fix(hermes): remove stale openclaw state dir - #5882
Merged
Merged
Conversation
Signed-off-by: Aaron Erickson <aerickson@nvidia.com>
Contributor
|
No actionable comments were generated in the recent review. 🎉 ℹ️ Recent review info⚙️ Run configurationConfiguration used: Path: .coderabbit.yaml Review profile: CHILL Plan: Enterprise Run ID: 📒 Files selected for processing (1)
🚧 Files skipped from review as they are similar to previous changes (1)
📝 WalkthroughWalkthroughHermes now validates stale ChangesHermes OpenClaw cleanup
Estimated code review effort🎯 4 (Complex) | ⏱️ ~60 minutes Suggested labels
Suggested reviewers
🚥 Pre-merge checks | ✅ 4 | ❌ 1❌ Failed checks (1 warning)
✅ Passed checks (4 passed)
✨ Finishing Touches🧪 Generate unit tests (beta)
Comment |
Contributor
Code Coverage OverviewLanguages: TypeScript TypeScript / code-coverage/pluginThe overall coverage in the Show a code coverage summary of the most covered files.
TypeScript / code-coverage/cliThe overall coverage in the Show a code coverage summary of the most covered files.
Updated |
Contributor
PR Review Advisor — No blocking findingsMerge posture: No blocking advisor findings This is an automated, non-binding review; it still expects maintainers and agents to respond to each required or warning item. Treat suggestions as current-PR improvements when they touch changed code; defer only with maintainer rationale or a linked follow-up. A human maintainer must make the final merge decision. |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
Contributor
There was a problem hiding this comment.
🧹 Nitpick comments (1)
test/sandbox-provisioning.test.ts (1)
1308-1312: 📐 Maintainability & Code Quality | 🔵 Trivial | ⚡ Quick winConsider covering the symlink fail-closed branch too.
The fixture seeds
.openclawas a regular directory, so only the happy-path removal is exercised. The Dockerfile's security-relevantif [ -L "$openclaw_dir" ]; ... exit 1branch (a symlinked stale state must abort the build) is never tested, so a regression that follows the symlink could go unnoticed. A second scenario that seeds.openclawas a symlink and asserts the run fails would lock down that behavior.Want me to draft the symlink-rejection test case?
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@test/sandbox-provisioning.test.ts` around lines 1308 - 1312, Add a second sandbox-provisioning test scenario in test/sandbox-provisioning.test.ts that seeds .openclaw as a symlink instead of a normal directory and verifies the build/run fails closed. Reuse the existing sandbox fixture setup around precreateStaleOpenclaw, but create the symlinked stale state and assert the Dockerfile path that checks if [ -L "$openclaw_dir" ] exits with an error, so the symlink-rejection branch is covered alongside the current happy-path removal case.
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Nitpick comments:
In `@test/sandbox-provisioning.test.ts`:
- Around line 1308-1312: Add a second sandbox-provisioning test scenario in
test/sandbox-provisioning.test.ts that seeds .openclaw as a symlink instead of a
normal directory and verifies the build/run fails closed. Reuse the existing
sandbox fixture setup around precreateStaleOpenclaw, but create the symlinked
stale state and assert the Dockerfile path that checks if [ -L "$openclaw_dir" ]
exits with an error, so the symlink-rejection branch is covered alongside the
current happy-path removal case.
ℹ️ Review info
⚙️ Run configuration
Configuration used: Path: .coderabbit.yaml
Review profile: CHILL
Plan: Enterprise
Run ID: 17f63828-3104-4974-ae4a-da0f432bf095
📒 Files selected for processing (2)
agents/hermes/Dockerfiletest/sandbox-provisioning.test.ts
Contributor
E2E Advisor RecommendationRequired E2E: Dispatch hint: Full advisor summaryE2E Recommendation AdvisorBase: Required E2E
Optional E2E
New E2E recommendations
Dispatch hint
|
Contributor
Vitest E2E Scenario RecommendationRequired Vitest E2E scenarios: None Full Vitest E2E advisor summaryVitest E2E Scenario AdvisorBase: Required Vitest E2E scenarios
Optional Vitest E2E scenarios
Relevant changed files
|
Contributor
PR Review Advisor (Nemotron Ultra) — Changes requestedMerge posture: Do not merge yet Action checklist
Findings index
🚨 Required before mergeAddress these before merging unless a maintainer explicitly overrides the advisor with rationale.
|
Contributor
Selective E2E Results — ✅ All requested jobs passedRun: 28261421550
|
Contributor
Selective E2E Results —
|
| Job | Result |
|---|---|
| channels-add-remove-e2e | |
| hermes-discord-e2e | |
| messaging-providers-e2e | |
| onboard-negative-paths-e2e |
Signed-off-by: Aaron Erickson <aerickson@nvidia.com>
Signed-off-by: Aaron Erickson <aerickson@nvidia.com>
Signed-off-by: Aaron Erickson <aerickson@nvidia.com>
Signed-off-by: Aaron Erickson <aerickson@nvidia.com>
Signed-off-by: Aaron Erickson <aerickson@nvidia.com>
Contributor
Selective E2E Results — ✅ All requested jobs passedRun: 28266450648
|
Contributor
Selective E2E Results — ✅ All requested jobs passedRun: 28266673637
|
Signed-off-by: Aaron Erickson <aerickson@nvidia.com>
Signed-off-by: Aaron Erickson <aerickson@nvidia.com>
Contributor
There was a problem hiding this comment.
🧹 Nitpick comments (3)
scripts/verify-hermes-stale-openclaw-image.sh (1)
90-97: 🩺 Stability & Availability | 🔵 Trivial | ⚡ Quick winAvoid dropping
errexitfor the expected-failure build.Capture the non-zero
docker buildwith anifinstead of togglingset +e; that keeps the script fail-fast if anything else gets added to this block later. As per path instructions, the workflow docs call for Bash hardening with explicit error handling.Suggested change
- set +e - docker build -f "${REPO_ROOT}/agents/hermes/Dockerfile" \ - --build-arg "BASE_IMAGE=${STALE_LINK_BASE}" \ - -t "$STALE_LINK_IMAGE" \ - "$REPO_ROOT" \ - >"$SYMLINK_BUILD_LOG" 2>&1 - local status="$?" - set -e - - if [ "$status" -eq 0 ]; then + if docker build -f "${REPO_ROOT}/agents/hermes/Dockerfile" \ + --build-arg "BASE_IMAGE=${STALE_LINK_BASE}" \ + -t "$STALE_LINK_IMAGE" \ + "$REPO_ROOT" \ + >"$SYMLINK_BUILD_LOG" 2>&1; then cat "$SYMLINK_BUILD_LOG" >&2 fail "Hermes final image unexpectedly built from stale-symlink base" fi🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@scripts/verify-hermes-stale-openclaw-image.sh` around lines 90 - 97, The expected-failure build in verify-hermes-stale-openclaw-image.sh is disabling errexit with set +e, which weakens fail-fast behavior for the whole block. Update the docker build handling in the stale image check to use an explicit if around docker build (capturing the non-zero status from that command only) and remove the temporary errexit toggle so the script remains hardened if more commands are added later.Sources: Path instructions, Linters/SAST tools
test/pr-workflow-contract.test.ts (1)
641-649: 📐 Maintainability & Code Quality | 🔵 Trivial | ⚡ Quick winCover the failure-log artifact step in this contract test too.
The workflow change also adds failure diagnostics, but this test only locks in the runner and main script path. Add an assertion for the upload-artifact step so regressions to the log-upload contract get caught here as well. As per path instructions, failure diagnostics should upload scoped logs with
if-no-files-found: ignore.Suggested change
it("runs Hermes stale OpenClaw image validation in self-hosted PR CI", () => { const job = prSelfHostedWorkflow.jobs["build-hermes-stale-openclaw-image"]; const runs = stepRuns(job).join("\n"); + const uploadStep = (job.steps ?? []).find( + (step) => step.name === "Upload Hermes stale OpenClaw image log on failure", + ); expect(job["runs-on"]).toBe("linux-amd64-cpu4"); expect(job["timeout-minutes"]).toBe(30); expect(stepUses(job)).toContain("./.github/actions/resolve-hermes-base-image"); expect(runs).toContain("bash scripts/verify-hermes-stale-openclaw-image.sh"); + expect(uploadStep?.if).toBe("failure()"); + expect(uploadStep?.uses).toBe( + "actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a", + ); + expect(uploadStep?.with?.["if-no-files-found"]).toBe("ignore"); });🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@test/pr-workflow-contract.test.ts` around lines 641 - 649, The contract test for build-hermes-stale-openclaw-image only checks the runner and main verification script, so it misses the new failure-log upload behavior. Update the test around prSelfHostedWorkflow.jobs["build-hermes-stale-openclaw-image"] and stepRuns/stepUses to also assert the upload-artifact step is present and configured for scoped logs with if-no-files-found set to ignore. Use the existing job inspection helpers in this test file to locate the artifact step and lock in the log-upload contract.Source: Path instructions
.github/workflows/pr-self-hosted.yaml (1)
94-95: 🔒 Security & Privacy | 🔵 Trivial | ⚡ Quick winDisable checkout credential persistence for this job.
This job only needs the workspace contents, so keeping the default persisted token is unnecessary. Setting
persist-credentials: falsealigns with the workflow guidance to avoid passing tokens unless needed. As per path instructions, “avoid passingGITHUB_TOKENunless needed”; the zizmor hint here is pointing at that same gap.Suggested change
- name: Checkout uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3 + with: + persist-credentials: false🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In @.github/workflows/pr-self-hosted.yaml around lines 94 - 95, The Checkout step in the self-hosted workflow is persisting credentials unnecessarily; update the actions/checkout usage in this job to disable credential persistence. Keep the workspace checkout behavior the same, but set persist-credentials to false on the Checkout step so the job does not retain the default token.Sources: Path instructions, Linters/SAST tools
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Nitpick comments:
In @.github/workflows/pr-self-hosted.yaml:
- Around line 94-95: The Checkout step in the self-hosted workflow is persisting
credentials unnecessarily; update the actions/checkout usage in this job to
disable credential persistence. Keep the workspace checkout behavior the same,
but set persist-credentials to false on the Checkout step so the job does not
retain the default token.
In `@scripts/verify-hermes-stale-openclaw-image.sh`:
- Around line 90-97: The expected-failure build in
verify-hermes-stale-openclaw-image.sh is disabling errexit with set +e, which
weakens fail-fast behavior for the whole block. Update the docker build handling
in the stale image check to use an explicit if around docker build (capturing
the non-zero status from that command only) and remove the temporary errexit
toggle so the script remains hardened if more commands are added later.
In `@test/pr-workflow-contract.test.ts`:
- Around line 641-649: The contract test for build-hermes-stale-openclaw-image
only checks the runner and main verification script, so it misses the new
failure-log upload behavior. Update the test around
prSelfHostedWorkflow.jobs["build-hermes-stale-openclaw-image"] and
stepRuns/stepUses to also assert the upload-artifact step is present and
configured for scoped logs with if-no-files-found set to ignore. Use the
existing job inspection helpers in this test file to locate the artifact step
and lock in the log-upload contract.
ℹ️ Review info
⚙️ Run configuration
Configuration used: Path: .coderabbit.yaml
Review profile: CHILL
Plan: Enterprise
Run ID: 31bdd849-306f-4986-8c2d-35075e4b0d87
📒 Files selected for processing (4)
.github/workflows/pr-self-hosted.yamlagents/hermes/Dockerfilescripts/verify-hermes-stale-openclaw-image.shtest/pr-workflow-contract.test.ts
Signed-off-by: Aaron Erickson <aerickson@nvidia.com>
Contributor
Selective E2E Results — ✅ All requested jobs passedRun: 28269063627
|
Contributor
Selective E2E Results — ✅ All requested jobs passedRun: 28269247005
|
Signed-off-by: Aaron Erickson <aerickson@nvidia.com>
Signed-off-by: Aaron Erickson <aerickson@nvidia.com>
Signed-off-by: Aaron Erickson <aerickson@nvidia.com>
Signed-off-by: Aaron Erickson <aerickson@nvidia.com>
Contributor
There was a problem hiding this comment.
Actionable comments posted: 1
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In `@test/hermes-stale-openclaw-guard.test.ts`:
- Around line 16-39: The helper dockerRunCommandContaining in the test file is
introducing extra if statements that trip the test-conditionals:scan check. Move
this parsing logic into a non-.test.ts utility module and keep the test focused
on assertions, or rewrite the helper to avoid the new conditionals entirely
while preserving the same behavior. Use dockerRunCommandContaining as the main
symbol to relocate or simplify.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Path: .coderabbit.yaml
Review profile: CHILL
Plan: Enterprise
Run ID: a6b14f8b-c579-449d-bada-95c439bee434
📒 Files selected for processing (5)
.github/actions/resolve-hermes-base-image/action.yamlagents/hermes/Dockerfilescripts/verify-hermes-stale-openclaw-image.shtest/hermes-stale-openclaw-guard.test.tstest/pr-workflow-contract.test.ts
🚧 Files skipped from review as they are similar to previous changes (2)
- agents/hermes/Dockerfile
- scripts/verify-hermes-stale-openclaw-image.sh
Contributor
Selective E2E Results —
|
| Job | Result |
|---|---|
| hermes-root-entrypoint-smoke-e2e |
Signed-off-by: Aaron Erickson <aerickson@nvidia.com>
Signed-off-by: Aaron Erickson <aerickson@nvidia.com>
Contributor
Selective E2E Results — ❌ Some jobs failedRun: 28272918335
|
Signed-off-by: Aaron Erickson <aerickson@nvidia.com>
Contributor
Author
|
@coderabbitai review |
Contributor
✅ Action performedReview finished.
|
Contributor
There was a problem hiding this comment.
🧹 Nitpick comments (2)
test/helpers/hermes-dockerfile-run.ts (1)
77-97: 📐 Maintainability & Code Quality | 🔵 Trivial | ⚡ Quick winMake
dockerRunCommandContaining()find the enclosingRUN, not one exact prologue.Line 82 only matches
RUN set -eu;, so a harmless Dockerfile change likeset -euo pipefailwill break these guard tests even if the target signature is still in the sameRUNblock.Suggested change
export function dockerRunCommandContaining(dockerfile: string, signature: string): string { const signatureIndex = dockerfile.indexOf(signature); if (signatureIndex === -1) { throw new Error(`Expected Dockerfile RUN signature: ${signature}`); } - const runIndex = dockerfile.lastIndexOf("RUN set -eu;", signatureIndex); - if (runIndex === -1) { + const previousRunIndex = dockerfile.lastIndexOf("\nRUN ", signatureIndex); + const runIndex = + previousRunIndex === -1 && dockerfile.startsWith("RUN ") + ? 0 + : previousRunIndex + 1; + if (runIndex <= 0 && !dockerfile.startsWith("RUN ")) { throw new Error(`Expected RUN instruction before ${signature}`); } const linesAfterRun = dockerfile.slice(runIndex).split("\n");🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@test/helpers/hermes-dockerfile-run.ts` around lines 77 - 97, dockerRunCommandContaining() is too strict because it only searches for the exact prologue "RUN set -eu;" before the target signature, so valid Dockerfile variations can fail. Update the helper to locate the enclosing RUN instruction more flexibly by identifying the nearest preceding RUN block around the signature, rather than matching one exact shell prefix; keep the behavior in dockerRunCommandContaining() and its related parsing logic intact.test/hermes-stale-openclaw-guard.test.ts (1)
23-46: 📐 Maintainability & Code Quality | 🔵 Trivial | ⚡ Quick winReuse
runDockerShell()here so root-only commands stay mocked.This test hand-rolls its own Bash wrapper, so it drops the helper’s
chownstub. If the cleanup block ever moves a privileged step before the digest check, this assertion will start failing for permissions instead of the digest guard.Suggested change
- const script = [ - "#!/usr/bin/env bash", - "set -euo pipefail", - `BASE_IMAGE=${JSON.stringify(`ghcr.io/nvidia/nemoclaw/hermes-sandbox-base@${DIFFERENT_DIGEST}`)}`, - `NEMOCLAW_STALE_OPENCLAW_BASE_DIGEST=${JSON.stringify(STALE_DIGEST)}`, - cleanupCommand.replaceAll("/sandbox", sandboxRoot), - ].join("\n"); - const scriptPath = path.join(tmp, "run-cleanup.sh"); fs.mkdirSync(sandboxRoot, { recursive: true }); - fs.writeFileSync(scriptPath, script, { mode: 0o700 }); try { - const result = spawnSync("bash", [scriptPath], { encoding: "utf-8", timeout: 5000 }); + const { result } = runDockerShell( + [ + `BASE_IMAGE=${JSON.stringify(`ghcr.io/nvidia/nemoclaw/hermes-sandbox-base@${DIFFERENT_DIGEST}`)}`, + `NEMOCLAW_STALE_OPENCLAW_BASE_DIGEST=${JSON.stringify(STALE_DIGEST)}`, + cleanupCommand, + ].join("; "), + sandboxRoot, + ); expect(result.status).toBe(1); expect(result.stderr).toContain("remove stale Hermes .openclaw cleanup or update"); expect(result.stderr).toContain(DIFFERENT_DIGEST);🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@test/hermes-stale-openclaw-guard.test.ts` around lines 23 - 46, The stale digest guard test is bypassing the shared Docker shell mock setup by hand-rolling its own Bash wrapper, which leaves root-only commands like chown unstubbed. Update the Hermes stale cleanup test to use runDockerShell() and its existing mocking behavior, while still injecting the BASE_IMAGE and NEMOCLAW_STALE_OPENCLAW_BASE_DIGEST values and asserting the digest-guard failure through dockerRunCommandContaining and STALE_CLEANUP_SIGNATURE.
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Nitpick comments:
In `@test/helpers/hermes-dockerfile-run.ts`:
- Around line 77-97: dockerRunCommandContaining() is too strict because it only
searches for the exact prologue "RUN set -eu;" before the target signature, so
valid Dockerfile variations can fail. Update the helper to locate the enclosing
RUN instruction more flexibly by identifying the nearest preceding RUN block
around the signature, rather than matching one exact shell prefix; keep the
behavior in dockerRunCommandContaining() and its related parsing logic intact.
In `@test/hermes-stale-openclaw-guard.test.ts`:
- Around line 23-46: The stale digest guard test is bypassing the shared Docker
shell mock setup by hand-rolling its own Bash wrapper, which leaves root-only
commands like chown unstubbed. Update the Hermes stale cleanup test to use
runDockerShell() and its existing mocking behavior, while still injecting the
BASE_IMAGE and NEMOCLAW_STALE_OPENCLAW_BASE_DIGEST values and asserting the
digest-guard failure through dockerRunCommandContaining and
STALE_CLEANUP_SIGNATURE.
ℹ️ Review info
⚙️ Run configuration
Configuration used: Path: .coderabbit.yaml
Review profile: CHILL
Plan: Enterprise
Run ID: 85723319-7b5d-43bc-b4a8-7e7ee2f72278
📒 Files selected for processing (7)
.github/actions/resolve-hermes-base-image/action.yamlagents/hermes/Dockerfilescripts/verify-hermes-stale-openclaw-image.shtest/helpers/hermes-dockerfile-run.tstest/hermes-stale-openclaw-guard.test.tstest/pr-workflow-contract.test.tstest/sandbox-provisioning.test.ts
🚧 Files skipped from review as they are similar to previous changes (4)
- .github/actions/resolve-hermes-base-image/action.yaml
- test/pr-workflow-contract.test.ts
- agents/hermes/Dockerfile
- test/sandbox-provisioning.test.ts
Signed-off-by: Aaron Erickson <aerickson@nvidia.com>
Contributor
Selective E2E Results — ❌ Some jobs failedRun: 28273631331
|
Contributor
Author
|
@coderabbitai review |
Contributor
✅ Action performedReview finished.
|
ericksoa
added
bug-fix
cv
approved these changes
Jun 27, 2026
cv
enabled auto-merge (squash)
June 28, 2026 18:25
This was referenced Jun 28, 2026
cv
added a commit
that referenced
this pull request
Jun 29, 2026
<!-- markdownlint-disable MD041 --> ## Summary Advance the default Hermes final-image base to the newly published post-stale-layout digest and retire the temporary digest-coupled repair that intentionally rejected newer published bases. This restores Hermes onboarding and live E2E builds after the `latest` base moved, while keeping current-state fail-closed layout checks and the older `.hermes-data` compatibility migration. ## Related Issue Unblocks #5947. Follow-up to #5882. ## Changes - Pin the default Hermes base to `sha256:8dad3b989a9ed1e601743310b97be21be5f59f89f7913a47d04f3ec3c40b8ce6`, whose published ARM64 image has neither `/sandbox/.openclaw` nor `/sandbox/.hermes-data`. - Remove the fired `NEMOCLAW_STALE_OPENCLAW_BASE_DIGEST` guard and temporary `/sandbox/.openclaw` repair; replace it with a small fail-closed invariant that rejects retired OpenClaw state rather than maintaining it. - Keep published-image provenance in the resolver: export immutable official GHCR digests and reject candidates containing `.openclaw` or `.hermes-data` state, while preserving local rebuild and caller-selected base refs in the final Dockerfile. - Delete the dedicated stale-layout verifier job, script, helpers, and tests now that their documented removal trigger has fired. - Add a focused final-image layout suite covering OpenClaw-state refusal, the retained `.hermes-data` migration, and symlink refusal; keep immutable published-ref coverage at the resolver boundary and extend live secret-boundary inspection to both retired paths. - Reject nested symlinks before copying retained `.hermes-data` compatibility state so migration cannot preserve links outside the legacy tree. ## Type of Change - [x] Code change (feature, bug fix, or refactor) - [ ] Code change with doc updates - [ ] Doc only (prose changes, no code sample modifications) - [ ] Doc only (includes code sample changes) ## Quality Gates <!-- Check all that apply. For any "covered by existing tests", "not applicable", or waiver entry, add a brief justification on the same line or in the Changes section. --> - [x] Tests added or updated for changed behavior - [ ] Existing tests cover changed behavior — justification: - [ ] Tests not applicable — justification: - [ ] Docs updated for user-facing behavior changes - [x] Docs not applicable — justification: internal published-image lifecycle cleanup; CLI behavior, configuration, supported workflows, and the documented Hermes state location are unchanged. - [x] Sensitive paths changed (security, policy, credentials, preflight, onboarding, inference, runner, sandbox, or messaging) - [ ] Sensitive-path review completed or maintainer-approved waiver recorded — reviewer/approval link/justification: pending independent review of the Hermes sandbox image boundary. - [ ] Non-success, skipped, or missing CI check accepted by maintainer — check name, approval link, and follow-up issue: ## Verification <!-- Check each item you ran and confirmed. Leave unchecked items you skipped. Doc-only changes do not require npm test unless you ran it. --> - [x] PR description includes the DCO sign-off declaration and every commit appears as `Verified` in GitHub - [x] Git hooks passed during commit and push, or `npx prek run --from-ref main --to-ref HEAD` passes - [x] Targeted tests pass for changed behavior - [ ] Full `npm test` passes (broad runtime changes only) - [ ] Quality Gates section completed with required justifications or waivers - [x] No secrets, API keys, or credentials committed - [ ] `npm run docs` builds without warnings (doc changes only) - [ ] Doc pages follow the [style guide](https://github.com/NVIDIA/NemoClaw/blob/main/docs/CONTRIBUTING.md) (doc changes only) - [ ] New doc pages include SPDX header and frontmatter (new pages only) Verification evidence: - Pulled and inspected the published ARM64 `8dad…` image; `/sandbox/.openclaw` and `/sandbox/.hermes-data` are absent. - Built `agents/hermes/Dockerfile` against the exact `8dad…` digest and verified sandbox-user readability, runtime permissions, runtime symlinks, and absence of both stale paths. - Focused integration run passed 61 tests across `hermes-final-image-layout`, `hermes-doctor-config-hash`, `pr-workflow-contract`, and `sandbox-provisioning`. - `npm run build:cli`, `npm run typecheck:cli`, `npm run checks`, and `npm run test:projects:check` passed. - Normal commit and push hooks passed for all commits, including the full CLI test lane, shellcheck, hadolint, repository checks, source-shape and test-size budgets, gitleaks, commitlint, and CLI TypeScript checks. - [Vitest E2E run 28339846140](https://github.com/NVIDIA/NemoClaw/actions/runs/28339846140) passed Hermes install/inference, root entrypoint, and secret-boundary jobs, then exposed that Dockerfile-level registry validation rejected the forced local `:latest` base-cache rebuild. Commit `ce85e762a` moves provenance back to the resolver boundary; [exact-head rerun 28340627350](https://github.com/NVIDIA/NemoClaw/actions/runs/28340627350) passed all four jobs, including stale-base rebuild. - Downloaded exact-head artifacts have no credential-shaped matches; every command result in the rebuild artifact is zero, post-rebuild inference returned `PONG`, backup scanning found no leaks, and all scenario cleanups report no failures. - Required documentation writer assessment, rerun after the fail-closed review fixes, reported no user-facing docs changes needed. --- <!-- DCO sign-off is required in this PR description, and every commit must appear as Verified in GitHub. Run: git config user.name && git config user.email --> Signed-off-by: Carlos Villela <cvillela@nvidia.com> --------- Signed-off-by: Carlos Villela <cvillela@nvidia.com>
21 tasks
jyaunches
pushed a commit
that referenced
this pull request
Jun 30, 2026
## Summary Refreshes the v0.0.70 release docs from the release announcement and the `v0.0.69..v0.0.70` commit range. It also documents the `channels start` policy restoration behavior that was missing from the shared OpenClaw and Hermes command references, and bumps the Fern CLI version used for docs validation. ## Changes - Replaced the stale `v0.0.70` release-notes entry with the actual release themes, including CLI, onboarding, inference, messaging, Windows, documentation, and release-validation changes. - Documented that `channels start` reapplies the matching built-in network policy preset before rebuild and rolls back to disabled if policy restoration fails. - Bumped `fern/fern.config.json` from `5.55.0` to `5.59.0` for the docs refresh. - Source summary: - #5754 -> `docs/about/release-notes.mdx`: Notes Docker Desktop gateway bridge retry behavior during onboarding. - #5930 -> `docs/about/release-notes.mdx`: Links `nemoclaw use` default sandbox selection to the command reference. - #5948 -> `docs/about/release-notes.mdx`: Links reasoning-compatible endpoint validation to inference documentation. - #5950 -> `docs/about/release-notes.mdx`: Links Windows bootstrap WSL recovery behavior to Windows preparation and troubleshooting docs. - #5856 -> `docs/about/release-notes.mdx`: Notes rebuilt policy preset registry repair. - #5882 and #5949 -> `docs/about/release-notes.mdx`: Notes Hermes stale base-image state repair. - #6016 -> `docs/reference/commands.mdx`, `docs/reference/commands-nemohermes.mdx`, and `docs/manage-sandboxes/messaging-channels.mdx`: Documents channel policy restoration and rollback on `channels start`. - #5859 -> `docs/about/release-notes.mdx`: Links quickstart network approval guidance. - #5863 -> `docs/about/release-notes.mdx`: Links Teams allowlist guidance in the messaging page. - #5756, #5926, #6010, and #6011 -> `docs/about/release-notes.mdx`: Summarizes the Vitest E2E validation cutover. ## Type of Change - [ ] Code change (feature, bug fix, or refactor) - [ ] Code change with doc updates - [x] Doc only (prose changes, no code sample modifications) - [ ] Doc only (includes code sample changes) ## Quality Gates - [ ] Tests added or updated for changed behavior - [ ] Existing tests cover changed behavior — justification: - [x] Tests not applicable — justification: doc-only prose refresh with no runtime behavior change. - [x] Docs updated for user-facing behavior changes - [ ] Docs not applicable — justification: - [ ] Sensitive paths changed (security, policy, credentials, preflight, onboarding, inference, runner, sandbox, or messaging) - [ ] Sensitive-path review completed or maintainer-approved waiver recorded — reviewer/approval link/justification: - [ ] Non-success, skipped, or missing CI check accepted by maintainer — check name, approval link, and follow-up issue: ## Verification - [x] PR description includes the DCO sign-off declaration and every commit appears as `Verified` in GitHub - [x] Git hooks passed during commit and push, or `npx prek run --from-ref main --to-ref HEAD` passes - [ ] Targeted tests pass for changed behavior - [ ] Full `npm test` passes (broad runtime changes only) - [x] Quality Gates section completed with required justifications or waivers - [x] No secrets, API keys, or credentials committed - [ ] `npm run docs` builds without warnings (doc changes only) - [x] Doc pages follow the [style guide](https://github.com/NVIDIA/NemoClaw/blob/main/docs/CONTRIBUTING.md) (doc changes only) - [ ] New doc pages include SPDX header and frontmatter (new pages only) `npm run docs` exited 0 and Fern reported one existing light-mode accent contrast warning. `fern check --warnings` confirmed the warning is the site theme contrast ratio, not content introduced by this PR. --- Signed-off-by: Miyoung Choi <miyoungc@nvidia.com>
Hadar301
pushed a commit
to Hadar301/NemoClaw-OpenShift
that referenced
this pull request
Jul 12, 2026
## Summary Hermes final image layout cleanup now removes inherited `/sandbox/.openclaw` state from stale Hermes base images. `Dockerfile.base` remains the source of truth for new base-image layout; this final-image repair only covers invalid `.openclaw` state already baked into older published Hermes base layers, where runtime migration cannot depend on root privileges after OpenShell starts the sandbox as the sandbox user. The `.openclaw` cleanup can be removed once the minimum supported Hermes base digest is newer than the stale layout. ## Changes - Remove stale `/sandbox/.openclaw` during Hermes final-image layout repair. - Reject symlinked stale OpenClaw state before cleanup and assert the path is gone afterward. - Enforce the stale-layout workaround removal trigger by checking the default published Hermes base digest at build time. - Add `scripts/verify-hermes-stale-openclaw-image.sh` plus a self-hosted PR CI job that builds real synthetic stale-directory and stale-symlink Hermes base images, validates the final-image runtime layout, and proves the symlink path fails closed. - Harden the new self-hosted validation job by disabling checkout credential persistence and validating the verifier's resolved base-image input. - Keep existing Hermes provisioning coverage verifying stale `.openclaw` removal while Hermes state permissions remain correct. ## Type of Change - [x] Code change (feature, bug fix, or refactor) - [ ] Code change with doc updates - [ ] Doc only (prose changes, no code sample modifications) - [ ] Doc only (includes code sample changes) ## Quality Gates - [x] Tests added or updated for changed behavior - [ ] Existing tests cover changed behavior — justification: - [ ] Tests not applicable — justification: - [ ] Docs updated for user-facing behavior changes - [x] Docs not applicable — justification: internal Hermes image layout cleanup; no user-facing behavior or commands changed. - [x] Sensitive paths changed (security, policy, credentials, preflight, onboarding, inference, runner, sandbox, or messaging) - [x] Sensitive-path review completed or maintainer-approved waiver recorded — reviewer/approval link/justification: author self-review; cleanup refuses symlinked `/sandbox/.openclaw`, removes only stale non-symlink `.openclaw` state baked into older Hermes base images, asserts removal, adds a default-base digest gate for workaround removal, and does not expand credential, policy, or runtime egress behavior. - [ ] Non-success, skipped, or missing CI check accepted by maintainer — check name, approval link, and follow-up issue: ## Verification - [x] PR description includes the DCO sign-off declaration and every commit appears as `Verified` in GitHub - [ ] Git hooks passed during commit and push, or `npx prek run --from-ref main --to-ref HEAD` passes - [x] Targeted tests pass for changed behavior - [ ] Full `npm test` passes (broad runtime changes only) - [x] Quality Gates section completed with required justifications or waivers - [x] No secrets, API keys, or credentials committed - [ ] `npm run docs` builds without warnings (doc changes only) - [ ] Doc pages follow the [style guide](https://github.com/NVIDIA/NemoClaw/blob/main/docs/CONTRIBUTING.md) (doc changes only) - [ ] New doc pages include SPDX header and frontmatter (new pages only) Verification commands run: - `bash -n scripts/verify-hermes-stale-openclaw-image.sh` - `shellcheck scripts/verify-hermes-stale-openclaw-image.sh` - `npx prek run --all-files --stage pre-push --skip tsc-plugin --skip tsc-js --skip tsc-cli --skip version-tag-sync --skip test-cli --skip test-plugin --skip source-shape-test-budget --skip test-file-size-budget --skip test-skills-yaml` - `NEMOCLAW_HERMES_BASE_IMAGE=ghcr.io/nvidia/nemoclaw/hermes-sandbox-base@sha256:60333c1982ad855d55887b4488e867eb343f3930a30aa8e0268e5397fc6f2926 bash scripts/verify-hermes-stale-openclaw-image.sh` - `npm test -- test/hermes-doctor-config-hash.test.ts test/pr-workflow-contract.test.ts test/sandbox-provisioning.test.ts` - `npm test -- test/pr-workflow-contract.test.ts test/sandbox-provisioning.test.ts` - `npm run source-shape:check` - `npm run test-size:check` - `npm run test-conditionals:scan -- --top 25` - `git diff --check` - `npm test -- test/sandbox-provisioning.test.ts` - `npm run build:cli` - `npm test -- src/lib/onboard/sandbox-create-launch.test.ts src/lib/onboard/openclaw-runtime-env.test.ts test/hermes-doctor-config-hash.test.ts` - `wc -l test/sandbox-provisioning.test.ts` - `gh api /repos/NVIDIA/NemoClaw/commits/2837307a0 --jq '.commit.verification'` - `gh api /repos/NVIDIA/NemoClaw/commits/98ea6fa72 --jq '.commit.verification'` - `gh api /repos/NVIDIA/NemoClaw/commits/396471a1b --jq '.commit.verification'` - `gh api /repos/NVIDIA/NemoClaw/commits/9c48e0607 --jq '.commit.verification'` - `gh api /repos/NVIDIA/NemoClaw/commits/6e0acc56b --jq '.commit.verification'` - `gh api /repos/NVIDIA/NemoClaw/commits/2ca0288f8 --jq '.commit.verification'` - `gh api /repos/NVIDIA/NemoClaw/commits/989dc46c3 --jq '.commit.verification'` - `gh api /repos/NVIDIA/NemoClaw/commits/f69014248 --jq '.commit.verification'` - `gh api /repos/NVIDIA/NemoClaw/commits/b4bc2a1ab --jq '.commit.verification'` - `gh api /repos/NVIDIA/NemoClaw/commits/060b3f3d2 --jq '.commit.verification'` - `gh api /repos/NVIDIA/NemoClaw/commits/a6d8b17d8 --jq '.commit.verification'` Note: `npx prek run --from-ref origin/main --to-ref HEAD` was started and visible checks passed through gitleaks/markdownlint skip, but the command stopped producing output and was interrupted rather than claimed as passed. --- Signed-off-by: Aaron Erickson <aerickson@nvidia.com> <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **New Features** * Added a self-hosted CI job and a Hermes verifier to validate “stale OpenClaw” cleanup behavior (directory cleanup and symlink detection). * **Bug Fixes** * Strengthened Hermes stale OpenClaw repair/guardrails with digest-based enforcement for supported pinned bases. * Improved Hermes base-image resolution to prefer immutable `image@sha256:` digests when available. * **Tests** * Expanded Hermes stale OpenClaw regression coverage with new provisioning options and reference-guarding assertions. * Updated workflow/contract tests to verify the new job and base resolver behavior. <!-- end of auto-generated comment: release notes by coderabbit.ai --> --------- Signed-off-by: Aaron Erickson <aerickson@nvidia.com> Co-authored-by: Carlos Villela <cvillela@nvidia.com>
Hadar301
pushed a commit
to Hadar301/NemoClaw-OpenShift
that referenced
this pull request
Jul 12, 2026
<!-- markdownlint-disable MD041 --> ## Summary Advance the default Hermes final-image base to the newly published post-stale-layout digest and retire the temporary digest-coupled repair that intentionally rejected newer published bases. This restores Hermes onboarding and live E2E builds after the `latest` base moved, while keeping current-state fail-closed layout checks and the older `.hermes-data` compatibility migration. ## Related Issue Unblocks NVIDIA#5947. Follow-up to NVIDIA#5882. ## Changes - Pin the default Hermes base to `sha256:8dad3b989a9ed1e601743310b97be21be5f59f89f7913a47d04f3ec3c40b8ce6`, whose published ARM64 image has neither `/sandbox/.openclaw` nor `/sandbox/.hermes-data`. - Remove the fired `NEMOCLAW_STALE_OPENCLAW_BASE_DIGEST` guard and temporary `/sandbox/.openclaw` repair; replace it with a small fail-closed invariant that rejects retired OpenClaw state rather than maintaining it. - Keep published-image provenance in the resolver: export immutable official GHCR digests and reject candidates containing `.openclaw` or `.hermes-data` state, while preserving local rebuild and caller-selected base refs in the final Dockerfile. - Delete the dedicated stale-layout verifier job, script, helpers, and tests now that their documented removal trigger has fired. - Add a focused final-image layout suite covering OpenClaw-state refusal, the retained `.hermes-data` migration, and symlink refusal; keep immutable published-ref coverage at the resolver boundary and extend live secret-boundary inspection to both retired paths. - Reject nested symlinks before copying retained `.hermes-data` compatibility state so migration cannot preserve links outside the legacy tree. ## Type of Change - [x] Code change (feature, bug fix, or refactor) - [ ] Code change with doc updates - [ ] Doc only (prose changes, no code sample modifications) - [ ] Doc only (includes code sample changes) ## Quality Gates <!-- Check all that apply. For any "covered by existing tests", "not applicable", or waiver entry, add a brief justification on the same line or in the Changes section. --> - [x] Tests added or updated for changed behavior - [ ] Existing tests cover changed behavior — justification: - [ ] Tests not applicable — justification: - [ ] Docs updated for user-facing behavior changes - [x] Docs not applicable — justification: internal published-image lifecycle cleanup; CLI behavior, configuration, supported workflows, and the documented Hermes state location are unchanged. - [x] Sensitive paths changed (security, policy, credentials, preflight, onboarding, inference, runner, sandbox, or messaging) - [ ] Sensitive-path review completed or maintainer-approved waiver recorded — reviewer/approval link/justification: pending independent review of the Hermes sandbox image boundary. - [ ] Non-success, skipped, or missing CI check accepted by maintainer — check name, approval link, and follow-up issue: ## Verification <!-- Check each item you ran and confirmed. Leave unchecked items you skipped. Doc-only changes do not require npm test unless you ran it. --> - [x] PR description includes the DCO sign-off declaration and every commit appears as `Verified` in GitHub - [x] Git hooks passed during commit and push, or `npx prek run --from-ref main --to-ref HEAD` passes - [x] Targeted tests pass for changed behavior - [ ] Full `npm test` passes (broad runtime changes only) - [ ] Quality Gates section completed with required justifications or waivers - [x] No secrets, API keys, or credentials committed - [ ] `npm run docs` builds without warnings (doc changes only) - [ ] Doc pages follow the [style guide](https://github.com/NVIDIA/NemoClaw/blob/main/docs/CONTRIBUTING.md) (doc changes only) - [ ] New doc pages include SPDX header and frontmatter (new pages only) Verification evidence: - Pulled and inspected the published ARM64 `8dad…` image; `/sandbox/.openclaw` and `/sandbox/.hermes-data` are absent. - Built `agents/hermes/Dockerfile` against the exact `8dad…` digest and verified sandbox-user readability, runtime permissions, runtime symlinks, and absence of both stale paths. - Focused integration run passed 61 tests across `hermes-final-image-layout`, `hermes-doctor-config-hash`, `pr-workflow-contract`, and `sandbox-provisioning`. - `npm run build:cli`, `npm run typecheck:cli`, `npm run checks`, and `npm run test:projects:check` passed. - Normal commit and push hooks passed for all commits, including the full CLI test lane, shellcheck, hadolint, repository checks, source-shape and test-size budgets, gitleaks, commitlint, and CLI TypeScript checks. - [Vitest E2E run 28339846140](https://github.com/NVIDIA/NemoClaw/actions/runs/28339846140) passed Hermes install/inference, root entrypoint, and secret-boundary jobs, then exposed that Dockerfile-level registry validation rejected the forced local `:latest` base-cache rebuild. Commit `ce85e762a` moves provenance back to the resolver boundary; [exact-head rerun 28340627350](https://github.com/NVIDIA/NemoClaw/actions/runs/28340627350) passed all four jobs, including stale-base rebuild. - Downloaded exact-head artifacts have no credential-shaped matches; every command result in the rebuild artifact is zero, post-rebuild inference returned `PONG`, backup scanning found no leaks, and all scenario cleanups report no failures. - Required documentation writer assessment, rerun after the fail-closed review fixes, reported no user-facing docs changes needed. --- <!-- DCO sign-off is required in this PR description, and every commit must appear as Verified in GitHub. Run: git config user.name && git config user.email --> Signed-off-by: Carlos Villela <cvillela@nvidia.com> --------- Signed-off-by: Carlos Villela <cvillela@nvidia.com>
Hadar301
pushed a commit
to Hadar301/NemoClaw-OpenShift
that referenced
this pull request
Jul 12, 2026
## Summary Refreshes the v0.0.70 release docs from the release announcement and the `v0.0.69..v0.0.70` commit range. It also documents the `channels start` policy restoration behavior that was missing from the shared OpenClaw and Hermes command references, and bumps the Fern CLI version used for docs validation. ## Changes - Replaced the stale `v0.0.70` release-notes entry with the actual release themes, including CLI, onboarding, inference, messaging, Windows, documentation, and release-validation changes. - Documented that `channels start` reapplies the matching built-in network policy preset before rebuild and rolls back to disabled if policy restoration fails. - Bumped `fern/fern.config.json` from `5.55.0` to `5.59.0` for the docs refresh. - Source summary: - NVIDIA#5754 -> `docs/about/release-notes.mdx`: Notes Docker Desktop gateway bridge retry behavior during onboarding. - NVIDIA#5930 -> `docs/about/release-notes.mdx`: Links `nemoclaw use` default sandbox selection to the command reference. - NVIDIA#5948 -> `docs/about/release-notes.mdx`: Links reasoning-compatible endpoint validation to inference documentation. - NVIDIA#5950 -> `docs/about/release-notes.mdx`: Links Windows bootstrap WSL recovery behavior to Windows preparation and troubleshooting docs. - NVIDIA#5856 -> `docs/about/release-notes.mdx`: Notes rebuilt policy preset registry repair. - NVIDIA#5882 and NVIDIA#5949 -> `docs/about/release-notes.mdx`: Notes Hermes stale base-image state repair. - NVIDIA#6016 -> `docs/reference/commands.mdx`, `docs/reference/commands-nemohermes.mdx`, and `docs/manage-sandboxes/messaging-channels.mdx`: Documents channel policy restoration and rollback on `channels start`. - NVIDIA#5859 -> `docs/about/release-notes.mdx`: Links quickstart network approval guidance. - NVIDIA#5863 -> `docs/about/release-notes.mdx`: Links Teams allowlist guidance in the messaging page. - NVIDIA#5756, NVIDIA#5926, NVIDIA#6010, and NVIDIA#6011 -> `docs/about/release-notes.mdx`: Summarizes the Vitest E2E validation cutover. ## Type of Change - [ ] Code change (feature, bug fix, or refactor) - [ ] Code change with doc updates - [x] Doc only (prose changes, no code sample modifications) - [ ] Doc only (includes code sample changes) ## Quality Gates - [ ] Tests added or updated for changed behavior - [ ] Existing tests cover changed behavior — justification: - [x] Tests not applicable — justification: doc-only prose refresh with no runtime behavior change. - [x] Docs updated for user-facing behavior changes - [ ] Docs not applicable — justification: - [ ] Sensitive paths changed (security, policy, credentials, preflight, onboarding, inference, runner, sandbox, or messaging) - [ ] Sensitive-path review completed or maintainer-approved waiver recorded — reviewer/approval link/justification: - [ ] Non-success, skipped, or missing CI check accepted by maintainer — check name, approval link, and follow-up issue: ## Verification - [x] PR description includes the DCO sign-off declaration and every commit appears as `Verified` in GitHub - [x] Git hooks passed during commit and push, or `npx prek run --from-ref main --to-ref HEAD` passes - [ ] Targeted tests pass for changed behavior - [ ] Full `npm test` passes (broad runtime changes only) - [x] Quality Gates section completed with required justifications or waivers - [x] No secrets, API keys, or credentials committed - [ ] `npm run docs` builds without warnings (doc changes only) - [x] Doc pages follow the [style guide](https://github.com/NVIDIA/NemoClaw/blob/main/docs/CONTRIBUTING.md) (doc changes only) - [ ] New doc pages include SPDX header and frontmatter (new pages only) `npm run docs` exited 0 and Fern reported one existing light-mode accent contrast warning. `fern check --warnings` confirmed the warning is the site theme contrast ratio, not content introduced by this PR. --- Signed-off-by: Miyoung Choi <miyoungc@nvidia.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
3 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Hermes final image layout cleanup now removes inherited
/sandbox/.openclawstate from stale Hermes base images.Dockerfile.baseremains the source of truth for new base-image layout; this final-image repair only covers invalid.openclawstate already baked into older published Hermes base layers, where runtime migration cannot depend on root privileges after OpenShell starts the sandbox as the sandbox user. The.openclawcleanup can be removed once the minimum supported Hermes base digest is newer than the stale layout.Changes
/sandbox/.openclawduring Hermes final-image layout repair.scripts/verify-hermes-stale-openclaw-image.shplus a self-hosted PR CI job that builds real synthetic stale-directory and stale-symlink Hermes base images, validates the final-image runtime layout, and proves the symlink path fails closed..openclawremoval while Hermes state permissions remain correct.Type of Change
Quality Gates
/sandbox/.openclaw, removes only stale non-symlink.openclawstate baked into older Hermes base images, asserts removal, adds a default-base digest gate for workaround removal, and does not expand credential, policy, or runtime egress behavior.Verification
Verifiedin GitHubnpx prek run --from-ref main --to-ref HEADpassesnpm testpasses (broad runtime changes only)npm run docsbuilds without warnings (doc changes only)Verification commands run:
bash -n scripts/verify-hermes-stale-openclaw-image.shshellcheck scripts/verify-hermes-stale-openclaw-image.shnpx prek run --all-files --stage pre-push --skip tsc-plugin --skip tsc-js --skip tsc-cli --skip version-tag-sync --skip test-cli --skip test-plugin --skip source-shape-test-budget --skip test-file-size-budget --skip test-skills-yamlNEMOCLAW_HERMES_BASE_IMAGE=ghcr.io/nvidia/nemoclaw/hermes-sandbox-base@sha256:60333c1982ad855d55887b4488e867eb343f3930a30aa8e0268e5397fc6f2926 bash scripts/verify-hermes-stale-openclaw-image.shnpm test -- test/hermes-doctor-config-hash.test.ts test/pr-workflow-contract.test.ts test/sandbox-provisioning.test.tsnpm test -- test/pr-workflow-contract.test.ts test/sandbox-provisioning.test.tsnpm run source-shape:checknpm run test-size:checknpm run test-conditionals:scan -- --top 25git diff --checknpm test -- test/sandbox-provisioning.test.tsnpm run build:clinpm test -- src/lib/onboard/sandbox-create-launch.test.ts src/lib/onboard/openclaw-runtime-env.test.ts test/hermes-doctor-config-hash.test.tswc -l test/sandbox-provisioning.test.tsgh api /repos/NVIDIA/NemoClaw/commits/2837307a0 --jq '.commit.verification'gh api /repos/NVIDIA/NemoClaw/commits/98ea6fa72 --jq '.commit.verification'gh api /repos/NVIDIA/NemoClaw/commits/396471a1b --jq '.commit.verification'gh api /repos/NVIDIA/NemoClaw/commits/9c48e0607 --jq '.commit.verification'gh api /repos/NVIDIA/NemoClaw/commits/6e0acc56b --jq '.commit.verification'gh api /repos/NVIDIA/NemoClaw/commits/2ca0288f8 --jq '.commit.verification'gh api /repos/NVIDIA/NemoClaw/commits/989dc46c3 --jq '.commit.verification'gh api /repos/NVIDIA/NemoClaw/commits/f69014248 --jq '.commit.verification'gh api /repos/NVIDIA/NemoClaw/commits/b4bc2a1ab --jq '.commit.verification'gh api /repos/NVIDIA/NemoClaw/commits/060b3f3d2 --jq '.commit.verification'gh api /repos/NVIDIA/NemoClaw/commits/a6d8b17d8 --jq '.commit.verification'Note:
npx prek run --from-ref origin/main --to-ref HEADwas started and visible checks passed through gitleaks/markdownlint skip, but the command stopped producing output and was interrupted rather than claimed as passed.Signed-off-by: Aaron Erickson aerickson@nvidia.com
Summary by CodeRabbit
New Features
Bug Fixes
image@sha256:digests when available.Tests