fix(ci): provision Hermes swap for direct main runs#7464
Merged
Conversation
Signed-off-by: Apurv Kumaria <akumaria@nvidia.com>
Contributor
|
Note Reviews pausedIt looks like this branch is under active development. To avoid overwhelming you with review comments due to an influx of new commits, CodeRabbit has automatically paused this review. You can configure this behavior by changing the Use the following commands to manage reviews:
Use the checkboxes below for quick actions:
📝 WalkthroughWalkthroughThe trusted Hermes swap now supports scheduled and manual trusted-main runs, validates event and revision identities by execution mode, updates Hermes job guards, enforces rebuild telemetry ordering, expands boundary tests, and documents fallback scope and removal criteria. ChangesTrusted Hermes swap
Estimated code review effort: 3 (Moderate) | ~25 minutes Suggested labels: Suggested reviewers: Sequence Diagram(s)sequenceDiagram
participant Workflow as E2E workflow
participant Validator as Trusted Hermes boundary
participant Swap as Hermes swap setup
participant Tests as Boundary harness
Workflow->>Validator: Pass event and workflow identities
Validator->>Validator: Validate trusted main or dispatched checkout
Validator->>Swap: Allow eligible swap
Tests->>Validator: Execute scenario with configured identities
Validator-->>Tests: Return status and swap calls
🚥 Pre-merge checks | ✅ 5✅ Passed checks (5 passed)
✨ Finishing Touches📝 Generate docstrings
🧪 Generate unit tests (beta)
Comment |
Contributor
Code Coverage OverviewLanguages: TypeScript TypeScript / code-coverage/pluginThe overall coverage in commit c6f9412 in the TypeScript / code-coverage/cliThe overall coverage in commit c6f9412 in the Show a code coverage summary of the most impacted files.
Updated |
Contributor
PR Review Advisor — Blocking findings reportedAdvisor assessment: Blockers require maintainer review Model lanes
Nemotron output stays in workflow artifacts and does not change the assessment above. E2E guidanceAdvisory only. E2E / PR Gate selects and runs jobs independently. Recommended E2E: 6 optional E2E recommendations
Blockers
|
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
Contributor
There was a problem hiding this comment.
🧹 Nitpick comments (1)
tools/e2e/trusted-hermes-swap-workflow-boundary.mts (1)
58-78: 📐 Maintainability & Code Quality | 🔵 Trivial | 💤 Low valueCorrect exact-head vs. direct-main branching.
Traced every combination (schedule/workflow_dispatch × empty/non-empty checkout_sha × valid/invalid SHAs) against the new branches and against the test harness's
it.eachscenarios (test/e2e/support/trusted-hermes-swap-workflow-boundary.test.ts:298-407) — all paths fail closed as intended, and the exact-head/direct-main revision checks match the fallback rules documented intest/e2e/README.md.Optional: a one-line comment above each branch (
# exact-head: controller-dispatched PR revision/# direct main: schedule or manual trigger on main) would help future readers, since this block was flagged as high complexity by static analysis and has no structural comments distinguishing the two modes.🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@tools/e2e/trusted-hermes-swap-workflow-boundary.mts` around lines 58 - 78, Add concise shell comments immediately before the exact-head and direct-main branches in the workflow validation block to distinguish their modes: controller-dispatched PR revision versus schedule or manual execution on main. Keep the existing branching logic and validation behavior unchanged.Source: Linters/SAST tools
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Nitpick comments:
In `@tools/e2e/trusted-hermes-swap-workflow-boundary.mts`:
- Around line 58-78: Add concise shell comments immediately before the
exact-head and direct-main branches in the workflow validation block to
distinguish their modes: controller-dispatched PR revision versus schedule or
manual execution on main. Keep the existing branching logic and validation
behavior unchanged.
ℹ️ Review info
⚙️ Run configuration
Configuration used: Path: .coderabbit.yaml
Review profile: CHILL
Plan: Enterprise
Run ID: 00023aba-2fd3-4f67-8c1f-c5604d0d6eb5
📒 Files selected for processing (4)
.github/workflows/e2e.yamltest/e2e/README.mdtest/e2e/support/trusted-hermes-swap-workflow-boundary.test.tstools/e2e/trusted-hermes-swap-workflow-boundary.mts
Signed-off-by: Apurv Kumaria <akumaria@nvidia.com>
Signed-off-by: Apurv Kumaria <akumaria@nvidia.com>
apurvvkumaria
added
v0.0.95
area: e2e
Signed-off-by: Apurv Kumaria <akumaria@nvidia.com>
Signed-off-by: Apurv Kumaria <akumaria@nvidia.com>
Signed-off-by: Apurv Kumaria <akumaria@nvidia.com>
Signed-off-by: Apurv Kumaria <akumaria@nvidia.com>
Contributor
There was a problem hiding this comment.
Caution
Some comments are outside the diff and can’t be posted inline due to platform limitations.
⚠️ Outside diff range comments (1)
test/e2e/README.md (1)
810-811: 📐 Maintainability & Code Quality | 🟡 Minor | ⚡ Quick winClarify the workflow-managed swap exceptions.
This wording says other E2E jobs only add workflow-managed swap for the trusted Hermes main-workflow fallback, while Lines 209-211 also document 32 GiB workflow-managed swap for
rebuild-hermesandrebuild-hermes-stale-base. Scope this note to non-rebuild lanes or list the rebuild exception to avoid contradictory operational guidance.🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@test/e2e/README.md` around lines 810 - 811, Update the workflow-managed swap note in the E2E documentation to exclude non-rebuild lanes or explicitly include rebuild-hermes and rebuild-hermes-stale-base alongside the trusted Hermes main-workflow fallback. Ensure the wording no longer contradicts the 32 GiB swap behavior documented elsewhere.
🧹 Nitpick comments (1)
test/e2e/support/runner-comparison-workflow-boundary.test.ts (1)
180-197: 🎯 Functional Correctness | 🔵 Trivial | ⚡ Quick winCover the late-swap branch independently.
The test only swaps the swap and initialize steps, so both validator predicates fail simultaneously. Add a case that inserts a step between
prepare-e2eand the swap while keeping swap→initialize adjacent; otherwise theswapIndex !== prepare + 1check can regress without a focused test.As per path instructions, review tests for behavioral confidence rather than implementation lock-in; this covers the other observable validator failure mode.
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@test/e2e/support/runner-comparison-workflow-boundary.test.ts` around lines 180 - 197, Add an independent test case alongside the existing runner comparison workflow boundary test that inserts an extra step between the prepare-e2e step and HERMES_REBUILD_SWAP_STEP while preserving adjacency between the swap and RUNNER_COMPARISON_INITIALIZE_STEP. Assert validateRunnerComparisonWorkflow reports the late-swap validation error, covering the swapIndex/prepare boundary without also violating swap-to-initialize ordering.Source: Path instructions
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Outside diff comments:
In `@test/e2e/README.md`:
- Around line 810-811: Update the workflow-managed swap note in the E2E
documentation to exclude non-rebuild lanes or explicitly include rebuild-hermes
and rebuild-hermes-stale-base alongside the trusted Hermes main-workflow
fallback. Ensure the wording no longer contradicts the 32 GiB swap behavior
documented elsewhere.
---
Nitpick comments:
In `@test/e2e/support/runner-comparison-workflow-boundary.test.ts`:
- Around line 180-197: Add an independent test case alongside the existing
runner comparison workflow boundary test that inserts an extra step between the
prepare-e2e step and HERMES_REBUILD_SWAP_STEP while preserving adjacency between
the swap and RUNNER_COMPARISON_INITIALIZE_STEP. Assert
validateRunnerComparisonWorkflow reports the late-swap validation error,
covering the swapIndex/prepare boundary without also violating
swap-to-initialize ordering.
ℹ️ Review info
⚙️ Run configuration
Configuration used: Path: .coderabbit.yaml
Review profile: CHILL
Plan: Enterprise
Run ID: c346a4e4-0330-4926-88f3-dde7da5ef308
📒 Files selected for processing (5)
.github/workflows/e2e.yamltest/e2e/README.mdtest/e2e/support/runner-comparison-workflow-boundary.test.tstest/e2e/support/runner-pressure-workflow-boundary.test.tstools/e2e/runner-comparison-workflow-boundary.mts
🚧 Files skipped from review as they are similar to previous changes (1)
- .github/workflows/e2e.yaml
Signed-off-by: Prekshi Vyas <prekshiv@nvidia.com>
prekshivyas
approved these changes
Jul 24, 2026
23 tasks
23 tasks
senthilr-nv
added a commit
that referenced
this pull request
Jul 25, 2026
<!-- markdownlint-disable MD041 --> ## Summary Adds the canonical pre-tag `## v0.0.95` release entry to `docs/changelog/2026-07-24.mdx`, before the existing v0.0.94 entry. The entry summarizes approved user-visible changes merged since v0.0.94 and excludes internal-only prerequisites. ## Changes - Adds the v0.0.95 summary and detailed bullets for gateway lifecycle, recovery, state transfer, inference compatibility, sandbox security, Discord policy, and E2E evidence. - Links each user-facing theme to the most specific published documentation. - Records the release entry in the shared native changelog used by the OpenClaw, Hermes, and Deep Agents guides. Source summary: - [#7246](#7246), [#7228](#7228), [#7267](#7267), [#7489](#7489), [#7509](#7509), [#7351](#7351), and [#7290](#7290) -> `docs/changelog/2026-07-24.mdx`: Gateway authority, forward teardown and retry, managed recovery, Hermes restart recovery, scoped uninstall, and orphan-aware backup behavior. - [#7344](#7344) and [#7416](#7416) -> `docs/changelog/2026-07-24.mdx`: Atomic SQLite restore and host download verification. - [#7476](#7476), [#7347](#7347), [#7281](#7281), [#7485](#7485), [#7491](#7491), and [#7422](#7422) -> `docs/changelog/2026-07-24.mdx`: Windows Ollama reuse, CDI fallback, bounded OpenRouter connection setup, Nemotron-3 request compatibility, and managed Deep Agents retry and provider-error behavior. - [#6884](#6884), [#7481](#7481), [#6878](#6878), [#7467](#7467), [#7502](#7502), [#7503](#7503), [#7504](#7504), and [#7486](#7486) -> `docs/changelog/2026-07-24.mdx`: Trusted base-image overrides, local rebuild images, runtime validation, config preservation, reviewed package updates, and fewer final-image payload layers. - [#7303](#7303) -> `docs/changelog/2026-07-24.mdx`: Scoped Discord application-command management. - [#7488](#7488), [#7465](#7465), [#7497](#7497), [#7464](#7464), [#7501](#7501), [#7494](#7494), and [#7493](#7493) -> `docs/changelog/2026-07-24.mdx`: Selected-test risk signals, retry cleanup, full root-image validation, direct-main Hermes setup, executed PR-gate evidence, nightly history, and runner wait reporting. - [#7447](#7447) is an internal pinned-runtime prerequisite and is intentionally excluded from canonical supported-integration documentation. - [#7370](#7370) adds maintainer-only advisory reconciliation tooling and does not change supported user behavior. - [#7495](#7495) updates existing documentation and does not add a new v0.0.95 behavior claim. ## Type of Change - [ ] Code change (feature, bug fix, or refactor) - [ ] Code change with doc updates - [x] Doc only (prose changes, no code sample modifications) - [ ] Doc only (includes code sample changes) ## Quality Gates - [ ] Tests added or updated for changed behavior - [x] Existing tests cover changed behavior — justification: `test/changelog-docs.test.ts` validates the dated changelog structure, heading uniqueness, and published links. - [ ] Tests not applicable — justification: - [x] Docs updated for user-facing behavior changes - [ ] Docs not applicable — justification: - [ ] Sensitive paths changed (security, policy, credentials, preflight, onboarding, inference, runner, sandbox, or messaging) - [ ] Sensitive-path review completed or maintainer-approved waiver recorded — reviewer/approval link/justification: - [ ] Non-success, skipped, or missing CI check accepted by maintainer — check name, approval link, and follow-up issue: ## Documentation Writer Review - [x] Documentation writer subagent reviewed the completed changes - Result: `docs-updated` - Evidence: `docs/changelog/2026-07-24.mdx`; writing rules, documentation style, factual release meaning, and published links reviewed at exact head `58b02f2bf`. - Agent: Codex documentation writer reviewer <!-- docs-review-head-sha: 58b02f2 --> <!-- docs-review-agents-blob-sha: 9c9b36d --> ## DGX Station Hardware Evidence - [ ] Tested on DGX Station - Tested commit: - Station profile/scenario: - Result: - Supporting evidence: ## Verification - [x] PR description includes a `Signed-off-by:` line and every commit appears as `Verified` in GitHub - [x] Normal `pre-commit`, `commit-msg`, and `pre-push` hooks passed, or `npm run check:diff` passed when hooks were skipped or unavailable - [x] Targeted behavior tests pass for the current change set, or tests are marked not applicable above — command/result or justification: `npx vitest run test/changelog-docs.test.ts` passed 6 tests. - [ ] Applicable broad gate passed — `npm test` for broad runtime/test-harness changes; `npm run check` for repo-wide validation/coverage changes — command/result: - [x] Quality Gates section completed with required justifications or waivers - [x] No secrets, API keys, or credentials committed - [ ] `npm run docs` builds without warnings (doc changes only) — the build passed with 0 errors and 2 Fern warnings. - [x] Doc pages follow the [style guide](https://github.com/NVIDIA/NemoClaw/blob/main/docs/CONTRIBUTING.md) (doc changes only) - [ ] New doc pages include SPDX header and frontmatter (new pages only) --- Signed-off-by: Senthil Ravichandran <senthilr@nvidia.com> <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **Documentation** * Added a new v0.0.95 changelog entry above v0.0.94. * Documented improved externally supervised gateway lifecycle ownership. * Improved snapshot restore reliability and SQLite state handling. * Tightened CLI `backup-all` behavior and host artifact verification. * Updated Windows onboarding guidance (including Ollama service reuse and CDI directory fallback). * Noted inference compatibility fixes, deeper agent failure classification, stricter base-image validation, updated Discord bot command permissions, and refined E2E release automation evidence handling. <!-- end of auto-generated comment: release notes by coderabbit.ai --> --------- Signed-off-by: Senthil Ravichandran <senthilr@nvidia.com>
23 tasks
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Scheduled and ordinary manual
mainE2E runs now provision the same bounded 32 GiB swap used by exact-head Hermes PR gates before checkout. Direct-main runs reject alternate checkout and workflow revisions and bind the workflow source to the run revision; exact-head guards remain unchanged. Runner-comparison telemetry now initializes only after each rebuild lane has established its fixed 32 GiB swap capacity. This does not change runner selection, and larger-runner routing remains tracked by #7145.Related Issue
Related to #7145. This PR keeps the larger-runner experiment out of scope.
Changes
mainruns across all eleven protected job identities, with shared matrix jobs limited to their Hermes rows.mainref, event, workflow revision, and ephemeral GitHub-hosted Linux x64 runner checks before any privileged operation.hermes-e2ejobs to use the fallback.test/e2e/README.md.The fallback remains necessary while eligible Hermes image-building lanes can run on standard hosted runners without the larger-runner routing tracked by #7145. Candidate-side provisioning is insufficient because candidate code must not control the program or arguments passed to
sudo;test/e2e/support/trusted-hermes-swap-workflow-boundary.test.tsprotects that boundary.Type of Change
Quality Gates
test/e2e/README.mdwas updated.sudoprogram remains step 0 before candidate checkout, identity drift fails before privileged operations, and no runner-routing lines changed.Documentation Writer Review
docs-updateddocs/page is needed.DGX Station Hardware Evidence
Verification
Signed-off-by:line and every commit appears asVerifiedin GitHubpre-commit,commit-msg, andpre-pushhooks passed, ornpm run check:diffpassed when hooks were skipped or unavailablenpx vitest run --project e2e-support test/e2e/support/trusted-hermes-swap-workflow-boundary.test.ts test/e2e/support/runner-comparison-workflow-boundary.test.ts test/e2e/support/runner-pressure-workflow-boundary.test.ts: 67/67 passed.npm run lint,npm run typecheck, andnpm run typecheck:clipassed.npm run docsbuilds without warnings (doc changes only)Signed-off-by: Apurv Kumaria akumaria@nvidia.com
Summary by CodeRabbit
mainruns using stricter two-mode validation, blocking alternate revision requests and enforcing identity/sha consistency, with expanded coverage including thehermes-discordlane.schedule/workflow_dispatchscenarios, including rebuild vs non-rebuild lane constraints and failure-message expectations.