ci(images): add protected buildless qualification batch - #8234
Conversation
Reconstruct the net #8077 terminal-outcome slice on current main. Signed-off-by: Aaron Erickson <aerickson@nvidia.com> (cherry picked from commit ce6f313e9f7705aa9374c0184710ca995dafdfa8)
Reconstruct the net #8078 shared-state authority slice on current main. Signed-off-by: Aaron Erickson <aerickson@nvidia.com> (cherry picked from commit 31236f767aa79c9e110be55bc1bf56b5396b227a)
Reconstruct the net #8080 journal-compatibility slice on current main. Signed-off-by: Aaron Erickson <aerickson@nvidia.com> (cherry picked from commit c52370db1119ec1b8f3365a0ce4c22beebdd28e4)
Signed-off-by: Aaron Erickson <aerickson@nvidia.com>
Signed-off-by: Aaron Erickson <aerickson@nvidia.com> (cherry picked from commit c3fea51)
Signed-off-by: Aaron Erickson <aerickson@nvidia.com> (cherry picked from commit 2060e9c)
Signed-off-by: Aaron Erickson <aerickson@nvidia.com> (cherry picked from commit 5976d9d)
Signed-off-by: Aaron Erickson <aerickson@nvidia.com> (cherry picked from commit c9a92ae)
Signed-off-by: Aaron Erickson <aerickson@nvidia.com>
Signed-off-by: Aaron Erickson <aerickson@nvidia.com>
Signed-off-by: Aaron Erickson <aerickson@nvidia.com>
Signed-off-by: Aaron Erickson <aerickson@nvidia.com>
Signed-off-by: Aaron Erickson <aerickson@nvidia.com>
Signed-off-by: Aaron Erickson <aerickson@nvidia.com>
Signed-off-by: Aaron Erickson <aerickson@nvidia.com>
|
Note Reviews pausedIt looks like this branch is under active development. To avoid overwhelming you with review comments due to an influx of new commits, CodeRabbit has automatically paused this review. You can configure this behavior by changing the Use the following commands to manage reviews:
Use the checkboxes below for quick actions:
No actionable comments were generated in the recent review. 🎉 ℹ️ Recent review info⚙️ Run configurationConfiguration used: Path: .coderabbit.yaml Review profile: CHILL Plan: Enterprise Run ID: 📒 Files selected for processing (3)
📝 WalkthroughWalkthroughAdds an explicit protected managed-image GPU E2E lane. It validates trusted workflow execution, immutable images, local inference through Ollama, NIM, and vLLM, rollback, cleanup, artifact upload, and risk-plan activation. ChangesProtected managed-image runtime
Estimated code review effort: 5 (Critical) | ~120 minutes Sequence Diagram(s)sequenceDiagram
participant GitHubActions
participant TrustedWorkflow
participant CandidateSource
participant LocalRegistry
participant OpenShellE2E
GitHubActions->>TrustedWorkflow: validate trusted dispatch metadata
TrustedWorkflow->>CandidateSource: checkout exact candidate sources
TrustedWorkflow->>LocalRegistry: build digest-pinned protected images
TrustedWorkflow->>OpenShellE2E: run GPU and local-inference qualification
OpenShellE2E-->>TrustedWorkflow: report rollback and cleanup status
TrustedWorkflow->>LocalRegistry: remove owned registry
Possibly related PRs
Suggested labels: Suggested reviewers: 🚥 Pre-merge checks | ✅ 4 | ❌ 1❌ Failed checks (1 warning)
✅ Passed checks (4 passed)
✨ Finishing Touches 💡 1📝 Generate docstrings 💡
🧪 Generate unit tests (beta)
Comment |
Code Coverage OverviewLanguages: TypeScript TypeScript / code-coverage/pluginThe overall coverage in commit ff85f48 in the TypeScript / code-coverage/cliThe overall coverage in commit ff85f48 in the Show a code coverage summary of the most impacted files.
Updated |
![github-advanced-security[bot]](https://avatars.githubusercontent.com/in/57789?s=60&v=4){kind=small}
PR Review Advisor — No blocking findings reportedAdvisor assessment: No blocking advisor findings reported Model lanes
5 terminology differences from the second opinionAdvisory only. These are normalized differences from the primary terminology receipt.
Second-opinion terminology and E2E selections are advisory. They do not change the primary assessment or E2E / PR Gate. 3 semantic terminology decisionsTerminology decisions are advisory. They affect the assessment only when a separate finding identifies concrete semantic impact.
E2E guidanceAdvisory only. E2E / PR Gate selects and runs jobs independently. Recommended E2E: This automated review informs maintainers. Warnings and suggestions do not require a response. A maintainer decides whether to merge. |
Signed-off-by: Aaron Erickson <aerickson@nvidia.com>
Signed-off-by: Aaron Erickson <aerickson@nvidia.com>
Signed-off-by: Aaron Erickson <aerickson@nvidia.com> # Conflicts: # test/pr-risk-plan.test.ts # tools/advisors/risk-plan.mts
|
@coderabbitai review |
✅ Action performedReview finished.
|
Signed-off-by: Aaron Erickson <aerickson@nvidia.com>
Signed-off-by: Aaron Erickson <aerickson@nvidia.com>
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 5
🧹 Nitpick comments (10)
test/e2e/live/managed-image-protected-runtime.test.ts (1)
20-28: 📐 Maintainability & Code Quality | 🔵 Trivial | ⚡ Quick winDerive the declared agent list from the contract constant.
Line 24 repeats the agent inventory as literals.
PROTECTED_MANAGED_IMAGE_AGENTSalready holds the same list, andtest/e2e/live/managed-image-protected-runtime-helpers.tsline 404 writes the summary artifact from that constant. If the activation contract inci/protected-managed-image-multiarch-activation-v1.jsonchanges, this declaration drifts silently.Import the constant and spread it here.
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@test/e2e/live/managed-image-protected-runtime.test.ts` around lines 20 - 28, The managed-image declaration should derive its agent inventory from the existing PROTECTED_MANAGED_IMAGE_AGENTS contract constant instead of duplicating string literals. Import PROTECTED_MANAGED_IMAGE_AGENTS from the shared helpers module and spread it into the agents field of artifacts.target.declare, keeping the remaining declaration unchanged.scripts/checks/run-managed-image-openshell-e2e.ts (2)
713-725: 📐 Maintainability & Code Quality | 🔵 Trivial | ⚡ Quick winDrop the prebuild conditions that cannot fail.
Line 713 constructs
prebuildwithimageRef: null,imageId: null, andcreateArgs: [...createArgs]. The first three conditions on lines 715-717 then test that same literal. They are constant-false and cannot detect any renderer behavior. Only thelaunch.createArgvconditions on lines 718-722 exercise the exact-image identity claim.Keep the
launch.createArgvchecks and remove the self-referential ones, so the guard states one testable claim.♻️ Proposed fix
const prebuild = { createArgs: [...createArgs], imageRef: null, imageId: null }; if ( - prebuild.imageId !== null || - prebuild.imageRef !== null || - prebuild.createArgs.join("\0") !== createArgs.join("\0") || launch.createArgv.filter((value) => value === "--from").length !== 1 ||🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@scripts/checks/run-managed-image-openshell-e2e.ts` around lines 713 - 725, Update the guard following the prebuild declaration by removing the checks against prebuild.imageId, prebuild.imageRef, and prebuild.createArgs, since they only compare unchanged literals. Preserve the launch.createArgv checks for --from and --policy so the guard validates the rendered image identity.Source: Path instructions
848-850: 🩺 Stability & Availability | 🔵 Trivial | ⚡ Quick winPreserve the original failure when cleanup also fails.
The
finallyblock throws at line 943. A throw insidefinallyreplaces any exception that thetryblock raised. If the qualification fails at line 833 or a probe fails, and cleanup then records an error, the reported error is only the cleanup error. The protected lane runs for up to 300 minutes, so the discarded root cause is expensive to recover.Capture the primary error and report both.
♻️ Proposed fix
async function run(input: Inputs): Promise<void> { @@ let failureInjectionQualified = false; + let primaryError: unknown = null; try { @@ + } catch (error) { + primaryError = error; + throw error; } finally { const cleanupErrors: string[] = []; @@ if (cleanupErrors.length > 0) { - throw new Error(`managed-image OpenShell cleanup failed: ${cleanupErrors.join("; ")}`); + const detail = `managed-image OpenShell cleanup failed: ${cleanupErrors.join("; ")}`; + if (primaryError) { + throw new Error( + `${primaryError instanceof Error ? primaryError.message : String(primaryError)}; ${detail}`, + { cause: primaryError }, + ); + } + throw new Error(detail); }Also applies to: 942-944
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@scripts/checks/run-managed-image-openshell-e2e.ts` around lines 848 - 850, Update the cleanup flow around the finally block and its cleanupErrors throw to preserve any exception from the protected try block. Capture the primary failure, then report it together with cleanup errors when both occur; only throw cleanup errors when no primary failure exists.Source: Linters/SAST tools
test/e2e/live/managed-image-protected-runtime-helpers.ts (1)
335-408: 🩺 Stability & Availability | 🔵 TrivialConsider the total time budget for the four phases.
The per-command timeouts add up beyond the test timeout.
test/e2e/live/managed-image-protected-runtime.test.tsline 7 sets 220 minutes, and the workflow job allows 300 minutes. The bounded waits in this file reach much more: nine agent qualifications at 20 minutes each, three rollback runs at 20 minutes each, plus a 45 minute Ollama pull and roughly 31 minutes for vLLM and 20 minutes for NIM.A slow run therefore ends at the test timeout instead of at a specific command timeout, which makes the failing phase harder to identify. The registered disposables at lines 343-356 still run, so cleanup is preserved.
Consider lowering the per-run
timeoutMsvalues so that the sum fits inside the test timeout, and record the phase in the failure path.🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@test/e2e/live/managed-image-protected-runtime-helpers.ts` around lines 335 - 408, Rebalance the bounded waits used by qualifyProtectedManagedImageRuntime and its helpers so the combined Ollama, vLLM, NIM, agent-qualification, and rollback budgets fit within the 220-minute test timeout. Preserve cleanup registration while reducing the relevant timeoutMs values, and record the active progress.phase in the failure path so timeout errors identify the phase that failed..github/workflows/e2e.yaml (2)
2249-2250: 📐 Maintainability & Code Quality | 🔵 Trivial | 💤 Low valueDeclare
shell: bashfor consistency.Every other
runstep in this job declaresshell: bash. This step omits it and also omitsset -euo pipefail. The default shell on the Linux runner already fails on error, so behavior is correct. Addshell: bashto match the surrounding steps.♻️ Proposed change
- name: Install OpenShell CLI + shell: bash run: env -u DOCKER_CONFIG -u DOCKERHUB_USERNAME -u DOCKERHUB_TOKEN -u NVIDIA_API_KEY -u NVIDIA_INFERENCE_API_KEY -u GITHUB_TOKEN bash scripts/install-openshell.sh🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In @.github/workflows/e2e.yaml around lines 2249 - 2250, Add an explicit shell: bash setting to the “Install OpenShell CLI” workflow step, matching the shell declaration used by the other run steps in the job; leave the existing command unchanged.
2152-2229: 📐 Maintainability & Code Quality | 🔵 Trivial | 🏗️ Heavy liftThe protected runtime lane duplicates the multiarch lane in both the workflow and its validator. The new lane was created by copying
managed-image-multiarch-startuprather than extracting the shared parts, so the digest-pinning and registry-isolation guarantees now exist twice, and each copy is pinned by its own validator text. The two copies can drift independently while both validators still pass.
.github/workflows/e2e.yaml#L2152-L2229: extract theresolve_basefunction and the registry start/stop bodies into a shared script underscripts/checks/, and call it from both this job andmanaged-image-multiarch-startup(lines 1832-1912, 1992-2016).tools/e2e/managed-image-protected-runtime-workflow-boundary.mts#L183-L201: after the shared script exists, replace theserequireFragmentsshell-text assertions with assertions on the shared script invocation, and share the common step expectations with the multiarch validator instead of restating them.🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In @.github/workflows/e2e.yaml around lines 2152 - 2229, Extract the shared resolve_base logic and protected registry start/stop bodies from .github/workflows/e2e.yaml lines 2152-2229 and the corresponding managed-image-multiarch-startup sections at lines 1832-1912 and 1992-2016 into a script under scripts/checks/, then invoke that script from both jobs. Update tools/e2e/managed-image-protected-runtime-workflow-boundary.mts lines 183-201 to assert the shared-script invocation and reuse common step expectations with the multiarch validator instead of duplicating shell fragments.test/e2e/support/managed-image-protected-runtime-workflow.test.ts (1)
24-28: 📐 Maintainability & Code Quality | 🔵 Trivial | 💤 Low valueReplace the non-null assertion with an explicit assertion.
namedStepuses!on thefindresult. If a step name changes, the test fails with aTypeErroron an unrelated line instead of naming the missing step. An explicitexpect(...).toBeDefined()reports the real cause.♻️ Proposed change
function namedStep(value: WorkflowRecord, name: string): Record<string, unknown> { - return (runtimeJob(value).steps as Array<Record<string, unknown>>).find( + const step = (runtimeJob(value).steps as Array<Record<string, unknown>>).find( (step) => step.name === name, - )!; + ); + expect(step, `workflow step '${name}' is missing`).toBeDefined(); + return step as Record<string, unknown>; }🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@test/e2e/support/managed-image-protected-runtime-workflow.test.ts` around lines 24 - 28, Update namedStep to store the find result, assert it is defined with expect(...).toBeDefined(), and then return it without using a non-null assertion; preserve the existing step-name lookup and ensure failures identify the missing named step.tools/advisors/risk-plan.mts (3)
446-446: 📐 Maintainability & Code Quality | 🔵 Trivial | 💤 Low valueUse a job-id constant for consistency.
The sibling rule on line 425 references
PROTECTED_MANAGED_IMAGE_MULTIARCH_JOB_ID. This rule inlines the literal"managed-image-protected-runtime", and the same literal also appears as the ruleidon line 442 and in theRiskFamilyIdunion on line 98. Introduce a constant so the workflow job id has one definition in this file.🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@tools/advisors/risk-plan.mts` at line 446, Introduce a shared constant for the managed image protected runtime job ID and replace the literal in the rule’s requiredJobs, rule id, and RiskFamilyId union with that constant, matching the existing PROTECTED_MANAGED_IMAGE_MULTIARCH_JOB_ID pattern.
76-84: 🚀 Performance & Scalability | 🔵 TrivialConsider the CI cost of the broad prefixes.
scripts/,nemoclaw/, andnemoclaw-blueprint/are wide prefixes. Any change under them now requires the 210-minutemanaged-image-multiarch-startupjob, andtest/pr-e2e-gate-signal-shards.test.tsconfirms the broad shard count rises from 13 to 14 and the flattened count from 15 to 17. If this scope is intentional, plan for the added GPU and runner queue time. If not, narrow the prefixes to the directories that actually feed the managed images.🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@tools/advisors/risk-plan.mts` around lines 76 - 84, Review MANAGED_IMAGE_MULTIARCH_INPUT_PREFIXES and narrow the broad scripts/, nemoclaw/, and nemoclaw-blueprint/ entries to only the subdirectories or files that feed the managed images, unless the full-prefix scope is explicitly intentional. Preserve the required managed-image trigger coverage while avoiding unnecessary managed-image-multiarch-startup jobs and shard-count increases.
59-84: 🗄️ Data Integrity & Integration | 🔵 Trivial | 🏗️ Heavy liftEnforce synchronization with the managed-image workflow path filter.
MANAGED_IMAGE_MULTIARCH_INPUTSandMANAGED_IMAGE_MULTIARCH_INPUT_PREFIXEScurrently cover the workflow filter.PROTECTED_MANAGED_IMAGE_ACTIVATION_PATHis the intentional extra. Existing tests cover risk-plan matching but do not parse the workflow. Derive the inventory from.github/workflows/managed-images.yaml, or add a parser test that permits only this exception and covers false-positive paths.🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@tools/advisors/risk-plan.mts` around lines 59 - 84, Synchronize the risk-plan inventory with the path filters in managed-images.yaml by deriving MANAGED_IMAGE_MULTIARCH_INPUTS and MANAGED_IMAGE_MULTIARCH_INPUT_PREFIXES from that workflow, or add a parser-based test that validates every workflow path and permits only PROTECTED_MANAGED_IMAGE_ACTIVATION_PATH as an intentional extra. Include false-positive path cases to ensure unrelated files are excluded.Source: Path instructions
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In @.github/workflows/e2e.yaml:
- Line 2055: Update the managed-image-protected-runtime job configuration to
remove NEMOCLAW_CLI_BIN, matching managed-image-multiarch-startup, or
alternatively enable CLI building in Prepare E2E workspace so bin/nemoclaw.js
has its required dist/nemoclaw output.
In `@scripts/checks/run-managed-image-openshell-e2e.ts`:
- Around line 154-156: Update managedImageOpenShellBasePolicyPath to resolve the
module directory through the repository’s CJS/ESM normalization pattern instead
of assuming __dirname, so it works under both tsx and Vitest. Replace the
require.main === module entrypoint check with the repository’s dual-mode guard,
ensuring imported modules do not execute the CLI while direct execution still
does.
In `@test/e2e/live/managed-image-protected-runtime-helpers.ts`:
- Around line 217-224: Update the timeout failure command in the readiness
script to add Docker’s --tail option to the docker logs invocation, limiting the
vLLM log dump to a bounded number of recent lines while preserving stderr output
and the existing exit behavior.
- Around line 384-397: The NEMOCLAW_VLLM_LOCAL_TOKEN values passed to
qualifyEveryAgent in both the vllm and nim phases are hardcoded
source-controlled literals instead of being dynamically generated per-run.
Either generate unique tokens for each qualification phase instead of the static
"protected-local-vllm" and "protected-local-nim" strings, or update the
credentialBoundary configuration to align with these static credential values.
Ensure the approach matches how the sandbox provider credential is actually
registered and used.
In `@test/e2e/support/managed-image-protected-runtime-workflow.test.ts`:
- Around line 14-18: Update workflow() to resolve e2e.yaml using
import.meta.dirname instead of __dirname, matching the ESM path-resolution
pattern used by sibling support tests. Preserve the existing relative workflow
path and YAML parsing behavior.
---
Nitpick comments:
In @.github/workflows/e2e.yaml:
- Around line 2249-2250: Add an explicit shell: bash setting to the “Install
OpenShell CLI” workflow step, matching the shell declaration used by the other
run steps in the job; leave the existing command unchanged.
- Around line 2152-2229: Extract the shared resolve_base logic and protected
registry start/stop bodies from .github/workflows/e2e.yaml lines 2152-2229 and
the corresponding managed-image-multiarch-startup sections at lines 1832-1912
and 1992-2016 into a script under scripts/checks/, then invoke that script from
both jobs. Update
tools/e2e/managed-image-protected-runtime-workflow-boundary.mts lines 183-201 to
assert the shared-script invocation and reuse common step expectations with the
multiarch validator instead of duplicating shell fragments.
In `@scripts/checks/run-managed-image-openshell-e2e.ts`:
- Around line 713-725: Update the guard following the prebuild declaration by
removing the checks against prebuild.imageId, prebuild.imageRef, and
prebuild.createArgs, since they only compare unchanged literals. Preserve the
launch.createArgv checks for --from and --policy so the guard validates the
rendered image identity.
- Around line 848-850: Update the cleanup flow around the finally block and its
cleanupErrors throw to preserve any exception from the protected try block.
Capture the primary failure, then report it together with cleanup errors when
both occur; only throw cleanup errors when no primary failure exists.
In `@test/e2e/live/managed-image-protected-runtime-helpers.ts`:
- Around line 335-408: Rebalance the bounded waits used by
qualifyProtectedManagedImageRuntime and its helpers so the combined Ollama,
vLLM, NIM, agent-qualification, and rollback budgets fit within the 220-minute
test timeout. Preserve cleanup registration while reducing the relevant
timeoutMs values, and record the active progress.phase in the failure path so
timeout errors identify the phase that failed.
In `@test/e2e/live/managed-image-protected-runtime.test.ts`:
- Around line 20-28: The managed-image declaration should derive its agent
inventory from the existing PROTECTED_MANAGED_IMAGE_AGENTS contract constant
instead of duplicating string literals. Import PROTECTED_MANAGED_IMAGE_AGENTS
from the shared helpers module and spread it into the agents field of
artifacts.target.declare, keeping the remaining declaration unchanged.
In `@test/e2e/support/managed-image-protected-runtime-workflow.test.ts`:
- Around line 24-28: Update namedStep to store the find result, assert it is
defined with expect(...).toBeDefined(), and then return it without using a
non-null assertion; preserve the existing step-name lookup and ensure failures
identify the missing named step.
In `@tools/advisors/risk-plan.mts`:
- Line 446: Introduce a shared constant for the managed image protected runtime
job ID and replace the literal in the rule’s requiredJobs, rule id, and
RiskFamilyId union with that constant, matching the existing
PROTECTED_MANAGED_IMAGE_MULTIARCH_JOB_ID pattern.
- Around line 76-84: Review MANAGED_IMAGE_MULTIARCH_INPUT_PREFIXES and narrow
the broad scripts/, nemoclaw/, and nemoclaw-blueprint/ entries to only the
subdirectories or files that feed the managed images, unless the full-prefix
scope is explicitly intentional. Preserve the required managed-image trigger
coverage while avoiding unnecessary managed-image-multiarch-startup jobs and
shard-count increases.
- Around line 59-84: Synchronize the risk-plan inventory with the path filters
in managed-images.yaml by deriving MANAGED_IMAGE_MULTIARCH_INPUTS and
MANAGED_IMAGE_MULTIARCH_INPUT_PREFIXES from that workflow, or add a parser-based
test that validates every workflow path and permits only
PROTECTED_MANAGED_IMAGE_ACTIVATION_PATH as an intentional extra. Include
false-positive path cases to ensure unrelated files are excluded.
🪄 Autofix
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Path: .coderabbit.yaml
Review profile: CHILL
Plan: Enterprise
Run ID: f4e79d32-0289-4082-a7dd-1f59b84b562b
📒 Files selected for processing (18)
.github/workflows/e2e.yamlci/protected-managed-image-multiarch-activation-v1.jsonscripts/checks/managed-image-protected-runtime-contract.tsscripts/checks/run-managed-image-openshell-e2e.tstest/e2e/live/managed-image-protected-runtime-helpers.tstest/e2e/live/managed-image-protected-runtime.test.tstest/e2e/mock-parity.jsontest/e2e/support/managed-image-protected-runtime-workflow.test.tstest/managed-image-protected-runtime-contract.test.tstest/pr-e2e-gate-signal-shards.test.tstest/pr-e2e-gate.test.tstest/pr-risk-plan.test.tstest/protected-managed-image-contract.test.tstools/advisors/risk-plan.mtstools/e2e/managed-image-protected-runtime-workflow-boundary.mtstools/e2e/prepare-e2e-workflow-boundary.mtstools/e2e/upload-e2e-artifacts-workflow-boundary.mtstools/e2e/workflow-boundary.mts
wscurran
added
area: ci
|
@coderabbitai review |
✅ Action performedReview finished.
|
Signed-off-by: Aaron Erickson <aerickson@nvidia.com>
|
@coderabbitai review |
✅ Action performedReview finished.
|
Coordination note for future Pi qualificationThis PR should remain the current OpenClaw, Hermes, and Deep Agents Code protected buildless qualification batch. #7923 proposes Pi as a future shipped agent, but #7926 has not accepted its product contract. Do not add Pi to this PR or make the evidence for this PR responsible for a fourth agent runtime. After the current buildless activation batch merges, Pi should use the same managed-image contract, direct startup harness, native amd64/arm64 publication evidence, protected bootstrap and runtime checks, rollback, and cleanup of identified resources. Pi image work belongs to #7925. Lifecycle and qualification work belongs to #7927 and #7928. If Pi activates before Podman, a later #7744 qualification or activation change must add Pi to the all-shipped-agent gate before NemoClaw documents Podman support. Do not add a Pi-specific provider or workflow execution branch. |
ericksoa
added
area: e2e
Signed-off-by: Carlos Villela <cvillela@nvidia.com>
Signed-off-by: Carlos Villela <cvillela@nvidia.com>
4 participants
Summary
Stack
08435d31e45ce91391d884a94f5ae59caf5701d5; signed mergebeeb0d990f38b4db5809a7ad8a87aaaf39215947preserves B3-C patch ID784174a359c3f95d1898eef01075e5bd6c995afd, and exact repair head59fbc1af816b759c102f391ec289cc0f2023a231refreshes the two intended workflow/risk-plan compatibility hashesValidation
npm run checks:repositorynpm run typecheck:clinpm run source-shape:checknpm run test-size:checknpm run test-conditionals:scan -- --top 25npm run test:e2e-phases:checkSafety boundary
The trusted workflow and its fail-closed validator land before activation. The NVIDIA credential is scoped only to host-side NGC/NIM setup; managed sandboxes receive generated local route tokens, and the E2E artifact sink redacts the workflow secret.
Signed-off-by: Aaron Erickson aerickson@nvidia.com
Summary by CodeRabbit
New Features
Security
Tests