ci: fold OpenClaw checks into Node workflow

[willkill07]

Overview

Fold OpenClaw validation into the existing Node.js CI workflow as a conditional step, and make just test-openclaw run the live smoke coverage path.

• I confirm this contribution is my own work, or I have the right to submit it under this project's license.
• I searched existing issues and open pull requests, and this does not duplicate existing work.

Details

• Add a run_openclaw input to the reusable Node.js workflow.
• Run OpenClaw integration checks as a conditional step across the full Node test matrix.
• Remove the separate OpenClaw workflow call and workflow file.
• Keep OpenClaw package artifact creation inside the existing Node package job while leaving Node package steps gated by run_package.
• Add the live smoke test path to just test-openclaw and document the target in contributor testing guidance.

Where should the reviewer start?

Start with .github/workflows/ci_node.yml, especially the conditional OpenClaw test step in the Node test job and the package-job gating.

Related Issues: (use one of the action keywords Closes / Fixes / Resolves / Relates to)

• Relates to: none

Summary by CodeRabbit

• Tests

  • Added live-run OpenClaw smoke tests and a helper script to run them.
  • OpenClaw integration checks now run conditionally inside the Node.js test flow.
  • Test suites updated to use compiled test artifacts and adjusted import paths.

• Chores

  • Removed standalone OpenClaw CI job; its checks and optional packaging were folded into the Node.js workflow and gated by inputs.
  • OpenClaw packaging and artifact upload are now conditional.

• Documentation

  • Testing guide and integration README updated with live-test target and artifact locations.

[coderabbitai]

Note

Reviews paused

It looks like this branch is under active development. To avoid overwhelming you with review comments due to an influx of new commits, CodeRabbit has automatically paused this review. You can configure this behavior by changing the reviews.auto_review.auto_pause_after_reviewed_commits setting.

Use the following commands to manage reviews:

• @coderabbitai resume to resume automatic reviews.
• @coderabbitai review to trigger a single review.

Use the checkboxes below for quick actions:

• ▶️ Resume reviews
• 🔍 Trigger review

Walkthrough

OpenClaw CI was folded into the Node.js workflow: the standalone ci_openclaw workflow was removed and ci_node gains a run_openclaw input that drives conditional OpenClaw test and packaging steps. Change-detection outputs, docs, test targets, and OpenClaw packaging scripts were updated accordingly.

Changes

OpenClaw CI Integration into Node Workflow

Layer / File(s)	Summary
Change detection outputs .github/workflows/ci_changes.yml	Adjusted jobs.changes.outputs.run_node and jobs.changes.outputs.run_openclaw expressions to include cross-path filter flags (steps.filter.outputs.openclaw / steps.filter.outputs.node) so Node/OpenClaw changes can trigger each other.
Node workflow interface and Test job .github/workflows/ci_node.yml	Added workflow_call input run_openclaw: boolean (default false). Test job adds a conditional "Run OpenClaw integration checks" step guarded by inputs.run_openclaw.
Packaging and artifact flow in Node workflow .github/workflows/ci_node.yml	Package job if broadened to run when `(inputs.run_package
Top-level CI orchestration and gating .github/workflows/ci.yaml	Removed ci_openclaw job and its workflow; ci_node now forwards run_openclaw: ${{ needs.ci_changes.outputs.run_openclaw == 'true' }}; ci_required.needs no longer includes ci_openclaw; removed OPENCLAW_RESULT export/check and all OpenClaw checks from required/publish verification logic.
OpenClaw test runtime, packaging checks, and docs justfile, integrations/openclaw/package.json, integrations/openclaw/scripts/test-live.mjs, integrations/openclaw/scripts/check-pack-payload.mjs, integrations/openclaw/README.md	test-openclaw target now runs npm run test:live --workspace=nemo-flow-openclaw; test:live updated to invoke node scripts/test-live.mjs; added scripts/test-live.mjs to spawn Node --test for live-smoke with NEMO_FLOW_OPENCLAW_LIVE_SMOKE; pack-payload checks tightened to exclude .test.ts and test/-prefixed files; README clarifies .test-dist output location.
Test imports and TypeScript config adjustments integrations/openclaw/test/*, integrations/openclaw/tsconfig.build.json, integrations/openclaw/tsconfig.test.json	Multiple tests updated to import runtime/source modules from ../src/... and use ESM .js specifiers where applicable; build/test tsconfigs updated to exclude test/** and include index.ts, `src/**/*.ts

🎯 3 (Moderate) | ⏱️ ~25 minutes

• Possibly related PRs
  • NVIDIA/NeMo-Flow#107: adjusts package-openclaw / version-lockstep logic used by the new OpenClaw packaging step.
  • NVIDIA/NeMo-Flow#102: earlier changes to the live-smoke test runner and plugin ATIF configuration that interact with the added test:live flow.

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Title check	✅ Passed	Title follows Conventional Commits format with 'ci' type, clear scope, and accurately describes the main change of consolidating OpenClaw checks into the Node workflow.
Description check	✅ Passed	Description includes all required sections: overview with checkboxes, detailed changes, reviewer guidance, and related issues. Content is comprehensive and directly addresses the PR objectives.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

_{✏️ Tip: You can configure your own custom pre-merge checks in the settings.}

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests

---

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

[AjayThorve]

LGTM. I reviewed the workflow consolidation and OpenClaw test move. Locally verified workflow YAML parsing and NPM_CONFIG_CACHE=/private/tmp/nemo-flow-npm-cache just test-openclaw, which passes typecheck, tests, live smoke, and pack payload validation.

Current CI failures look unrelated to the PR tbh

[coderabbitai]

Actionable comments posted: 1

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In @.github/workflows/ci_node.yml:
- Line 117: The current workflow if-condition "(inputs.run_package ||
inputs.run_openclaw) && !cancelled() && needs.Test.result == 'success'" causes
the Package matrix to fan out for all OS entries when only inputs.run_openclaw
is true; change the condition so the matrix runs for inputs.run_package OR
(inputs.run_openclaw AND the matrix/os is linux-amd64). Concretely, update the
job-level if (where inputs.run_openclaw and inputs.run_package are checked) to
guard package matrix entries by adding a check for the matrix OS (e.g.,
matrix.os == 'linux-amd64') when inputs.run_openclaw is set, so OpenClaw-only
runs only create the linux-amd64 package job (see inputs.run_openclaw,
inputs.run_package, needs.Test.result and the package job that only runs on
linux-amd64 at the block around lines 219-248).

🪄 Autofix (Beta)

Fix all unresolved CodeRabbit comments on this PR:

• Push a commit to this branch (recommended)
• Create a new PR with the fixes

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: ASSERTIVE

Plan: Enterprise

Run ID: c51d5934-7d74-40b8-9aab-d309e69bfe4d

📥 Commits

Reviewing files that changed from the base of the PR and between b18cccb and cfd3893.

📒 Files selected for processing (1)

• .github/workflows/ci_node.yml

📜 Review details

🧰 Additional context used

📓 Path-based instructions (4)

.github/workflows/**/*.{yml,yaml}

📄 CodeRabbit inference engine (.agents/skills/maintain-ci/SKILL.md)

.github/workflows/**/*.{yml,yaml}: Put permissions: on each job that needs token access in GitHub Actions workflows
Avoid workflow-level permissions unless the repository intentionally centralizes them and the inheritance tradeoff is documented
Keep third-party actions pinned to full commit SHAs and preserve the readable version comment after the SHA
Prefer action-native or ecosystem-native caching over generic actions/cache in GitHub Actions workflows
Use lockfiles or dependency manifests to drive cache invalidation in GitHub Actions workflows
Keep deploy and publish permissions isolated to the jobs that need them
Read both caller and callee when a workflow uses workflow_call in GitHub Actions
Put release-tag validation in the earliest practical caller job when the pipeline has tag-based publish behavior
Keep release-tag policy aligned with RELEASING.md: raw SemVer tags only, no leading v
contents: read is the default minimum for checkout-based build, test, docs, and packaging jobs
pull-requests: read is required for PR metadata lookup jobs in GitHub Actions workflows
pages: write and id-token: write should be limited to Pages deployment jobs and any caller that invokes them through a reusable workflow
For reusable workflows, the caller must grant every permission the called jobs require and the callee cannot elevate beyond what the caller provides
Prefer astral-sh/setup-uv cache support with cache-dependency-glob anchored to uv.lock for Python dependency caching
Prefer Swatinem/rust-cache with explicit shared-key and workspaces instead of ad hoc target-directory caching
Avoid caching generated outputs that can hide stale behavior unless the repo already relies on them deliberately
Ensure each job has the minimum permissions it needs during GitHub Actions CI review
Ensure reusable workflow callers grant only the scopes their callees require
Ensure every external action is pinned to a full SHA in GitHub Actions workflows
Ensure cache ...

Files:

• .github/workflows/ci_node.yml

{.github/**/*.{yml,yaml},*.patch,scripts/**/*,*.sh,*.bat,Dockerfile*}

📄 CodeRabbit inference engine (.agents/skills/rename-surfaces/SKILL.md)

Update CI configuration, patch files, and build scripts with new functional identifiers after rename operations

Files:

• .github/workflows/ci_node.yml

{.github/workflows/*.{yml,yaml},.gitlab-ci.yml}

📄 CodeRabbit inference engine (.agents/skills/maintain-packaging/SKILL.md)

Ensure CI workflow references match local package names and installation methods

Files:

• .github/workflows/ci_node.yml

{.github/**,.gitlab-ci.yml,.pre-commit-config.yaml,justfile,scripts/**}

⚙️ CodeRabbit configuration file

{.github/**,.gitlab-ci.yml,.pre-commit-config.yaml,justfile,scripts/**}: Review automation changes for reproducibility, pinned versions where appropriate, secret handling, and consistency with the documented validation matrix.
Pay attention to commands that need generated native artifacts, FFI libraries, or platform-specific environment variables.

Files:

• .github/workflows/ci_node.yml

🧠 Learnings (1)

📚 Learning: 2026-05-03T04:23:07.497Z

Learnt from: willkill07
Repo: NVIDIA/NeMo-Flow PR: 46
File: .github/workflows/ci_rust.yml:31-64
Timestamp: 2026-05-03T04:23:07.497Z
Learning: In GitHub Actions workflow YAML, it’s valid to conditionally disable a service container by setting the service container’s `image` to an empty string (`''`) via a matrix variable (e.g., `redis_service_image: ''`). This intentionally makes the runner skip service initialization for that matrix entry rather than failing the job. When reviewing workflows, don’t flag this as an error if the workflow uses an empty `image` to disable the service on specific matrix entries (e.g., OS-specific setups); verify the `image` is sourced from the matrix variable and that the service is only expected to be available when a non-empty image is provided.

Applied to files:

• .github/workflows/ci_node.yml

🔇 Additional comments (1)

.github/workflows/ci_node.yml (1)

192-196: Caller-side tag validation is already enforced in the correct location.

The .github/workflows/ci.yaml workflow validates release tag format in the prepare job (lines 53-59) before calling any reusable workflows. Tags starting with v are rejected with an error message, enforcing raw SemVer format (e.g., 0.1.0, not v0.1.0). This validation occurs at the earliest practical caller job, as required by the coding guidelines. The release policy is documented in RELEASING.md and is already implemented correctly.