Skip to content

ci(e2e): tier retained gateway upgrade coverage - #7956

Closed
scarab-systems wants to merge 3 commits into
NVIDIA:mainfrom
scarab-systems:scarab-systems/nemoclaw-7920-e2e-gateway-coverage-tiers
Closed

ci(e2e): tier retained gateway upgrade coverage#7956
scarab-systems wants to merge 3 commits into
NVIDIA:mainfrom
scarab-systems:scarab-systems/nemoclaw-7920-e2e-gateway-coverage-tiers

Conversation

@scarab-systems

@scarab-systems scarab-systems commented Jul 31, 2026

Copy link
Copy Markdown
Contributor

Summary

Tiers the retained OpenShell gateway upgrade rows so ordinary scheduled runs keep the
current state-upgrade migration row while preserving historical and architecture
coverage for weekly, release-qualification, and explicit maintainer dispatch runs.
The change stays inside the existing openshell-gateway-upgrade job and does not
change gateway product behavior.

Related Issue

Fixes #7920

Changes

  • Add execution_tier and unique_boundary metadata to each retained gateway
    upgrade matrix row.
  • Run the current v0.0.89-x86_64 state-upgrade row in the ordinary nightly tier.
  • Retain the older and architecture-specific rows for explicit selection, weekly
    scheduled coverage, and release qualification.
  • Gate prepare, live execution, and artifact upload through the row classifier so
    skipped rows are reported as skipped-by-tier instead of looking like failures.
  • Extend the existing workflow-boundary tests to protect the retained row inventory,
    tier metadata, classifier, and reviewed prepare/upload caller gates.

Expected runner-minute reduction: ordinary scheduled Monday-Saturday runs now execute
1 of 5 retained gateway upgrade rows; weekly, release-qualification, and explicit
selection paths still execute the retained historical and architecture rows.

Type of Change

  • Code change (feature, bug fix, or refactor)
  • Code change with doc updates
  • Doc only (prose changes, no code sample modifications)
  • Doc only (includes code sample changes)

Quality Gates

  • Tests added or updated for changed behavior
  • Existing tests cover changed behavior — justification:
  • Tests not applicable — justification:
  • Docs updated for user-facing behavior changes
  • Docs not applicable — justification: This changes internal E2E workflow row
    selection and workflow-boundary tests only. It does not change user-facing docs,
    CLI commands, configuration, or product runtime behavior.
  • Sensitive paths changed (security, policy, credentials, preflight, onboarding,
    inference, runner, sandbox, or messaging)
  • Sensitive-path review completed or maintainer-approved waiver recorded —
    reviewer/approval link/justification: Reviewed against Epic: reduce E2E wall time, runner cost, and failure surface #7912 and ci(e2e): tier retained gateway compatibility coverage #7920. The
    change does not delete retained assertions, add a new workflow lane, or alter
    gateway product behavior. Explicit selection, weekly retained coverage, and
    release qualification still run the historical and architecture rows.
  • Non-success, skipped, or missing CI check accepted by maintainer — check name,
    approval link, and follow-up issue:

Documentation Writer Review

  • Documentation writer subagent reviewed the completed changes
  • Result: no-docs-needed
  • Evidence: Reviewed origin/main...HEAD; the diff changes only E2E workflow
    tiering and boundary-test files for openshell-gateway-upgrade, with no changes
    to Fern docs, README user guidance, CLI commands, configuration options,
    install/runtime behavior, or public workflow inputs. No user-facing documentation
    paths need updates.
  • Agent: Codex Desktop

DGX Station Hardware Evidence

  • Tested on DGX Station
  • Tested commit:
  • Station profile/scenario:
  • Result:
  • Supporting evidence:

Verification

  • PR description includes a Signed-off-by: line and every commit appears as
    Verified in GitHub
  • Normal pre-commit, commit-msg, and pre-push hooks passed, or
    npm run validate:pr passed after refreshing origin/main when hooks were
    skipped or unavailable — npm run validate:pr passed for 032e419aa.
  • Targeted behavior tests pass for the current change set, or tests are marked
    not applicable above — npx vitest run --project e2e-support test/e2e/support/openshell-gateway-upgrade-workflow-boundary.test.ts passed 7
    tests; focused workflow/report/planner checks passed 122 tests; npm run test:changed passed 327 tests; npm run test:e2e-phases:check validated 114
    semantic E2E phase plans.
  • Applicable broad gate passed — npm test for broad runtime/test-harness
    changes; npm run check for repo-wide validation/coverage changes — not
    applicable to this focused workflow-tiering change; targeted workflow checks and
    npm run validate:pr passed.
  • Quality Gates section completed with required justifications or waivers
  • No secrets, API keys, or credentials committed
  • npm run docs builds without warnings (doc changes only)
  • Doc pages follow the style guide (doc changes only)
  • New doc pages include SPDX header and frontmatter (new pages only)

Disclosure: This PR was prepared with AI assistance under human direction and
review.


Signed-off-by: ScarabSystems scarab.systems@yahoo.com

Summary by CodeRabbit

  • New Features

    • Added tier-based selection for gateway upgrade checks across scheduled, nightly, staging, and explicitly selected runs.
    • Added clear reporting for selected and skipped upgrade tiers.
    • Limited workspace preparation, test execution, and artifact uploads to applicable tiers.
  • Tests

    • Added end-to-end coverage for tier boundaries, selection logic, conditional execution, and skipped-tier reporting.
    • Expanded workflow validation for execution conditions and environment configuration.

Document each retained gateway row's boundary and tier.

Gate prepare, live execution, and upload through the row classifier.

Explicit dispatch, weekly runs, and release qualification still execute retained rows.

Signed-off-by: ScarabSystems <scarab.systems@yahoo.com>
@copy-pr-bot

copy-pr-bot Bot commented Jul 31, 2026

Copy link
Copy Markdown

This pull request requires additional validation before any workflows can run on NVIDIA's runners.

Pull request vetters can view their responsibilities here.

Contributors can view more details about this message here.

@coderabbitai

coderabbitai Bot commented Jul 31, 2026

Copy link
Copy Markdown
Contributor

Review Change Stack

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info
⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Enterprise

Run ID: c7e49256-38f5-46e2-afac-79abe34aa56b

📥 Commits

Reviewing files that changed from the base of the PR and between 39c1c8d and 46dda8c.

📒 Files selected for processing (1)
  • test/e2e/support/openshell-gateway-upgrade-workflow-boundary.test.ts
🚧 Files skipped from review as they are similar to previous changes (1)
  • test/e2e/support/openshell-gateway-upgrade-workflow-boundary.test.ts

📝 Walkthrough

Walkthrough

OpenShell gateway upgrade rows now include execution tiers and unique migration boundaries. Classification selects rows by explicit selection, schedule, or release qualification. Preparation, tests, and artifact upload follow the selection result. Boundary validators and tests verify the workflow behavior.

Changes

Gateway upgrade tiering

Layer / File(s) Summary
Workflow tier classification
.github/workflows/e2e.yaml
Matrix rows expose execution tiers and migration boundaries. Classification selects eligible rows and records reasons, budgets, reductions, summaries, and skipped rows.
Fixture and workflow boundary validation
tools/e2e/openshell-gateway-upgrade-workflow-boundary.mts, test/e2e/support/openshell-gateway-upgrade-workflow-boundary.test.ts
Fixtures, workflow checks, and scenario tests validate tier metadata, environment bindings, classification outputs, execution gates, and skipped-row reporting.
Caller-specific workflow gating
tools/e2e/prepare-e2e-workflow-boundary.mts, tools/e2e/upload-e2e-artifacts-workflow-boundary.mts
The boundary validators require gateway-tier conditions for preparation and artifact upload.

Estimated code review effort: 3 (Moderate) | ~25 minutes

Suggested labels: area: ci, area: e2e, chore

Suggested reviewers: cv

Sequence Diagram(s)

sequenceDiagram
  participant Matrix as Gateway upgrade matrix
  participant Classifier as gateway_upgrade_tier
  participant E2E as E2E preparation and tests
  participant Upload as Artifact upload
  Matrix->>Classifier: Provide tier and migration boundary
  Classifier->>Classifier: Evaluate selection and schedule
  Classifier->>E2E: Emit run decision
  E2E->>Upload: Upload artifacts for selected rows
Loading
🚥 Pre-merge checks | ✅ 4 | ❌ 1

❌ Failed checks (1 warning)

Check name Status Explanation Resolution
Docstring Coverage ⚠️ Warning Docstring coverage is 0.00% which is insufficient. The required threshold is 80.00%. Write docstrings for the functions missing them to satisfy the coverage threshold.
✅ Passed checks (4 passed)
Check name Status Explanation
Description Check ✅ Passed Check skipped - CodeRabbit’s high-level summary is enabled.
Title check ✅ Passed The title clearly summarizes the main change: tiering retained gateway upgrade E2E coverage.
Linked Issues check ✅ Passed The changes satisfy #7920 by adding tier metadata, classification, scheduling gates, skip reporting, and coverage for nightly, weekly, release, and explicit runs.
Out of Scope Changes check ✅ Passed The changes remain within workflow classification, boundary validation, artifact gating, and related tests; no unrelated product behavior changes are present.
✨ Finishing Touches
🧪 Generate unit tests (beta)
  • Create PR with unit tests

Comment @coderabbitai help to get the list of available commands.

@github-actions

github-actions Bot commented Jul 31, 2026

Copy link
Copy Markdown
Contributor

PR Review Advisor — No blocking findings reported

Advisor assessment: No blocking advisor findings reported
Next action: No advisor follow-up needed.
Findings: 0 blockers · 0 warnings · 0 suggestions

Model lanes

  • GPT-5.6 Terra (primary): Completed · high confidence · 0 blockers · 0 warnings · 0 suggestions
  • Nemotron 3 Ultra (second opinion): Completed · high confidence · 0 blockers · 0 warnings · 0 suggestions
  • Model comparison: normalized findings match; normalized E2E selections match; severity counts match.

Nemotron output stays in workflow artifacts and does not change the assessment above.

E2E guidance

Advisory only. E2E / PR Gate selects and runs jobs independently.

Recommended E2E: cloud-inference, cloud-onboard, security-posture

1 optional E2E recommendation
  • openshell-gateway-upgrade

Workflow run details

This automated review informs maintainers. Warnings and suggestions do not require a response. A maintainer decides whether to merge.

@scarab-systems
scarab-systems marked this pull request as ready for review July 31, 2026 01:38

@coderabbitai coderabbitai Bot left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Caution

Some comments are outside the diff and can’t be posted inline due to platform limitations.

⚠️ Outside diff range comments (1)
.github/workflows/e2e.yaml (1)

4396-4402: 🩺 Stability & Availability | 🟠 Major | 🏗️ Heavy lift

Gate Docker Hub authentication on the tier decision.

On scheduled weekdays and default manual runs, all four weekly-release rows are skipped, but auth-required remains 1, so each still performs docker login and can fail before classification. Move classification before auth and run the auth step only when steps.gateway_upgrade_tier.outputs.run == '1'.

🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In @.github/workflows/e2e.yaml around lines 4396 - 4402, Move the upgrade-tier
classification step before the *dockerhub-auth step in the weekly-release
workflow, then gate Docker Hub authentication with
steps.gateway_upgrade_tier.outputs.run == '1'. Ensure scheduled weekdays and
default manual runs skip docker login when no weekly-release rows are selected,
while eligible runs retain authentication.
🧹 Nitpick comments (3)
tools/e2e/openshell-gateway-upgrade-workflow-boundary.mts (2)

227-244: 📐 Maintainability & Code Quality | 🔵 Trivial | ⚡ Quick win

Classify-step env check doesn't guard against extraneous keys.

The loop at lines 238-244 verifies each expected key/value is bound but never confirms classifyEnv has no other keys. Other contracts in this same module (and in prepare-e2e-workflow-boundary.mts/upload-e2e-artifacts-workflow-boundary.mts) use isDeepStrictEqual on the full key set to catch unexpected additions. Consider the same here to keep the contract airtight.

♻️ Proposed refactor
-  for (const [key, expected] of Object.entries(expectedClassifyEnv)) {
-    if (classifyEnv[key] !== expected) {
-      errors.push(
-        `${JOB_NAME} step '${CLASSIFY_STEP_NAME}' must bind ${key} from workflow context`,
-      );
-    }
-  }
+  if (!isDeepStrictEqual(classifyEnv, expectedClassifyEnv)) {
+    errors.push(
+      `${JOB_NAME} step '${CLASSIFY_STEP_NAME}' must bind exactly the reviewed workflow context`,
+    );
+  }
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@tools/e2e/openshell-gateway-upgrade-workflow-boundary.mts` around lines 227 -
244, Update the classify-step environment validation around classifyEnv and
expectedClassifyEnv to compare their complete key sets with the module’s
established deep-strict-equality approach, while retaining the existing value
checks and error reporting. Ensure unexpected keys in classifyEnv are reported
alongside missing or mismatched expected bindings.

245-254: 📐 Maintainability & Code Quality | 🔵 Trivial | ⚡ Quick win

Missing coverage for the nightly-canonical reason string.

The fragment list checks for explicit-selection, weekly-retained, release-qualification, and skipped-by-tier, but not nightly-canonical — the reason string set by the EXECUTION_TIER == "nightly" branch in e2e.yaml. A regression there (e.g., someone deletes or renames that branch) wouldn't be caught.

🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@tools/e2e/openshell-gateway-upgrade-workflow-boundary.mts` around lines 245 -
254, Update the fragment list in the classification assertions around
CLASSIFY_STEP_NAME to include the nightly-canonical reason string, ensuring the
nightly execution-tier branch in e2e.yaml is covered while preserving all
existing fragment checks.
test/e2e/support/openshell-gateway-upgrade-workflow-boundary.test.ts (1)

66-105: 📐 Maintainability & Code Quality | 🔵 Trivial | ⚡ Quick win

Duplicated fixture-tier literal risks silent drift from the validator's source of truth.

The fixtures.map(...) expectation (lines 74-105) duplicates EXPECTED_FIXTURE_TIERS from tools/e2e/openshell-gateway-upgrade-workflow-boundary.mts verbatim. If one copy is updated and the other isn't, this test and the boundary validator can silently diverge. Consider exporting EXPECTED_FIXTURE_TIERS from the boundary module and importing it here instead.

🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@test/e2e/support/openshell-gateway-upgrade-workflow-boundary.test.ts` around
lines 66 - 105, Export EXPECTED_FIXTURE_TIERS from the boundary validator module
and import it into the test instead of duplicating the fixture-tier objects in
the fixtures.map expectation. Update the assertion to compare against the shared
source-of-truth constant while preserving the existing fixture mapping and
validation behavior.
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Outside diff comments:
In @.github/workflows/e2e.yaml:
- Around line 4396-4402: Move the upgrade-tier classification step before the
*dockerhub-auth step in the weekly-release workflow, then gate Docker Hub
authentication with steps.gateway_upgrade_tier.outputs.run == '1'. Ensure
scheduled weekdays and default manual runs skip docker login when no
weekly-release rows are selected, while eligible runs retain authentication.

---

Nitpick comments:
In `@test/e2e/support/openshell-gateway-upgrade-workflow-boundary.test.ts`:
- Around line 66-105: Export EXPECTED_FIXTURE_TIERS from the boundary validator
module and import it into the test instead of duplicating the fixture-tier
objects in the fixtures.map expectation. Update the assertion to compare against
the shared source-of-truth constant while preserving the existing fixture
mapping and validation behavior.

In `@tools/e2e/openshell-gateway-upgrade-workflow-boundary.mts`:
- Around line 227-244: Update the classify-step environment validation around
classifyEnv and expectedClassifyEnv to compare their complete key sets with the
module’s established deep-strict-equality approach, while retaining the existing
value checks and error reporting. Ensure unexpected keys in classifyEnv are
reported alongside missing or mismatched expected bindings.
- Around line 245-254: Update the fragment list in the classification assertions
around CLASSIFY_STEP_NAME to include the nightly-canonical reason string,
ensuring the nightly execution-tier branch in e2e.yaml is covered while
preserving all existing fragment checks.

ℹ️ Review info
⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Enterprise

Run ID: b1ef55b3-a007-4e96-91ca-24dcc912a499

📥 Commits

Reviewing files that changed from the base of the PR and between 0030ba4 and 032e419.

📒 Files selected for processing (5)
  • .github/workflows/e2e.yaml
  • test/e2e/support/openshell-gateway-upgrade-workflow-boundary.test.ts
  • tools/e2e/openshell-gateway-upgrade-workflow-boundary.mts
  • tools/e2e/prepare-e2e-workflow-boundary.mts
  • tools/e2e/upload-e2e-artifacts-workflow-boundary.mts

Record expected and row-level observed nightly runner-minute reduction from
OpenShell gateway upgrade tier classification.

Extend the gateway workflow boundary validator and support test so the
classifier summary, outputs, and branch decisions stay covered for explicit
selection, nightly, weekly, release qualification, and skipped-by-tier rows.

Validation before commit:

- Gateway boundary test: passed, 13 tests.
- Focused workflow/report/planner bundle: passed, 128 tests.
- npm run source-shape:check: passed.
- npm run test:e2e-phases:check: passed.
- npm run test:changed: passed, 262 tests.

Signed-off-by: ScarabSystems <scarab.systems@yahoo.com>

@coderabbitai coderabbitai Bot left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Actionable comments posted: 1

🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In `@test/e2e/support/openshell-gateway-upgrade-workflow-boundary.test.ts`:
- Around line 234-299: Add a test case to the gateway tier classifier coverage
that sets checkoutSha and simulates an owning gateway-upgrade file change by
stubbing the changed-file command through the temporary PATH. Assert the
forced-selection output, including run, reason, and observed reduction, so
owning-file changes remain directly selectable. Use the existing
runGatewayTierClassifier test setup and output assertions.
🪄 Autofix (Beta)

Fix all unresolved CodeRabbit comments on this PR:

  • Push a commit to this branch (recommended)
  • Create a new PR with the fixes

ℹ️ Review info
⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Enterprise

Run ID: 4d6455db-5e7c-48f7-b14e-e61bf8f676f5

📥 Commits

Reviewing files that changed from the base of the PR and between 032e419 and 39c1c8d.

📒 Files selected for processing (3)
  • .github/workflows/e2e.yaml
  • test/e2e/support/openshell-gateway-upgrade-workflow-boundary.test.ts
  • tools/e2e/openshell-gateway-upgrade-workflow-boundary.mts
🚧 Files skipped from review as they are similar to previous changes (2)
  • tools/e2e/openshell-gateway-upgrade-workflow-boundary.mts
  • .github/workflows/e2e.yaml

Add a gateway tier classifier scenario for a PR controller checkout that
receives the upstream-selected openshell-gateway-upgrade job.

The classifier remains a selector consumer. Owning-file discovery stays in the
PR risk plan and workflow planner.

Validation before commit:

- Gateway boundary test: passed, 14 tests.
- Focused workflow/report/planner bundle: passed, 129 tests.
- npm run test:changed: passed, 14 tests.

Signed-off-by: ScarabSystems <scarab.systems@yahoo.com>
@cv

cv commented Jul 31, 2026

Copy link
Copy Markdown
Collaborator

Thank you for implementing the scope and tests requested by #7920.

We are closing this pull request because the maintainer scheduling decision has changed: NemoClaw will not use weekly E2E schedules. Weekly compatibility coverage creates a timebomb because releases can ship with a regressed retained boundary before its next execution.

Every retained compatibility boundary must run for every release candidate. If the coverage is too expensive, we must reduce setup, build, and test runtime or retire a non-unique boundary based on evidence. We must not defer required coverage beyond the release cadence.

This closure is about the scheduling premise, not the implementation quality. Follow-up optimization remains in #7912, with exact-commit artifact reuse tracked by #7915.

@cv cv closed this Jul 31, 2026
@scarab-systems

Copy link
Copy Markdown
Contributor Author

Thanks for the clear direction. That scheduling distinction makes sense.

I appreciate the clarification that this closure is about the scheduling premise, not the implementation quality. I’ll treat this PR as closed on that basis and keep any follow-up focused on #7912 optimization, with #7915’s exact-commit artifact reuse as the path for reducing setup/build/test cost instead of deferring required coverage.

Dorothy c/o Scarab Systems

@scarab-systems
scarab-systems deleted the scarab-systems/nemoclaw-7920-e2e-gateway-coverage-tiers branch July 31, 2026 22:59
@wscurran wscurran added area: ci CI workflows, checks, release automation, or GitHub Actions area: e2e End-to-end tests, nightly failures, or validation infrastructure chore Build, CI, dependency, or tooling maintenance labels Aug 3, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

area: ci CI workflows, checks, release automation, or GitHub Actions area: e2e End-to-end tests, nightly failures, or validation infrastructure chore Build, CI, dependency, or tooling maintenance

Projects

None yet

Development

Successfully merging this pull request may close these issues.

ci(e2e): tier retained gateway compatibility coverage

3 participants