fix(e2e): use hosted validation models in Vitest lanes - #5893
Merged
Conversation
Signed-off-by: Carlos Villela <cvillela@nvidia.com>
21 tasks
Contributor
|
No actionable comments were generated in the recent review. 🎉 ℹ️ Recent review info⚙️ Run configurationConfiguration used: Path: .coderabbit.yaml Review profile: CHILL Plan: Enterprise Run ID: 📒 Files selected for processing (1)
🚧 Files skipped from review as they are similar to previous changes (1)
📝 WalkthroughWalkthroughThe PR removes a pinned Hermes model env entry and updates live E2E scenarios and stale-sandbox helpers to use hosted inference defaults and env objects. ChangesHosted inference env alignment
Estimated review effort🎯 3 (Moderate) | ⏱️ ~25 minutes Possibly related PRs
Suggested labels
Suggested reviewers
Poem
🚥 Pre-merge checks | ✅ 4 | ❌ 1❌ Failed checks (1 warning)
✅ Passed checks (4 passed)
✨ Finishing Touches📝 Generate docstrings
🧪 Generate unit tests (beta)
Comment |
Contributor
Code Coverage OverviewLanguages: TypeScript TypeScript / code-coverage/pluginThe overall coverage in the Show a code coverage summary of the most covered files.
TypeScript / code-coverage/cliThe overall coverage in the Show a code coverage summary of the most covered files.
Updated |
Contributor
E2E Advisor RecommendationRequired E2E: None Dispatch hint: Full advisor summaryE2E Recommendation AdvisorBase: Required E2E
Optional E2E
New E2E recommendations
Dispatch hint
|
Contributor
Vitest E2E Scenario RecommendationRequired Vitest E2E scenarios: Dispatch required Vitest E2E scenarios:
Full Vitest E2E advisor summaryVitest E2E Scenario AdvisorBase: Required Vitest E2E scenarios
Optional Vitest E2E scenarios
Relevant changed files
|
Contributor
PR Review Advisor — No blocking findingsMerge posture: No blocking advisor findings Action checklist
Test follow-ups to resolve or justifyIf these cover changed behavior, prefer adding them in this PR; otherwise state why existing coverage is enough or link the follow-up.
This is an automated, non-binding review; it still expects maintainers and agents to respond to each required or warning item. Treat suggestions as current-PR improvements when they touch changed code; defer only with maintainer rationale or a linked follow-up. A human maintainer must make the final merge decision. |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
Contributor
There was a problem hiding this comment.
Actionable comments posted: 1
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In `@tools/e2e-scenarios/workflow-boundary.mts`:
- Around line 3877-3878: The Hermes hosted-inference validator in
requireHostedInferenceConfig currently only rejects NEMOCLAW_MODEL, so it still
allows a bypass via NEMOCLAW_COMPAT_MODEL. Update the same check in
workflow-boundary.mts to treat NEMOCLAW_COMPAT_MODEL as an explicit model
override too, alongside NEMOCLAW_MODEL, and keep pushing the same shared-default
error when either variable is set.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Path: .coderabbit.yaml
Review profile: CHILL
Plan: Enterprise
Run ID: f2f11428-e394-4b8b-ab56-5630f94313ff
📒 Files selected for processing (7)
.github/workflows/e2e-vitest-scenarios.yamltest/e2e-scenario/live/cron-preflight-inference-local.test.tstest/e2e-scenario/live/diagnostics.test.tstest/e2e-scenario/live/hermes-e2e.test.tstest/e2e-scenario/live/upgrade-stale-sandbox-helpers.tstest/e2e-scenario/live/upgrade-stale-sandbox.test.tstools/e2e-scenarios/workflow-boundary.mts
💤 Files with no reviewable changes (1)
- .github/workflows/e2e-vitest-scenarios.yaml
Comment on lines
+3877
to
+3878
| if (jobEnv.NEMOCLAW_MODEL !== undefined) { | ||
| errors.push("hermes-e2e-vitest job must use the shared hosted-compatible model default"); |
Contributor
There was a problem hiding this comment.
🎯 Functional Correctness | 🟠 Major | ⚡ Quick win
Reject NEMOCLAW_COMPAT_MODEL here too.
requireHostedInferenceConfig() treats NEMOCLAW_COMPAT_MODEL as the same kind of explicit model override as NEMOCLAW_MODEL, so this validator still allows the Hermes job to bypass the shared default by setting only the compat variable.
Suggested fix
- if (jobEnv.NEMOCLAW_MODEL !== undefined) {
+ if (
+ jobEnv.NEMOCLAW_MODEL !== undefined ||
+ jobEnv.NEMOCLAW_COMPAT_MODEL !== undefined
+ ) {
errors.push("hermes-e2e-vitest job must use the shared hosted-compatible model default");
}📝 Committable suggestion
‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.
Suggested change
| if (jobEnv.NEMOCLAW_MODEL !== undefined) { | |
| errors.push("hermes-e2e-vitest job must use the shared hosted-compatible model default"); | |
| if ( | |
| jobEnv.NEMOCLAW_MODEL !== undefined || | |
| jobEnv.NEMOCLAW_COMPAT_MODEL !== undefined | |
| ) { | |
| errors.push("hermes-e2e-vitest job must use the shared hosted-compatible model default"); |
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In `@tools/e2e-scenarios/workflow-boundary.mts` around lines 3877 - 3878, The
Hermes hosted-inference validator in requireHostedInferenceConfig currently only
rejects NEMOCLAW_MODEL, so it still allows a bypass via NEMOCLAW_COMPAT_MODEL.
Update the same check in workflow-boundary.mts to treat NEMOCLAW_COMPAT_MODEL as
an explicit model override too, alongside NEMOCLAW_MODEL, and keep pushing the
same shared-default error when either variable is set.
Contributor
PR Review Advisor (Nemotron Ultra) — Changes requestedMerge posture: Do not merge yet Action checklist
Findings index
Review findings by urgency: 0 required fixes, 4 items to resolve/justify, 1 in-scope improvement
|
Signed-off-by: Carlos Villela <cvillela@nvidia.com>
Signed-off-by: Carlos Villela <cvillela@nvidia.com>
Signed-off-by: Carlos Villela <cvillela@nvidia.com>
21 tasks
cv
added a commit
that referenced
this pull request
Jun 27, 2026
<!-- markdownlint-disable MD041 --> ## Summary Fixes the remaining post-#5893 hosted-compatible validation assertions in live Vitest lanes. Hermes and diagnostics now assert the hosted-compatible provider name, and the stale-upgrade old-base fixture includes the sandbox rlimits script required by the current base Dockerfile. ## Changes - Updates Hermes `openshell inference get` assertion to expect `hosted.providerName` instead of hard-coded `nvidia-prod`. - Updates diagnostics credential assertions/reset to use `hosted.providerName` instead of hard-coded `nvidia-prod`. - Copies `scripts/lib/sandbox-rlimits.sh` into the stale-upgrade old-base Docker build context so `Dockerfile.base` can build. ## Type of Change - [x] Code change (feature, bug fix, or refactor) - [ ] Code change with doc updates - [ ] Doc only (prose changes, no code sample modifications) - [ ] Doc only (includes code sample changes) ## Quality Gates <!-- Check all that apply. For any "covered by existing tests", "not applicable", or waiver entry, add a brief justification on the same line or in the Changes section. --> - [x] Tests added or updated for changed behavior - [x] Existing tests cover changed behavior — justification: affected live tests are gated locally; TypeScript validates the helper and assertion updates. - [ ] Tests not applicable — justification: - [ ] Docs updated for user-facing behavior changes - [x] Docs not applicable — justification: live E2E harness behavior only. - [x] Sensitive paths changed (security, policy, credentials, preflight, onboarding, inference, runner, sandbox, or messaging) - [x] Sensitive-path review completed or maintainer-approved waiver recorded — reviewer/approval link/justification: self-review; changes use existing hosted provider metadata and copy an existing checked-in script into a test Docker build context. - [ ] Non-success, skipped, or missing CI check accepted by maintainer — check name, approval link, and follow-up issue: ## Verification <!-- Check each item you ran and confirmed. Leave unchecked items you skipped. Doc-only changes do not require npm test unless you ran it. --> - [x] PR description includes the DCO sign-off declaration and every commit appears as `Verified` in GitHub - [ ] Git hooks passed during commit and push, or `npx prek run --from-ref main --to-ref HEAD` passes - [x] Targeted tests pass for changed behavior - [ ] Full `npm test` passes (broad runtime changes only) - [x] Quality Gates section completed with required justifications or waivers - [x] No secrets, API keys, or credentials committed - [ ] `npm run docs` builds without warnings (doc changes only) - [ ] Doc pages follow the [style guide](https://github.com/NVIDIA/NemoClaw/blob/main/docs/CONTRIBUTING.md) (doc changes only) - [ ] New doc pages include SPDX header and frontmatter (new pages only) Targeted verification: ```bash npm run typecheck:cli ``` Live scenario test files are gated locally unless `NEMOCLAW_RUN_E2E_SCENARIOS=1` is set; validation evidence will come from targeted GitHub E2E reruns after merge. --- <!-- DCO sign-off is required in this PR description, and every commit must appear as Verified in GitHub. Run: git config user.name && git config user.email --> Signed-off-by: Carlos Villela <cvillela@nvidia.com> <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **Tests** * Updated end-to-end checks to use the active provider name dynamically instead of a fixed value. * Improved coverage for credential reset behavior, including the expected removal message and post-reset credential state. * Adjusted inference verification to match the current provider identifier format. * **Chores** * Kept test artifacts in sync with the detected provider name and provider-specific skip reason. * Updated upgrade test setup to include an additional script in the temporary build context. <!-- end of auto-generated comment: release notes by coderabbit.ai --> Signed-off-by: Carlos Villela <cvillela@nvidia.com>
Hadar301
pushed a commit
to Hadar301/NemoClaw-OpenShift
that referenced
this pull request
Jul 12, 2026
<!-- markdownlint-disable MD041 --> ## Summary Fixes hosted-compatible Vitest lanes that reached the custom provider path but still used public/provider-specific model or env setup, causing hosted endpoint validation to fail with HTTP 401/403. The affected tests now use the shared hosted-compatible model/env plumbing consistently. ## Changes - Removes the Hermes Vitest workflow override for `NEMOCLAW_MODEL=minimaxai/minimax-m2.7` so hosted-compatible runs use the shared hosted model default. - Updates Hermes and cron live Vitest tests to default to `DEFAULT_HOSTED_INFERENCE_MODEL`. - Routes diagnostics and stale-upgrade live Vitest setup through `requireHostedInferenceConfig()` / `hosted.env` instead of manually passing only `NVIDIA_INFERENCE_API_KEY`. - Updates the workflow boundary validator to require Hermes Vitest to use the shared hosted-compatible model default. ## Type of Change - [x] Code change (feature, bug fix, or refactor) - [ ] Code change with doc updates - [ ] Doc only (prose changes, no code sample modifications) - [ ] Doc only (includes code sample changes) ## Quality Gates <!-- Check all that apply. For any "covered by existing tests", "not applicable", or waiver entry, add a brief justification on the same line or in the Changes section. --> - [x] Tests added or updated for changed behavior - [x] Existing tests cover changed behavior — justification: workflow boundary tests cover the Hermes model contract; TypeScript covers the live helper env signatures. - [ ] Tests not applicable — justification: - [ ] Docs updated for user-facing behavior changes - [x] Docs not applicable — justification: live E2E harness behavior only. - [x] Sensitive paths changed (security, policy, credentials, preflight, onboarding, inference, runner, sandbox, or messaging) - [x] Sensitive-path review completed or maintainer-approved waiver recorded — reviewer/approval link/justification: self-review; change narrows test model/env selection to the existing hosted-compatible fixture boundary without broadening secret exposure. - [ ] Non-success, skipped, or missing CI check accepted by maintainer — check name, approval link, and follow-up issue: ## Verification <!-- Check each item you ran and confirmed. Leave unchecked items you skipped. Doc-only changes do not require npm test unless you ran it. --> - [x] PR description includes the DCO sign-off declaration and every commit appears as `Verified` in GitHub - [ ] Git hooks passed during commit and push, or `npx prek run --from-ref main --to-ref HEAD` passes - [x] Targeted tests pass for changed behavior - [ ] Full `npm test` passes (broad runtime changes only) - [x] Quality Gates section completed with required justifications or waivers - [x] No secrets, API keys, or credentials committed - [ ] `npm run docs` builds without warnings (doc changes only) - [ ] Doc pages follow the [style guide](https://github.com/NVIDIA/NemoClaw/blob/main/docs/CONTRIBUTING.md) (doc changes only) - [ ] New doc pages include SPDX header and frontmatter (new pages only) Targeted verification: ```bash npm test -- --run test/e2e-scenario/support-tests/e2e-scenarios-workflow.test.ts npm run typecheck:cli ``` Live scenario test files are gated locally unless `NEMOCLAW_RUN_E2E_SCENARIOS=1` is set; the validation evidence will come from targeted GitHub E2E reruns after merge. --- <!-- DCO sign-off is required in this PR description, and every commit must appear as Verified in GitHub. Run: git config user.name && git config user.email --> Signed-off-by: Carlos Villela <cvillela@nvidia.com> <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **Tests** * Updated end-to-end live scenarios (Hermes chat, diagnostics, cron preflight, and stale sandbox upgrade) to use shared hosted-inference model defaults instead of hardcoded model strings and to wire hosted env/model consistently. * Removed direct model pinning from the Hermes Vitest workflow job configuration and expanded validation to disallow user-pinned overrides. * Added an E2E test covering the workflow boundary rejection behavior. * **Bug Fixes** * Reduced configuration mismatches that could cause E2E failures when model settings diverged from hosted inference defaults. <!-- end of auto-generated comment: release notes by coderabbit.ai --> --------- Signed-off-by: Carlos Villela <cvillela@nvidia.com>
Hadar301
pushed a commit
to Hadar301/NemoClaw-OpenShift
that referenced
this pull request
Jul 12, 2026
<!-- markdownlint-disable MD041 --> ## Summary Fixes the remaining post-NVIDIA#5893 hosted-compatible validation assertions in live Vitest lanes. Hermes and diagnostics now assert the hosted-compatible provider name, and the stale-upgrade old-base fixture includes the sandbox rlimits script required by the current base Dockerfile. ## Changes - Updates Hermes `openshell inference get` assertion to expect `hosted.providerName` instead of hard-coded `nvidia-prod`. - Updates diagnostics credential assertions/reset to use `hosted.providerName` instead of hard-coded `nvidia-prod`. - Copies `scripts/lib/sandbox-rlimits.sh` into the stale-upgrade old-base Docker build context so `Dockerfile.base` can build. ## Type of Change - [x] Code change (feature, bug fix, or refactor) - [ ] Code change with doc updates - [ ] Doc only (prose changes, no code sample modifications) - [ ] Doc only (includes code sample changes) ## Quality Gates <!-- Check all that apply. For any "covered by existing tests", "not applicable", or waiver entry, add a brief justification on the same line or in the Changes section. --> - [x] Tests added or updated for changed behavior - [x] Existing tests cover changed behavior — justification: affected live tests are gated locally; TypeScript validates the helper and assertion updates. - [ ] Tests not applicable — justification: - [ ] Docs updated for user-facing behavior changes - [x] Docs not applicable — justification: live E2E harness behavior only. - [x] Sensitive paths changed (security, policy, credentials, preflight, onboarding, inference, runner, sandbox, or messaging) - [x] Sensitive-path review completed or maintainer-approved waiver recorded — reviewer/approval link/justification: self-review; changes use existing hosted provider metadata and copy an existing checked-in script into a test Docker build context. - [ ] Non-success, skipped, or missing CI check accepted by maintainer — check name, approval link, and follow-up issue: ## Verification <!-- Check each item you ran and confirmed. Leave unchecked items you skipped. Doc-only changes do not require npm test unless you ran it. --> - [x] PR description includes the DCO sign-off declaration and every commit appears as `Verified` in GitHub - [ ] Git hooks passed during commit and push, or `npx prek run --from-ref main --to-ref HEAD` passes - [x] Targeted tests pass for changed behavior - [ ] Full `npm test` passes (broad runtime changes only) - [x] Quality Gates section completed with required justifications or waivers - [x] No secrets, API keys, or credentials committed - [ ] `npm run docs` builds without warnings (doc changes only) - [ ] Doc pages follow the [style guide](https://github.com/NVIDIA/NemoClaw/blob/main/docs/CONTRIBUTING.md) (doc changes only) - [ ] New doc pages include SPDX header and frontmatter (new pages only) Targeted verification: ```bash npm run typecheck:cli ``` Live scenario test files are gated locally unless `NEMOCLAW_RUN_E2E_SCENARIOS=1` is set; validation evidence will come from targeted GitHub E2E reruns after merge. --- <!-- DCO sign-off is required in this PR description, and every commit must appear as Verified in GitHub. Run: git config user.name && git config user.email --> Signed-off-by: Carlos Villela <cvillela@nvidia.com> <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **Tests** * Updated end-to-end checks to use the active provider name dynamically instead of a fixed value. * Improved coverage for credential reset behavior, including the expected removal message and post-reset credential state. * Adjusted inference verification to match the current provider identifier format. * **Chores** * Kept test artifacts in sync with the detected provider name and provider-specific skip reason. * Updated upgrade test setup to include an additional script in the temporary build context. <!-- end of auto-generated comment: release notes by coderabbit.ai --> Signed-off-by: Carlos Villela <cvillela@nvidia.com>
wscurran
added
area: e2e
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Fixes hosted-compatible Vitest lanes that reached the custom provider path but still used public/provider-specific model or env setup, causing hosted endpoint validation to fail with HTTP 401/403. The affected tests now use the shared hosted-compatible model/env plumbing consistently.
Changes
NEMOCLAW_MODEL=minimaxai/minimax-m2.7so hosted-compatible runs use the shared hosted model default.DEFAULT_HOSTED_INFERENCE_MODEL.requireHostedInferenceConfig()/hosted.envinstead of manually passing onlyNVIDIA_INFERENCE_API_KEY.Type of Change
Quality Gates
Verification
Verifiedin GitHubnpx prek run --from-ref main --to-ref HEADpassesnpm testpasses (broad runtime changes only)npm run docsbuilds without warnings (doc changes only)Targeted verification:
npm test -- --run test/e2e-scenario/support-tests/e2e-scenarios-workflow.test.ts npm run typecheck:cliLive scenario test files are gated locally unless
NEMOCLAW_RUN_E2E_SCENARIOS=1is set; the validation evidence will come from targeted GitHub E2E reruns after merge.Signed-off-by: Carlos Villela cvillela@nvidia.com
Summary by CodeRabbit
Tests
Bug Fixes