fix(e2e): accept push publication preflight

[cv]

Summary

The first push-triggered E2E run after #8445 failed before matrix generation because the base-image publication preflight accepted only the retired schedule event and manual dispatches. Accept trusted pushes to main while retaining manual dispatch support and rejecting scheduled, pull-request, or missing events.

Changes

• Recognize push and workflow_dispatch as the only base-image publication preflight events.
• Keep repository, main ref, and exact GITHUB_SHA binding unchanged.
• Add focused positive and negative event regression cases.

Type of Change

• Code change (feature, bug fix, or refactor)
• Code change with doc updates
• Doc only (prose changes, no code sample modifications)
• Doc only (includes code sample changes)

Quality Gates

• Tests added or updated for changed behavior
• Existing tests cover changed behavior — justification:
• Tests not applicable — justification:
• Docs updated for user-facing behavior changes
• Docs not applicable — justification: This aligns an internal E2E publication preflight with the trusted workflow event. It does not change a user-facing command, configuration, or supported product workflow.
• Sensitive paths changed (security, policy, credentials, preflight, onboarding, inference, runner, sandbox, or messaging)
• Sensitive-path review completed or maintainer-approved waiver recorded — reviewer/approval link/justification: A nine-category review of commit c01c7146b4c7105756eb936d7d11efd608a50858 found no findings. The change does not alter token flow, repository/ref/SHA binding, dependencies, logging, cryptography, or privileges; negative tests retain rejection of schedule, pull-request, and missing events.
• Non-success, skipped, or missing CI check accepted by maintainer — check name, approval link, and follow-up issue:

Documentation Writer Review

• Documentation writer subagent reviewed the completed changes
• Result: no-docs-needed
• Evidence: Independent review confirmed this internal preflight alignment changes no public command, configuration, user workflow, agent-runtime behavior, guide variant, or support claim. Changed files: tools/e2e/base-image-publication.mts and test/e2e/support/base-image-publication.test.ts.
• Agent: Pi CLI

DGX Station Hardware Evidence

• Tested on DGX Station
• Tested commit: Not applicable.
• Station profile/scenario: Not applicable.
• Result: Not applicable.
• Supporting evidence: Not applicable.

Verification

• PR description includes a Signed-off-by: line and every commit appears as Verified in GitHub
• Normal pre-commit, commit-msg, and pre-push hooks passed, or npm run validate:pr passed after refreshing origin/main when hooks were skipped or unavailable
• Targeted behavior tests pass for the current change set, or tests are marked not applicable above — npx vitest run --project e2e-support test/e2e/support/base-image-publication.test.ts test/e2e/support/base-image-publication-workflow-boundary.test.ts: 66 tests passed after formatting.
• Applicable broad gate passed — npm test for broad runtime/test-harness changes; npm run check for repo-wide validation/coverage changes — command/result: GitHub CI is authoritative for broad validation.
• Quality Gates section completed with required justifications or waivers
• No secrets, API keys, or credentials committed
• npm run docs builds without warnings (doc changes only)
• Doc pages follow the style guide (doc changes only)
• New doc pages include SPDX header and frontmatter (new pages only)

---

Signed-off-by: Carlos Villela cvillela@nvidia.com

Summary by CodeRabbit

• Bug Fixes
  • Base image publication workflows now run only for supported push and manual trigger events.
  • Scheduled and pull request events are no longer accepted for base image publication.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Enterprise

Run ID: cbbb0a2c-e0fc-4c94-9281-1698bdf200a4

📥 Commits

Reviewing files that changed from the base of the PR and between be34105 and c01c714.

📒 Files selected for processing (2)

• test/e2e/support/base-image-publication.test.ts
• tools/e2e/base-image-publication.mts

---

📝 Walkthrough

Walkthrough

The base image publication flow now accepts only push and workflow_dispatch events. An exported classifier provides this validation, and parameterized tests cover supported and unsupported event names.

Changes

Base Image Publication Event Validation

Layer / File(s)	Summary
Event classifier and coverage tools/e2e/base-image-publication.mts, test/e2e/support/base-image-publication.test.ts	Adds isBaseImagePublicationEvent, which accepts push and workflow_dispatch. Tests cover accepted, rejected, and undefined event names.
Publication preflight integration tools/e2e/base-image-publication.mts	Updates preflight validation to use the classifier and reject unsupported events with an updated error message.

Estimated code review effort: 2 (Simple) | ~10 minutes

Suggested labels: bug-fix

Suggested reviewers: brandonpelfrey, apurvvkumaria

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly and concisely describes the main change: accepting push events during the base-image publication preflight.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

✨ Finishing Touches

📝 Generate docstrings

• Create stacked PR
• Commit on current branch

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch fix/e2e-push-publication-event

---

_{Comment @coderabbitai help to get the list of available commands.}

[github-code-quality]

Code Coverage Overview

Languages: TypeScript

TypeScript / code-coverage/plugin

The overall coverage in commit c01c714 in the fix/e2e-push-publica... branch remains at 96%, unchanged from commit be34105 in the main branch.

TypeScript / code-coverage/cli

The overall coverage in commit c01c714 in the fix/e2e-push-publica... branch remains at 82%, unchanged from commit be34105 in the main branch.

Show a code coverage summary of the most impacted files.

File	main be34105	fix/e2e-push-publica... c01c714	+/-
src/lib/domain/.../connect-env.ts	97%	89%	-8%
src/lib/credentials/store.ts	56%	55%	-1%
src/lib/inferen...er-discovery.ts	88%	87%	-1%
src/lib/actions...air-approval.ts	90%	89%	-1%
src/lib/core/immutable.ts	97%	97%	0%
src/lib/messagi...flow-planner.ts	93%	93%	0%
src/lib/sandbox...rce-identity.ts	87%	87%	0%
src/lib/onboard...shboard-port.ts	90%	96%	+6%

---

_{Updated August 06, 2026 08:03 UTC}

[github-actions]

PR Review Advisor — No blocking findings reported

Advisor assessment: No blocking advisor findings reported
Next action: No advisor follow-up needed.
Findings: 0 blockers · 0 warnings · 0 suggestions

Model lanes

• GPT-5.6 Terra (primary): Completed · high confidence · 0 blockers · 0 warnings · 0 suggestions
• Nemotron 3 Ultra (second opinion): Failed after a partial review · low confidence · 0 blockers · 1 warning · 0 suggestions

Second-opinion terminology and E2E selections are advisory. Live E2E does not run automatically for pull requests.

1 semantic terminology decision

Terminology decisions are advisory. They affect the assessment only when a separate finding identifies concrete semantic impact.

• established — publication preflight at test/e2e/support/base-image-publication.test.ts:165: Keep the established term in the parameterized test titles.

E2E guidance

Advisory only. A maintainer can dispatch the default E2E suite against this exact revision.

Recommended E2E: cloud-inference, cloud-onboard, security-posture

Workflow run details

This automated review informs maintainers. Warnings and suggestions do not require a response. A maintainer decides whether to merge.