ci(e2e): let maintainers authorize internal runs - #7826
Merged
Conversation
Signed-off-by: Julie Yaunches <jyaunches@nvidia.com>
Contributor
|
No actionable comments were generated in the recent review. 🎉 ℹ️ Recent review info⚙️ Run configurationConfiguration used: Path: .coderabbit.yaml Review profile: CHILL Plan: Enterprise Run ID: 📒 Files selected for processing (10)
💤 Files with no reviewable changes (1)
📝 WalkthroughWalkthroughThe PR E2E gate removes internal protected-environment control-plane approval, adopts maintainer/admin dispatch authorization, and narrows protected approval to fork E2E runs. Workflow wiring, controller parsing, tests, and documentation are updated accordingly. ChangesPR E2E authorization
Estimated code review effort: 3 (Moderate) | ~25 minutes Possibly related issues
Possibly related PRs
Suggested labels: Suggested reviewers: 🚥 Pre-merge checks | ✅ 5✅ Passed checks (5 passed)
✨ Finishing Touches📝 Generate docstrings
🧪 Generate unit tests (beta)
Comment |
Contributor
Code Coverage OverviewLanguages: TypeScript TypeScript / code-coverage/pluginThe overall coverage in commit 32747a2 in the TypeScript / code-coverage/cliThe overall coverage in commit 32747a2 in the Show a code coverage summary of the most impacted files.
Updated |
Contributor
PR Review Advisor — No blocking findings reportedAdvisor assessment: No blocking advisor findings reported Model lanes
Nemotron output stays in workflow artifacts and does not change the assessment above. E2E guidanceAdvisory only. E2E / PR Gate selects and runs jobs independently. Recommended E2E: This automated review informs maintainers. Warnings and suggestions do not require a response. A maintainer decides whether to merge. |
wscurran
added
area: ci
This was referenced Jul 29, 2026
This was referenced Jul 30, 2026
prekshivyas
pushed a commit
that referenced
this pull request
Aug 4, 2026
<!-- markdownlint-disable MD041 --> ## Summary Publish `E2E / PR Gate` directly from the trusted controller instead of mirroring the controller verdict through a six-hour polling job. The required check keeps the exact PR head, base, GitHub App, retry-history, and final-state validation already enforced by the controller. ## Related Issue Closes #7451 ## Changes - Remove the polling `required` workflow job and delete `tools/e2e/pr-e2e-required.mts` with its observer tests. - Rename the controller-owned custom check to the required `E2E / PR Gate` context and update the child-workflow authorization boundary. - Keep `E2E / PR Gate Coordination` as a rollout-only maintainer-inspection fallback when the current check is absent. - Update risk planning, watch triggers, merge-gate inspection, tests, and operator documentation for the direct lifecycle. - Preserve automatic internal dispatch and the unified exact-SHA `approve-e2e` route for selected fork work established by #7826 and #7832. ## Type of Change - [ ] Code change (feature, bug fix, or refactor) - [x] Code change with doc updates - [ ] Doc only (prose changes, no code sample modifications) - [ ] Doc only (includes code sample changes) ## Quality Gates - [x] Tests added or updated for changed behavior - [ ] Existing tests cover changed behavior — justification: - [ ] Tests not applicable — justification: - [x] Docs updated for user-facing behavior changes - [ ] Docs not applicable — justification: - [x] Sensitive paths changed (security, policy, credentials, preflight, onboarding, inference, runner, sandbox, or messaging) - [x] Sensitive-path review completed or maintainer-approved waiver recorded — reviewer/approval link/justification: [Nine-category security review](#7935 (comment)) passed all categories with no findings. Exact head/base identity, GitHub App ownership, retry lineage, final live-state checks, and child authorization remain fail closed. - [ ] Non-success, skipped, or missing CI check accepted by maintainer — check name, approval link, and follow-up issue: ## Documentation Writer Review - [x] Documentation writer subagent reviewed the completed changes - Result: `docs-updated` - Evidence: `.agents/skills/nemoclaw-maintainer-day/MERGE-GATE.md`, `test/e2e/README.md`, and `test/e2e/docs/README.md` accurately document the direct check, rollout fallback, automatic internal dispatch, and fork-only `approve-e2e` route. The exact-head documentation review corrected the seeded-check identity rule; a follow-up review confirmed the final test-only fixture change needs no additional prose. Focused documentation-policy validation passed 19 tests. - Agent: Codex Desktop <!-- docs-review-head-sha: 848d79aba921 --> <!-- docs-review-agents-blob-sha: 3dd7c24 --> ## DGX Station Hardware Evidence - [ ] Tested on DGX Station - Tested commit: - Station profile/scenario: - Result: - Supporting evidence: ## Verification - [x] PR description includes a `Signed-off-by:` line and every commit appears as `Verified` in GitHub - [x] Normal `pre-commit`, `commit-msg`, and `pre-push` hooks passed, or `npm run validate:pr` passed after refreshing `origin/main` when hooks were skipped or unavailable - [x] Targeted behavior tests pass for the current change set, or tests are marked not applicable above — `npm exec -- vitest run --project integration test/pr-e2e-gate*.test.ts test/maintainer-skills-policy.test.ts test/pr-risk-plan.test.ts test/skills/check-gates*.test.ts test/vitest-watch-triggers.test.ts` passed 23 files and 508 tests; the final ordered-comparison fixture passed 26/26 controller tests; `npm exec -- vitest run --project e2e-support test/e2e/support/e2e-operations-workflow-boundary.test.ts` passed 45 tests; `npm run test:changed` passed with no source-backed tests selected. - [ ] Applicable broad gate passed — `npm test` for broad runtime/test-harness changes; `npm run check` for repo-wide validation/coverage changes — command/result: Not applicable. This is a focused controller/check-name migration; the targeted integration and workflow-boundary suites cover the changed behavior, and required CI supplies the broad result. `npm run check:diff` and `npm run typecheck:cli` passed against current `main`. - [x] Quality Gates section completed with required justifications or waivers - [x] No secrets, API keys, or credentials committed - [ ] `npm run docs` builds without warnings (doc changes only) - [ ] Doc pages follow the [style guide](https://github.com/NVIDIA/NemoClaw/blob/main/docs/CONTRIBUTING.md) (doc changes only) - [ ] New doc pages include SPDX header and frontmatter (new pages only) --- Signed-off-by: Charan Jagwani <cjagwani@nvidia.com> <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **Bug Fixes** * Improved E2E merge-gate verification using the trusted `E2E / PR Gate` check, with clearer retry semantics and fail-closed behavior. * Strengthened PR identity, stale-state, dispatch authorization, fork approval, and runner-loss recovery handling. * Improved verdict and evidence reporting, including compatibility with the former check name during rollout. * **Documentation** * Updated merge-gate and E2E CI documentation for revised lifecycle, authorization, retry, and rollout behavior. * **Tests** * Expanded coverage for lifecycle, retries, recovery, fork approval, rollout compatibility, and evidence handling. <!-- end of auto-generated comment: release notes by coderabbit.ai --> --------- Signed-off-by: Charan Jagwani <cjagwani@nvidia.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Internal credential-bearing PR E2E no longer waits for a protected environment limited to two reviewers. Any repository maintainer or administrator can authorize the exact pending plan through the existing trusted
run-control-planeworkflow dispatch, while fork PRs retain protected-environment approval.Changes
run-control-planedispatch the only authorization path for internal control-plane PR changes.Type of Change
Quality Gates
Documentation Writer Review
docs-updatedtest/e2e/README.md— reviewed againstWRITING.mdand the workflow/controller implementation; maintainer authorization and fork approval paths are accurate.DGX Station Hardware Evidence
Verification
Signed-off-by:line and every commit appears asVerifiedin GitHubpre-commit,commit-msg, andpre-pushhooks passed, ornpm run check:diffpassed when hooks were skipped or unavailablenpx vitest run --project integration test/pr-e2e-gate-command.test.ts test/pr-e2e-gate-fork-approval.test.ts test/pr-e2e-gate-lifecycle.test.ts test/pr-e2e-gate-retry-history.test.ts test/pr-e2e-gate-workflow.test.ts test/pr-e2e-required.test.ts(6 files, 119 tests passed);npm run typecheck:cli;npm run test:projects:check;npm run source-shape:check;npm run test-size:check;npx markdownlint-cli2 test/e2e/README.md.npm testfor broad runtime/test-harness changes;npm run checkfor repo-wide validation/coverage changes — command/result:npm run docsbuilds without warnings (doc changes only)Signed-off-by: Julie Yaunches jyaunches@nvidia.com
Summary by CodeRabbit