Skip to content

test(e2e): restore Hermes dashboard coverage - #5921

Merged
cv merged 1 commit into
mainfrom
codex/e2e-hermes-variant-parity
Jun 28, 2026
Merged

test(e2e): restore Hermes dashboard coverage#5921
cv merged 1 commit into
mainfrom
codex/e2e-hermes-variant-parity

Conversation

@cv

@cv cv commented Jun 28, 2026

Copy link
Copy Markdown
Collaborator

Summary

Restores the missing Hermes dashboard variant in the Vitest E2E workflow so the new suite covers the same dashboard-enabled journey as the legacy nightly workflow. The job is default-enabled, independently selectable, and reported through the common PR result job.

This is the first landable slice of #5919: establish variant parity while both E2E implementations still exist, collect live-run evidence, then remove the legacy suite only after the domain gates are satisfied.

Related Issue

Refs #5919

Changes

  • add a dedicated hermes-dashboard-vitest job that runs the existing Hermes live test with dashboard coverage enabled
  • expose hermes-dashboard through the generated free-standing job inventory and both selective dispatch paths
  • include dashboard artifacts and the job result in report-to-pr
  • add an executable workflow contract with mutation coverage for dashboard mode, Vitest execution, and result aggregation drift

Type of Change

  • Code change (feature, bug fix, or refactor)
  • Code change with doc updates
  • Doc only (prose changes, no code sample modifications)
  • Doc only (includes code sample changes)

Quality Gates

  • Tests added or updated for changed behavior
  • Existing tests cover changed behavior — justification:
  • Tests not applicable — justification:
  • Docs updated for user-facing behavior changes
  • Docs not applicable — justification: CI-only E2E workflow coverage; no user-facing behavior or interface changes
  • Sensitive paths changed (security, policy, credentials, preflight, onboarding, inference, runner, sandbox, or messaging)
  • Sensitive-path review completed or maintainer-approved waiver recorded — reviewer/approval link/justification:
  • Non-success, skipped, or missing CI check accepted by maintainer — check name, approval link, and follow-up issue:

Verification

  • PR description includes the DCO sign-off declaration and every commit appears as Verified in GitHub
  • Git hooks passed during commit and push, or npx prek run --from-ref main --to-ref HEAD passes
  • Targeted tests pass for changed behavior
  • Full npm test passes (broad runtime changes only)
  • Quality Gates section completed with required justifications or waivers
  • No secrets, API keys, or credentials committed
  • npm run docs builds without warnings (doc changes only)
  • Doc pages follow the style guide (doc changes only)
  • New doc pages include SPDX header and frontmatter (new pages only)

Targeted evidence: npx vitest run --project e2e-vitest-support (53 files, 385 tests); npm run typecheck:cli; source-shape and test-size ratchets; normal commit and push hooks.


Signed-off-by: Carlos Villela cvillela@nvidia.com

Summary by CodeRabbit

  • New Features

    • Added a new end-to-end dashboard test run to the release workflow, available by default or when explicitly selected.
    • Included live Vitest coverage for the Hermes dashboard scenario and published dedicated artifacts for easier review.
  • Bug Fixes

    • Improved workflow validation to ensure the dashboard test run, its required settings, and its reporting step stay correctly connected.
    • Added guardrails to catch configuration changes that would skip required dashboard coverage.

Signed-off-by: Carlos Villela <cvillela@nvidia.com>
@cv cv self-assigned this Jun 28, 2026
@cv cv added chore Build, CI, dependency, or tooling maintenance area: e2e End-to-end tests, nightly failures, or validation infrastructure area: ci CI workflows, checks, release automation, or GitHub Actions v0.0.70 labels Jun 28, 2026
@coderabbitai

coderabbitai Bot commented Jun 28, 2026

Copy link
Copy Markdown
Contributor

Review Change Stack

📝 Walkthrough

Walkthrough

Adds a new hermes-dashboard-vitest GitHub Actions job to the E2E Vitest scenarios workflow, wires it into report-to-pr, implements a TypeScript workflow boundary validator (validateHermesDashboardWorkflow), and adds a Vitest test suite that verifies correct job selection and rejects invalid mutations.

Hermes Dashboard Vitest E2E Job

Layer / File(s) Summary
hermes-dashboard-vitest CI job definition
.github/workflows/e2e-vitest-scenarios.yaml
Adds the hermes-dashboard-vitest job gated by inputs.jobs/inputs.scenarios, with Hermes env vars, checkout/Node/build/run/upload steps, and adds the job to report-to-pr needs.
Workflow boundary validator
tools/e2e-scenarios/hermes-dashboard-workflow-boundary.mts
Defines HermesDashboardWorkflow type, readHermesDashboardWorkflow, validateHermesDashboardWorkflow (enforces runner, timeout, env, Vitest command, artifact upload SHA, and report-to-pr dependency), and validateHermesDashboardWorkflowBoundary.
Boundary validator tests
test/e2e-scenario/support-tests/hermes-dashboard-workflow-boundary.test.ts
Tests default validation, scenario/job selector dispatch, and three mutation-based error assertions against the boundary validator.

Estimated code review effort

🎯 3 (Moderate) | ⏱️ ~20 minutes

Possibly related PRs

  • NVIDIA/NemoClaw#5605: Adds a Hermes Vitest free-standing job and updates report-to-pr needs in the same workflow file.
  • NVIDIA/NemoClaw#5610: Adds a free-standing Hermes Vitest job with workflow-boundary test/validator logic in the same files.
  • NVIDIA/NemoClaw#5776: Passes inference key/COMPATIBLE_API_KEY into the live Vitest step env, which the new boundary validator explicitly enforces.

Suggested labels

bug-fix

🚥 Pre-merge checks | ✅ 4 | ❌ 1

❌ Failed checks (1 warning)

Check name Status Explanation Resolution
Docstring Coverage ⚠️ Warning Docstring coverage is 0.00% which is insufficient. The required threshold is 80.00%. Write docstrings for the functions missing them to satisfy the coverage threshold.
✅ Passed checks (4 passed)
Check name Status Explanation
Description Check ✅ Passed Check skipped - CodeRabbit’s high-level summary is enabled.
Title check ✅ Passed The title clearly summarizes the main change: restoring Hermes dashboard E2E coverage.
Linked Issues check ✅ Passed Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check ✅ Passed Check skipped because no linked issues were found for this pull request.
✨ Finishing Touches
📝 Generate docstrings
  • Create stacked PR
  • Commit on current branch
🧪 Generate unit tests (beta)
  • Create PR with unit tests
  • Commit unit tests in branch codex/e2e-hermes-variant-parity

Comment @coderabbitai help to get the list of available commands.

@github-code-quality

github-code-quality Bot commented Jun 28, 2026

Copy link
Copy Markdown
Contributor

Code Coverage Overview

Languages: TypeScript

TypeScript / code-coverage/plugin

The overall coverage in the codex/e2e-hermes-var... branch is 96%. Coverage data for the main branch is not yet available.

Show a code coverage summary of the most covered files.
File main codex/e2e-hermes-var... 4c3f514 +/-
nemoclaw/src/se...cret-scanner.ts 100%
nemoclaw/src/commands/slash.ts 100%
nemoclaw/src/li...bprocess-env.ts 100%
nemoclaw/src/bl...eprint/state.ts 98%
nemoclaw/src/onboard/config.ts 98%
nemoclaw/src/bl...int/snapshot.ts 97%
nemoclaw/src/bl...print/runner.ts 95%
nemoclaw/src/co...ration-state.ts 94%
nemoclaw/src/bl...ate-networks.ts 94%
nemoclaw/src/index.ts 94%

TypeScript / code-coverage/cli

The overall coverage in the codex/e2e-hermes-var... branch is 68%. Coverage data for the main branch is not yet available.

Show a code coverage summary of the most covered files.
File main codex/e2e-hermes-var... 4c3f514 +/-
src/lib/actions...all/run-plan.ts 80%
src/lib/state/o...oard-session.ts 79%
src/lib/actions...dbox/rebuild.ts 74%
src/lib/state/sandbox.ts 72%
src/lib/shields/index.ts 70%
src/lib/onboard/preflight.ts 69%
src/lib/actions...licy-channel.ts 59%
src/lib/onboard...er-gpu-patch.ts 59%
src/lib/policy/index.ts 52%
src/lib/onboard.ts 20%

Updated June 28, 2026 05:24 UTC
Code Coverage is in Public Preview. Learn more and provide us with your feedback.

@github-actions

Copy link
Copy Markdown
Contributor

E2E Advisor Recommendation

Required E2E: hermes-dashboard-vitest
Optional E2E: hermes-e2e-vitest

Dispatch hint: hermes-dashboard-vitest

Workflow run

Full advisor summary

E2E Recommendation Advisor

Base: origin/main
Head: HEAD
Confidence: high

Required E2E

  • hermes-dashboard-vitest (high): This PR introduces the hermes-dashboard free-standing live E2E job. Run it to validate the new workflow selector, dashboard-mode environment, hosted-inference execution path, isolated sandbox configuration, artifact upload, and report-to-pr integration.

Optional E2E

  • hermes-e2e-vitest (high): Useful baseline comparison because the new dashboard job reuses test/e2e-scenario/live/hermes-e2e.test.ts with a dashboard-specific environment flag. Running the standard Hermes live job can distinguish dashboard-mode failures from general Hermes live-flow failures.

New E2E recommendations

  • None.

Dispatch hint

  • Workflow: .github/workflows/e2e-vitest-scenarios.yaml
  • jobs input: hermes-dashboard-vitest

@github-actions

Copy link
Copy Markdown
Contributor

Vitest E2E Scenario Recommendation

Required Vitest E2E scenarios: hermes-dashboard-vitest
Optional Vitest E2E scenarios: None

Dispatch required Vitest E2E scenarios:

  • gh workflow run e2e-vitest-scenarios.yaml --ref <pr-head-ref> --field jobs=hermes-dashboard-vitest

Workflow run

Full Vitest E2E advisor summary

Vitest E2E Scenario Advisor

Base: origin/main
Head: HEAD
Confidence: high

Required Vitest E2E scenarios

  • hermes-dashboard-vitest: The PR wires a new free-standing live Vitest job in e2e-vitest-scenarios.yaml for Hermes dashboard coverage and adds workflow-boundary support tests for that job. Per the free-standing job rule, dispatch the specific job rather than the typed scenario fan-out.
    • Dispatch: gh workflow run e2e-vitest-scenarios.yaml --ref <pr-head-ref> --field jobs=hermes-dashboard-vitest

Optional Vitest E2E scenarios

  • None.

Relevant changed files

  • .github/workflows/e2e-vitest-scenarios.yaml
  • test/e2e-scenario/support-tests/hermes-dashboard-workflow-boundary.test.ts
  • tools/e2e-scenarios/hermes-dashboard-workflow-boundary.mts

@github-actions

github-actions Bot commented Jun 28, 2026

Copy link
Copy Markdown
Contributor

PR Review Advisor (Nemotron Ultra) — Changes requested

Merge posture: Do not merge yet
Primary next action: Add or justify PRA-T1 and any related test follow-ups.
Open items: 0 required · 0 warnings · 4 suggestions · 3 test follow-ups
Since last review: 0 prior items resolved · 0 still apply · 0 new items found

Action checklist

  • PRA-T1 Add or justify test follow-up: Runtime validation
  • PRA-T2 Add or justify test follow-up: Runtime validation
  • PRA-T3 Add or justify test follow-up: Add test asserting scenario.json dashboardEnabled field differs between jobs
  • PRA-1 In-scope improvement: job.needs validation should accept array form for future-proofing in tools/e2e-scenarios/hermes-dashboard-workflow-boundary.mts:54
  • PRA-2 In-scope improvement: Add test asserting scenario.json dashboardEnabled field differs between jobs in .github/workflows/e2e-vitest-scenarios.yaml:1776
  • PRA-3 In-scope improvement: workflowPath parameter is single-use config knob; could shrink to internal constant in tools/e2e-scenarios/hermes-dashboard-workflow-boundary.mts:10
  • PRA-4 In-scope improvement: Verify parity with nightly-e2e.yaml hermes-dashboard-e2e job configuration in .github/workflows/e2e-vitest-scenarios.yaml:1776

Findings index

ID Severity Category Location Required action
PRA-1 Improvement security tools/e2e-scenarios/hermes-dashboard-workflow-boundary.mts:54 Accept both string and array forms: check Array.isArray(needs) ? needs.includes("generate-matrix") : needs === "generate-matrix"
PRA-2 Improvement tests .github/workflows/e2e-vitest-scenarios.yaml:1776 Add Vitest test that runs hermes-e2e.test.ts with and without NEMOCLAW_E2E_HERMES_DASHBOARD and asserts scenario.json.dashboardEnabled field is true vs false
PRA-3 Improvement architecture tools/e2e-scenarios/hermes-dashboard-workflow-boundary.mts:10 Make DEFAULT_WORKFLOW_PATH an internal constant (not exported), remove workflowPath parameter from readHermesDashboardWorkflow and validateHermesDashboardWorkflowBoundary, keep test passing explicit path
PRA-4 Improvement acceptance .github/workflows/e2e-vitest-scenarios.yaml:1776 Verify parity: sandbox name (e2e-hermes-dashboard), NEMOCLAW_E2E_HERMES_DASHBOARD=1, NEMOCLAW_E2E_USE_HOSTED_INFERENCE=1, timeout 75min (nightly uses 60min - acceptable difference for Vitest overhead)
Review findings by urgency: 0 required fixes, 0 items to resolve/justify, 4 in-scope improvements

⚠️ Resolve or justify before merge

Investigate these in the current review; either fix them, explain why they are not applicable, or document the accepted risk.

  • None.

💡 In-scope improvements

These are lower-risk, not throwaway. Prefer fixing them in this PR when they are local to changed code; defer only with rationale or a linked follow-up.

PRA-1 Improvement — job.needs validation should accept array form for future-proofing

  • Location: tools/e2e-scenarios/hermes-dashboard-workflow-boundary.mts:54
  • Category: security
  • Problem: Validation for job.needs uses strict equality against string "generate-matrix" but type allows string[]; if workflow ever changes to array form (e.g., needs: ["generate-matrix", "other"]), validation will fail despite valid dependency
  • Impact: False positive validation failure if workflow author adds additional dependencies to job.needs array while keeping generate-matrix
  • Suggested action: Accept both string and array forms: check Array.isArray(needs) ? needs.includes("generate-matrix") : needs === "generate-matrix"
  • Expected follow-up: Prefer a current-PR fix when local to changed code; defer only with rationale or linked follow-up.
  • Verification: Read tools/e2e-scenarios/hermes-dashboard-workflow-boundary.mts line 54 and confirm needs validation handles array form
  • Missing regression test: Add test case where job.needs = ["generate-matrix", "other"] and validation passes
  • Done when: The local improvement is applied, or the PR notes why it should be deferred.
  • Evidence: Line 54: requireEqual(errors, job.needs, "generate-matrix", `${JOB_NAME} must depend on generate-matrix`); type allows string[] | string

PRA-2 Improvement — Add test asserting scenario.json dashboardEnabled field differs between jobs

  • Location: .github/workflows/e2e-vitest-scenarios.yaml:1776
  • Category: tests
  • Problem: New job uses same test file (hermes-e2e.test.ts) as hermes-e2e-vitest but with NEMOCLAW_E2E_HERMES_DASHBOARD=1; test writes dashboardEnabled to scenario.json artifact so runs are distinguishable, but no test asserts this field differs
  • Impact: Cannot programmatically verify dashboard variant produces distinct artifacts; CI result aggregation may conflate the two jobs
  • Suggested action: Add Vitest test that runs hermes-e2e.test.ts with and without NEMOCLAW_E2E_HERMES_DASHBOARD and asserts scenario.json.dashboardEnabled field is true vs false
  • Expected follow-up: Prefer a current-PR fix when local to changed code; defer only with rationale or linked follow-up.
  • Verification: Run both jobs locally or in CI and verify scenario.json shows dashboardEnabled: true for dashboard job and false for regular job
  • Missing regression test: Vitest test that runs hermes-e2e.test.ts with and without NEMOCLAW_E2E_HERMES_DASHBOARD and asserts scenario.json dashboardEnabled field
  • Done when: The local improvement is applied, or the PR notes why it should be deferred.
  • Evidence: hermes-e2e.test.ts lines 66, 83-84: hermesDashboardE2eEnabled() reads NEMOCLAW_E2E_HERMES_DASHBOARD; scenario.json includes dashboardEnabled: hermesDashboardE2eEnabled()

PRA-3 Improvement — workflowPath parameter is single-use config knob; could shrink to internal constant

  • Location: tools/e2e-scenarios/hermes-dashboard-workflow-boundary.mts:10
  • Category: architecture
  • Problem: DEFAULT_WORKFLOW_PATH constant and workflowPath parameter with default exist for testability but only the default is ever used in production code; test passes path explicitly anyway
  • Impact: Minor maintenance burden; parameter suggests configurability that doesn't exist
  • Suggested action: Make DEFAULT_WORKFLOW_PATH an internal constant (not exported), remove workflowPath parameter from readHermesDashboardWorkflow and validateHermesDashboardWorkflowBoundary, keep test passing explicit path
  • Expected follow-up: Prefer a current-PR fix when local to changed code; defer only with rationale or linked follow-up.
  • Verification: Compare tools/e2e-scenarios/hermes-dashboard-workflow-boundary.mts lines 10, 35, 111 with tools/e2e-scenarios/workflow-boundary.mts pattern
  • Missing regression test: Existing test in hermes-dashboard-workflow-boundary.test.ts covers validation drift detection
  • Done when: The local improvement is applied, or the PR notes why it should be deferred.
  • Evidence: Three locations with workflowPath = DEFAULT_WORKFLOW_PATH default parameter; test file imports and calls with explicit path

PRA-4 Improvement — Verify parity with nightly-e2e.yaml hermes-dashboard-e2e job configuration

  • Location: .github/workflows/e2e-vitest-scenarios.yaml:1776
  • Category: acceptance
  • Problem: PR restores Hermes dashboard coverage matching nightly-e2e.yaml:hermes-dashboard-e2e job; verify new job runs same test with same sandbox isolation and env vars as nightly counterpart
  • Impact: Ensures behavioral parity between legacy and new E2E suites during transition period
  • Suggested action: Verify parity: sandbox name (e2e-hermes-dashboard), NEMOCLAW_E2E_HERMES_DASHBOARD=1, NEMOCLAW_E2E_USE_HOSTED_INFERENCE=1, timeout 75min (nightly uses 60min - acceptable difference for Vitest overhead)
  • Expected follow-up: Prefer a current-PR fix when local to changed code; defer only with rationale or linked follow-up.
  • Verification: Diff nightly-e2e.yaml hermes-dashboard-e2e job env_json against new job env vars; confirm sandbox name and dashboard flag match
  • Missing regression test: Workflow boundary test already validates env vars and sandbox name; nightly parity not automated but manually verifiable
  • Done when: The local improvement is applied, or the PR notes why it should be deferred.
  • Evidence: nightly-e2e.yaml lines 1098-1100: env_json includes NEMOCLAW_E2E_HERMES_DASHBOARD=1, NEMOCLAW_SANDBOX_NAME=e2e-hermes-dashboard; new job matches both
Simplification opportunities: 1 possible cut, net -8 lines possible

These are safe simplification checks only. Do not remove validation, security controls, data-loss prevention, or required tests.

  • PRA-3 shrink (tools/e2e-scenarios/hermes-dashboard-workflow-boundary.mts:10): workflowPath parameter with default from readHermesDashboardWorkflow and validateHermesDashboardWorkflowBoundary; export only validateHermesDashboardWorkflowBoundary
    • Replacement: Internal DEFAULT_WORKFLOW_PATH constant; readHermesDashboardWorkflow takes no arguments
    • Net: -8 lines
    • Safety boundary: Test file must continue to pass explicit path for test isolation; validation logic unchanged
Test follow-ups to resolve or justify

If these cover changed behavior, prefer adding them in this PR; otherwise state why existing coverage is enough or link the follow-up.

  • PRA-T1 Runtime validation — Vitest test: run hermes-e2e.test.ts with NEMOCLAW_E2E_HERMES_DASHBOARD=1 and =0, assert scenario.json dashboardEnabled field differs. Workflow boundary validation and dispatch selector logic fully unit-tested; live dashboard test behavior requires sandbox, inference, and Hermes runtime — cannot be unit-tested; needs CI runtime validation
  • PRA-T2 Runtime validation — Workflow validation test: job.needs as array ["generate-matrix", "other"] should pass validation. Workflow boundary validation and dispatch selector logic fully unit-tested; live dashboard test behavior requires sandbox, inference, and Hermes runtime — cannot be unit-tested; needs CI runtime validation
  • PRA-T3 Add test asserting scenario.json dashboardEnabled field differs between jobs — Add Vitest test that runs hermes-e2e.test.ts with and without NEMOCLAW_E2E_HERMES_DASHBOARD and asserts scenario.json.dashboardEnabled field is true vs false
Since last review details

Current findings, using the urgency labels above:

PRA-1 Improvement — job.needs validation should accept array form for future-proofing

  • Location: tools/e2e-scenarios/hermes-dashboard-workflow-boundary.mts:54
  • Category: security
  • Problem: Validation for job.needs uses strict equality against string "generate-matrix" but type allows string[]; if workflow ever changes to array form (e.g., needs: ["generate-matrix", "other"]), validation will fail despite valid dependency
  • Impact: False positive validation failure if workflow author adds additional dependencies to job.needs array while keeping generate-matrix
  • Suggested action: Accept both string and array forms: check Array.isArray(needs) ? needs.includes("generate-matrix") : needs === "generate-matrix"
  • Expected follow-up: Prefer a current-PR fix when local to changed code; defer only with rationale or linked follow-up.
  • Verification: Read tools/e2e-scenarios/hermes-dashboard-workflow-boundary.mts line 54 and confirm needs validation handles array form
  • Missing regression test: Add test case where job.needs = ["generate-matrix", "other"] and validation passes
  • Done when: The local improvement is applied, or the PR notes why it should be deferred.
  • Evidence: Line 54: requireEqual(errors, job.needs, "generate-matrix", `${JOB_NAME} must depend on generate-matrix`); type allows string[] | string

PRA-2 Improvement — Add test asserting scenario.json dashboardEnabled field differs between jobs

  • Location: .github/workflows/e2e-vitest-scenarios.yaml:1776
  • Category: tests
  • Problem: New job uses same test file (hermes-e2e.test.ts) as hermes-e2e-vitest but with NEMOCLAW_E2E_HERMES_DASHBOARD=1; test writes dashboardEnabled to scenario.json artifact so runs are distinguishable, but no test asserts this field differs
  • Impact: Cannot programmatically verify dashboard variant produces distinct artifacts; CI result aggregation may conflate the two jobs
  • Suggested action: Add Vitest test that runs hermes-e2e.test.ts with and without NEMOCLAW_E2E_HERMES_DASHBOARD and asserts scenario.json.dashboardEnabled field is true vs false
  • Expected follow-up: Prefer a current-PR fix when local to changed code; defer only with rationale or linked follow-up.
  • Verification: Run both jobs locally or in CI and verify scenario.json shows dashboardEnabled: true for dashboard job and false for regular job
  • Missing regression test: Vitest test that runs hermes-e2e.test.ts with and without NEMOCLAW_E2E_HERMES_DASHBOARD and asserts scenario.json dashboardEnabled field
  • Done when: The local improvement is applied, or the PR notes why it should be deferred.
  • Evidence: hermes-e2e.test.ts lines 66, 83-84: hermesDashboardE2eEnabled() reads NEMOCLAW_E2E_HERMES_DASHBOARD; scenario.json includes dashboardEnabled: hermesDashboardE2eEnabled()

PRA-3 Improvement — workflowPath parameter is single-use config knob; could shrink to internal constant

  • Location: tools/e2e-scenarios/hermes-dashboard-workflow-boundary.mts:10
  • Category: architecture
  • Problem: DEFAULT_WORKFLOW_PATH constant and workflowPath parameter with default exist for testability but only the default is ever used in production code; test passes path explicitly anyway
  • Impact: Minor maintenance burden; parameter suggests configurability that doesn't exist
  • Suggested action: Make DEFAULT_WORKFLOW_PATH an internal constant (not exported), remove workflowPath parameter from readHermesDashboardWorkflow and validateHermesDashboardWorkflowBoundary, keep test passing explicit path
  • Expected follow-up: Prefer a current-PR fix when local to changed code; defer only with rationale or linked follow-up.
  • Verification: Compare tools/e2e-scenarios/hermes-dashboard-workflow-boundary.mts lines 10, 35, 111 with tools/e2e-scenarios/workflow-boundary.mts pattern
  • Missing regression test: Existing test in hermes-dashboard-workflow-boundary.test.ts covers validation drift detection
  • Done when: The local improvement is applied, or the PR notes why it should be deferred.
  • Evidence: Three locations with workflowPath = DEFAULT_WORKFLOW_PATH default parameter; test file imports and calls with explicit path

PRA-4 Improvement — Verify parity with nightly-e2e.yaml hermes-dashboard-e2e job configuration

  • Location: .github/workflows/e2e-vitest-scenarios.yaml:1776
  • Category: acceptance
  • Problem: PR restores Hermes dashboard coverage matching nightly-e2e.yaml:hermes-dashboard-e2e job; verify new job runs same test with same sandbox isolation and env vars as nightly counterpart
  • Impact: Ensures behavioral parity between legacy and new E2E suites during transition period
  • Suggested action: Verify parity: sandbox name (e2e-hermes-dashboard), NEMOCLAW_E2E_HERMES_DASHBOARD=1, NEMOCLAW_E2E_USE_HOSTED_INFERENCE=1, timeout 75min (nightly uses 60min - acceptable difference for Vitest overhead)
  • Expected follow-up: Prefer a current-PR fix when local to changed code; defer only with rationale or linked follow-up.
  • Verification: Diff nightly-e2e.yaml hermes-dashboard-e2e job env_json against new job env vars; confirm sandbox name and dashboard flag match
  • Missing regression test: Workflow boundary test already validates env vars and sandbox name; nightly parity not automated but manually verifiable
  • Done when: The local improvement is applied, or the PR notes why it should be deferred.
  • Evidence: nightly-e2e.yaml lines 1098-1100: env_json includes NEMOCLAW_E2E_HERMES_DASHBOARD=1, NEMOCLAW_SANDBOX_NAME=e2e-hermes-dashboard; new job matches both

Workflow run details

This is an automated, non-binding review; it still expects maintainers and agents to respond to each required or warning item. Treat suggestions as current-PR improvements when they touch changed code; defer only with maintainer rationale or a linked follow-up. A human maintainer must make the final merge decision.

@github-actions

github-actions Bot commented Jun 28, 2026

Copy link
Copy Markdown
Contributor

PR Review Advisor — Changes requested

Merge posture: Do not merge yet
Primary next action: Resolve or justify PRA-1: Dashboard workflow contract misses trusted-boundary drift for the secret-consuming job.
Open items: 0 required · 1 warning · 0 suggestions · 7 test follow-ups
Since last review: 0 prior items resolved · 0 still apply · 1 new item found

Action checklist

  • PRA-1 Resolve or justify: Dashboard workflow contract misses trusted-boundary drift for the secret-consuming job in tools/e2e-scenarios/hermes-dashboard-workflow-boundary.mts:44
  • PRA-T1 Add or justify test follow-up: Runtime validation
  • PRA-T2 Add or justify test follow-up: Runtime validation
  • PRA-T3 Add or justify test follow-up: Runtime validation
  • PRA-T4 Add or justify test follow-up: Runtime validation
  • PRA-T5 Add or justify test follow-up: Runtime validation
  • PRA-T6 Add or justify test follow-up: Dashboard workflow contract misses trusted-boundary drift for the secret-consuming job
  • PRA-T7 Add or justify test follow-up: Acceptance clause

Findings index

ID Severity Category Location Required action
PRA-1 Resolve/justify tests tools/e2e-scenarios/hermes-dashboard-workflow-boundary.mts:44 Extend `validateHermesDashboardWorkflow` and its mutation test to enforce the same trusted-boundary invariants already present in the workflow: checkout full-SHA with `persist-credentials: false`, setup-node full-SHA, `Install root dependencies` running `npm ci --ignore-scripts`, no `NVIDIA_INFERENCE_API_KEY` outside the Vitest run step, and artifact upload `include-hidden-files: false`, `if-no-files-found: ignore`, and `retention-days: 14`.
Review findings by urgency: 0 required fixes, 1 item to resolve/justify, 0 in-scope improvements

⚠️ Resolve or justify before merge

Investigate these in the current review; either fix them, explain why they are not applicable, or document the accepted risk.

PRA-1 Resolve/justify — Dashboard workflow contract misses trusted-boundary drift for the secret-consuming job

  • Location: tools/e2e-scenarios/hermes-dashboard-workflow-boundary.mts:44
  • Category: tests
  • Problem: The new `hermes-dashboard-vitest` job receives `NVIDIA_INFERENCE_API_KEY`, but the new dashboard-specific validator only checks a subset of the workflow boundary: dashboard env, runner/timeout, Vitest command, upload action pin/path, and `report-to-pr` needs. It does not reject checkout credential persistence, secret env on setup/install/build/upload steps, changing `npm ci --ignore-scripts` to a script-running install, or unsafe artifact upload settings such as `include-hidden-files: true`, `if-no-files-found: error`, or nonstandard retention. The current YAML is safe on these points, but the executable contract added by this PR would not catch several local regressions that matter for a secret-consuming GitHub Actions lane.
  • Impact: A future edit to this new job could accidentally expose the checkout token, run package scripts before the controlled build, pass the inference secret to broader setup steps, or upload hidden files without the dashboard boundary test failing. That weakens the review value of the new contract around workflow trusted-code and credential hygiene.
  • Recommended action: Extend `validateHermesDashboardWorkflow` and its mutation test to enforce the same trusted-boundary invariants already present in the workflow: checkout full-SHA with `persist-credentials: false`, setup-node full-SHA, `Install root dependencies` running `npm ci --ignore-scripts`, no `NVIDIA_INFERENCE_API_KEY` outside the Vitest run step, and artifact upload `include-hidden-files: false`, `if-no-files-found: ignore`, and `retention-days: 14`.
  • Expected follow-up: Resolve in this PR or explain why the risk is acceptable.
  • Verification: Read `validateHermesDashboardWorkflow` in `tools/e2e-scenarios/hermes-dashboard-workflow-boundary.mts` and compare it with the new `hermes-dashboard-vitest` job in `.github/workflows/e2e-vitest-scenarios.yaml`; the omitted checks are visible in the YAML but absent from the validator and mutation assertions.
  • Missing regression test: Add mutations in `test/e2e-scenario/support-tests/hermes-dashboard-workflow-boundary.test.ts` that set checkout `persist-credentials: true`, add `NVIDIA_INFERENCE_API_KEY` to `Install root dependencies.env`, change install to `npm install`, and set upload `include-hidden-files: true` / `if-no-files-found: error` / `retention-days: 1`, then assert the validator reports each drift.
  • Done when: The risk is fixed or explicitly justified in the PR. Verification: Read `validateHermesDashboardWorkflow` in `tools/e2e-scenarios/hermes-dashboard-workflow-boundary.mts` and compare it with the new `hermes-dashboard-vitest` job in `.github/workflows/e2e-vitest-scenarios.yaml`; the omitted checks are visible in the YAML but absent from the validator and mutation assertions.
  • Evidence: The new validator checks `NEMOCLAW_E2E_HERMES_DASHBOARD`, the Vitest command, `run.env.NVIDIA_INFERENCE_API_KEY`, upload action pin/path, and `report-to-pr.needs`; the new mutation test only changes dashboard mode, execution, and reporting. The workflow job itself also contains checkout `persist-credentials: false`, `npm ci --ignore-scripts`, and artifact safety settings that are not covered by the dashboard-specific validator.

💡 In-scope improvements

These are lower-risk, not throwaway. Prefer fixing them in this PR when they are local to changed code; defer only with rationale or a linked follow-up.

  • None.
Test follow-ups to resolve or justify

If these cover changed behavior, prefer adding them in this PR; otherwise state why existing coverage is enough or link the follow-up.

  • PRA-T1 Runtime validation — Extend the dashboard workflow boundary mutation test to reject checkout `persist-credentials: true` for `hermes-dashboard-vitest`.. The changed behavior is a live workflow/sandbox/dashboard lane. Static support tests cover selector and workflow-shape drift, but dashboard behavior ultimately depends on runtime installation, sandbox forwarding, hosted inference, and artifact creation.
  • PRA-T2 Runtime validation — Extend the dashboard workflow boundary mutation test to reject `NVIDIA_INFERENCE_API_KEY` on `Install root dependencies`, `Build CLI`, checkout, setup-node, or upload steps.. The changed behavior is a live workflow/sandbox/dashboard lane. Static support tests cover selector and workflow-shape drift, but dashboard behavior ultimately depends on runtime installation, sandbox forwarding, hosted inference, and artifact creation.
  • PRA-T3 Runtime validation — Extend the dashboard workflow boundary mutation test to reject changing `Install root dependencies` from `npm ci --ignore-scripts` to a script-running install command.. The changed behavior is a live workflow/sandbox/dashboard lane. Static support tests cover selector and workflow-shape drift, but dashboard behavior ultimately depends on runtime installation, sandbox forwarding, hosted inference, and artifact creation.
  • PRA-T4 Runtime validation — Extend the dashboard workflow boundary mutation test to reject artifact upload drift: `include-hidden-files: true`, `if-no-files-found: error`, and retention other than 14 days.. The changed behavior is a live workflow/sandbox/dashboard lane. Static support tests cover selector and workflow-shape drift, but dashboard behavior ultimately depends on runtime installation, sandbox forwarding, hosted inference, and artifact creation.
  • PRA-T5 Runtime validation — Identify a dashboard-enabled live validation artifact that shows `dashboardChecked: true` and output under `e2e-artifacts/vitest/hermes-dashboard/`; do not rely on this advisor review to evaluate external E2E job status.. The changed behavior is a live workflow/sandbox/dashboard lane. Static support tests cover selector and workflow-shape drift, but dashboard behavior ultimately depends on runtime installation, sandbox forwarding, hosted inference, and artifact creation.
  • PRA-T6 Dashboard workflow contract misses trusted-boundary drift for the secret-consuming job — Extend `validateHermesDashboardWorkflow` and its mutation test to enforce the same trusted-boundary invariants already present in the workflow: checkout full-SHA with `persist-credentials: false`, setup-node full-SHA, `Install root dependencies` running `npm ci --ignore-scripts`, no `NVIDIA_INFERENCE_API_KEY` outside the Vitest run step, and artifact upload `include-hidden-files: false`, `if-no-files-found: ignore`, and `retention-days: 14`.
  • PRA-T7 Acceptance clause — add an executable workflow contract with mutation coverage for dashboard mode, Vitest execution, and result aggregation drift — add test evidence or identify existing coverage. The new test mutates dashboard mode, the Vitest run script, and reporting needs. It does not yet mutate or assert several trusted-boundary fields for this secret-consuming job, including checkout credential persistence, install command safety, non-run-step secret exposure, and artifact upload safety.
Since last review details

Current findings, using the urgency labels above:

PRA-1 Resolve/justify — Dashboard workflow contract misses trusted-boundary drift for the secret-consuming job

  • Location: tools/e2e-scenarios/hermes-dashboard-workflow-boundary.mts:44
  • Category: tests
  • Problem: The new `hermes-dashboard-vitest` job receives `NVIDIA_INFERENCE_API_KEY`, but the new dashboard-specific validator only checks a subset of the workflow boundary: dashboard env, runner/timeout, Vitest command, upload action pin/path, and `report-to-pr` needs. It does not reject checkout credential persistence, secret env on setup/install/build/upload steps, changing `npm ci --ignore-scripts` to a script-running install, or unsafe artifact upload settings such as `include-hidden-files: true`, `if-no-files-found: error`, or nonstandard retention. The current YAML is safe on these points, but the executable contract added by this PR would not catch several local regressions that matter for a secret-consuming GitHub Actions lane.
  • Impact: A future edit to this new job could accidentally expose the checkout token, run package scripts before the controlled build, pass the inference secret to broader setup steps, or upload hidden files without the dashboard boundary test failing. That weakens the review value of the new contract around workflow trusted-code and credential hygiene.
  • Recommended action: Extend `validateHermesDashboardWorkflow` and its mutation test to enforce the same trusted-boundary invariants already present in the workflow: checkout full-SHA with `persist-credentials: false`, setup-node full-SHA, `Install root dependencies` running `npm ci --ignore-scripts`, no `NVIDIA_INFERENCE_API_KEY` outside the Vitest run step, and artifact upload `include-hidden-files: false`, `if-no-files-found: ignore`, and `retention-days: 14`.
  • Expected follow-up: Resolve in this PR or explain why the risk is acceptable.
  • Verification: Read `validateHermesDashboardWorkflow` in `tools/e2e-scenarios/hermes-dashboard-workflow-boundary.mts` and compare it with the new `hermes-dashboard-vitest` job in `.github/workflows/e2e-vitest-scenarios.yaml`; the omitted checks are visible in the YAML but absent from the validator and mutation assertions.
  • Missing regression test: Add mutations in `test/e2e-scenario/support-tests/hermes-dashboard-workflow-boundary.test.ts` that set checkout `persist-credentials: true`, add `NVIDIA_INFERENCE_API_KEY` to `Install root dependencies.env`, change install to `npm install`, and set upload `include-hidden-files: true` / `if-no-files-found: error` / `retention-days: 1`, then assert the validator reports each drift.
  • Done when: The risk is fixed or explicitly justified in the PR. Verification: Read `validateHermesDashboardWorkflow` in `tools/e2e-scenarios/hermes-dashboard-workflow-boundary.mts` and compare it with the new `hermes-dashboard-vitest` job in `.github/workflows/e2e-vitest-scenarios.yaml`; the omitted checks are visible in the YAML but absent from the validator and mutation assertions.
  • Evidence: The new validator checks `NEMOCLAW_E2E_HERMES_DASHBOARD`, the Vitest command, `run.env.NVIDIA_INFERENCE_API_KEY`, upload action pin/path, and `report-to-pr.needs`; the new mutation test only changes dashboard mode, execution, and reporting. The workflow job itself also contains checkout `persist-credentials: false`, `npm ci --ignore-scripts`, and artifact safety settings that are not covered by the dashboard-specific validator.

Workflow run details

This is an automated, non-binding review; it still expects maintainers and agents to respond to each required or warning item. Treat suggestions as current-PR improvements when they touch changed code; defer only with maintainer rationale or a linked follow-up. A human maintainer must make the final merge decision.

@coderabbitai coderabbitai Bot left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Actionable comments posted: 1

🧹 Nitpick comments (1)
tools/e2e-scenarios/hermes-dashboard-workflow-boundary.mts (1)

53-53: 📐 Maintainability & Code Quality | 🔵 Trivial | ⚡ Quick win

Treat needs as a dependency set, not a YAML spelling.

Line 53 only accepts the scalar form. needs: [generate-matrix] is behaviorally equivalent in GitHub Actions, but this validator would reject it and create churn in the boundary test for a non-contract change.

Suggested refactor
+function includesNeed(job: WorkflowJob, expected: string): boolean {
+  const needs = Array.isArray(job.needs) ? job.needs : job.needs ? [job.needs] : [];
+  return needs.includes(expected);
+}
+
 export function validateHermesDashboardWorkflow(workflow: HermesDashboardWorkflow): string[] {
   const errors: string[] = [];
   const job = workflow.jobs[JOB_NAME] ?? {};
   const env = job.env ?? {};
 
-  requireEqual(errors, job.needs, "generate-matrix", `${JOB_NAME} must depend on generate-matrix`);
+  if (!includesNeed(job, "generate-matrix")) {
+    errors.push(`${JOB_NAME} must depend on generate-matrix`);
+  }
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@tools/e2e-scenarios/hermes-dashboard-workflow-boundary.mts` at line 53, The
boundary check in the workflow validator is treating job.needs as only a scalar
string, so it will incorrectly fail valid equivalent array syntax like needs:
[generate-matrix]. Update the assertion around requireEqual in the
hermes-dashboard-workflow-boundary test to accept needs as a dependency
set/collection and compare semantically against generate-matrix, rather than
enforcing one YAML spelling.
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In `@tools/e2e-scenarios/hermes-dashboard-workflow-boundary.mts`:
- Around line 48-105: The boundary validator in validateHermesDashboardWorkflow
currently checks the Hermes dashboard job wiring but does not verify the
hermes-dashboard-vitest selector gate. Add a deterministic assertion for the
workflow/job selector state (the jobs/scenarios gate for
hermes-dashboard-vitest) so the inventory cannot mark it selectable unless the
real workflow would run it by default; use the existing workflow object and
related job lookup helpers to validate the selector source of truth alongside
the current requires/step checks.

---

Nitpick comments:
In `@tools/e2e-scenarios/hermes-dashboard-workflow-boundary.mts`:
- Line 53: The boundary check in the workflow validator is treating job.needs as
only a scalar string, so it will incorrectly fail valid equivalent array syntax
like needs: [generate-matrix]. Update the assertion around requireEqual in the
hermes-dashboard-workflow-boundary test to accept needs as a dependency
set/collection and compare semantically against generate-matrix, rather than
enforcing one YAML spelling.
🪄 Autofix (Beta)

Fix all unresolved CodeRabbit comments on this PR:

  • Push a commit to this branch (recommended)
  • Create a new PR with the fixes

ℹ️ Review info
⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Enterprise

Run ID: 14a59c6e-0f1a-454d-aeb8-fcc6e3db7fee

📥 Commits

Reviewing files that changed from the base of the PR and between b4063f6 and 4c3f514.

📒 Files selected for processing (3)
  • .github/workflows/e2e-vitest-scenarios.yaml
  • test/e2e-scenario/support-tests/hermes-dashboard-workflow-boundary.test.ts
  • tools/e2e-scenarios/hermes-dashboard-workflow-boundary.mts

Comment thread tools/e2e-scenarios/hermes-dashboard-workflow-boundary.mts
@cv
cv merged commit d1988dc into main Jun 28, 2026
47 checks passed
@cv
cv deleted the codex/e2e-hermes-variant-parity branch June 28, 2026 06:00
@github-actions

Copy link
Copy Markdown
Contributor

Vitest E2E Scenario Results — ✅ All requested jobs passed

Run: 28313287973
Workflow ref: main
Requested scenarios: (default — all supported)
Requested jobs: hermes-dashboard-vitest
Summary: 1 passed, 0 failed, 0 cancelled, 0 skipped

Job Result
hermes-dashboard-vitest ✅ success

@cv cv added v0.0.69 and removed v0.0.70 labels Jun 29, 2026
Hadar301 pushed a commit to Hadar301/NemoClaw-OpenShift that referenced this pull request Jul 12, 2026
## Summary

Restores the missing Hermes dashboard variant in the Vitest E2E workflow
so the new suite covers the same dashboard-enabled journey as the legacy
nightly workflow. The job is default-enabled, independently selectable,
and reported through the common PR result job.

This is the first landable slice of NVIDIA#5919: establish variant parity
while both E2E implementations still exist, collect live-run evidence,
then remove the legacy suite only after the domain gates are satisfied.

## Related Issue

Refs NVIDIA#5919

## Changes

- add a dedicated `hermes-dashboard-vitest` job that runs the existing
Hermes live test with dashboard coverage enabled
- expose `hermes-dashboard` through the generated free-standing job
inventory and both selective dispatch paths
- include dashboard artifacts and the job result in `report-to-pr`
- add an executable workflow contract with mutation coverage for
dashboard mode, Vitest execution, and result aggregation drift

## Type of Change

- [x] Code change (feature, bug fix, or refactor)
- [ ] Code change with doc updates
- [ ] Doc only (prose changes, no code sample modifications)
- [ ] Doc only (includes code sample changes)

## Quality Gates

- [x] Tests added or updated for changed behavior
- [ ] Existing tests cover changed behavior — justification:
- [ ] Tests not applicable — justification:
- [ ] Docs updated for user-facing behavior changes
- [x] Docs not applicable — justification: CI-only E2E workflow
coverage; no user-facing behavior or interface changes
- [ ] Sensitive paths changed (security, policy, credentials, preflight,
onboarding, inference, runner, sandbox, or messaging)
- [ ] Sensitive-path review completed or maintainer-approved waiver
recorded — reviewer/approval link/justification:
- [ ] Non-success, skipped, or missing CI check accepted by maintainer —
check name, approval link, and follow-up issue:

## Verification

- [x] PR description includes the DCO sign-off declaration and every
commit appears as `Verified` in GitHub
- [x] Git hooks passed during commit and push, or `npx prek run
--from-ref main --to-ref HEAD` passes
- [x] Targeted tests pass for changed behavior
- [ ] Full `npm test` passes (broad runtime changes only)
- [x] Quality Gates section completed with required justifications or
waivers
- [x] No secrets, API keys, or credentials committed
- [ ] `npm run docs` builds without warnings (doc changes only)
- [ ] Doc pages follow the [style
guide](https://github.com/NVIDIA/NemoClaw/blob/main/docs/CONTRIBUTING.md)
(doc changes only)
- [ ] New doc pages include SPDX header and frontmatter (new pages only)

Targeted evidence: `npx vitest run --project e2e-vitest-support` (53
files, 385 tests); `npm run typecheck:cli`; source-shape and test-size
ratchets; normal commit and push hooks.

---

Signed-off-by: Carlos Villela <cvillela@nvidia.com>


<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->

## Summary by CodeRabbit

* **New Features**
* Added a new end-to-end dashboard test run to the release workflow,
available by default or when explicitly selected.
* Included live Vitest coverage for the Hermes dashboard scenario and
published dedicated artifacts for easier review.

* **Bug Fixes**
* Improved workflow validation to ensure the dashboard test run, its
required settings, and its reporting step stay correctly connected.
* Added guardrails to catch configuration changes that would skip
required dashboard coverage.

<!-- end of auto-generated comment: release notes by coderabbit.ai -->

Signed-off-by: Carlos Villela <cvillela@nvidia.com>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

area: ci CI workflows, checks, release automation, or GitHub Actions area: e2e End-to-end tests, nightly failures, or validation infrastructure chore Build, CI, dependency, or tooling maintenance

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants