fix(ci): trigger main publication for lifecycle changes

[apurvvkumaria]

Outcome

Lifecycle recovery changes now run the real all-agent activation gate before merge and the trusted image publication workflow after merge. Changes to the gateway recovery helper are covered by the same selectors.

Reason

PR #11641 added the lifecycle fixture to the managed-image pull request selector, but the main publication selector still omitted it. Both selectors also omitted the gateway recovery helper imported by that fixture. A lifecycle-only or helper-only change could therefore skip required managed-image validation or post-merge publication.

Related issues

• Follow-up to ci(e2e): trigger managed activation for lifecycle changes #11641

Changes

• Add the lifecycle fixture and its gateway recovery helper to the main image publication paths.
• Add the gateway recovery helper to the managed-image pull request paths.
• Require both selectors to retain the two lifecycle inputs in the existing managed-image workflow contract test.

This changes trigger selection only. It does not change workflow jobs, permissions, credentials, publication logic, or supported runtime behavior.

Verification

• npx vitest run --project integration test/inference/managed/managed-image-publication-workflow.test.ts — 36 tests passed.
• npx vitest run --project e2e-support test/e2e/support/gateway-runtime-start.test.ts test/e2e/support/e2e-phase-lifecycle.test.ts test/e2e/support/base-image-publication.test.ts — 123 tests passed.
• Normal pre-commit hooks — passed, including YAML, repository, source-shape, growth, and secret checks.
• Normal pre-push publication validation and CLI type-check — passed.
• GitHub reports commit 3be7bb5fe3cd19ae3e22f436e083cdd57390e828 as Verified.
• The diff contains no secrets, API keys, or credentials.

Review notes

• Resolves the valid exact-head PR Review Advisor trigger finding and the directly imported helper gap found during follow-up.
• No additional live E2E target is needed. The existing all-agent activation and publication jobs exercise the affected boundary when these paths change.

---

Signed-off-by: Apurv Kumaria akumaria@nvidia.com

Summary by CodeRabbit

• Chores
  • Updated automated image build workflows to run when gateway runtime startup, lifecycle, and activation fixtures change.
  • Ensured managed-image pull request and base-image push checks cover relevant runtime and lifecycle test updates, helping keep published images aligned with current end-to-end coverage.
• Tests
  • Updated workflow trigger validation to reflect the expanded test coverage and ensure expected checks run for applicable changes.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Enterprise

Run ID: d33e5ad6-0699-4409-95b7-8cc4780aea52

📥 Commits

Reviewing files that changed from the base of the PR and between 3be7bb5 and f8feb16.

📒 Files selected for processing (1)

• test/inference/managed/managed-image-publication-workflow.test.ts

Included review availability: Your plan provides up to 12 included reviews per hour; 4 remain after this review.

---

📝 Walkthrough

Walkthrough

The workflows now trigger for gateway runtime-start and lifecycle fixture changes. Tests verify the managed-image pull-request and base-image push path filters.

Changes

Workflow Trigger Coverage

Layer / File(s)	Summary
Fixture trigger filters and assertions .github/workflows/base-image.yaml, .github/workflows/managed-images.yaml, test/inference/managed/managed-image-publication-workflow.test.ts	Base-image pushes and managed-image pull requests now include the gateway runtime-start fixture. Base-image pushes also include the lifecycle fixture. Tests assert these paths.

Priority: ⬇️ Low

Estimated code review effort: 1 (Trivial) | ~5 minutes

Change: Bug fix

Suggested reviewers: cv, prekshivyas

Merge Risk: ⚪ Minimal · up to f8feb

Workflow trigger coverage is expanded for the listed fixtures, with no concrete merge-blocking risk established.

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly describes the main change: CI now triggers the main publication workflow for lifecycle-related changes.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff. Analyzed 0 functions across 1…
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

✨ Finishing Touches

📝 Generate docstrings

• Create stacked PR
• Commit on current branch

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch codex/fix-lifecycle-main-publish-trigger

---

_{Comment @coderabbitai help to get the list of available commands.}

[github-code-quality]

Code Coverage Overview

Languages: TypeScript

TypeScript / code-coverage/plugin

The overall line coverage in commit f8feb16 in the codex/fix-lifecycle-... branch remains at 96%, unchanged from commit ebb5e75 in the main branch.

TypeScript / code-coverage/cli

The overall line coverage in commit f8feb16 in the codex/fix-lifecycle-... branch remains at 83%, unchanged from commit 3ea2d5f in the main branch.

Show a line coverage summary of the most impacted files.

File	main 3ea2d5f	codex/fix-lifecycle-... f8feb16	+/-
src/lib/sandbox...rce-identity.ts	82%	82%	0%
src/lib/onboard...uild-context.ts	74%	75%	+1%

---

_{Updated September 14, 2026 00:53 UTC}

[github-actions]

PR Review Advisor finished for commit f8feb16. Include the Advisor findings in the complete PR feedback collection. Verify and group valid findings before repair.

All previous runs