fix(ci): use supported protected audit verifier flag - #11522
Merged
Conversation
Signed-off-by: San Dang <sdang@nvidia.com>
|
Auto-sync is disabled for draft pull requests in this repository. Workflows must be run manually. Contributors can view more details about this message here. |
Contributor
|
No actionable comments were generated in the recent review. 🎉 ℹ️ Recent review info⚙️ Run configurationConfiguration used: Path: .coderabbit.yaml Review profile: CHILL Plan: Enterprise Run ID: 📒 Files selected for processing (1)
Included review availability: Your plan provides up to 12 included reviews per hour; 11 remain after this review. 📝 WalkthroughWalkthroughThe protected managed image check now passes ChangesAudit policy verification
Priority: ⚪ Not assessed Estimated code review effort: 1 (Trivial) | ~2 minutes Change: Bug fix Suggested reviewers: Merge Risk: ⚪ Minimal · up to The protected managed-image audit now uses the supported verifier option and is ready to merge. 🚥 Pre-merge checks | ✅ 4 | ❌ 1❌ Failed checks (1 warning)
✅ Passed checks (4 passed)
✨ Finishing Touches 💡 1📝 Generate docstrings 💡
🧪 Generate unit tests (beta)
Comment |
Contributor
sandl99
marked this pull request as ready for review
September 11, 2026 05:59
sandl99
enabled auto-merge (squash)
September 11, 2026 06:04
hunglp6d
approved these changes
Sep 11, 2026
cv
added a commit
that referenced
this pull request
Sep 11, 2026
) ## Outcome Protected OpenClaw rebuilds consume verified mcporter audit evidence while networking is disabled. The fix reuses #11370's trusted controller and preserves rejection of incomplete or mismatched evidence. ## Reason The [failed GPU job](https://github.com/NVIDIA/NemoClaw/actions/runs/34375097855/job/102555650142) ran `npm audit` during an offline rebuild without supplied evidence. Both attempts returned the same 206-byte `EAI_AGAIN` document with missing metadata. GPU inference never started. ### Related issues Fixes #11088. Uses merged prerequisites #11370 and #11522 (the trusted-controller flag correction). ## Changes - Share the receipt, raw-report, and trusted-policy consumer between both Dockerfiles. Verify transport hashes; run a live audit only when evidence is absent. - Keep bounded, redacted diagnostics and the existing two-attempt limit for recognized transient audit failures. - Reuse the producer's policy output. Remove duplicate policy emission, redundant workflow-shape coverage, and unrelated cache-export cleanup. - Stub unrelated llama.cpp host discovery in the existing vLLM serving-profile fixture after its CI timeout. - Retain up to 64 KiB of redacted host gateway logs when managed-image activation fails. The preceding failure retained no gateway explanation; onboarding behavior and retry limits are unchanged. The diff is reduced from 22 files and 1,137 added lines to 21 files and 917 added lines. No new test scenario or public documentation is added. ## Verification Candidate: `ca72fcbfac849946db3552f2abff68b4627c6656`. Canonical validation reference: `c5eee32476e90b7f200a2207a3fd3175a56b8d32`. PR base: `e0273c244c0e96ab35bd1d3c962c3802633d67e7`. - Initial audit-fix tests: 336 passed, 2 skipped across 11 files; CLI and plugin builds passed. Those audit-fix paths remain unchanged. - Existing vLLM fixture: four tests pass. A temporary 6-second host-probe delay reproduced the prior 5-second timeout; the fixture correction prevented that unrelated call. Temporary probe code was removed. [CI passed on `38fa1ebe5f`](https://github.com/NVIDIA/NemoClaw/actions/runs/34580969055), including the previously failing shard 3. - Existing diagnostic/redaction tests: 59 passed across `managed-image-activation-diagnostics.test.ts`, `docker-probe.test.ts`, `e2e-redaction-entry.test.ts`, and `e2e-redaction-parity.test.ts`, using `npm exec -- vitest run --project e2e-support` with those four files. - `npm run validate:pr`: all pre-commit code, formatting, repository, and security checks passed. Commitlint reports the same five historical message errors: three have a [recorded exception](#11156 (comment)), and the user authorized preserving the `31645fc` type and `a126c3f` body-length errors. History is preserved; no code or security check is waived. - Separate pre-push CLI type checks passed. Validation uses Node 22.23.2 Linux as an unprivileged user, without host mounts, credentials, or a Docker socket. No secrets are in the diff. The [preceding image run](https://github.com/NVIDIA/NemoClaw/actions/runs/34580969115) passed every image build/publication and both MCP checks, but OpenClaw activation entered OpenShell `Error` before a durable create identity was available. The retained filtered Docker inventory was empty. The underlying gateway cause remains unresolved; this revision adds the missing failure evidence. The workflow's existing `managed_image_revision` input can reuse the [fully successful `1bd6e085e4` image cohort](https://github.com/NVIDIA/NemoClaw/actions/runs/34575859333). Only the existing unit-test fixture and E2E failure diagnostics changed after that revision; image build sources are unchanged. Protected GPU qualification still builds images from the latest candidate checkout and must bind its result to that candidate. Ancestor cohort reuse does not waive the current activation check. Current CI, image qualification, and protected GPU/local-inference E2E remain pending. The protected selector is `jobs=managed-image-protected-runtime`, with empty targets and no staging or Jetson dispatch. ## Review notes Self-review covers the full candidate diff. CodeRabbit's receipt/raw binding and strict JSON parsing corrections are retained. Advisor's duplicate-policy finding is addressed; broader cache transactions and duplicate test infrastructure are excluded. All nine Advisor specialists completed for `38fa1ebe5f`; eight requested no change. The verification specialist's extra YAML wiring scenario is [declined with the coverage gap and rationale recorded](#11156 (comment)). Existing executable handoff tests and actual workflow qualification remain required. The human request for protected E2E evidence remains open. No review is dismissed or merge requirement bypassed. --- Signed-off-by: San Dang <sdang@nvidia.com> --------- Signed-off-by: San Dang <sdang@nvidia.com> Signed-off-by: Rebecca Sliter <571084+rsliter@users.noreply.github.com> Signed-off-by: Julie Yaunches <jyaunches@nvidia.com> Signed-off-by: Rebecca Sliter <sliterrm@gmail.com> Co-authored-by: Rebecca Sliter <571084+rsliter@users.noreply.github.com> Co-authored-by: Julie Yaunches <jyaunches@nvidia.com> Co-authored-by: Carlos Villela <cvillela@nvidia.com> Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com> Co-authored-by: Rebecca Sliter <sliterrm@gmail.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Outcome
Protected managed-image builds can verify supplied mcporter audit evidence before the offline rebuild.
Reason
The trusted controller passes
--legacy-npmjs, but the verifier accepts only--legacy-audit. It rejects valid evidence withverifier arguments has unexpected or missing keysbefore Docker starts. Manual PR E2E uses this controller frommain, so repairing the candidate copy cannot unblock GPU qualification.Related issues
Refs #11088. Prerequisite for #11156, following #11370.
Changes
Replace the obsolete verifier flag with the supported name. One line changes; no new mechanism or test scenario.
Verification
npm run validate:pr: passed on615eb8afdc9906d22d8eb360b33380122780aad4against canonical main189043e740fdab61c8c3fdf6fe9407f438e4d955.Review notes
Self-review covered
scripts/checks/build-protected-managed-images.shat615eb8afdcin NVIDIA/NemoClaw. Validation used an unprivileged Node 22.23.2 Linux container without host mounts, credentials, or a Docker socket. Independent review is pending. The GPU target remains owned by #11156.Signed-off-by: San Dang sdang@nvidia.com
Summary by CodeRabbit