Repository navigation
fix(e2e): route gateway guard through hosted inference - #5889
Merged
Merged
Conversation
Signed-off-by: Carlos Villela <cvillela@nvidia.com>
9 of 21 tasks
Contributor
|
No actionable comments were generated in the recent review. 🎉 ℹ️ Recent review info⚙️ Run configurationConfiguration used: Path: .coderabbit.yaml Review profile: CHILL Plan: Enterprise Run ID: 📒 Files selected for processing (1)
📝 WalkthroughWalkthroughThe ChangesGateway guard recovery hosted inference
Estimated review effort🎯 2 (Simple) | ⏱️ ~10 minutes Possibly related PRs
Suggested labels
Suggested reviewers
Poem
🚥 Pre-merge checks | ✅ 4 | ❌ 1❌ Failed checks (1 warning)
✅ Passed checks (4 passed)
✨ Finishing Touches📝 Generate docstrings
🧪 Generate unit tests (beta)
Comment |
Contributor
Code Coverage OverviewLanguages: TypeScript TypeScript / code-coverage/pluginThe overall coverage in the Show a code coverage summary of the most covered files.
TypeScript / code-coverage/cliThe overall coverage in the Show a code coverage summary of the most covered files.
Updated |
Contributor
E2E Advisor RecommendationRequired E2E: Dispatch hint: Full advisor summaryE2E Recommendation AdvisorBase: Required E2E
Optional E2E
New E2E recommendations
Dispatch hint
|
Contributor
Vitest E2E Scenario RecommendationRequired Vitest E2E scenarios: Dispatch required Vitest E2E scenarios:
Full Vitest E2E advisor summaryVitest E2E Scenario AdvisorBase: Required Vitest E2E scenarios
Optional Vitest E2E scenarios
Relevant changed files
|
Contributor
PR Review Advisor — No blocking findingsMerge posture: No blocking advisor findings Action checklist
Test follow-ups to resolve or justifyIf these cover changed behavior, prefer adding them in this PR; otherwise state why existing coverage is enough or link the follow-up.
This is an automated, non-binding review; it still expects maintainers and agents to respond to each required or warning item. Treat suggestions as current-PR improvements when they touch changed code; defer only with maintainer rationale or a linked follow-up. A human maintainer must make the final merge decision. |
Contributor
PR Review Advisor (Nemotron Ultra) — Changes requestedMerge posture: Do not merge yet Action checklist
Findings index
Review findings by urgency: 0 required fixes, 0 items to resolve/justify, 3 in-scope improvements
|
Signed-off-by: Carlos Villela <cvillela@nvidia.com>
cv
enabled auto-merge (squash)
June 27, 2026 02:24
cv
disabled auto-merge
June 27, 2026 02:42
9 of 21 tasks
cv
added a commit
that referenced
this pull request
Jun 27, 2026
<!-- markdownlint-disable MD041 --> ## Summary Normalizes hosted-compatible inference routing for live Vitest jobs that receive the repository `NVIDIA_INFERENCE_API_KEY` secret. The targeted reruns after #5887/#5889 showed many live Vitest jobs still interpreted the hosted-compatible secret as a public `nvapi-*` key and failed before reaching their behavior under test. ## Changes - Adds `NEMOCLAW_E2E_USE_HOSTED_INFERENCE=1` to live Vitest jobs that pass `NVIDIA_INFERENCE_API_KEY` and are not public-NVIDIA-key-specific lanes. - Keeps public `nvapi-*` lanes (`model-router-provider-routed-inference-vitest`, `device-auth-health-vitest`) excluded from that requirement. - Extends the workflow boundary validator so secret-bearing live Vitest jobs must opt into hosted-compatible inference unless explicitly allowlisted. ## Type of Change - [x] Code change (feature, bug fix, or refactor) - [ ] Code change with doc updates - [ ] Doc only (prose changes, no code sample modifications) - [ ] Doc only (includes code sample changes) ## Quality Gates <!-- Check all that apply. For any "covered by existing tests", "not applicable", or waiver entry, add a brief justification on the same line or in the Changes section. --> - [x] Tests added or updated for changed behavior - [ ] Existing tests cover changed behavior — justification: - [ ] Tests not applicable — justification: - [ ] Docs updated for user-facing behavior changes - [x] Docs not applicable — justification: CI/E2E workflow routing only. - [x] Sensitive paths changed (security, policy, credentials, preflight, onboarding, inference, runner, sandbox, or messaging) - [x] Sensitive-path review completed or maintainer-approved waiver recorded — reviewer/approval link/justification: self-review; the change passes only the hosted-compatible mode flag and does not broaden secret exposure beyond existing step env boundaries. - [ ] Non-success, skipped, or missing CI check accepted by maintainer — check name, approval link, and follow-up issue: ## Verification <!-- Check each item you ran and confirmed. Leave unchecked items you skipped. Doc-only changes do not require npm test unless you ran it. --> - [x] PR description includes the DCO sign-off declaration and every commit appears as `Verified` in GitHub - [ ] Git hooks passed during commit and push, or `npx prek run --from-ref main --to-ref HEAD` passes - [x] Targeted tests pass for changed behavior - [ ] Full `npm test` passes (broad runtime changes only) - [x] Quality Gates section completed with required justifications or waivers - [x] No secrets, API keys, or credentials committed - [ ] `npm run docs` builds without warnings (doc changes only) - [ ] Doc pages follow the [style guide](https://github.com/NVIDIA/NemoClaw/blob/main/docs/CONTRIBUTING.md) (doc changes only) - [ ] New doc pages include SPDX header and frontmatter (new pages only) Targeted verification: ```bash npm test -- --run test/e2e-scenario/support-tests/e2e-scenarios-workflow.test.ts npm run source-shape:check npm run test-size:check npm run typecheck:cli ``` --- <!-- DCO sign-off is required in this PR description, and every commit must appear as Verified in GitHub. Run: git config user.name && git config user.email --> Signed-off-by: Carlos Villela <cvillela@nvidia.com> <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **New Features** * End-to-end workflow jobs now consistently run with hosted inference mode enabled. * Added validation to ensure the main scenario job and related scenario jobs use the required hosted-compatible inference setting. * **Bug Fixes** * Improved workflow checks to catch unsafe or unsupported inference configurations earlier. * **Tests** * Expanded end-to-end boundary coverage to include the new hosted inference requirement. <!-- end of auto-generated comment: release notes by coderabbit.ai --> Signed-off-by: Carlos Villela <cvillela@nvidia.com>
Hadar301
pushed a commit
to Hadar301/NemoClaw-OpenShift
that referenced
this pull request
Jul 12, 2026
<!-- markdownlint-disable MD041 --> ## Summary Routes the free-standing `gateway-guard-recovery` Vitest E2E job through hosted-compatible inference. The targeted rerun after NVIDIA#5887 showed the job still selected the public NVIDIA provider and failed early because the CI secret is not `nvapi-*`. ## Changes - Adds `NEMOCLAW_E2E_USE_HOSTED_INFERENCE=1` to the `gateway-guard-recovery` job environment in `.github/workflows/e2e-vitest-scenarios.yaml`. - Extends the workflow boundary validator so this routing cannot drift again. ## Type of Change - [x] Code change (feature, bug fix, or refactor) - [ ] Code change with doc updates - [ ] Doc only (prose changes, no code sample modifications) - [ ] Doc only (includes code sample changes) ## Quality Gates <!-- Check all that apply. For any "covered by existing tests", "not applicable", or waiver entry, add a brief justification on the same line or in the Changes section. --> - [x] Tests added or updated for changed behavior - [ ] Existing tests cover changed behavior — justification: - [ ] Tests not applicable — justification: - [ ] Docs updated for user-facing behavior changes - [x] Docs not applicable — justification: CI/E2E workflow routing only. - [x] Sensitive paths changed (security, policy, credentials, preflight, onboarding, inference, runner, sandbox, or messaging) - [x] Sensitive-path review completed or maintainer-approved waiver recorded — reviewer/approval link/justification: self-review; change passes only the CI mode flag, not credentials, and keeps the secret on the existing step-level boundary. - [ ] Non-success, skipped, or missing CI check accepted by maintainer — check name, approval link, and follow-up issue: ## Verification <!-- Check each item you ran and confirmed. Leave unchecked items you skipped. Doc-only changes do not require npm test unless you ran it. --> - [x] PR description includes the DCO sign-off declaration and every commit appears as `Verified` in GitHub - [ ] Git hooks passed during commit and push, or `npx prek run --from-ref main --to-ref HEAD` passes - [x] Targeted tests pass for changed behavior - [ ] Full `npm test` passes (broad runtime changes only) - [x] Quality Gates section completed with required justifications or waivers - [x] No secrets, API keys, or credentials committed - [ ] `npm run docs` builds without warnings (doc changes only) - [ ] Doc pages follow the [style guide](https://github.com/NVIDIA/NemoClaw/blob/main/docs/CONTRIBUTING.md) (doc changes only) - [ ] New doc pages include SPDX header and frontmatter (new pages only) Targeted verification: ```bash npm test -- --run test/e2e-scenario/support-tests/e2e-scenarios-workflow.test.ts npm run source-shape:check npm run test-size:check npm run build:cli npm run typecheck:cli ``` --- <!-- DCO sign-off is required in this PR description, and every commit must appear as Verified in GitHub. Run: git config user.name && git config user.email --> Signed-off-by: Carlos Villela <cvillela@nvidia.com> <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **Bug Fixes** * Improved end-to-end workflow consistency for the gateway guard recovery scenario by ensuring the hosted inference setting is enabled. * Added workflow boundary validation to detect and report misconfigured scenario runs earlier. <!-- end of auto-generated comment: release notes by coderabbit.ai --> --------- Signed-off-by: Carlos Villela <cvillela@nvidia.com>
Hadar301
pushed a commit
to Hadar301/NemoClaw-OpenShift
that referenced
this pull request
Jul 12, 2026
<!-- markdownlint-disable MD041 --> ## Summary Normalizes hosted-compatible inference routing for live Vitest jobs that receive the repository `NVIDIA_INFERENCE_API_KEY` secret. The targeted reruns after NVIDIA#5887/NVIDIA#5889 showed many live Vitest jobs still interpreted the hosted-compatible secret as a public `nvapi-*` key and failed before reaching their behavior under test. ## Changes - Adds `NEMOCLAW_E2E_USE_HOSTED_INFERENCE=1` to live Vitest jobs that pass `NVIDIA_INFERENCE_API_KEY` and are not public-NVIDIA-key-specific lanes. - Keeps public `nvapi-*` lanes (`model-router-provider-routed-inference-vitest`, `device-auth-health-vitest`) excluded from that requirement. - Extends the workflow boundary validator so secret-bearing live Vitest jobs must opt into hosted-compatible inference unless explicitly allowlisted. ## Type of Change - [x] Code change (feature, bug fix, or refactor) - [ ] Code change with doc updates - [ ] Doc only (prose changes, no code sample modifications) - [ ] Doc only (includes code sample changes) ## Quality Gates <!-- Check all that apply. For any "covered by existing tests", "not applicable", or waiver entry, add a brief justification on the same line or in the Changes section. --> - [x] Tests added or updated for changed behavior - [ ] Existing tests cover changed behavior — justification: - [ ] Tests not applicable — justification: - [ ] Docs updated for user-facing behavior changes - [x] Docs not applicable — justification: CI/E2E workflow routing only. - [x] Sensitive paths changed (security, policy, credentials, preflight, onboarding, inference, runner, sandbox, or messaging) - [x] Sensitive-path review completed or maintainer-approved waiver recorded — reviewer/approval link/justification: self-review; the change passes only the hosted-compatible mode flag and does not broaden secret exposure beyond existing step env boundaries. - [ ] Non-success, skipped, or missing CI check accepted by maintainer — check name, approval link, and follow-up issue: ## Verification <!-- Check each item you ran and confirmed. Leave unchecked items you skipped. Doc-only changes do not require npm test unless you ran it. --> - [x] PR description includes the DCO sign-off declaration and every commit appears as `Verified` in GitHub - [ ] Git hooks passed during commit and push, or `npx prek run --from-ref main --to-ref HEAD` passes - [x] Targeted tests pass for changed behavior - [ ] Full `npm test` passes (broad runtime changes only) - [x] Quality Gates section completed with required justifications or waivers - [x] No secrets, API keys, or credentials committed - [ ] `npm run docs` builds without warnings (doc changes only) - [ ] Doc pages follow the [style guide](https://github.com/NVIDIA/NemoClaw/blob/main/docs/CONTRIBUTING.md) (doc changes only) - [ ] New doc pages include SPDX header and frontmatter (new pages only) Targeted verification: ```bash npm test -- --run test/e2e-scenario/support-tests/e2e-scenarios-workflow.test.ts npm run source-shape:check npm run test-size:check npm run typecheck:cli ``` --- <!-- DCO sign-off is required in this PR description, and every commit must appear as Verified in GitHub. Run: git config user.name && git config user.email --> Signed-off-by: Carlos Villela <cvillela@nvidia.com> <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **New Features** * End-to-end workflow jobs now consistently run with hosted inference mode enabled. * Added validation to ensure the main scenario job and related scenario jobs use the required hosted-compatible inference setting. * **Bug Fixes** * Improved workflow checks to catch unsafe or unsupported inference configurations earlier. * **Tests** * Expanded end-to-end boundary coverage to include the new hosted inference requirement. <!-- end of auto-generated comment: release notes by coderabbit.ai --> Signed-off-by: Carlos Villela <cvillela@nvidia.com>
wscurran
added
area: ci
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Routes the free-standing
gateway-guard-recoveryVitest E2E job through hosted-compatible inference. The targeted rerun after #5887 showed the job still selected the public NVIDIA provider and failed early because the CI secret is notnvapi-*.Changes
NEMOCLAW_E2E_USE_HOSTED_INFERENCE=1to thegateway-guard-recoveryjob environment in.github/workflows/e2e-vitest-scenarios.yaml.Type of Change
Quality Gates
Verification
Verifiedin GitHubnpx prek run --from-ref main --to-ref HEADpassesnpm testpasses (broad runtime changes only)npm run docsbuilds without warnings (doc changes only)Targeted verification:
npm test -- --run test/e2e-scenario/support-tests/e2e-scenarios-workflow.test.ts npm run source-shape:check npm run test-size:check npm run build:cli npm run typecheck:cliSigned-off-by: Carlos Villela cvillela@nvidia.com
Summary by CodeRabbit