ci(installer): trust prepared gateway runtime template - #11346
Conversation
|
Auto-sync is disabled for draft pull requests in this repository. Workflows must be run manually. Contributors can view more details about this message here. |
|
No actionable comments were generated in the recent review. 🎉 ℹ️ Recent review info⚙️ Run configurationConfiguration used: Path: .coderabbit.yaml Review profile: CHILL Plan: Enterprise Run ID: 📒 Files selected for processing (5)
🚧 Files skipped from review as they are similar to previous changes (1)
Included review availability: Your plan provides up to 12 included reviews per hour; 4 remain after this review. 📝 WalkthroughWalkthroughThe change centralizes installer fixture transformations, preserves existing trust values, and adds parameterized coverage for prepared gateway runtime templates across supported OpenShell releases. ChangesSupervisor runtime trust
Priority: ⬇️ Low Estimated code review effort: 2 (Simple) | ~10 minutes Suggested reviewers: Merge Risk: ⚪ Minimal · up to This change expands installer trust-parser coverage for prepared gateway runtime templates while retaining rejection coverage for altered supervisor registries. No current merge-blocking risk is identified. 🚥 Pre-merge checks | ✅ 4 | ❌ 1❌ Failed checks (1 warning)
✅ Passed checks (4 passed)
✨ Finishing Touches 💡 2📝 Generate docstrings 💡
🛠️ Fix failing CI checks 💡
🧪 Generate unit tests (beta)
Comment |
|
@coderabbitai review |
✅ Action performedReview finished.
|
Code Coverage OverviewLanguages: TypeScript TypeScript / code-coverage/pluginThe overall line coverage in commit 80cb0e0 in the TypeScript / code-coverage/cliThe overall line coverage in commit 80cb0e0 in the Updated |
|
@coderabbitai review |
✅ Action performedReview finished.
|
|
@coderabbitai review |
✅ Action performedReview finished.
|
|
@coderabbitai review |
✅ Action performedReview finished.
|
|
PR Review Advisor finished for commit |
|
Reviewed all nine complete Advisor reports for d66fc41 from https://github.com/NVIDIA/NemoClaw/actions/runs/34423073564. The reduction report suggests extracting the repeated prospective digest into a constant. I am leaving this as an optional refactor: each release record deliberately lists its authorized template identities, and the six-release parser tests protect membership coherence. A named constant could preserve that membership, but it does not correct a demonstrated behavior or security defect. The architecture report confirms the existing ownership model, and the security and verification reports found no required change. All other specialist reports are clear. Full CI passed. The managed-image activation job failed once in a read-only Docker DNS probe before Deep Agents sandbox creation. The same probe passed earlier for OpenClaw and Hermes, neither the probe nor activation test changed in this PR, and retained cleanup.json reports all resources cleaned with no failures. Classified as transient runner/network failure; reran only job 102702308977 once under the maintainer's standing authorization. No code change or broad workflow rerun was made. Both MCP-discovery runs passed on the first attempt. The activation rerun remains in progress. |
|
@coderabbitai review |
✅ Action performedReview finished.
|
|
Candidate 4841805 passed all 112 focused installer-trust tests, trusted local publication validation, and full CI: https://github.com/NVIDIA/NemoClaw/actions/runs/34480091864. All five commits have verified signatures. CodeRabbit finished its incremental review request without a new finding. Fresh Advisor run https://github.com/NVIDIA/NemoClaw/actions/runs/34481673089 failed for all nine specialists with service HTTP 429 budget_exceeded. No fresh specialist findings were produced. This is a shared service budget blocker; an unchanged rerun will not resolve it until the service owner restores capacity. Keeping the candidate unchanged and draft pending that intervention and completed reviews. Managed-image run https://github.com/NVIDIA/NemoClaw/actions/runs/34480091871 passed every image build, staging permission check, and exact all-agent activation. Both OpenClaw MCP discovery passes failed before product execution: the external quick-tunnel public HEAD /mcp probe failed after its three bounded attempts. Both retained cleanup.json files report successful fixture cleanup and no failures. The tunnel fixture and workflow are identical to the recorded main base. The available TypeError diagnostic does not distinguish DNS, TLS, or other transport causes, so no speculative code change or unchanged retry was made. The parent #11212 remains dependent on this independently reviewed trust prerequisite. No merge gate was waived and neither PR has merged. |
|
@coderabbitai review |
✅ Action performedReview finished.
|
wscurran
added
area: ci
cjagwani
left a comment
cjagwani
left a comment
There was a problem hiding this comment.
Reviewed the complete installer-trust delta and affected trusted parser path. The prospective runtime digest is limited to the six supervisor-bearing release records, reproduces exactly from the shared preparation fixture, and remains independently bound to release-specific image and manifest identities. The real parser accepts all intended selections and rejects altered runtime bytes. Focused trust suites passed 112/112; installer hash verification, exact-head CI, managed-image validation, self-hosted qualification, CodeRabbit, DCO, and commit verification are clean.
3 participants
Outcome
The base-trusted installer parser accepts the exact gateway runtime preparation template needed by #11212. Other operational mutations remain rejected.
Reason
Installer CI executes the parser from the PR base. The platform fix cannot authorize its own runtime-file change, so this independently reviewed prerequisite must land first, following #10580.
Related issues
Unblocks #11212. Refs #11208.
Changes
b6e467dd20e1bcb27d26d40ccc56eaef2a0c1321537108884e0941661a840373in the six release records with supervisor identities. Preserve their image, manifest, binary, and release identities.Verification
npm run validate:prpassed for80cb0e03da5938ce70fda1a2926e879a65bb91c0against canonical main5b82037acb402862bb590ef57cb4d4c608e35ce7.d66fc41candidate passed full CI and managed-image validation. Its activation DNS failure passed on one targeted rerun; retained artifacts showed cleanup succeeded. Current-commit CI and review results are recorded in checks and review comments.npm run review:localcould not produce findings: its temporary OpenShell gateway refused the connection during configuration, and temporary-file cleanup reported EACCES. Earlier GitHub Advisor reviews completed successfully. The latest attempt failed before findings because the shared service exhausted its budget; Rebecca explicitly confirmed Advisor is optional and its unavailability does not block this PR.Review notes
Rebecca Sliter approved this prerequisite and authenticated GitHub CLI publication in the originating task. Local review of the dependent runtime at
9a097650ddbc58111138d27c6fae4e78d035dabcconfirmed one preparation result supplies the gateway environment and TLS path without changing supervisor image or manifest identities. The prospective fixture reconstructs that runtime byte-for-byte before normalization.All nine full Advisor reports for
d66fc41were reviewed. The optional suggestion to extract the digest into a constant does not correct a demonstrated defect; release-specific authorization remains the established policy owner and six-release tests cover membership. All other reports found no required change. The earlier release-selection test gap and unclear trust comments were repaired. CodeRabbit found no actionable issue.The final base integration addresses the current-main merge gate. The prior candidate passed full CI and exact all-agent activation. Its two MCP discovery runs failed during external tunnel setup before product execution; their unchanged fixtures cleaned up successfully. The transport diagnostic does not establish a transient cause, so no blind retry or speculative product repair was made. Fresh checks will evaluate the refreshed candidate.
Signed-off-by: Rebecca Sliter 571084+rsliter@users.noreply.github.com