Skip to content

test(e2e): retire local-only scenarios - #7625

Merged
cv merged 4 commits into
mainfrom
codex/retire-priority-0-e2e-tests
Jul 27, 2026
Merged

test(e2e): retire local-only scenarios#7625
cv merged 4 commits into
mainfrom
codex/retire-priority-0-e2e-tests

Conversation

@cv

@cv cv commented Jul 27, 2026

Copy link
Copy Markdown
Collaborator

Summary

Retire six Priority 0 E2E scenarios whose checks do not require live cloud state. Their assertions now run in ordinary integration or installer tests, or remain covered by dedicated PR workflows, reducing the shared credential-free matrix from six tests to one and removing four standalone workflow jobs.

Based on recent job medians, this removes about 5.7 runner-minutes from a full E2E invocation without weakening the covered behavior.

Related Issue

Fixes #7616
Parent: #7614

Changes

  • Move gateway health honesty and OpenShell version-pin coverage into fast source/installer integration tests.
  • Run gateway drift preflight as an ordinary integration test and preserve the invalid-key no-stack assertion in the focused credentials suite.
  • Retire redundant docs validation and Ubuntu CLI smoke scenarios in favor of existing PR workflows and alias/version tests.
  • Remove retired selectors from E2E workflows, recommendation inventory, mock parity, semantic-phase policy, and workflow contract fixtures.

Type of Change

  • Code change (feature, bug fix, or refactor)
  • Code change with doc updates
  • Doc only (prose changes, no code sample modifications)
  • Doc only (includes code sample changes)

Quality Gates

  • Tests added or updated for changed behavior
  • Existing tests cover changed behavior — justification:
  • Tests not applicable — justification:
  • Docs updated for user-facing behavior changes
  • Docs not applicable — justification: Test execution lanes and workflow inventory changed; supported behavior, configuration, output, and user procedures did not.
  • Sensitive paths changed (security, policy, credentials, preflight, onboarding, inference, runner, sandbox, or messaging)
  • Sensitive-path review completed or maintainer-approved waiver recorded — reviewer/approval link/justification: Test-only migration preserves the fail-closed gateway/preflight and credential no-stack assertions; no production sensitive code changed.
  • Non-success, skipped, or missing CI check accepted by maintainer — check name, approval link, and follow-up issue:

Documentation Writer Review

  • Documentation writer subagent reviewed the completed changes
  • Result: No documentation update required
  • Evidence: Reviewed the full E2E-retirement, gateway guardrail, and compiled package-contract diff. The package contracts preserve public version output, CLI/documentation parity, invalid-key boundaries, and repository-local link validation without changing supported behavior. No maintained-documentation references remain. The package-contract suite passes 326/326 tests across 25 files, and staged pre-commit and pre-push pass.
  • Agent: Codex Desktop documentation-writer subagent (/root/documentation_writer_review)

DGX Station Hardware Evidence

  • Tested on DGX Station
  • Tested commit:
  • Station profile/scenario:
  • Result:
  • Supporting evidence:

Verification

  • PR description includes a Signed-off-by: line and every commit appears as Verified in GitHub
  • Normal pre-commit, commit-msg, and pre-push hooks passed, or npm run check:diff passed when hooks were skipped or unavailable
  • Targeted behavior tests pass for the current change set, or tests are marked not applicable above — gateway/source integration 1/1; rebased integration 134/134 plus Advisor 44/44; installer 3/3; credentials 45/45; E2E-support 93/93; workflow fixture 46/46; boundary guards 41/41; project membership and semantic-phase checks pass.
  • Applicable broad gate passed — npm test for broad runtime/test-harness changes; npm run check for repo-wide validation/coverage changes — command/result: npm test was attempted with the SSH signing agent. The aggregate run was environment-limited by three unchanged DGX Station host-OS cases and one unchanged root-topology fixture (exec /usr/local/bin/python3: exec format error), then stopped after Vitest ceased producing output. GitHub CI is pending.
  • Quality Gates section completed with required justifications or waivers
  • No secrets, API keys, or credentials committed
  • npm run docs builds without warnings (doc changes only)
  • Doc pages follow the style guide (doc changes only)
  • New doc pages include SPDX header and frontmatter (new pages only)

Signed-off-by: Carlos Villela cvillela@nvidia.com

Summary by CodeRabbit

  • New Features

    • Added contract checks for CLI version output, documentation links, and invalid NVIDIA credential handling.
    • Added installer verification coverage for pinned OpenShell versions.
  • Bug Fixes

    • Improved validation to ensure invalid credentials fail safely without exposing secrets, making external calls, or producing misleading errors.
  • Refactor

    • Streamlined end-to-end and regression test coverage by removing obsolete checks and updating workflow selection and reporting.

Signed-off-by: Carlos Villela <cvillela@nvidia.com>
@cv cv self-assigned this Jul 27, 2026
@copy-pr-bot

copy-pr-bot Bot commented Jul 27, 2026

Copy link
Copy Markdown

Auto-sync is disabled for draft pull requests in this repository. Workflows must be run manually.

Contributors can view more details about this message here.

@coderabbitai

coderabbitai Bot commented Jul 27, 2026

Copy link
Copy Markdown
Contributor

Review Change Stack

Caution

Review failed

The pull request is closed.

ℹ️ Recent review info
⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Enterprise

Run ID: 61e115b1-486a-49ab-9e3d-8d70d520c4d7

📥 Commits

Reviewing files that changed from the base of the PR and between b77e9e8 and 7798aa7.

📒 Files selected for processing (30)
  • .github/workflows/docs-cli-parity-pr.yaml
  • .github/workflows/e2e.yaml
  • .github/workflows/regression-e2e.yaml
  • .pre-commit-config.yaml
  • ci/source-shape-test-budget.json
  • scripts/checks/vitest-project-overlap.mts
  • test/credentials.test.ts
  • test/e2e-recommendations.test.ts
  • test/e2e/live/docs-validation.test.ts
  • test/e2e/live/gateway-health-honest.test.ts
  • test/e2e/live/onboard-negative-paths.test.ts
  • test/e2e/live/ubuntu-repo-cli-smoke.test.ts
  • test/e2e/mock-parity.json
  • test/e2e/support/credential-free-tests.test.ts
  • test/e2e/support/dockerhub-auth-workflow-boundary.test.ts
  • test/e2e/support/e2e-semantic-phase-check.test.ts
  • test/e2e/support/e2e-workflow.test.ts
  • test/gateway-drift-preflight.test.ts
  • test/gateway-health-honest.test.ts
  • test/install-openshell-version-pin.test.ts
  • test/package-contract/cli/public-cli-contracts.test.ts
  • test/package-contract/onboard/invalid-nvidia-key.test.ts
  • test/pr-e2e-gate-signal-shards.test.ts
  • test/pr-review-advisor-comment-cli.test.ts
  • test/pr-review-advisor.test.ts
  • test/regression-e2e-workflow.test.ts
  • test/test-boundary-guards.test.ts
  • tools/e2e/check-semantic-phases.mts
  • tools/e2e/workflow-boundary.mts
  • vitest.config.ts

📝 Walkthrough

Walkthrough

This change retires several local-only E2E jobs and mappings, converts selected checks to direct Vitest or compiled-CLI contract tests, routes installer coverage to installer-integration, and updates workflow-boundary and recommendation fixtures.

Changes

E2E scenario retirement

Layer / File(s) Summary
Retire workflow jobs and mappings
.github/workflows/*, test/e2e/mock-parity.json, tools/e2e/*
Removes retired gateway, installer, documentation, onboarding, and CLI smoke selections, jobs, mappings, aggregation dependencies, and boundary checks.
Move checks into fast Vitest projects
test/gateway-drift-preflight.test.ts, test/gateway-health-honest.test.ts, test/install-openshell-version-pin.test.ts, test/package-contract/*, test/credentials.test.ts
Converts gateway drift and installer checks to direct Vitest execution and adds compiled CLI, invalid-key, gateway-failure, and runtime-output contract assertions.
Update project routing and recommendations
vitest.config.ts, scripts/checks/*, test/e2e-recommendations.test.ts, test/e2e/support/*, test/pr-*
Routes installer coverage to installer-integration and replaces retired recommendation and selector fixtures with vllm-docker-storage.
Refresh workflow boundary fixtures
.pre-commit-config.yaml, ci/source-shape-test-budget.json, test/e2e/support/e2e-workflow.test.ts
Updates semantic-phase matching, source-shape exceptions, and generated workflow fixtures for replacement validation jobs.

Estimated code review effort: 4 (Complex) | ~45 minutes

Possibly related issues

Possibly related PRs

Suggested labels: area: e2e, area: ci, chore

Suggested reviewers: ericksoa, prekshivyas, laitingsheng

✨ Finishing Touches
📝 Generate docstrings
  • Create stacked PR
  • Commit on current branch
🧪 Generate unit tests (beta)
  • Create PR with unit tests
  • Commit unit tests in branch codex/retire-priority-0-e2e-tests

Comment @coderabbitai help to get the list of available commands.

@github-code-quality

github-code-quality Bot commented Jul 27, 2026

Copy link
Copy Markdown
Contributor

Code Coverage Overview

Languages: TypeScript

TypeScript / code-coverage/plugin

The overall coverage in commit 7798aa7 in the codex/retire-priorit... branch remains at 96%, unchanged from commit 921e1b0 in the main branch.

TypeScript / code-coverage/cli

The overall coverage in commit 7798aa7 in the codex/retire-priorit... branch remains at 80%, unchanged from commit 921e1b0 in the main branch.

Show a code coverage summary of the most impacted files.
File main 921e1b0 codex/retire-priorit... 7798aa7 +/-
src/lib/sandbox...rce-identity.ts 88% 88% 0%
src/lib/tunnel/services.ts 73% 73% 0%
src/lib/shields/index.ts 71% 72% +1%
src/lib/onboard/tracing.ts 80% 85% +5%

Updated July 27, 2026 09:00 UTC

@github-actions

github-actions Bot commented Jul 27, 2026

Copy link
Copy Markdown
Contributor

PR Review Advisor — No blocking findings reported

Advisor assessment: No blocking advisor findings reported
Next action: No advisor follow-up needed.
Findings: 0 blockers · 0 warnings · 0 suggestions

Model lanes

  • GPT-5.6 Terra (primary): Completed · high confidence · 0 blockers · 0 warnings · 0 suggestions
  • Nemotron 3 Ultra (second opinion): Completed · medium confidence · 2 blockers · 4 warnings · 0 suggestions
  • Model comparison: normalized findings differ; normalized E2E selections differ; Nemotron reported 2 more blockers, 4 more warnings, the same number of suggestions.

Nemotron output stays in workflow artifacts and does not change the assessment above.

E2E guidance

Advisory only. E2E / PR Gate selects and runs jobs independently.

Recommended E2E: cloud-onboard, credential-sanitization, security-posture, gateway-health-honest, docs-validation, gateway-drift-preflight, onboard-negative-paths, ubuntu-repo-cli-smoke

Workflow run details

This automated review informs maintainers. Warnings and suggestions do not require a response. A maintainer decides whether to merge.

cv added 3 commits July 27, 2026 01:15
Signed-off-by: Carlos Villela <cvillela@nvidia.com>
Signed-off-by: Carlos Villela <cvillela@nvidia.com>
Signed-off-by: Carlos Villela <cvillela@nvidia.com>
@cv
cv marked this pull request as ready for review July 27, 2026 16:16
@cv
cv merged commit a8748ab into main Jul 27, 2026
71 of 79 checks passed
@cv
cv deleted the codex/retire-priority-0-e2e-tests branch July 27, 2026 16:17
cv added a commit that referenced this pull request Jul 27, 2026
<!-- markdownlint-disable MD041 -->
## Summary

PR #7625 correctly retired six local-only E2E scenarios, but the trusted
controller on `main` can still dispatch those retired selector IDs while
a candidate workflow is taking over. This adds a fail-closed transition
bridge: the candidate runs the ordinary replacement tests once and emits
controller-bound evidence for each retired selector while the remaining
live jobs continue.

## Related Issue

Follow-up to #7625 and #7616
Parent: #7614

## Changes

- Add a compatibility job for the current requirement that trusted PR
E2E controllers can select IDs retired by the candidate they dispatch.
The consumer is the SHA-bound `e2e.yaml` workflow invoked by the
controller on `main`.
- Keep the raw trusted selector list for evidence, filter only the six
known retired IDs from candidate planning, and fail closed when no
active controller-selected job remains.
- Run each replacement Vitest project once, require the retired live
files to remain absent, and emit SHA-, plan-, correlation-, and
shard-bound risk signals for all selected retired IDs.
- Extend the prepare/upload workflow boundary contracts and add planner
and compatibility regression tests. A direct controller change is
insufficient because the controller must remain on trusted `main`;
restoring the retired live jobs would reintroduce the cost this
migration removes.
- Keep the retired selector list authoritative in the executable
workflow boundary, reject workflow-gate drift, and pass the
caller-supplied environment to every replacement command.

## Type of Change

- [x] Code change (feature, bug fix, or refactor)
- [ ] Code change with doc updates
- [ ] Doc only (prose changes, no code sample modifications)
- [ ] Doc only (includes code sample changes)

## Quality Gates

- [x] Tests added or updated for changed behavior
- [ ] Existing tests cover changed behavior — justification:
- [ ] Tests not applicable — justification:
- [ ] Docs updated for user-facing behavior changes
- [x] Docs not applicable — justification: This is an internal
controller-transition path. It adds no supported CLI behavior,
configuration, operator action, or public documentation contract.
- [x] Sensitive paths changed (security, policy, credentials, preflight,
onboarding, inference, runner, sandbox, or messaging)
- [x] Sensitive-path review completed or maintainer-approved waiver
recorded — reviewer/approval link/justification: The bridge remains
SHA-, plan-, correlation-, and shard-bound, rejects unsafe selectors,
preserves raw trusted evidence, and fails closed without another active
controller job. The exact nine-selector replay emitted six valid bound
signals.
- [ ] Non-success, skipped, or missing CI check accepted by maintainer —
check name, approval link, and follow-up issue:

## Documentation Writer Review

- [x] Documentation writer subagent reviewed the completed changes
- Result: `no-docs-needed`
- Evidence: No documentation paths changed or require updates. The
reviewer checked `docs/`, `README.md`, `CONTRIBUTING.md`, and
`test/e2e/README.md`; existing guidance already covers controller
planning, SHA-bound checkout, protected approval, and evidence
validation without promising transient selector IDs.
- Agent: Codex Desktop documentation-writer subagent
(`/root/documentation_writer_review`)
<!-- docs-review-head-sha: 8980c62 -->
<!-- docs-review-agents-blob-sha: be20a09 -->

## DGX Station Hardware Evidence

- [ ] Tested on DGX Station
- Tested commit:
- Station profile/scenario:
- Result:
- Supporting evidence:

## Verification

- [x] PR description includes a `Signed-off-by:` line and every commit
appears as `Verified` in GitHub
- [x] Normal `pre-commit`, `commit-msg`, and `pre-push` hooks passed, or
`npm run check:diff` passed when hooks were skipped or unavailable
- [x] Targeted behavior tests pass for the current change set, or tests
are marked not applicable above — exact nine-selector replay: 47
integration, 3 installer-integration, and 4 package-contract assertions
passed with six bound risk signals; focused workflow contracts: 75/75;
full E2E-support: 163 files passed, 3 skipped, 1,737 tests passed, 17
skipped; source-shape cases remain zero; semantic phase coverage: 117
tests across 76 files; Vitest membership: exact 1,861 files across 8
projects; `npm run build:cli` and `npm run check:diff` passed.
- [ ] Applicable broad gate passed — `npm test` for broad
runtime/test-harness changes; `npm run check` for repo-wide
validation/coverage changes — command/result: `npm test` was attempted
on the original PR head and reproduced three unchanged DGX Station
host-detection fixture failures plus one unchanged root-topology fixture
failure, then stopped making progress and was interrupted. GitHub CI
will provide hosted aggregate evidence for the updated head.
- [x] Quality Gates section completed with required justifications or
waivers
- [x] No secrets, API keys, or credentials committed
- [ ] `npm run docs` builds without warnings (doc changes only)
- [ ] Doc pages follow the [style
guide](https://github.com/NVIDIA/NemoClaw/blob/main/docs/CONTRIBUTING.md)
(doc changes only)
- [ ] New doc pages include SPDX header and frontmatter (new pages only)

---
Signed-off-by: Carlos Villela <cvillela@nvidia.com>


<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->

## Summary by CodeRabbit

* **New Features**
* Added retired-selector-compatibility checks that run targeted
replacement E2E tests and generate compatibility evidence artifacts
(including risk-signal and summary output).
* Expanded CI and PR reporting to include a dedicated
retired-selector-compatibility job when relevant.
* Updated workflow planning and boundary validation to map
controller-selected jobs to compatible sets and enforce retired-only
selection rules.
* **Bug Fixes**
* Prevented planning/runs when controller-selected jobs become fully
retired without required targets.
* **Tests**
* Added E2E coverage for selector filtering, artifact outputs,
error/guard behaviors, and workflow selector gate drift detection.

<!-- end of auto-generated comment: release notes by coderabbit.ai -->

---------

Signed-off-by: Carlos Villela <cvillela@nvidia.com>
@wscurran wscurran added area: ci CI workflows, checks, release automation, or GitHub Actions area: e2e End-to-end tests, nightly failures, or validation infrastructure chore Build, CI, dependency, or tooling maintenance labels Jul 29, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

area: ci CI workflows, checks, release automation, or GitHub Actions area: e2e End-to-end tests, nightly failures, or validation infrastructure chore Build, CI, dependency, or tooling maintenance

Projects

None yet

Development

Successfully merging this pull request may close these issues.

Priority 0: retire local-only E2E scenarios

2 participants