Skip to content

fix(e2e): scope generic GPU risk signals to PR runs - #8639

Merged
apurvvkumaria merged 3 commits into
mainfrom
codex/fix-trusted-main-risk-signal
Aug 9, 2026
Merged

fix(e2e): scope generic GPU risk signals to PR runs#8639
apurvvkumaria merged 3 commits into
mainfrom
codex/fix-trusted-main-risk-signal

Conversation

@apurvvkumaria

@apurvvkumaria apurvvkumaria commented Aug 9, 2026

Copy link
Copy Markdown
Collaborator

Summary

Automatic main-push generic GPU E2E runs currently activate risk-signal reporting with github.sha even though no correlation UUID exists, so Vitest exits before the live test starts. Keep reporting inactive when checkout_sha is absent, bind source attestation to a separate candidate SHA, and preserve the exact SHA and lowercase UUIDv4 contract for manual PR qualification.

Changes

  • Bind the generic GPU reporter identity only to inputs.checkout_sha, leaving automatic main pushes inactive.
  • Bind the generic GPU live test and its qualification evidence to a separate exact candidate SHA on both trusted-main and PR self-hosted paths.
  • Keep manual PR expected-SHA and correlation inputs exact and fail closed for missing or invalid active identities.
  • Refresh the immutable CLI artifact workflow digest and add focused workflow and reporter contract coverage.

Failure Evidence

Type of Change

  • Code change (feature, bug fix, or refactor)
  • Code change with doc updates
  • Doc only (prose changes, no code sample modifications)
  • Doc only (includes code sample changes)

Quality Gates

  • Tests added or updated for changed behavior
  • Existing tests cover changed behavior — justification:
  • Tests not applicable — justification:
  • Docs updated for user-facing behavior changes
  • Docs not applicable — justification: This repairs internal trusted CI identity wiring. It does not change a public CLI, configuration, API, policy schema, documented default, or supported runtime behavior.
  • Sensitive paths changed (security, policy, credentials, preflight, onboarding, inference, runner, sandbox, or messaging)
  • Sensitive-path review completed or maintainer-approved waiver recorded — reviewer/approval link/justification: Independent Codex Desktop nine-category review of e9b4613ef passed with no findings.
  • Non-success, skipped, or missing CI check accepted by maintainer — check name, approval link, and follow-up issue:

Documentation Writer Review

  • Documentation writer subagent reviewed the completed changes
  • Result: no-docs-needed
  • Evidence: Reviewed all seven changed files. The change only affects internal workflow risk-signal activation, candidate identity, validators, and regression coverage; public documentation does not expose this lane or environment contract.
  • Agent: Codex Desktop

DGX Station Hardware Evidence

  • Tested on DGX Station
  • Tested commit:
  • Station profile/scenario:
  • Result:
  • Supporting evidence:

Verification

  • PR description includes a Signed-off-by: line and every commit appears as Verified in GitHub
  • Normal pre-commit, commit-msg, and pre-push hooks passed, or npm run validate:pr passed after refreshing origin/main when hooks were skipped or unavailable
  • Targeted behavior tests pass for the current change set, or tests are marked not applicable above — 48 E2E operations workflow tests, 40 CLI artifact workflow tests, 20 risk-signal reporter tests, and all 441 path-selected tests passed; npm run validate:pr passed.
  • Applicable broad gate passed — npm test for broad runtime/test-harness changes; npm run check for repo-wide validation/coverage changes — command/result: Not run locally; fresh PR automation will provide the repository-wide gates.
  • Quality Gates section completed with required justifications or waivers
  • No secrets, API keys, or credentials committed
  • npm run docs builds without warnings (doc changes only)
  • Doc pages follow the style guide (doc changes only)
  • New doc pages include SPDX header and frontmatter (new pages only)

Signed-off-by: Apurv Kumaria akumaria@nvidia.com

Summary by CodeRabbit

  • Bug Fixes

    • Improved validation of generic GPU end-to-end qualification commits.
    • Added fail-closed handling for missing or invalid correlation identifiers.
    • Corrected workflow identity and risk-signal environment validation.
  • Tests

    • Expanded coverage for disabled configurations, candidate commit identity, and workflow boundaries.
    • Updated qualification evidence and completion metadata checks.

Signed-off-by: Apurv Kumaria <akumaria@nvidia.com>
@apurvvkumaria apurvvkumaria self-assigned this Aug 9, 2026
@apurvvkumaria
apurvvkumaria requested a review from cv August 9, 2026 01:51
@coderabbitai

coderabbitai Bot commented Aug 9, 2026

Copy link
Copy Markdown
Contributor

Review Change Stack

📝 Walkthrough

Walkthrough

The PR separates the dispatch checkout SHA from the effective llama.cpp qualification head SHA. It updates workflow bindings, qualification evidence, workflow boundary validation, risk-signal tests, and the CLI workflow contract checksum.

Changes

Llama.cpp E2E SHA identity

Layer / File(s) Summary
Workflow SHA bindings
.github/workflows/e2e.yaml, .github/workflows/pr-self-hosted.yaml, tools/e2e/workflow-boundary.mts, tools/e2e/cli-artifact-workflow-boundary.mts
The workflows bind NEMOCLAW_E2E_EXPECTED_SHA to the checkout input and bind NEMOCLAW_LLAMA_CPP_QUALIFICATION_HEAD_SHA to the checkout input or github.sha. Boundary validation and its checksum match the updated contract.
Qualification evidence identity
test/e2e/live/llama-cpp-generic-gpu.test.ts
The live test validates the qualification head SHA and records it in qualification evidence and completion metadata.
Boundary and risk-signal tests
test/e2e/support/e2e-operations-workflow-boundary.test.ts, test/e2e-risk-signal-reporter.test.ts
Tests cover generic GPU workflow identity bindings and fail-closed handling for missing or invalid correlation IDs. The manual PR identity test targets llama-cpp-generic-gpu.

Estimated code review effort: 2 (Simple) | ~10 minutes

Possibly related PRs

  • NVIDIA/NemoClaw#8570: Updates E2E workflow identity handling and lane-specific qualification head SHA bindings.
  • NVIDIA/NemoClaw#8477: Modifies E2E workflow SHA validation and llama.cpp qualification bindings.
  • NVIDIA/NemoClaw#8518: Separates manual PR checkout SHAs from github.sha fallback behavior.

Suggested labels: v0.0.106

Suggested reviewers: cv, ericksoa, aasthajh

🚥 Pre-merge checks | ✅ 4 | ❌ 1

❌ Failed checks (1 warning)

Check name Status Explanation Resolution
Docstring Coverage ⚠️ Warning Docstring coverage is 0.00% which is insufficient. The required threshold is 80.00%. Write docstrings for the functions missing them to satisfy the coverage threshold.
✅ Passed checks (4 passed)
Check name Status Explanation
Description Check ✅ Passed Check skipped - CodeRabbit’s high-level summary is enabled.
Title check ✅ Passed The title clearly and concisely describes the main change: restricting generic GPU risk-signal reporting to pull request runs.
Linked Issues check ✅ Passed Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check ✅ Passed Check skipped because no linked issues were found for this pull request.
✨ Finishing Touches 💡 1
📝 Generate docstrings 💡
  • Create stacked PR
  • Commit on current branch
🧪 Generate unit tests (beta)
  • Create PR with unit tests
  • Commit unit tests in branch codex/fix-trusted-main-risk-signal

Comment @coderabbitai help to get the list of available commands.

@github-code-quality

github-code-quality Bot commented Aug 9, 2026

Copy link
Copy Markdown
Contributor

Code Coverage Overview

Languages: TypeScript

TypeScript / code-coverage/plugin

The overall coverage in commit e4049cc in the codex/fix-trusted-ma... branch remains at 96%, unchanged from commit 8e5b6df in the main branch.

TypeScript / code-coverage/cli

The overall coverage in commit e4049cc in the codex/fix-trusted-ma... branch remains at 81%, unchanged from commit 8e5b6df in the main branch.

Show a code coverage summary of the most impacted files.
File main 8e5b6df codex/fix-trusted-ma... e4049cc +/-
src/lib/onboard...shared-state.ts 90% 73% -17%
src/lib/adapter...ainer-engine.ts 95% 85% -10%
src/lib/onboard.../docker-spec.ts 74% 65% -9%
src/lib/onboard...strap/docker.ts 72% 64% -8%
src/lib/onboard...ne-authority.ts 91% 84% -7%
src/lib/onboard...cker-journal.ts 75% 70% -5%
src/lib/onboard...trap/adapter.ts 70% 68% -2%
src/lib/onboard...mo-lifecycle.ts 86% 84% -2%
src/lib/onboard...eate-journal.ts 82% 80% -2%
src/lib/onboard...an-lifecycle.ts 79% 95% +16%

Updated August 09, 2026 03:04 UTC

@coderabbitai coderabbitai Bot left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Actionable comments posted: 1

🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In `@test/e2e-risk-signal-reporter.test.ts`:
- Around line 91-96: Update the test around configuredEnvironment to retain a
valid correlation ID and all other activation inputs while setting only
NEMOCLAW_E2E_EXPECTED_SHA to an empty string. Assert that configuredEnvironment
returns null, isolating the absent expected-SHA guard.
🪄 Autofix

Fix all unresolved CodeRabbit comments on this PR:

  • Push a commit to this branch (recommended)
  • Create a new PR with the fixes

ℹ️ Review info
⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Enterprise

Run ID: 54133fd1-e2ba-4b5c-a37d-09a2ff399c57

📥 Commits

Reviewing files that changed from the base of the PR and between 290eb94 and e9b4613.

📒 Files selected for processing (7)
  • .github/workflows/e2e.yaml
  • .github/workflows/pr-self-hosted.yaml
  • test/e2e-risk-signal-reporter.test.ts
  • test/e2e/live/llama-cpp-generic-gpu.test.ts
  • test/e2e/support/e2e-operations-workflow-boundary.test.ts
  • tools/e2e/cli-artifact-workflow-boundary.mts
  • tools/e2e/workflow-boundary.mts

Comment on lines +91 to +96
expect(
configuredEnvironment({
NEMOCLAW_E2E_CORRELATION_ID: "",
NEMOCLAW_E2E_EXPECTED_SHA: "",
}),
).toBeNull();

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

🎯 Functional Correctness | 🟡 Minor | ⚡ Quick win

Test the absent expected-SHA guard independently.

This test clears both identity values. It passes if reporting incorrectly activates when a correlation ID exists but NEMOCLAW_E2E_EXPECTED_SHA is absent.

Keep a valid correlation ID and the other activation inputs. Set only NEMOCLAW_E2E_EXPECTED_SHA to "". Expect configuredEnvironment to return null.

Proposed test change
     expect(
       configuredEnvironment({
-        NEMOCLAW_E2E_CORRELATION_ID: "",
+        E2E_ARTIFACT_DIR: "/tmp/e2e-risk-signal-test",
+        E2E_TARGET_ID: "llama-cpp-generic-gpu",
+        GITHUB_WORKSPACE: "/workspace",
+        NEMOCLAW_E2E_CORRELATION_ID: CORRELATION_ID,
         NEMOCLAW_E2E_EXPECTED_SHA: "",
+        NEMOCLAW_E2E_SHARD: "default",
       }),
     ).toBeNull();

As per path instructions, “Review tests for behavioral confidence rather than implementation lock-in.”

📝 Committable suggestion

‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.

Suggested change
expect(
configuredEnvironment({
NEMOCLAW_E2E_CORRELATION_ID: "",
NEMOCLAW_E2E_EXPECTED_SHA: "",
}),
).toBeNull();
expect(
configuredEnvironment({
E2E_ARTIFACT_DIR: "/tmp/e2e-risk-signal-test",
E2E_TARGET_ID: "llama-cpp-generic-gpu",
GITHUB_WORKSPACE: "/workspace",
NEMOCLAW_E2E_CORRELATION_ID: CORRELATION_ID,
NEMOCLAW_E2E_EXPECTED_SHA: "",
NEMOCLAW_E2E_SHARD: "default",
}),
).toBeNull();
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@test/e2e-risk-signal-reporter.test.ts` around lines 91 - 96, Update the test
around configuredEnvironment to retain a valid correlation ID and all other
activation inputs while setting only NEMOCLAW_E2E_EXPECTED_SHA to an empty
string. Assert that configuredEnvironment returns null, isolating the absent
expected-SHA guard.

Source: Path instructions

@github-actions

github-actions Bot commented Aug 9, 2026

Copy link
Copy Markdown
Contributor

PR Review Advisor — No blocking findings reported

Advisor assessment: No blocking advisor findings reported
Next action: No advisor follow-up needed.
Findings: 0 blockers · 0 warnings · 0 suggestions

Model lanes

  • GPT-5.6 Terra (primary): Completed · high confidence · 0 blockers · 0 warnings · 0 suggestions
  • Nemotron 3 Ultra (second opinion): Completed · high confidence · 0 blockers · 0 warnings · 0 suggestions
  • Model comparison: normalized findings match; normalized terminology decisions differ; normalized E2E selections differ; severity counts match.
3 terminology differences from the second opinion

Advisory only. These are normalized differences from the primary terminology receipt.

  • risk signal at test/e2e-risk-signal-reporter.test.ts:104: selected only by the second-opinion lane as established.
  • NEMOCLAW_LLAMA_CPP_QUALIFICATION_HEAD_SHA at .github/workflows/e2e.yaml:1993: selected only by the second-opinion lane as established.
  • qualification at .github/workflows/e2e.yaml:1993: selected only by the second-opinion lane as justified.
2 additional E2E selections from the second opinion

Advisory only. The primary lane did not select these E2E jobs or targets.

  • gpu-e2e: The completed second-opinion lane identified E2E coverage that the primary lane omitted.
  • managed-image-protected-runtime: The completed second-opinion lane identified E2E coverage that the primary lane omitted.

Second-opinion terminology and E2E selections are advisory. Live E2E does not run automatically for pull requests.

2 semantic terminology decisions

Terminology decisions are advisory. They affect the assessment only when a separate finding identifies concrete semantic impact.

  • established — candidate identity at test/e2e/support/e2e-operations-workflow-boundary.test.ts:208: Keep `candidate identity` for the qualification commit identity.
  • justified — risk reporting at test/e2e/support/e2e-operations-workflow-boundary.test.ts:198: Keep `risk reporting` to distinguish PR risk-signal emission from generic GPU qualification.

E2E guidance

Advisory only. A maintainer can dispatch the default E2E suite against this exact revision.

Recommended E2E: cloud-inference, cloud-onboard, security-posture, llama-cpp-generic-gpu

Workflow run details

This automated review informs maintainers. Warnings and suggestions do not require a response. A maintainer decides whether to merge.

@apurvvkumaria
apurvvkumaria enabled auto-merge (squash) August 9, 2026 02:50
@apurvvkumaria
apurvvkumaria merged commit ea72d1d into main Aug 9, 2026
46 checks passed
@apurvvkumaria
apurvvkumaria deleted the codex/fix-trusted-main-risk-signal branch August 9, 2026 03:04
@wscurran wscurran added chore Build, CI, dependency, or tooling maintenance area: e2e End-to-end tests, nightly failures, or validation infrastructure area: ci CI workflows, checks, release automation, or GitHub Actions labels Aug 10, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

area: ci CI workflows, checks, release automation, or GitHub Actions area: e2e End-to-end tests, nightly failures, or validation infrastructure chore Build, CI, dependency, or tooling maintenance

Projects

None yet

Development

Successfully merging this pull request may close these issues.

3 participants