ci(deps): upgrade cache actions to Node.js 24 - #11353
Conversation
Signed-off-by: Carlos Villela <cvillela@nvidia.com>
|
Auto-sync is disabled for draft pull requests in this repository. Workflows must be run manually. Contributors can view more details about this message here. |
|
No actionable comments were generated in the recent review. 🎉 ℹ️ Recent review info⚙️ Run configurationConfiguration used: Path: .coderabbit.yaml Review profile: CHILL Plan: Enterprise Run ID: 📒 Files selected for processing (1)
Included review availability: Your plan provides up to 12 included reviews per hour; 10 remain after this review. 📝 WalkthroughWalkthroughThe pull request updates GitHub Actions cache restore and save references from v4.2.4 to v6.1.0 in compiled artifact and reviewed npm audit workflows. It also updates matching workflow test expectations. ChangesGitHub Actions cache upgrade
Estimated code review effort: 1 (Trivial) | ~2 minutes Suggested reviewers: Merge Risk: ⚪ Minimal · up to This updates the pinned GitHub cache actions used by compiled-artifact and npm-audit CI workflows while retaining matching workflow expectations. No merge-blocking risk is identified. 🚥 Pre-merge checks | ✅ 5✅ Passed checks (5 passed)
✨ Finishing Touches📝 Generate docstrings
🧪 Generate unit tests (beta)
Comment |
Code Coverage OverviewLanguages: TypeScript TypeScript / code-coverage/pluginThe overall line coverage in commit 276422a in the TypeScript / code-coverage/cliThe overall line coverage in commit 276422a in the Updated |
## Outcome The shared CLI and test type-check step receives a 5 GiB JavaScript heap. This gives the current TypeScript program enough memory to finish instead of aborting near the default 4 GiB limit. ## Reason The [build-typecheck job on #11353](https://github.com/NVIDIA/NemoClaw/actions/runs/34424271617/job/102706461224) passed all 1,299 package-contract tests, then aborted during `npm run typecheck:cli` with `JavaScript heap out of memory` and exit 134. ## Changes Set `NODE_OPTIONS: --max-old-space-size=5120` on `Typecheck CLI + tests` in `.github/actions/ci-build-typecheck/action.yaml`. Both PR and main CI use this shared action. The value matches the existing CLI heap remediation in `scripts/dev-setup.sh`. ## Verification - Node.js 22.23.1 reproduction on the original failing compiler inputs: `--max-old-space-size=4096` reproduced exit 134; `--max-old-space-size=5120` passed and reported `Memory used: 4356061K`. - Executed the changed YAML step's command and environment under Node.js 22.23.1 on this branch — `npm run typecheck:cli` passed. - `npx vitest run --project integration test/automation/pull-requests/pr-workflow-contract.test.ts` — all 44 tests passed. - `npm run validate:pr` — passed against canonical base `a4265abfc2e46922100baff0ba8f5985b681cf69`, with unchanged local validator sources and executables. - `git diff --check` and secret scans — passed. The diff contains no secrets, API keys, or credentials. ## Review notes Self-reviewed NVIDIA/NemoClaw commit `35bc9934af317cff2cdc0ea7da0310f64986676f` and the changed `.github/actions/ci-build-typecheck/action.yaml` against both callers, the existing setup remediation, and the executed type-check result. No actionable finding. Independent review of this sensitive path is pending; this PR is a draft. PR CI loads this action from its base commit. This PR's CI can still encounter the old heap limit until the shared action change lands on `main`. The local execution above exercises the proposed setting directly. --- Signed-off-by: Carlos Villela <cvillela@nvidia.com> Signed-off-by: Carlos Villela <cvillela@nvidia.com>
Signed-off-by: Carlos Villela <cvillela@nvidia.com>
Signed-off-by: Carlos Villela <cvillela@nvidia.com>
|
PR Review Advisor finished for commit |
1 participant
Outcome
CI selects cache restore/save actions that declare Node.js 24. All five pins move from v4.2.4 to v6.1.0, and the existing managed-image workflow test expects the new pins.
Reason
GitHub warns that the pinned v4.2.4 actions target deprecated Node.js 20 and are being forced to run on Node.js 24.
Changes
actions/cache/restorecalls and twoactions/cache/savecalls to v6.1.0 (55cc8345863c7cc4c66a329aec7e433d2d1c52a9) inci-compile-artifactsandci-reviewed-npm-audit..github, including transitive composite actions and the reusable workflow. Across 34 unique references, cache restore/save were the only actions declaring Node.js 20.Verification
npx vitest run --project integration test/automation/pull-requests/compiled-artifact.test.ts test/automation/pull-requests/pr-workflow-contract.test.ts test/automation/releases/reviewed-npm-audit-cache-key.test.ts test/automation/releases/reviewed-npm-audit-workflow.test.ts test/inference/managed/managed-image-publication-workflow.test.ts— 133 tests passed across five files. The managed-image workflow file reproduced the stale-pin failure before repair and passes afterward.npm run validate:pr— passed against canonical base270275f2a2b31a70fa72692d2ec304b5dffe8ee3after verifying the validation surface and resolved validator identities.node24. Upstream build, distribution, and Linux/macOS/Windows restore/save checks passed for the pinned commit..githubortest.git diff --checkand hook secret scans — passed. The diff contains no secrets, API keys, or credentials.Review notes
Self-reviewed NVIDIA/NemoClaw commit
dfd169efa1d95103879d2fc2be33a41d922ee117and its three-file diff against canonical base270275f2a2b31a70fa72692d2ec304b5dffe8ee3. The sensitive paths are.github/actions/ci-compile-artifacts/action.yamland.github/actions/ci-reviewed-npm-audit/action.yaml; review checked the upstream manifests, cache consumers, and trust assertions. No actionable finding remains in the local repair.CodeRabbit completed review through
dfd169efa1d95103879d2fc2be33a41d922ee117with no actionable comments. All nine Advisor specialists completed successfully, and their full Markdown reports were read. Eight reported no findings. The verification specialist suggested adding exact-SHA assertions for the compiled-artifact cache actions; this is advisory and was not adopted because it would duplicate the dependency pin without testing behavior. The existing cache hit/miss and artifact-integrity tests plus the authenticated upstream action audit remain the evidence for that change.PR CI loads these composite actions from its base commit, so it can still emit the old cache warning until this change merges. Execution of the new pins in NemoClaw remains a post-merge validation step.
Remaining CI failure: missing shared-module build
The required PR CI run passed for
dfd169efa1d95103879d2fc2be33a41d922ee117, including build/type-check and all CLI shards.The remaining managed-image-openclaw-security failure occurs during test collection:
Cannot find module '../../nemoclaw/dist/shared/sandbox-name.cjs'. The job installs root dependencies with--ignore-scriptsand does not build the shared modules imported by its fixture chain. It does not invoke either cache composite action changed by this PR.Reproduced the same failure on a clean archive of the PR base
270275f2a2b31a70fa72692d2ec304b5dffe8ee3using Node.js 22.23.1 and the locked root dependencies.vitest list --project integration test/e2e-runtime/managed-image-openclaw-security.test.tsexited 1 beforenpm run build:policy-boundaryand exited 0 afterward. WithNEMOCLAW_TEST_IMAGEset, it registers the security test. This verifies the collection prerequisite; the Docker assertions were not run locally.The minimal separate repair is to run
npm run build:policy-boundaryafter dependency installation in themanaged-image-openclaw-securityjobs in.github/workflows/pr-self-hosted.yamland.github/workflows/sandbox-images.yaml. Both jobs and the affected source/configuration are unchanged from the recorded base and remain unchanged on current canonical main. This inherited failure has no waiver.Signed-off-by: Carlos Villela cvillela@nvidia.com
Summary by CodeRabbit