test(machine-a-tron): guard the empty-NDF-MAC Dell boot NIC through HostInit

[chet]

Summary

libredfish v0.44.16 makes a Dell host whose boot NIC reports an empty NetworkDeviceFunction MAC -- a NicMode-stripped or iDRAC partition, where the EthernetInterface MAC stays populated -- resolve the boot NIC by its interface id instead of by the absent MAC, so it clears HostInit/PollingBiosSetup instead of looping there forever.

This bumps the pin to bring that in and adds an end-to-end machine-a-tron regression test so the path stays covered. The host still resolves a Pair (MAC + the interface id captured at exploration), so is_bios_setup's MAC lookup fails and falls back to the id -- reaching Ready proves it no longer hangs.

Changes

• Bump libredfish v0.44.15 -> v0.44.16 (the Dell BIOS-verify by-interface-id fix, fix(dell): resolve boot NIC by interface id on the BIOS verify path libredfish#96). Same pin as chore: bump libredfish to v0.44.16 #2889 -- the two merge cleanly whichever lands first.
• Add a per-host bmc-mock empty_ndf_mac knob: serves an empty boot-NIC NetworkDeviceFunction MAC while the EthernetInterface MAC stays populated (honored by Dell -- the one model with a NetworkDeviceFunction).
• Add test_machine_a_tron_empty_ndf_mac, driving such a Dell host to Ready.

Testing

test_integration locally, both directions:

• v0.44.16 (this PR): passes -- the empty-NDF-MAC host reaches Ready.
• v0.44.15 (pre-fix): the same host times out in PollingBiosSetup -- confirming the guard catches the regression.

This supports #2821

[coderabbitai]

Important

Review skipped

No new commits to review since the last review.

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Enterprise

Run ID: a223f4b6-e8f2-4ecc-a555-b38d96ddd11c

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

Walkthrough

The PR adds an empty_ndf_mac flag from machine configuration into the Dell R750 mock, where the boot NIC’s NetworkDeviceFunction can emit an empty MAC. The machine-a-tron integration suite adds a dedicated empty-MAC scenario and updates existing harness calls.

Changes

Empty NDF MAC support

Layer / File(s)	Summary
Config plumbing Cargo.toml, crates/machine-a-tron/src/config.rs, crates/bmc-mock/src/machine_info.rs, crates/machine-a-tron/src/host_machine.rs	Adds empty_ndf_mac to machine config and host state, copies it through persisted and new host construction, wires it into the Dell mock config, and updates the workspace libredfish dependency tag.
Dell mock MAC handling crates/bmc-mock/src/hw/dell_poweredge_r750.rs	The Dell PowerEdge R750 mock now uses empty_ndf_mac to emit either an empty NetworkDeviceFunction.MACAddress or the NIC MAC.
Integration harness and scenario coverage crates/api-integration-tests/tests/lib.rs	The machine-a-tron harness accepts the new flag, existing integration cases pass false, and a new test covers the empty-NDF-MAC ready-state path with true.

Estimated code review effort

🎯 3 (Moderate) | ⏱️ ~20 minutes

Possibly related PRs

• NVIDIA/infra-controller#2845: This also updates the same workspace libredfish dependency to a newer git tag.

🚥 Pre-merge checks | ✅ 4 | ❌ 1

❌ Failed checks (1 warning)

Check name	Status	Explanation	Resolution
Linked Issues check	⚠️ Warning	The PR adds the regression test and mock knob, but it does not show the verify-path code changes requested in #96.	Implement the BootInterfaceRef verify-path changes in is_bios_setup, diff_bios_bmc_attr, machine_setup_status, and shared helper reuse, or retarget the issue scope.

✅ Passed checks (4 passed)

Check name	Status	Explanation
Title check	✅ Passed	The title clearly describes the empty-NDF-MAC Dell boot-NIC regression guard, which matches the main change.
Description check	✅ Passed	The description matches the changeset and accurately explains the libredfish bump, mock knob, and regression test.
Out of Scope Changes check	✅ Passed	The dependency bump, mock flag, and regression test are all tied to the Dell empty-NDF-MAC fix; no unrelated changes stand out.
Docstring Coverage	✅ Passed	Docstring coverage is 100.00% which is sufficient. The required threshold is 80.00%.

_{✏️ Tip: You can configure your own custom pre-merge checks in the settings.}

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests

---

_{Comment @coderabbitai help to get the list of available commands.}

[chet]

@coderabbitai PTAL, thanks!

[coderabbitai]

@chet I'll review the changes now.

🐇

✅ Action performed

Review finished.

Note: CodeRabbit is an incremental review system and does not re-review already reviewed commits. This command is applicable only when automatic reviews are paused.

[poroh]

I doubt that adding one-off flag to machine info is right approach. Putting "request change" to discuss it before merge.

[github-actions]

🔍 Container Scan Summary

Service	Total	Critical	High	Medium	Low	Other
boot-artifacts-aarch64	3	0	0	3	0	0
boot-artifacts-x86_64	3	0	0	3	0	0
forge-admin-cli-x86_64	283	6	24	98	7	148
machine-validation-runner	744	32	188	267	36	221
machine_validation	744	32	188	267	36	221
machine_validation-aarch64	744	32	188	267	36	221
nvmetal-carbide	744	32	188	267	36	221
TOTAL	3265	134	776	1172	151	1032

Per-CVE detail lives in the per-service grype-* artifacts (JSON + SARIF). Severity counts only — no CVE IDs published here.

[chet]

Closing in favor of #2931.

The fix itself shipped in libredfish v0.44.16 (NVIDIA/libredfish#96, with a nw_dev_func_matches unit test) and is in NICo via #2889 — so #2821 is fixed and guarded at the layer where the bug lived.

This PR was an attempt to add an end-to-end machine-a-tron guard. Per the review steer, I reworked it from a bmc-mock flag to the failure-injection feature (including a new MergeEachMember action), but the e2e couldn't reproduce the hang deterministically. is_bios_setup reads the boot NIC's NetworkDeviceFunction via the $expand'd collection, so: a member-endpoint rule never reached it; a collection rule corrupted the bare $refs that exploration parses (Members[0]: missing Id); and even past that, the host still reached Ready on the pre-fix build — i.e. the test wasn't actually catching the regression. An object-level mock would have bitten, but that's the flag approach we were moving away from.

Rather than land a vacuous e2e, the deterministic coverage now lives in #2931 — tests for retained_boot_interfaces, the store that keeps the boot-interface id available so the controller can always fall back to it (the mechanism that keeps #2821-class hosts resolvable). Combined with the libredfish unit test and QA on the XE9680, #2821 is covered.

The MergeEachMember injection action prototyped here was clean and unit-tested — happy to revisit it if a future test needs runtime field-injection into an expanded collection.