Skip to content

ci(e2e): enforce retained runtime budgets - #7945

Draft
cjagwani wants to merge 4 commits into
mainfrom
codex/7922-live-e2e-runtime-policy
Draft

ci(e2e): enforce retained runtime budgets#7945
cjagwani wants to merge 4 commits into
mainfrom
codex/7922-live-e2e-runtime-policy

Conversation

@cjagwani

@cjagwani cjagwani commented Jul 30, 2026

Copy link
Copy Markdown
Collaborator

Summary

Adds a machine-checkable runtime policy for every retained live E2E target and workflow unit. The validator separates policy failures from live-target failures and constrains the initial PR/nightly set to 15 targets and 121 planned runner-minutes while the measured baseline is refreshed after #7665 and #7915.

Related Issue

Fixes #7922

Changes

  • Define ownership, unique boundaries, runtime and runner budgets, tiers, evidence, artifacts, and review conditions for all 96 selectable live units.
  • Add a dedicated repository check with exact inventory coverage, budget ceilings, and expiring exception validation.
  • Seed two PR targets plus thirteen nightly targets; record provisional baseline and retirement exceptions for the two selectors removed by test(e2e): consolidate priority 2 live seams #7665.
  • Document the policy, current counts, exception lifecycle, and five-passing-run refresh requirement.

Type of Change

  • Code change (feature, bug fix, or refactor)
  • Code change with doc updates
  • Doc only (prose changes, no code sample modifications)
  • Doc only (includes code sample changes)

Quality Gates

  • Tests added or updated for changed behavior
  • Existing tests cover changed behavior — justification:
  • Tests not applicable — justification:
  • Docs updated for user-facing behavior changes
  • Docs not applicable — justification:
  • Sensitive paths changed (security, policy, credentials, preflight, onboarding, inference, runner, sandbox, or messaging)
  • Sensitive-path review completed or maintainer-approved waiver recorded — reviewer/approval link/justification: PASS review
  • Non-success, skipped, or missing CI check accepted by maintainer — check name, approval link, and follow-up issue:

Documentation Writer Review

  • Documentation writer subagent reviewed the completed changes
  • Result: docs-updated
  • Evidence: test/e2e/docs/README.md
  • Agent: Codex Desktop

DGX Station Hardware Evidence

  • Tested on DGX Station
  • Tested commit: not applicable
  • Station profile/scenario: not applicable
  • Result: not applicable
  • Supporting evidence: not applicable

Verification

  • PR description includes a Signed-off-by: line and every commit appears as Verified in GitHub
  • Normal pre-commit, commit-msg, and pre-push hooks passed, or npm run validate:pr passed after refreshing origin/main when hooks were skipped or unavailable
  • Targeted behavior tests pass for the current change set, or tests are marked not applicable above — 54 E2E-support and 14 integration assertions passed
  • Applicable broad gate passed — npm run checks:repository passed; the focused policy does not change live execution
  • Quality Gates section completed with required justifications or waivers
  • No secrets, API keys, or credentials committed
  • npm run docs builds without warnings (doc changes only) — build passed with two non-blocking Fern warnings
  • Doc pages follow the style guide (doc changes only)
  • New doc pages include SPDX header and frontmatter (new pages only)

Signed-off-by: Charan Jagwani cjagwani@nvidia.com

Summary by CodeRabbit

  • New Features

    • Added runtime policy coverage for live end-to-end tests, including tier eligibility, runtime budgets, ownership, telemetry, artifacts, and review conditions.
    • Added validation to detect missing, duplicate, stale, or incorrectly classified E2E coverage.
    • Added a repository check that reports policy validation results and planned runner-minute usage.
  • Documentation

    • Documented the runtime policy contract, sources of truth, validation process, and exception requirements.
  • Tests

    • Added comprehensive validation and workflow-trigger coverage for the runtime policy.

Signed-off-by: Charan Jagwani <cjagwani@nvidia.com>
@copy-pr-bot

copy-pr-bot Bot commented Jul 30, 2026

Copy link
Copy Markdown

Auto-sync is disabled for draft pull requests in this repository. Workflows must be run manually.

Contributors can view more details about this message here.

@coderabbitai

coderabbitai Bot commented Jul 30, 2026

Copy link
Copy Markdown
Contributor

Review Change Stack

Important

Review skipped

Draft detected.

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Enterprise

Run ID: 931276ae-44b0-4510-969c-15a0da9261c0

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

  • 🔍 Trigger review
📝 Walkthrough

Walkthrough

Changes

Live E2E runtime policy

Layer / File(s) Summary
Runtime policy definition
test/e2e/runtime-policy.ts
Defines policy types, registry and workflow runtime specifications, ownership mappings, exceptions, and generated coverage entries.
Policy validation and command execution
tools/e2e/runtime-policy.mts
Validates policy structure, inventory coverage, metadata, files, exceptions, tier budgets, and baseline goals, then exposes direct execution and prefixed failures.
Validation and execution tests
test/e2e/support/e2e-runtime-policy.test.ts
Covers valid coverage, malformed policies, exceptions, budget goals, error labeling, and direct script execution.
Repository check and workflow wiring
scripts/checks/run.mts, test/checks-runner.test.ts, test/helpers/vitest-watch-triggers.ts, test/vitest-watch-triggers.test.ts, test/e2e/docs/README.md
Registers the validator as a default check, updates watch-trigger coverage, and documents the runtime policy contract.

Estimated code review effort: 4 (Complex) | ~45 minutes

Sequence Diagram(s)

sequenceDiagram
  participant CheckRunner
  participant RuntimePolicyValidator
  participant RuntimePolicy
  participant E2EInventory
  CheckRunner->>RuntimePolicyValidator: execute runtime-policy.mts
  RuntimePolicyValidator->>RuntimePolicy: load LIVE_E2E_RUNTIME_POLICY
  RuntimePolicyValidator->>E2EInventory: read registry and workflow targets
  E2EInventory-->>RuntimePolicyValidator: return target inventory
  RuntimePolicyValidator-->>CheckRunner: report success or policy violation
Loading

Suggested labels: area: ci, area: e2e

Suggested reviewers: cv, prekshivyas, ericksoa

🚥 Pre-merge checks | ✅ 4 | ❌ 1

❌ Failed checks (1 warning)

Check name Status Explanation Resolution
Docstring Coverage ⚠️ Warning Docstring coverage is 0.00% which is insufficient. The required threshold is 80.00%. Write docstrings for the functions missing them to satisfy the coverage threshold.
✅ Passed checks (4 passed)
Check name Status Explanation
Linked Issues check ✅ Passed The PR adds machine-checkable policy, metadata validation, initial budgets, exception handling, and docs/tests that match #7922.
Out of Scope Changes check ✅ Passed The changes are focused on the runtime-policy feature, related validation, docs, and tests with no obvious unrelated additions.
Description Check ✅ Passed Check skipped - CodeRabbit’s high-level summary is enabled.
Title check ✅ Passed The title accurately captures the main change: enforcing retained E2E runtime budgets and policy checks.
✨ Finishing Touches 💡 1
📝 Generate docstrings 💡
  • Create stacked PR
  • Commit on current branch
🧪 Generate unit tests (beta)
  • Create PR with unit tests
  • Commit unit tests in branch codex/7922-live-e2e-runtime-policy

Comment @coderabbitai help to get the list of available commands.

@cjagwani

cjagwani commented Jul 30, 2026

Copy link
Copy Markdown
Collaborator Author

Sensitive-path security review

Verdict: PASS

Reviewed commit 33d4a96c0b71e0e6840ae1bb1ce6c21771dd729c and the complete PR diff.

  1. Secrets and credentials — PASS. The change contains static target-policy metadata only; it does not add credentials, secret values, or credential handling. The normal gitleaks hook passed.
  2. Injection and input validation — PASS. The validator accepts repository-owned TypeScript data, enforces exact keys and primitive types, validates dates and controlled vocabularies, and rejects missing, duplicate, stale, or unknown inventory entries. Owning paths must resolve to existing repository files.
  3. Authentication and authorization — PASS. No authentication, authorization, token, identity, or approval behavior changes.
  4. Dependencies and supply chain — PASS. No dependency, lockfile, action pin, downloaded executable, or external service was added.
  5. Logging and error handling — PASS. Policy failures use the bounded E2E runtime policy violation prefix and target identifiers; they do not emit secrets or environment contents. The policy check is separate from live target execution failures.
  6. Cryptography — PASS. No cryptographic behavior or algorithm selection changes.
  7. Permissions and privilege — PASS. No workflow permissions, runner privileges, filesystem modes, sandbox capabilities, or network policy changes.
  8. Security-relevant tests — PASS. Tests cover exact inventory, duplicate and stale entries, duplicate unique live boundaries, incomplete boundaries/evidence/ownership/review metadata, invalid or expired exceptions, budget ceilings, and the non-live CLI boundary. Focused E2E-support and integration suites passed.
  9. Race conditions and external state — PASS. Validation is read-only and synchronous over the checked-out repository. It creates no external state and introduces no time-of-check/time-of-use security boundary.

Residual operational note: the baseline and two soon-to-retire selectors are explicitly provisional, carry rationale and review conditions, and expire on 2026-08-31. That dependency is why this PR remains draft; it is not a security exception.

@cjagwani

Copy link
Copy Markdown
Collaborator Author

@coderabbitai review

@coderabbitai

coderabbitai Bot commented Jul 30, 2026

Copy link
Copy Markdown
Contributor
✅ Action performed

Review finished.

Note: CodeRabbit is an incremental review system and does not re-review already reviewed commits. This command is applicable only when automatic reviews are paused.

@github-actions

github-actions Bot commented Jul 30, 2026

Copy link
Copy Markdown
Contributor

PR Review Advisor — Blocking findings reported

Advisor assessment: Blockers require maintainer review
Next action: Review the blockers below.
Findings: 1 blocker · 0 warnings · 0 suggestions

Model lanes

  • GPT-5.6 Terra (primary): Completed · high confidence · 1 blocker · 0 warnings · 0 suggestions
  • Nemotron 3 Ultra (second opinion): Completed · high confidence · 0 blockers · 0 warnings · 0 suggestions
  • Model comparison: normalized findings differ; normalized E2E selections differ; Nemotron reported 1 fewer blocker, the same number of warnings, the same number of suggestions.

Nemotron output stays in workflow artifacts and does not change the assessment above.

E2E guidance

Advisory only. E2E / PR Gate selects and runs jobs independently.

Recommended E2E: cloud-inference, cloud-onboard, security-posture

Blockers

PRA-1 Blocker — Use the required post-retirement baseline for runtime budgets

Workflow run details

This automated review informs maintainers. Warnings and suggestions do not require a response. A maintainer decides whether to merge.

@coderabbitai coderabbitai Bot left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Actionable comments posted: 2

🧹 Nitpick comments (1)
test/e2e/runtime-policy.ts (1)

369-381: 🚀 Performance & Scalability | 🔵 Trivial | ⚡ Quick win

Hoist repeated listTargets() / readFreeStandingJobsInventory() calls.

registryOwningFiles and workflowOwningFiles are invoked once per entry(...) call, so building LIVE_E2E_RUNTIME_POLICY.coverage calls listTargets() 26 times and readFreeStandingJobsInventory() 69 times at module load, instead of once each. This runs on every process that imports this module (the CLI check on every PR via checks:repository, plus any test file pulling in the policy), so redundant I/O/computation is paid repeatedly.

♻️ Proposed fix: compute inventories once and reuse
+const REGISTRY_TARGETS = listTargets();
+const WORKFLOW_INVENTORY = readFreeStandingJobsInventory();
+
 function registryOwningFiles(id: string): string[] {
-  const target = listTargets().find((candidate) => candidate.id === id);
+  const target = REGISTRY_TARGETS.find((candidate) => candidate.id === id);
   if (!target?.manifestPath) return ["test/e2e/registry/definitions/baseline.ts"];
   return ["test/e2e/registry/definitions/baseline.ts", target.manifestPath];
 }

 function workflowOwningFiles(id: string): string[] {
   if (id === "staging-brev-launchable") return ["tools/e2e/brev-launchable-e2e.sh"];
-  const inventory = readFreeStandingJobsInventory();
-  return [...inventory.liveTestToJobs]
+  return [...WORKFLOW_INVENTORY.liveTestToJobs]
     .filter(([, targetIds]) => targetIds.includes(id))
     .map(([file]) => file);
 }

Also applies to: 439-446

🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@test/e2e/runtime-policy.ts` around lines 369 - 381, Hoist the results of
listTargets() and readFreeStandingJobsInventory() to shared module-level values
before registryOwningFiles and workflowOwningFiles are used, then have both
functions reuse those values instead of recomputing inventories per entry.
Preserve the existing target lookup, baseline manifest handling,
staging-brev-launchable special case, and workflow filtering behavior.
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In `@test/e2e/support/e2e-runtime-policy.test.ts`:
- Line 28: Update the top-level describe title in the live E2E runtime policy
suite to use a behavior-oriented title ending with the local issue reference
suffix "(`#7922`)".

In `@tools/e2e/runtime-policy.mts`:
- Around line 216-222: Update the policy validation around validateEntry to
enforce uniqueness of non-empty uniqueBoundary values across policy.coverage,
reusing the existing duplicates() helper as with owningFiles/string lists. Add a
validation error for duplicate boundary text while preserving the current format
checks and allowing missing boundaries to be handled by their existing
validation.

---

Nitpick comments:
In `@test/e2e/runtime-policy.ts`:
- Around line 369-381: Hoist the results of listTargets() and
readFreeStandingJobsInventory() to shared module-level values before
registryOwningFiles and workflowOwningFiles are used, then have both functions
reuse those values instead of recomputing inventories per entry. Preserve the
existing target lookup, baseline manifest handling, staging-brev-launchable
special case, and workflow filtering behavior.
🪄 Autofix (Beta)

Fix all unresolved CodeRabbit comments on this PR:

  • Push a commit to this branch (recommended)
  • Create a new PR with the fixes

ℹ️ Review info
⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Enterprise

Run ID: b7ecf59d-12ef-4fa9-b417-9d8a57b073db

📥 Commits

Reviewing files that changed from the base of the PR and between 231395a and 39831cc.

📒 Files selected for processing (8)
  • scripts/checks/run.mts
  • test/checks-runner.test.ts
  • test/e2e/docs/README.md
  • test/e2e/runtime-policy.ts
  • test/e2e/support/e2e-runtime-policy.test.ts
  • test/helpers/vitest-watch-triggers.ts
  • test/vitest-watch-triggers.test.ts
  • tools/e2e/runtime-policy.mts

Comment thread test/e2e/support/e2e-runtime-policy.test.ts Outdated
Comment thread tools/e2e/runtime-policy.mts
@github-code-quality

github-code-quality Bot commented Jul 30, 2026

Copy link
Copy Markdown
Contributor

Code Coverage Overview

Languages: TypeScript

TypeScript / code-coverage/plugin

The overall coverage in commit ea32b37 in the codex/7922-live-e2e-... branch remains at 96%, unchanged from commit ef32617 in the main branch.

TypeScript / code-coverage/cli

The overall coverage in commit ea32b37 in the codex/7922-live-e2e-... branch remains at 81%, unchanged from commit a8c7ab0 in the main branch.

Show a code coverage summary of the most impacted files.
File main a8c7ab0 codex/7922-live-e2e-... ea32b37 +/-
src/lib/onboard...ndbox-create.ts 83% 33% -50%
src/lib/onboard...box-prebuild.ts 92% 74% -18%
src/lib/actions...ocker-health.ts 82% 65% -17%
src/lib/actions...confirmation.ts 79% 69% -10%
src/lib/onboard...ndbox-create.ts 91% 83% -8%
src/lib/onboard...box-gpu-mode.ts 97% 92% -5%
src/lib/onboard/preflight.ts 80% 80% 0%
src/lib/onboard...host-anchors.ts 90% 94% +4%
src/lib/domain/.../connect-env.ts 89% 97% +8%
src/lib/onboard/docker-cdi.ts 70% 80% +10%

Updated July 30, 2026 22:21 UTC

cjagwani added 3 commits July 30, 2026 14:26
Signed-off-by: Charan Jagwani <cjagwani@nvidia.com>
Signed-off-by: Charan Jagwani <cjagwani@nvidia.com>
Signed-off-by: Charan Jagwani <cjagwani@nvidia.com>
@wscurran wscurran added area: ci CI workflows, checks, release automation, or GitHub Actions area: e2e End-to-end tests, nightly failures, or validation infrastructure chore Build, CI, dependency, or tooling maintenance labels Aug 3, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

area: ci CI workflows, checks, release automation, or GitHub Actions area: e2e End-to-end tests, nightly failures, or validation infrastructure chore Build, CI, dependency, or tooling maintenance

Projects

None yet

Development

Successfully merging this pull request may close these issues.

ci(e2e): enforce runtime budgets for retained live E2E

2 participants