ci: remove unused maintainer workflow approval

[cv]

Summary

This change removes the unused maintainer workflow-run approval controller and its actions: write permission. GitHub's approval controls remain in effect.

Changes

• Remove .github/workflows/approve-maintainer-pr-workflow-runs.yaml and its trusted TypeScript helper.
• Remove the workflow and helper contract tests.
• Remove the obsolete Vitest watch-trigger mapping and assertion.
• Remove the deleted security contract from the source-shape test budget.

Type of Change

• Code change (feature, bug fix, or refactor)
• Code change with doc updates
• Doc only (prose changes, no code sample modifications)
• Doc only (includes code sample changes)

Quality Gates

• Tests added or updated for changed behavior
• Existing tests cover changed behavior — justification:
• Tests not applicable — justification:
• Docs updated for user-facing behavior changes
• Docs not applicable — justification: This removes maintainer-only CI automation and does not change a public API, CLI, configuration, UI, default, error, or supported user workflow.
• Sensitive paths changed (security, policy, credentials, preflight, onboarding, inference, runner, sandbox, or messaging)
• Sensitive-path review completed or maintainer-approved waiver recorded — reviewer/approval link/justification: Independent Pi CLI security review of b5606fa84 covered all seven changed files and passed all nine repository rubric categories with no findings. Removing the pull_request_target workflow eliminates its actions: write token and leaves GitHub approval controls fail-closed.
• Non-success, skipped, or missing CI check accepted by maintainer — check name, approval link, and follow-up issue:

Documentation Writer Review

• Documentation writer subagent reviewed the completed changes
• Result: no-docs-needed
• Evidence: Pi CLI reviewed committed head b5606fa84; the removal changes maintainer-only CI automation and has no public documentation impact.
• Agent: Pi CLI

DGX Station Hardware Evidence

• Tested on DGX Station
• Tested commit: Not applicable.
• Station profile/scenario: Not applicable.
• Result: Not applicable; this change does not modify scripts/prepare-dgx-station-host.sh.
• Supporting evidence: Not applicable.

Verification

• PR description includes a Signed-off-by: line and every commit appears as Verified in GitHub
• Normal pre-commit, commit-msg, and pre-push hooks passed, or npm run validate:pr passed after refreshing origin/main when hooks were skipped or unavailable
• Targeted behavior tests pass for the current change set, or tests are marked not applicable above — command/result or justification: npx vitest run --project integration test/vitest-watch-triggers.test.ts passed 5 tests; npm run checks:repository passed, including exact Vitest project membership and source-shape budget validation.
• Applicable broad gate passed — npm test for broad runtime/test-harness changes; npm run check for repo-wide validation/coverage changes — command/result:
• Quality Gates section completed with required justifications or waivers
• No secrets, API keys, or credentials committed
• npm run docs builds without warnings (doc changes only)
• Doc pages follow the style guide (doc changes only)
• New doc pages include SPDX header and frontmatter (new pages only)

---

Signed-off-by: Carlos Villela cvillela@nvidia.com

Summary by CodeRabbit

• Chores
  • Removed the automated approval workflow for maintainer-related workflow runs.
  • Removed the associated command-line tooling and safety validation logic.
• Tests
  • Removed automated coverage for workflow approval, validation, retries, polling, and fail-closed behavior.
  • Removed watch triggers and test-budget exceptions tied to the retired workflow.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Enterprise

Run ID: b10385f1-cf51-4282-9e7c-c93d36d80359

📥 Commits

Reviewing files that changed from the base of the PR and between c31724f and b5606fa.

📒 Files selected for processing (7)

• .github/workflows/approve-maintainer-pr-workflow-runs.yaml
• ci/source-shape-test-budget.json
• test/helpers/vitest-watch-triggers.ts
• test/maintainer-pr-workflow-approval-helper.test.ts
• test/maintainer-pr-workflow-approval.test.ts
• test/vitest-watch-triggers.test.ts
• tools/ci/approve-maintainer-pr-workflow-runs.mts

💤 Files with no reviewable changes (7)

• .github/workflows/approve-maintainer-pr-workflow-runs.yaml
• test/maintainer-pr-workflow-approval.test.ts
• ci/source-shape-test-budget.json
• tools/ci/approve-maintainer-pr-workflow-runs.mts
• test/vitest-watch-triggers.test.ts
• test/maintainer-pr-workflow-approval-helper.test.ts
• test/helpers/vitest-watch-triggers.ts

---

📝 Walkthrough

Walkthrough

The pull request removes the maintainer workflow approval workflow, its implementation, related tests, the source-shape exception, and Vitest watch-trigger entries.

Changes

Maintainer approval removal

Layer / File(s)	Summary
Approval workflow and implementation removal .github/workflows/approve-maintainer-pr-workflow-runs.yaml, tools/ci/approve-maintainer-pr-workflow-runs.mts	Removes the workflow and its approval entry point, validation, polling, retries, and safety checks.
Test and budget cleanup test/maintainer-pr-workflow-approval*.test.ts, ci/source-shape-test-budget.json	Removes approval contract tests, helper tests, and the related source-shape compatibility exception.
Vitest watch-trigger cleanup test/helpers/vitest-watch-triggers.ts, test/vitest-watch-triggers.test.ts	Removes watch and expectation entries for the deleted workflow and test.

Estimated code review effort: 3 (Moderate) | ~20 minutes

Possibly related PRs

• NVIDIA/NemoClaw#8492: Changes the runner label for the same workflow.
• NVIDIA/NemoClaw#8493: Changes the runner for the workflow that this pull request deletes.

Suggested labels: refactor

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly and concisely describes the removal of the unused maintainer workflow approval automation.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

✨ Finishing Touches

📝 Generate docstrings

• Create stacked PR
• Commit on current branch

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch ci/remove-maintainer-workflow-approval

---

_{Comment @coderabbitai help to get the list of available commands.}

[github-code-quality]

Code Coverage Overview

Languages: TypeScript

TypeScript / code-coverage/plugin

The overall coverage in commit b5606fa in the ci/remove-maintainer... branch remains at 96%, unchanged from commit c31724f in the main branch.

TypeScript / code-coverage/cli

The overall coverage in commit b5606fa in the ci/remove-maintainer... branch remains at 81%, unchanged from commit d8fbb6e in the main branch.

Show a code coverage summary of the most impacted files.

File	main d8fbb6e	ci/remove-maintainer... b5606fa	+/-
src/lib/agent/d...e-base-image.ts	100%	86%	-14%
src/lib/inferen...board-probes.ts	95%	94%	-1%
src/lib/messagi...flow-planner.ts	91%	91%	0%
src/lib/onboard...-transaction.ts	93%	93%	0%
src/lib/inferen...ompatibility.ts	90%	90%	0%
src/lib/shields/index.ts	82%	83%	+1%
src/lib/onboard...oute-handoff.ts	92%	95%	+3%
src/lib/onboard...flight-ports.ts	33%	67%	+34%
src/lib/adapter...command-argv.ts	0%	50%	+50%
src/lib/shields...-convergence.ts	0%	75%	+75%

---

_{Updated August 07, 2026 11:33 UTC}

[github-actions]

PR Review Advisor — No blocking findings reported

Advisor assessment: No blocking advisor findings reported
Next action: No advisor follow-up needed.
Findings: 0 blockers · 0 warnings · 0 suggestions

Model lanes

• GPT-5.6 Terra (primary): Completed · high confidence · 0 blockers · 0 warnings · 0 suggestions
• Nemotron 3 Ultra (second opinion): Completed · high confidence · 0 blockers · 0 warnings · 0 suggestions
• Model comparison: normalized findings match; normalized terminology decisions match; normalized E2E selections match; severity counts match.

Second-opinion terminology and E2E selections are advisory. Live E2E does not run automatically for pull requests.

E2E guidance

Advisory only. A maintainer can dispatch the default E2E suite against this exact revision.

Recommended E2E: None

Workflow run details

This automated review informs maintainers. Warnings and suggestions do not require a response. A maintainer decides whether to merge.