ci: retire TypeScript migration fallbacks

[cv]

Summary

Trusted coverage actions now invoke only the migrated .mts entrypoints. Missing entrypoints fail at the canonical path instead of falling back to deleted .ts files.

Related Issue

Part of #6918

Changes

• Remove four temporary coverage and sourcemap fallbacks added by ci: unblock TypeScript migration release gates #6969 for the migration window.
• Remove the matching E2E mock-parity fallback after the repository check suite migration landed.
• Update the behavioral parity fixture to reject the retired .ts entrypoint.
• Keep the existing parity missing-entrypoint diagnostic, but require the .mts path.
• Update the workflow contract to accept only .mts entrypoints and reject a missing canonical file.

Type of Change

• Code change (feature, bug fix, or refactor)
• Code change with doc updates
• Doc only (prose changes, no code sample modifications)
• Doc only (includes code sample changes)

Quality Gates

• Tests added or updated for changed behavior
• Existing tests cover changed behavior — justification:
• Tests not applicable — justification:
• Docs updated for user-facing behavior changes
• Docs not applicable — justification: These internal CI entrypoint paths do not change a command, configuration, output, or supported workflow.
• Sensitive paths changed (security, policy, credentials, preflight, onboarding, inference, runner, sandbox, or messaging)
• Sensitive-path review completed or maintainer-approved waiver recorded — reviewer/approval link/justification: Refreshed security review passed on exact head 5d85df195; the diff narrows trusted execution to fixed .mts paths and updates only regression tests.
• Non-success, skipped, or missing CI check accepted by maintainer — check name, approval link, and follow-up issue:

Documentation Writer Review

• Documentation writer subagent reviewed the completed changes
• Result: no-docs-needed
• Evidence: Head 5d85df195 changes only internal CI actions and regression tests. Test titles and CI error text follow WRITING.md; no user-facing documentation is affected.
• Agent: Codex Desktop

DGX Station Hardware Evidence

• Tested on DGX Station
• Tested commit:
• Station profile/scenario:
• Result:
• Supporting evidence:

Verification

Signed-off-by: Carlos Villela cvillela@nvidia.com

• PR description includes a Signed-off-by: line and every commit appears as Verified in GitHub
• Normal pre-commit, commit-msg, and pre-push hooks passed, or npm run check:diff passed when hooks were skipped or unavailable
• Targeted behavior tests pass for the current change set, or tests are marked not applicable above — npx vitest run test/e2e-mock-parity.test.ts test/pr-workflow-contract.test.ts --project integration: 2 files and 31 tests passed. Biome and normal commit hooks passed.
• Applicable broad gate passed — npm test for broad runtime/test-harness changes; npm run check for repo-wide validation/coverage changes — command/result:
• Quality Gates section completed with required justifications or waivers
• No secrets, API keys, or credentials committed

Summary by CodeRabbit

• CI and Validation

  • Standardized coverage, sourcemap, and E2E mock parity checks on the migrated TypeScript entrypoints.
  • Removed compatibility handling for retired script variants, enabling faster failure when required checks are unavailable.

• Tests

  • Updated workflow contract tests to verify the new entrypoints.
  • Added coverage for rejecting missing or retired validation scripts.

[coderabbitai]

📝 Walkthrough

Walkthrough

Coverage CI actions now invoke .mts scripts directly for sourcemap, ratchet, and E2E mock parity checks. Workflow and parity tests enforce the migrated entrypoints and reject legacy .ts fallbacks.

Changes

Coverage entrypoint migration

Layer / File(s)	Summary
CI entrypoint enforcement .github/actions/ci-cli-coverage-merge/action.yaml, .github/actions/ci-cli-coverage-shard/action.yaml, .github/actions/ci-plugin-coverage/action.yaml	Coverage and parity checks now invoke the required .mts scripts directly, removing .ts fallback selection.
Workflow contract validation test/pr-workflow-contract.test.ts	Contract tests require the .mts parity command and expect migrated coverage entrypoint behavior when the fixture extension is missing.
Parity entrypoint validation test/e2e-mock-parity.test.ts	E2E parity tests verify the .mts invocation and reject missing or retired .ts entrypoints.

Estimated code review effort: 2 (Simple) | ~10 minutes

Possibly related issues

• Migrate repository tools to explicit .mts ESM boundaries #6918 — Covers the .mts entrypoint migration enforced by these workflow and test changes.

Suggested labels: chore

Suggested reviewers: brandonpelfrey, aasthajh

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly reflects the main change: removing temporary TypeScript migration fallbacks from CI actions.

✨ Finishing Touches

📝 Generate docstrings

• Create stacked PR
• Commit on current branch

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch codex/6918-retire-ts-ci-fallbacks

---

_{Comment @coderabbitai help to get the list of available commands.}

[cv]

Security review — PASS

Reviewed exact head c80c9f751 across all four changed files. The change narrows trusted CI execution to fixed, repository-owned .mts paths and removes deleted-path fallback branches. No security findings.

1. Secrets and credentials — PASS: No secrets, environment handling, or credential data changed; the commit hooks also passed gitleaks.
2. Input validation and sanitization — PASS: No user-controlled input parsing changed. Each command uses a fixed repository path.
3. Authentication and authorization — PASS: No authentication, permission, token, or reviewer-routing behavior changed.
4. Dependencies — PASS: No dependency or action pin changed.
5. Error handling and logging — PASS: Missing parity entrypoints still fail with a bounded diagnostic. Other missing canonical files fail through npx tsx.
6. Cryptography and data protection — PASS: No cryptographic or data-storage behavior changed.
7. Configuration and security headers — PASS: No runtime service configuration changed. Trusted action scope is narrower.
8. Security testing — PASS: The workflow contract requires .mts, rejects deleted .ts paths, and verifies missing canonical coverage entrypoints fail. Focused result: 22/22 tests passed.
9. System security — PASS: Removing alternate executable paths reduces ambiguity and does not weaken a control.

Files reviewed: the three coverage composite actions and test/pr-workflow-contract.test.ts.

[github-code-quality]

Code Coverage Overview

Languages: TypeScript

TypeScript / code-coverage/plugin

The overall coverage in commit 5d85df1 in the codex/6918-retire-ts... branch remains at 96%, unchanged from commit 10fc8b1 in the main branch.

TypeScript / code-coverage/cli

The overall coverage in commit 5d85df1 in the codex/6918-retire-ts... branch remains at 80%, unchanged from commit 07553d7 in the main branch.

Show a code coverage summary of the most impacted files.

File	main 07553d7	codex/6918-retire-ts... 5d85df1	+/-
src/lib/actions...all/run-plan.ts	84%	83%	-1%
src/lib/sandbox...rce-identity.ts	88%	88%	0%
src/lib/onboard/tracing.ts	80%	85%	+5%

---

_{Updated July 27, 2026 23:34 UTC}

[github-actions]

PR Review Advisor — No blocking findings reported

Advisor assessment: No blocking advisor findings reported
Next action: No advisor follow-up needed.
Findings: 0 blockers · 0 warnings · 0 suggestions

Model lanes

• GPT-5.6 Terra (primary): Completed · high confidence · 0 blockers · 0 warnings · 0 suggestions
• Nemotron 3 Ultra (second opinion): Completed · high confidence · 0 blockers · 0 warnings · 1 suggestion
• Model comparison: normalized findings differ; normalized E2E selections match; Nemotron reported the same number of blockers, the same number of warnings, 1 more suggestion.

Nemotron output stays in workflow artifacts and does not change the assessment above.

E2E guidance

Advisory only. E2E / PR Gate selects and runs jobs independently.

Recommended E2E: None

Workflow run details

This automated review informs maintainers. Warnings and suggestions do not require a response. A maintainer decides whether to merge.

[cv]

Security review refresh — PASS. Reviewed exact head 5d85df1. The only delta from the prior nine-category PASS is a regression-test update: the fixture now accepts the canonical .mts entrypoint and rejects a retired .ts-only fixture. No production execution, secrets, permissions, dependencies, input handling, cryptography, configuration, or system controls changed. The focused suite passes 31/31 tests; no security findings.