae in the main branch.

Show a code coverage summary of the most impacted files.

File	main 21e60ae	fix/base-image-publi... 0616729	+/-
src/lib/inferen...lama/process.ts	100%	50%	-50%
src/lib/inferen...er-lifecycle.ts	71%	65%	-6%
src/lib/agent/r...ime-manifest.ts	100%	100%	0%
src/lib/messagi...nnels/policy.ts	100%	100%	0%
src/lib/sandbox...rce-identity.ts	87%	87%	0%
src/lib/securit...ntial-filter.ts	93%	93%	0%
src/lib/trace.ts	94%	94%	0%
src/lib/state/g...way-registry.ts	94%	95%	+1%
src/lib/platform.ts	84%	89%	+5%

---

_{Updated July 23, 2026 10:14 UTC}

[github-actions]

PR Review Advisor — Informational

Advisor assessment: Informational / high confidence
Next action: No advisor follow-up needed.
Findings: 0 blockers · 0 warnings · 0 suggestions
Status: No actionable findings remain in the canonical review ledger.

Model lanes

• GPT-5.6 Terra (primary): Completed · high confidence · 0 blockers · 0 warnings · 0 suggestions
• Nemotron 3 Ultra (second opinion): Completed · high confidence · 0 blockers · 0 warnings · 0 suggestions
• Model comparison: normalized findings match; normalized E2E selections differ; severity counts match.

Nemotron output stays in workflow artifacts and does not change the assessment above.

E2E guidance

Advisory only. E2E / PR Gate selects and runs jobs independently.

Recommended E2E: cloud-onboard, credential-sanitization, security-posture

Workflow run details

This automated review informs maintainers. Warnings and suggestions do not require a response. A maintainer decides whether to merge.

[github-actions]

E2E Target Results — ❌ Some tests failed

Run: 29998445991
Workflow ref: fix/base-image-publication-history
Requested targets: (selector rejected by workflow validation)
Requested test IDs: (default — all default-enabled tests; explicit-only tests openshell-gateway-auth-contract, mcp-bridge-dev, hermes-gpu-startup, sandbox-rlimits-connect, and jetson-nvmap-gpu are skipped unless selected)
Summary: 0 passed, 1 failed, 0 cancelled, 0 skipped, 0 unknown

Test	Result	Total wall clock time
base-image-publication	❌ failure	5s

Failed tests: base-image-publication. Check the workflow run for all logs and artifacts.