Skip to content

ci: consolidate hermetic Vitest lanes - #6857

Merged
cv merged 1 commit into
mainfrom
codex/consolidate-hermetic-vitest-ci
Jul 14, 2026
Merged

ci: consolidate hermetic Vitest lanes#6857
cv merged 1 commit into
mainfrom
codex/consolidate-hermetic-vitest-ci

Conversation

@cv

@cv cv commented Jul 14, 2026

Copy link
Copy Markdown
Collaborator

Summary

Consolidates hermetic Vitest coverage into the existing CLI shard matrix so PR and main CI have fewer independent lanes to reason about. Retires the duplicate mock Ollama shell lane and standalone live-workflow alias while keeping the real ollama-auth-proxy target available through the canonical E2E workflow.

Changes

  • Include the e2e-support Vitest project and changed-live-E2E mock-parity validation in the eight shared CLI coverage shards.
  • Preserve the base-trusted PR action boundary with a bootstrap in .github/workflows/pr.yaml: the current PR and PRs targeting older bases run e2e-support directly only when the trusted base action does not advertise that project. A direct action replacement is insufficient because PR-authored composite actions cannot be executed with the base workflow's trust. test/pr-workflow-contract.test.ts protects the capability probe, bootstrap conditions, full-history checkout, and steady-state shared action.
  • Retire test/e2e-ollama-proxy.sh in favor of the existing handler Vitest, adding the one missing unauthenticated POST /api/tags assertion.
  • Remove the standalone ollama-proxy-e2e.yaml alias; the live ollama-auth-proxy target remains selectable through .github/workflows/e2e.yaml.
  • Remove the duplicate direct skill-frontmatter Vitest invocation from static checks because the integration project is already collected by the CLI shards.
  • Update shard balancing/contracts and internal E2E contributor documentation.

Type of Change

  • Code change (feature, bug fix, or refactor)
  • Code change with doc updates
  • Doc only (prose changes, no code sample modifications)
  • Doc only (includes code sample changes)

Quality Gates

  • Tests added or updated for changed behavior
  • Existing tests cover changed behavior — justification:
  • Tests not applicable — justification:
  • Docs updated for user-facing behavior changes
  • Docs not applicable — justification: User-facing runtime behavior is unchanged; internal E2E contributor docs were updated for the new CI routing.
  • Sensitive paths changed (security, policy, credentials, preflight, onboarding, inference, runner, sandbox, or messaging)
  • Sensitive-path review completed or maintainer-approved waiver recorded — reviewer/approval link/justification: Pending maintainer review of the CI trust-boundary change; base-trusted action execution remains intact and is covered by a security-classified workflow contract.
  • Non-success, skipped, or missing CI check accepted by maintainer — check name, approval link, and follow-up issue: Not applicable.

Verification

  • PR description includes a Signed-off-by: line and every commit appears as Verified in GitHub
  • Normal pre-commit, commit-msg, and pre-push hooks passed, or npm run check:diff passed when hooks were skipped or unavailable
  • Targeted behavior tests pass for the current change set, or tests are marked not applicable above — 38 integration contract/handler/shard tests and 4 E2E-support retirement tests passed.
  • Applicable broad gate passed — npm test: 1,504 files / 17,105 tests passed; npm run check: all pre-commit/manual checks and coverage ratchets passed.
  • Quality Gates section completed with required justifications or waivers
  • No secrets, API keys, or credentials committed
  • npm run docs builds without warnings (doc changes only) — passed with 0 errors and 2 existing Fern warnings.
  • Doc pages follow the style guide (doc changes only) — not applicable to internal test/e2e contributor docs; markdownlint passed.
  • New doc pages include SPDX header and frontmatter (new pages only) — no new doc pages.

Signed-off-by: Carlos Villela cvillela@nvidia.com

Summary by CodeRabbit

  • CI Improvements

    • Integrated E2E support coverage and Ollama proxy checks into existing CLI test shards.
    • Improved coverage validation for pull requests and main-branch builds.
    • Removed redundant standalone E2E workflow jobs and legacy shell-based checks.
    • Added validation to detect mismatches in live E2E mocks.
  • Bug Fixes

    • Added coverage ensuring unauthenticated Ollama API requests are rejected.
  • Documentation

    • Updated E2E testing guidance and CI workflow documentation.

Signed-off-by: Carlos Villela <cvillela@nvidia.com>
@cv cv self-assigned this Jul 14, 2026
@coderabbitai

coderabbitai Bot commented Jul 14, 2026

Copy link
Copy Markdown
Contributor

Review Change Stack

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info
⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Enterprise

Run ID: 7031a4a9-ddae-4052-ba2d-4f47e2940761

📥 Commits

Reviewing files that changed from the base of the PR and between 33d55b0 and d8989f5.

📒 Files selected for processing (14)
  • .github/actions/ci-cli-coverage-shard/action.yaml
  • .github/actions/ci-static-checks/action.yaml
  • .github/workflows/main.yaml
  • .github/workflows/ollama-proxy-e2e.yaml
  • .github/workflows/pr.yaml
  • ci/source-shape-test-budget.json
  • test/cli-coverage-sequencer.test.ts
  • test/e2e-ollama-proxy.sh
  • test/e2e/README.md
  • test/e2e/docs/README.md
  • test/e2e/support/e2e-retired-shell-entrypoints.test.ts
  • test/helpers/cli-coverage-sequencer.ts
  • test/ollama-auth-proxy-handler.test.ts
  • test/pr-workflow-contract.test.ts
💤 Files with no reviewable changes (3)
  • .github/workflows/ollama-proxy-e2e.yaml
  • .github/actions/ci-static-checks/action.yaml
  • test/e2e-ollama-proxy.sh

📝 Walkthrough

Walkthrough

CLI coverage shards now include the e2e-support Vitest project with live mock parity validation. Standalone E2E lanes are removed from workflows and aggregate gates, while sharding, workflow contracts, documentation, and Ollama proxy authentication tests are updated.

Changes

E2E coverage consolidation

Layer / File(s) Summary
Shared shard E2E execution
.github/actions/ci-cli-coverage-shard/action.yaml, .github/workflows/pr.yaml, .github/workflows/main.yaml
Coverage shards fetch full history, validate changed live E2E mock parity, detect trusted action capability, and run CLI, integration, and e2e-support projects.
Retired lane and gate removal
.github/workflows/main.yaml, .github/workflows/pr.yaml, .github/actions/ci-static-checks/action.yaml, .github/workflows/ollama-proxy-e2e.yaml, test/e2e-ollama-proxy.sh, test/e2e/support/*, test/ollama-auth-proxy-handler.test.ts, test/e2e/README.md, test/e2e/docs/README.md
Standalone E2E jobs and shell entrypoints are removed from workflows and aggregate checks; static checks and Ollama proxy coverage are updated.
Sharding and workflow contract updates
test/helpers/cli-coverage-sequencer.ts, test/cli-coverage-sequencer.test.ts, test/pr-workflow-contract.test.ts, ci/source-shape-test-budget.json
Stable E2E support sharding, workflow contract assertions, aggregate gate fixtures, and source-shape exceptions are updated for the consolidated coverage lanes.

Estimated code review effort: 4 (Complex) | ~45 minutes

Suggested labels: chore, area: ci, area: e2e

Suggested reviewers: prekshivyas, hoyalim, jyaunches

Sequence Diagram(s)

sequenceDiagram
  participant PRWorkflow
  participant CliCoverageShard
  participant E2EMockParity
  participant Vitest
  participant Checks
  PRWorkflow->>CliCoverageShard: start sharded coverage with full history
  CliCoverageShard->>E2EMockParity: validate changed live mock parity when required
  CliCoverageShard->>Vitest: run cli, integration, and e2e-support projects
  PRWorkflow->>Checks: provide remaining required job results
  Checks->>Checks: verify non-retired required lanes
Loading
🚥 Pre-merge checks | ✅ 4 | ❌ 1

❌ Failed checks (1 warning)

Check name Status Explanation Resolution
Docstring Coverage ⚠️ Warning Docstring coverage is 0.00% which is insufficient. The required threshold is 80.00%. Write docstrings for the functions missing them to satisfy the coverage threshold.
✅ Passed checks (4 passed)
Check name Status Explanation
Description Check ✅ Passed Check skipped - CodeRabbit’s high-level summary is enabled.
Title check ✅ Passed The title clearly summarizes the main change: consolidating hermetic CI coverage into shared Vitest lanes.
Linked Issues check ✅ Passed Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check ✅ Passed Check skipped because no linked issues were found for this pull request.
✨ Finishing Touches
📝 Generate docstrings
  • Create stacked PR
  • Commit on current branch
🧪 Generate unit tests (beta)
  • Create PR with unit tests
  • Commit unit tests in branch codex/consolidate-hermetic-vitest-ci

Comment @coderabbitai help to get the list of available commands.

@github-code-quality

github-code-quality Bot commented Jul 14, 2026

Copy link
Copy Markdown
Contributor

Code Coverage Overview

Languages: TypeScript

TypeScript / code-coverage/plugin

The overall coverage remains at 96%, unchanged from the main branch.

TypeScript / code-coverage/cli

The overall coverage in the codex/consolidate-he... branch remains at 79%, unchanged from the main branch.

Show a code coverage summary of the most impacted files.
File main 33d55b0 codex/consolidate-he... d8989f5 +/-
src/lib/agent/dashboard-ui.ts 89% 83% -6%
src/lib/state/config-io.ts 94% 91% -3%
src/lib/agent/m...fest-readers.ts 97% 95% -2%
src/lib/messagi...annel-config.ts 99% 98% -1%
src/lib/state/sandbox.ts 85% 85% 0%
src/lib/state/gateway.ts 91% 93% +2%
src/lib/messagi.../persistence.ts 86% 89% +3%
src/lib/messagi...n-validation.ts 96% 100% +4%
src/lib/sandbox...rce-identity.ts 89% 94% +5%
src/lib/adapter...shell/client.ts 83% 88% +5%

Updated July 14, 2026 11:09 UTC
Code Coverage is in Public Preview. Learn more and provide us with your feedback.

@github-actions

github-actions Bot commented Jul 14, 2026

Copy link
Copy Markdown
Contributor

PR Review Advisor — Informational

Advisor assessment: Informational / high confidence
Next action: No advisor follow-up needed.
Findings: 0 blockers · 0 warnings · 0 suggestions
Status: No actionable findings remain in the canonical review ledger.

Model lanes

  • GPT-5.6 Terra (primary): Completed · high confidence · 0 blockers · 0 warnings · 0 suggestions
  • Nemotron 3 Ultra (second opinion): Completed · high confidence · 0 blockers · 0 warnings · 0 suggestions
  • Model comparison: normalized findings match; normalized E2E selections match; severity counts match.

Nemotron output stays in workflow artifacts and does not change the assessment above.

E2E guidance

Advisory only. E2E / PR Gate selects and runs jobs independently.

Recommended E2E: cloud-onboard, credential-sanitization, security-posture

1 optional E2E recommendation
  • ollama-auth-proxy

Workflow run details

This automated review informs maintainers. Warnings and suggestions do not require a response. A maintainer decides whether to merge.

@wscurran wscurran added area: ci CI workflows, checks, release automation, or GitHub Actions area: e2e End-to-end tests, nightly failures, or validation infrastructure chore Build, CI, dependency, or tooling maintenance labels Jul 14, 2026
@cv
cv merged commit cf04a13 into main Jul 14, 2026
84 of 86 checks passed
@cv
cv deleted the codex/consolidate-hermetic-vitest-ci branch July 14, 2026 15:33
cv added a commit that referenced this pull request Jul 14, 2026
<!-- markdownlint-disable MD041 -->
## Summary

Jetson workflow mutation tests now validate the runner-dispatch boundary
in memory instead of serializing a 249 KB workflow and running the full
aggregate validator for every mutation. This keeps `e2e-support` in the
combined CLI coverage shards while removing the operation that exceeded
the five-second test budget under CI contention.

## Changes

- Add `validateJetsonRunnerDispatchBoundary` as the shared consumer of
the existing Jetson workflow input, selector, routing, and guard checks;
the aggregate E2E workflow validator continues to invoke it.
- Route focused Jetson mutations through that in-memory boundary instead
of temporary YAML files and repeated whole-workflow validation. The
current requirement is the combined coverage shard introduced in #6857,
and `jetson-workflow-boundary.test.ts` protects the direct and aggregate
validator paths.
- Leave artifact-upload and Docker-auth cleanup contracts with their
dedicated validators and tests rather than duplicating those
cross-cutting assertions in the Jetson dispatch test.
- Reduce the previously failing coverage-mode mutation from 1.35 seconds
to 118 milliseconds locally.

## Type of Change

- [x] Code change (feature, bug fix, or refactor)
- [ ] Code change with doc updates
- [ ] Doc only (prose changes, no code sample modifications)
- [ ] Doc only (includes code sample changes)

## Quality Gates

- [x] Tests added or updated for changed behavior
- [ ] Existing tests cover changed behavior — justification:
- [ ] Tests not applicable — justification:
- [ ] Docs updated for user-facing behavior changes
- [x] Docs not applicable — justification: Internal test-harness
optimization; no CLI behavior, workflow behavior, contributor command,
or user-facing contract changes.
- [x] Sensitive paths changed (security, policy, credentials, preflight,
onboarding, inference, runner, sandbox, or messaging)
- [x] Sensitive-path review completed or maintainer-approved waiver
recorded — reviewer/approval link/justification: No runtime runner path
changed. The aggregate validator still invokes the same Jetson input,
selector, routing, and dispatch-guard checks, and the complete E2E
support suite passes.
- [ ] Non-success, skipped, or missing CI check accepted by maintainer —
check name, approval link, and follow-up issue:

## Verification

- [x] PR description includes a `Signed-off-by:` line and every commit
appears as `Verified` in GitHub
- [x] Normal `pre-commit`, `commit-msg`, and `pre-push` hooks passed, or
`npm run check:diff` passed when hooks were skipped or unavailable
- [x] Targeted behavior tests pass for the current change set, or tests
are marked not applicable above — `npx vitest run --project
e2e-support`: 116 files and 1,000 tests passed; focused CI-style V8
coverage run: 3 tests passed and the mutation completed in 118 ms.
- [ ] Applicable broad gate passed — `npm test` for broad
runtime/test-harness changes; `npm run check` for repo-wide
validation/coverage changes — command/result:
- [x] Quality Gates section completed with required justifications or
waivers
- [x] No secrets, API keys, or credentials committed
- [ ] `npm run docs` builds without warnings (doc changes only)
- [ ] Doc pages follow the [style
guide](https://github.com/NVIDIA/NemoClaw/blob/main/docs/CONTRIBUTING.md)
(doc changes only)
- [ ] New doc pages include SPDX header and frontmatter (new pages only)

---
Signed-off-by: Carlos Villela <cvillela@nvidia.com>


<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->

## Summary by CodeRabbit

* **Tests**
* Updated end-to-end workflow validation to check Jetson GPU dispatch
boundaries directly and consistently.
* Refined expected validation results to focus on runner queue settings
and dispatch guard ordering.

* **Refactor**
* Consolidated workflow boundary checks, reducing duplicate validation
paths and improving test reliability.

<!-- end of auto-generated comment: release notes by coderabbit.ai -->
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

area: ci CI workflows, checks, release automation, or GitHub Actions area: e2e End-to-end tests, nightly failures, or validation infrastructure chore Build, CI, dependency, or tooling maintenance

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants