ci(e2e): centralize Vitest inference env

.github/actions/export-e2e-hosted-inference/action.yaml

@@ -0,0 +1,39 @@
+# SPDX-FileCopyrightText: Copyright (c) 2026 NVIDIA CORPORATION & AFFILIATES. All rights reserved.
+# SPDX-License-Identifier: Apache-2.0
+
+name: Export E2E hosted inference environment
+description: Canonicalize NemoClaw hosted inference secrets and export the shared E2E env contract.
+inputs:
+  nvidia-inference-api-key:
+    description: Canonical repository-hosted NVIDIA inference credential.
+    required: false
+    default: ""
+  nvidia-api-key:
+    description: >-
+      Temporary compatibility alias for legacy E2E lanes that still read
+      NVIDIA_API_KEY directly. The source-owned inventories and removal
+      conditions live in tools/e2e-scenarios/hosted-inference-legacy-alias.mts.
+    required: false
+    default: ""
+  export-nvidia-api-key:
+    description: >-
+      Emit NVIDIA_API_KEY only for documented legacy consumers that still need
+      the compatibility alias. Defaults to false so hosted CI inference exports
+      only NVIDIA_INFERENCE_API_KEY and COMPATIBLE_API_KEY.
+    required: false
+    default: "false"
+  require-hosted-inference:
+    description: Fail when no nvapi-prefixed hosted inference credential is available.
+    required: false
+    default: "true"
+runs:
+  using: composite
+  steps:
+    - name: Export hosted inference env
+      shell: bash
+      env:
+        INPUT_NVIDIA_INFERENCE_API_KEY: ${{ inputs.nvidia-inference-api-key }}
+        INPUT_NVIDIA_API_KEY: ${{ inputs.nvidia-api-key }}
+        INPUT_EXPORT_NVIDIA_API_KEY: ${{ inputs.export-nvidia-api-key }}
+        INPUT_REQUIRE_HOSTED_INFERENCE: ${{ inputs.require-hosted-inference }}
+      run: bash "${GITHUB_ACTION_PATH}/export.sh"

.github/actions/export-e2e-hosted-inference/export.sh

@@ -0,0 +1,53 @@
+#!/usr/bin/env bash
+# SPDX-FileCopyrightText: Copyright (c) 2026 NVIDIA CORPORATION & AFFILIATES. All rights reserved.
+# SPDX-License-Identifier: Apache-2.0
+
+set -euo pipefail
+
+canonical="${INPUT_NVIDIA_INFERENCE_API_KEY:-}"
+public_alias="${INPUT_NVIDIA_API_KEY:-}"
+
+# Keep the hosted E2E contract canonical: NVIDIA_INFERENCE_API_KEY is the
+# hosted CI source secret and COMPATIBLE_API_KEY is the custom endpoint
+# credential. NVIDIA_API_KEY is emitted only when the caller explicitly opts in
+# for documented legacy consumers that still assert the older env name.
+for value in "${canonical}" "${public_alias}"; do
+  if [[ "${value}" == *$'\n'* || "${value}" == *$'\r'* ]]; then
+    echo "::error::Hosted inference credentials must be single-line values." >&2
+    exit 1
+  fi
+done
+
+if [[ "${canonical}" != nvapi-* && "${public_alias}" == nvapi-* ]]; then
+  canonical="${public_alias}"
+fi
+if [[ "${public_alias}" != nvapi-* && "${canonical}" == nvapi-* ]]; then
+  public_alias="${canonical}"
+fi
+
+if [[ "${INPUT_REQUIRE_HOSTED_INFERENCE:-true}" == "true" ]]; then
+  if [[ -z "${canonical}" ]]; then
+    echo "::error::NVIDIA_INFERENCE_API_KEY secret is required for hosted CI inference." >&2
+    exit 1
+  fi
+  if [[ "${canonical}" != nvapi-* ]]; then
+    echo "::error::NVIDIA_INFERENCE_API_KEY must be nvapi-prefixed for hosted CI inference." >&2
+    exit 1
+  fi
+fi
+
+{
+  printf 'NEMOCLAW_E2E_USE_HOSTED_INFERENCE=1\n'
+  printf 'NEMOCLAW_PROVIDER=custom\n'
+  printf 'NEMOCLAW_ENDPOINT_URL=https://inference-api.nvidia.com/v1\n'
+  printf 'NEMOCLAW_MODEL=nvidia/nvidia/nemotron-3-super-v3\n'
+  printf 'NEMOCLAW_COMPAT_MODEL=nvidia/nvidia/nemotron-3-super-v3\n'
+  printf 'NEMOCLAW_PREFERRED_API=openai-completions\n'
+  if [[ -n "${canonical}" ]]; then
+    printf 'NVIDIA_INFERENCE_API_KEY=%s\n' "${canonical}"
+    printf 'COMPATIBLE_API_KEY=%s\n' "${canonical}"
+  fi
+  if [[ "${INPUT_EXPORT_NVIDIA_API_KEY:-false}" == "true" && -n "${public_alias}" ]]; then
+    printf 'NVIDIA_API_KEY=%s\n' "${public_alias}"
+  fi
+} >>"${GITHUB_ENV}"

.github/workflows/e2e-script.yaml

@@ -62,6 +62,11 @@ on:
         required: false
         type: boolean
         default: false
+      nvidia_api_key_alias:
+        description: Emit NVIDIA_API_KEY compatibility alias for documented legacy shell consumers.
+        required: false
+        type: boolean
+        default: false
       brave_api_key:
         description: Pass the BRAVE_API_KEY secret to the script.
         required: false
@@ -80,6 +85,8 @@ on:
     secrets:
       NVIDIA_INFERENCE_API_KEY:
         required: false
+      NVIDIA_API_KEY:
+        required: false
       BRAVE_API_KEY:
         required: false
       DOCKERHUB_USERNAME:
@@ -143,6 +150,7 @@ jobs:
         with:
           ref: ${{ github.ref }}
           sparse-checkout: |
+            .github/actions/export-e2e-hosted-inference
             .github/actions/run-e2e-script
           path: workflow-actions
           persist-credentials: false
@@ -214,26 +222,11 @@ jobs:
 
       - name: Export hosted CI inference environment
         if: ${{ inputs.nvidia_api_key }}
-        env:
-          NVIDIA_INFERENCE_API_KEY: ${{ secrets.NVIDIA_INFERENCE_API_KEY }}
-        shell: bash
-        run: |
-          set -euo pipefail
-
-          if [ -z "${NVIDIA_INFERENCE_API_KEY:-}" ]; then
-            echo "::error::NVIDIA_INFERENCE_API_KEY secret is required for hosted CI inference; it is withheld for workflow_dispatch target_ref runs." >&2
-            exit 1
-          fi
-
-          {
-            printf 'NEMOCLAW_E2E_USE_HOSTED_INFERENCE=1\n'
-            printf 'NEMOCLAW_PROVIDER=custom\n'
-            printf 'NEMOCLAW_ENDPOINT_URL=https://inference-api.nvidia.com/v1\n'
-            printf 'NEMOCLAW_MODEL=nvidia/nvidia/nemotron-3-super-v3\n'
-            printf 'NEMOCLAW_COMPAT_MODEL=nvidia/nvidia/nemotron-3-super-v3\n'
-            printf 'NEMOCLAW_PREFERRED_API=openai-completions\n'
-            printf 'COMPATIBLE_API_KEY=%s\n' "${NVIDIA_INFERENCE_API_KEY}"
-          } >> "$GITHUB_ENV"
+        uses: ./workflow-actions/.github/actions/export-e2e-hosted-inference
+        with:
+          nvidia-inference-api-key: ${{ secrets.NVIDIA_INFERENCE_API_KEY }}
+          nvidia-api-key: ${{ secrets.NVIDIA_API_KEY }}
+          export-nvidia-api-key: ${{ inputs.nvidia_api_key_alias }}
 
       - name: Run E2E script
         uses: ./workflow-actions/.github/actions/run-e2e-script
@@ -248,7 +241,6 @@ jobs:
         env:
           BRAVE_API_KEY: ${{ inputs.brave_api_key && secrets.BRAVE_API_KEY || '' }}
           GITHUB_TOKEN: ${{ inputs.github_token && github.token || '' }}
-          NVIDIA_INFERENCE_API_KEY: ${{ inputs.nvidia_api_key && secrets.NVIDIA_INFERENCE_API_KEY || '' }}
           TELEGRAM_BOT_TOKEN_REAL: ${{ inputs.messaging_live_secrets && secrets.TELEGRAM_BOT_TOKEN_REAL || '' }}
           TELEGRAM_CHAT_ID_E2E: ${{ inputs.messaging_live_secrets && secrets.TELEGRAM_CHAT_ID_E2E || '' }}
           DISCORD_BOT_TOKEN_REAL: ${{ inputs.messaging_live_secrets && secrets.DISCORD_BOT_TOKEN_REAL || '' }}