Skip to content

fix(ci): clarify E2E gate outcomes#6821

Merged
cv merged 5 commits into
mainfrom
codex/ci-gate-outcomes
Jul 14, 2026
Merged

fix(ci): clarify E2E gate outcomes#6821
cv merged 5 commits into
mainfrom
codex/ci-gate-outcomes

Conversation

@cv

@cv cv commented Jul 14, 2026

Copy link
Copy Markdown
Collaborator

Summary

Separate trusted controller health from the exact-diff merge verdict so handled PR CI/E2E failures and superseded or closed revisions no longer masquerade as controller failures. Add self-explanatory diagnostics and exception links while preserving red controller status for real controller, correlation, and evidence-download faults. This follows the actual-run review of #6807 and #6810.

Changes

  • Rename the workflow to E2E / PR Gate Controller while preserving the required custom check name E2E / PR Gate, and document which outcome controls merge authority.
  • Complete prerequisite-CI and selected-E2E failures as handled red PR verdicts with direct run, job, and failed-step links; paginate bounded workflow-job results and keep diagnostic lookup failures fail-closed at the PR check.
  • Cancel exact checks for superseded revisions and closed PRs, including deleted fork repositories, only after validating the trusted check identity. Bracket evidence parsing with live exact-diff reads so stale evidence cannot become a current result.
  • Keep infrastructure failures distinct: a successful child whose evidence download fails leaves both controller and custom check red, while classified missing, duplicate, skipped, pending, or reported-failing signals remain handled PR verdicts.
  • Make no-secret exceptions explicitly say that credentialed E2E did not run, embed the controller-run link needed for Review deployments, and clarify the exact manual evidence URL format.
  • Add lifecycle, pagination, workflow, command, exception, and race regression coverage; update the E2E reference and maintainer merge-gate guidance.

Type of Change

  • Code change (feature, bug fix, or refactor)
  • Code change with doc updates
  • Doc only (prose changes, no code sample modifications)
  • Doc only (includes code sample changes)

Quality Gates

  • Tests added or updated for changed behavior
  • Existing tests cover changed behavior — justification:
  • Tests not applicable — justification:
  • Docs updated for user-facing behavior changes
  • Docs not applicable — justification: No end-user product behavior changed; the internal E2E reference and maintainer merge-gate guidance were updated.
  • Sensitive paths changed (security, policy, credentials, preflight, onboarding, inference, runner, sandbox, or messaging)
  • Sensitive-path review completed or maintainer-approved waiver recorded — reviewer/approval link/justification: Adversarial fail-closed review covered GitHub App/external-ID correlation, stale and deleted-fork revisions, bounded diagnostics, evidence trust boundaries, download failures, and pre/post-parse race validation; no remaining blockers.
  • Non-success, skipped, or missing CI check accepted by maintainer — check name, approval link, and follow-up issue:

Verification

  • PR description includes the DCO sign-off declaration and every commit appears as Verified in GitHub
  • Normal pre-commit, commit-msg, and pre-push hooks passed, or npm run check:diff passed when hooks were skipped or unavailable
  • Targeted behavior tests pass for the current change set, or tests are marked not applicable above — npx vitest run --project integration test/pr-e2e-gate-command.test.ts test/pr-e2e-gate.test.ts test/pr-e2e-gate-lifecycle.test.ts test/pr-e2e-gate-exceptions.test.ts test/pr-e2e-gate-workflow.test.ts (5 files, 107 tests passed)
  • Applicable broad gate passed — GIT_CONFIG_GLOBAL=/dev/null SSH_AUTH_SOCK=/tmp/ssh-qmH9wX3sr5/agent.4170011 npm test (1,502 files and 17,062 tests passed; 3 files and 40 tests skipped)
  • Quality Gates section completed with required justifications or waivers
  • No secrets, API keys, or credentials committed
  • npm run docs builds without warnings (doc changes only)
  • Doc pages follow the style guide (doc changes only)
  • New doc pages include SPDX header and frontmatter (new pages only)

Signed-off-by: Carlos Villela cvillela@nvidia.com

Summary by CodeRabbit

  • Improvements

    • Renamed the E2E gate workflow to E2E / PR Gate Controller with stronger handling for superseded, closed, cancelled, and timeout scenarios.
    • Improved evidence verification and finalization reporting, including evidence outcome propagation and clearer fail-closed behavior.
    • Updated wait/completion behavior so terminal failures/timeouts are reported consistently without unexpected non-zero exits, and improved check conclusion/link messaging (including cancelled).
  • Documentation

    • Refined controller/manual dispatch guidance, evidence handling rules, and “no-secret exception” workflow instructions.
  • Tests

    • Updated and expanded E2E lifecycle, workflow contract, and CLI parsing/evidence outcome coverage to match the new behavior and messages.

Signed-off-by: Carlos Villela <cvillela@nvidia.com>
@cv cv self-assigned this Jul 14, 2026
@coderabbitai

coderabbitai Bot commented Jul 14, 2026

Copy link
Copy Markdown
Contributor

Review Change Stack

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info
⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Enterprise

Run ID: d7142853-800b-416b-a08c-4147dec1932d

📥 Commits

Reviewing files that changed from the base of the PR and between 1c6a45c and 07d1081.

📒 Files selected for processing (2)
  • test/pr-e2e-gate-exceptions.test.ts
  • tools/e2e/pr-e2e-gate.mts
🚧 Files skipped from review as they are similar to previous changes (2)
  • test/pr-e2e-gate-exceptions.test.ts
  • tools/e2e/pr-e2e-gate.mts

📝 Walkthrough

Walkthrough

The PR updates the E2E gate controller’s workflow identity, command contracts, evidence handling, exact-diff lifecycle, CI reporting, exception resolution, documentation, and test coverage.

Changes

PR E2E Gate control plane

Layer / File(s) Summary
Controller contracts and workflow wiring
.github/workflows/pr-e2e-gate.yaml, tools/e2e/pr-e2e-gate.mts, test/pr-e2e-gate-command.test.ts, test/pr-e2e-gate-workflow.test.ts
Evidence outcomes are passed through finish commands, the workflow is renamed to E2E / PR Gate Controller, dependency installation flags are updated, terminal wait states exit successfully, and command/workflow contracts are tested.
Exact-diff and CI lifecycle handling
tools/e2e/pr-e2e-gate.mts, test/pr-e2e-gate.test.ts, test/pr-e2e-gate-lifecycle.test.ts
Obsolete revisions are finalized as cancelled, closed pull requests are handled, and workflow job failures or unavailable details are reported without throwing prerequisite errors.
Evidence-aware gate finalization
tools/e2e/pr-e2e-gate.mts, test/pr-e2e-gate-lifecycle.test.ts
Finish processing validates evidence outcomes, handles child-run failures and cancellations, and records final check conclusions and output links.
Exception control plane and operator guidance
.agents/skills/nemoclaw-maintainer-day/MERGE-GATE.md, test/e2e/README.md, test/pr-e2e-gate-exceptions.test.ts
Exception approval rules, controller-run links, evidence behavior, supersession semantics, and recorded outcomes are clarified and tested.

Estimated code review effort: 4 (Complex) | ~45 minutes

Suggested labels: area: ci, refactor, area: e2e, feature, bug-fix

Sequence Diagram(s)

sequenceDiagram
  participant ControllerWorkflow
  participant PrGateController
  participant E2EWorkflow
  participant GitHubCheck
  ControllerWorkflow->>PrGateController: pass command and evidence outcome
  PrGateController->>E2EWorkflow: inspect workflow status and jobs
  E2EWorkflow-->>PrGateController: return completion and evidence results
  PrGateController->>GitHubCheck: finalize verdict, conclusion, and output
Loading
🚥 Pre-merge checks | ✅ 4 | ❌ 1

❌ Failed checks (1 warning)

Check name Status Explanation Resolution
Docstring Coverage ⚠️ Warning Docstring coverage is 0.00% which is insufficient. The required threshold is 80.00%. Write docstrings for the functions missing them to satisfy the coverage threshold.
✅ Passed checks (4 passed)
Check name Status Explanation
Description Check ✅ Passed Check skipped - CodeRabbit’s high-level summary is enabled.
Title check ✅ Passed The title is concise and accurately reflects the main CI change: clarifying E2E gate outcome handling.
Linked Issues check ✅ Passed Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check ✅ Passed Check skipped because no linked issues were found for this pull request.
✨ Finishing Touches
📝 Generate docstrings
  • Create stacked PR
  • Commit on current branch
🧪 Generate unit tests (beta)
  • Create PR with unit tests
  • Commit unit tests in branch codex/ci-gate-outcomes

Comment @coderabbitai help to get the list of available commands.

@github-code-quality

github-code-quality Bot commented Jul 14, 2026

Copy link
Copy Markdown
Contributor

Code Coverage Overview

Languages: TypeScript

TypeScript / code-coverage/plugin

The overall coverage remains at 96%, unchanged from the main branch.

TypeScript / code-coverage/cli

The overall coverage in the codex/ci-gate-outcom... branch remains at 79%, unchanged from the main branch.

Show a code coverage summary of the most impacted files.
File main b634f01 codex/ci-gate-outcom... 07d1081 +/-
src/lib/core/wait.ts 99% 97% -2%
src/lib/state/gateway.ts 91% 93% +2%
src/lib/onboard...shboard-port.ts 89% 94% +5%
src/lib/policy/tiers.ts 80% 94% +14%
src/lib/actions...ge-preflight.ts 74% 89% +15%

Updated July 14, 2026 02:35 UTC
Code Coverage is in Public Preview. Learn more and provide us with your feedback.

Signed-off-by: Carlos Villela <cvillela@nvidia.com>
@github-actions

github-actions Bot commented Jul 14, 2026

Copy link
Copy Markdown
Contributor

PR Review Advisor — Informational

Advisor assessment: Informational / high confidence
Primary next action: No advisor follow-up required beyond maintainer review.
Findings: 0 blockers · 0 warnings · 0 optional suggestions
Status: No actionable findings remain in the canonical review ledger.

Model lanes

  • GPT-5.6 Terra (primary): Completed · high confidence · 0 blockers · 0 warnings · 0 suggestions
  • Nemotron 3 Ultra (non-blocking second opinion): Completed · high confidence · 0 blockers · 0 warnings · 0 suggestions
  • Model comparison: normalized findings match; normalized E2E selections differ; severity counts match.

Nemotron is a non-blocking second opinion. Its prose, findings, and E2E guidance do not change the primary assessment above and remain in workflow artifacts only.

E2E guidance

Advisory only: coverage and selector recommendations are non-authoritative. E2E / PR Gate independently computes and dispatches trusted jobs without consuming this output.

Recommended coverage: cloud-onboard, credential-sanitization, security-posture
Recommended selectors: cloud-onboard, credential-sanitization, security-posture

  • cloud-onboard — Selected from the trusted checked-in E2E coverage inventory.

  • credential-sanitization — Selected from the trusted checked-in E2E coverage inventory.

  • security-posture — Selected from the trusted checked-in E2E coverage inventory.

  • cloud-onboard — Selected as a trusted checked-in E2E job.

  • credential-sanitization — Selected as a trusted checked-in E2E job.

  • security-posture — Selected as a trusted checked-in E2E job.

Workflow run details

This is an automated, non-authoritative review. Findings are inputs to maintainer adjudication. Warnings and optional suggestions do not require a response or follow-up. A human maintainer makes the final merge decision.

Signed-off-by: Carlos Villela <cvillela@nvidia.com>

@coderabbitai coderabbitai Bot left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

🧹 Nitpick comments (2)
tools/e2e/pr-e2e-gate.mts (1)

1774-1786: 📐 Maintainability & Code Quality | 🔵 Trivial | ⚡ Quick win

Hardcoded workflow-name string duplicated instead of reusing WORKFLOW_NAME.

Both the fork-exception and control-plane-exception summaries build gateRunLink from the literal `[E2E / PR Gate Controller run ${command.gateRunId}](${gateRunUrl})`, duplicating the WORKFLOW_NAME constant (line 34, also used at line 2138) as free text in two places. If WORKFLOW_NAME is ever renamed, these two summaries will silently go stale.

♻️ Proposed fix: reuse WORKFLOW_NAME
-      const gateRunLink = `[E2E / PR Gate Controller run ${command.gateRunId}](${gateRunUrl})`;
+      const gateRunLink = `[${WORKFLOW_NAME} run ${command.gateRunId}](${gateRunUrl})`;

Apply the same change at the second occurrence (control-plane exception summary).

Also applies to: 1799-1813

🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@tools/e2e/pr-e2e-gate.mts` around lines 1774 - 1786, Update both
fork-exception and control-plane-exception summary constructions to derive the
gateRunLink label from the existing WORKFLOW_NAME constant instead of hardcoding
“E2E / PR Gate Controller”. Preserve the current run ID and URL formatting while
reusing WORKFLOW_NAME in both occurrences.
test/pr-e2e-gate-command.test.ts (1)

44-172: 📐 Maintainability & Code Quality | 🔵 Trivial | ⚡ Quick win

Consider splitting this into multiple focused tests.

One it(...) asserts 8+ independent command-parsing scenarios (start/cancel/seed/finish/resolve-fork/resolve-control-plane/abandon plus two distinct error paths) sharing a single workDir. This works, but a failure anywhere in the middle produces one generic failure that doesn't pinpoint which scenario broke, and the title ("parses one lifecycle command set...") doesn't reflect the negative-path assertions (safe-integer overflow, insecure directory permissions).

Splitting into per-scenario it blocks (via beforeEach/afterEach for the shared workDir) would improve failure isolation and readability at low cost.

🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@test/pr-e2e-gate-command.test.ts` around lines 44 - 172, Split the single
test in the “PR E2E controller commands” suite into focused it blocks for each
command-parsing scenario and each validation/error path, using
beforeEach/afterEach or equivalent lifecycle setup for the shared temporary
workDir. Give each test a title matching its scenario, while preserving all
existing assertions and cleanup behavior, including safe-integer overflow and
insecure-directory validation.
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Nitpick comments:
In `@test/pr-e2e-gate-command.test.ts`:
- Around line 44-172: Split the single test in the “PR E2E controller commands”
suite into focused it blocks for each command-parsing scenario and each
validation/error path, using beforeEach/afterEach or equivalent lifecycle setup
for the shared temporary workDir. Give each test a title matching its scenario,
while preserving all existing assertions and cleanup behavior, including
safe-integer overflow and insecure-directory validation.

In `@tools/e2e/pr-e2e-gate.mts`:
- Around line 1774-1786: Update both fork-exception and control-plane-exception
summary constructions to derive the gateRunLink label from the existing
WORKFLOW_NAME constant instead of hardcoding “E2E / PR Gate Controller”.
Preserve the current run ID and URL formatting while reusing WORKFLOW_NAME in
both occurrences.

ℹ️ Review info
⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Enterprise

Run ID: 69aa3846-6f12-45d6-bc62-91b83a2c2a98

📥 Commits

Reviewing files that changed from the base of the PR and between b634f01 and 48c2cf8.

📒 Files selected for processing (9)
  • .agents/skills/nemoclaw-maintainer-day/MERGE-GATE.md
  • .github/workflows/pr-e2e-gate.yaml
  • test/e2e/README.md
  • test/pr-e2e-gate-command.test.ts
  • test/pr-e2e-gate-exceptions.test.ts
  • test/pr-e2e-gate-lifecycle.test.ts
  • test/pr-e2e-gate-workflow.test.ts
  • test/pr-e2e-gate.test.ts
  • tools/e2e/pr-e2e-gate.mts

@cv
cv merged commit 35d51b9 into main Jul 14, 2026
85 checks passed
@cv
cv deleted the codex/ci-gate-outcomes branch July 14, 2026 02:39
@github-actions github-actions Bot added the v0.0.82 Release target label Jul 14, 2026
@cv cv mentioned this pull request Jul 14, 2026
21 tasks
cv added a commit that referenced this pull request Jul 14, 2026
## Summary

Controller-only internal PRs now automatically dispatch the selected
exact-SHA E2E jobs instead of requiring a no-run exception. Internal
changes that alter PR-controlled E2E execution or evidence code require
an explicit maintainer/admin `run-control-plane` authorization, then use
the normal dispatch, wait, evidence, and finish path so only verified
results can clear `E2E / PR Gate`. Fork handling remains a no-secret
exception.

## Related Issue

Part of #6145

## Changes

- Treat only `.github/workflows/pr-e2e-gate.yaml` and
`tools/e2e/pr-e2e-gate.mts` as controller-only control-plane changes
eligible for automatic internal dispatch.
- Replace the internal `resolve-control-plane` no-run waiver with
exact-head/base `run-control-plane` authorization that requires
`maintain` or `admin` and dispatches the selected jobs.
- Serialize automatic and manual coordination on the exact head SHA,
preserve a retryable failure after authorized-start errors, and keep
success exclusive to verified evidence.
- Expand command, workflow, risk-plan, lifecycle, authorization, retry,
origin, and #6821 regression coverage; update contributor and maintainer
E2E guidance.

## Type of Change

- [ ] Code change (feature, bug fix, or refactor)
- [x] Code change with doc updates
- [ ] Doc only (prose changes, no code sample modifications)
- [ ] Doc only (includes code sample changes)

## Quality Gates

- [x] Tests added or updated for changed behavior
- [ ] Existing tests cover changed behavior — justification:
- [ ] Tests not applicable — justification:
- [x] Docs updated for user-facing behavior changes
- [ ] Docs not applicable — justification:
- [x] Sensitive paths changed (security, policy, credentials, preflight,
onboarding, inference, runner, sandbox, or messaging)
- [x] Sensitive-path review completed or maintainer-approved waiver
recorded — reviewer/approval link/justification: Maintainer-directed
scope; an independent implementation audit found no success bypass,
identified two lifecycle races, and both were fixed and retested before
submission.
- [ ] Non-success, skipped, or missing CI check accepted by maintainer —
check name, approval link, and follow-up issue:

## Verification

- [x] PR description includes the DCO sign-off declaration and every
commit appears as `Verified` in GitHub
- [x] Normal `pre-commit`, `commit-msg`, and `pre-push` hooks passed, or
`npm run check:diff` passed when hooks were skipped or unavailable
- [x] Targeted behavior tests pass for the current change set, or tests
are marked not applicable above — `npx vitest run
test/pr-risk-plan.test.ts test/pr-e2e-gate-command.test.ts
test/pr-e2e-gate-workflow.test.ts test/pr-e2e-gate-exceptions.test.ts
test/pr-e2e-gate.test.ts` (154 passed)
- [ ] Applicable broad gate passed — local `npm test` did not complete:
after eight minutes it remained on one idle integration worker with an
orphaned persistent-log `tail -F`; the process was terminated and GitHub
CI is required for the broad verdict.
- [x] Quality Gates section completed with required justifications or
waivers
- [x] No secrets, API keys, or credentials committed
- [ ] `npm run docs` builds without warnings (doc changes only)
- [ ] Doc pages follow the [style
guide](https://github.com/NVIDIA/NemoClaw/blob/main/docs/CONTRIBUTING.md)
(doc changes only)
- [ ] New doc pages include SPDX header and frontmatter (new pages only)

---
Signed-off-by: Carlos Villela <cvillela@nvidia.com>

<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->

## Summary by CodeRabbit

* **New Features**
* Added maintainer-authorized, exact-revision execution for
control-plane E2E checks.
* Added clearer fork exception resolution with validated evidence links
and protected approvals.
* Improved risk-based handling of E2E changes and credentialed test
authorization.

* **Bug Fixes**
* Prevented unauthorized or outdated control-plane and fork workflows
from dispatching E2E jobs.
* Improved cancellation and supersession handling when pull requests
change.

* **Documentation**
* Updated E2E gate guidance, authorization requirements, exception
workflows, and manual recovery steps.

<!-- end of auto-generated comment: release notes by coderabbit.ai -->

Signed-off-by: Carlos Villela <cvillela@nvidia.com>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

v0.0.82 Release target

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants