fix(e2e): stage device auth through hosted inference - #6071
Merged
Conversation
Contributor
📝 WalkthroughWalkthroughDevice-auth health E2E helper now builds environment variables via ChangesDevice-auth Health Hosted Inference Wiring
Estimated code review effort🎯 2 (Simple) | ⏱️ ~10 minutes 🚥 Pre-merge checks | ✅ 3 | ❌ 2❌ Failed checks (2 warnings)
✅ Passed checks (3 passed)
✨ Finishing Touches📝 Generate docstrings
🧪 Generate unit tests (beta)
Comment |
Contributor
Code Coverage OverviewLanguages: TypeScript TypeScript / code-coverage/pluginThe overall coverage in the Show a code coverage summary of the most covered files.
TypeScript / code-coverage/cliThe overall coverage in the Show a code coverage summary of the most covered files.
Updated |
Contributor
E2E Advisor RecommendationRequired E2E: None Dispatch hint: Full advisor summaryE2E Recommendation AdvisorBase: Required E2E
Optional E2E
New E2E recommendations
Dispatch hint
|
Contributor
E2E Target RecommendationRequired E2E targets: Dispatch required E2E targets:
Full E2E target advisor summaryE2E Target AdvisorBase: Required E2E targets
Optional E2E targets
Relevant changed files
|
Contributor
PR Review Advisor — Changes requestedMerge posture: Do not merge yet Action checklist
Findings index
🚨 Required before mergeAddress these before merging unless a maintainer explicitly overrides the advisor with rationale.
|
Contributor
PR Review Advisor (Nemotron Ultra) — No blocking findingsMerge posture: No blocking advisor findings Action checklist
Findings index
Review findings by urgency: 0 required fixes, 0 items to resolve/justify, 5 in-scope improvements
|
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
Contributor
There was a problem hiding this comment.
🧹 Nitpick comments (1)
test/e2e/support/device-auth-health-helpers.test.ts (1)
26-65: 🎯 Functional Correctness | 🔵 Trivial | ⚡ Quick winMissing coverage for the "no API key" branch.
Per the AI summary,
commandEnv/the hosted env merge happens "when an API key is supplied," implying a conditional branch. Both tests here only exercise the happy path with"repo-hosted-key". Since this PR's objective is specifically to stop staging the key as the public NVIDIA provider, a test asserting behavior when no key is provided (e.g., env omits hosted/provider overrides, or throws as expected) would more fully prove the superseded path is gone, per the path instructions for migration tests.🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@test/e2e/support/device-auth-health-helpers.test.ts` around lines 26 - 65, The hosted inference tests only cover the branch where an API key is present, so add coverage for the no-key path in the device auth helpers. Extend the assertions around `commandEnv` and `installDeviceAuthSandbox` to verify what happens when no hosted credential is supplied, using the existing `commandEnv` and `installDeviceAuthSandbox` symbols to locate the logic. The new test should confirm the merged hosted/provider overrides are not staged without an API key, or that the expected fallback/error behavior is triggered, so the conditional path is fully exercised.Source: Path instructions
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Nitpick comments:
In `@test/e2e/support/device-auth-health-helpers.test.ts`:
- Around line 26-65: The hosted inference tests only cover the branch where an
API key is present, so add coverage for the no-key path in the device auth
helpers. Extend the assertions around `commandEnv` and
`installDeviceAuthSandbox` to verify what happens when no hosted credential is
supplied, using the existing `commandEnv` and `installDeviceAuthSandbox` symbols
to locate the logic. The new test should confirm the merged hosted/provider
overrides are not staged without an API key, or that the expected fallback/error
behavior is triggered, so the conditional path is fully exercised.
ℹ️ Review info
⚙️ Run configuration
Configuration used: Path: .coderabbit.yaml
Review profile: CHILL
Plan: Enterprise
Run ID: fcfbd374-1709-4ac6-859d-f3506bb0dc8d
📒 Files selected for processing (2)
test/e2e/live/device-auth-health-helpers.tstest/e2e/support/device-auth-health-helpers.test.ts
Contributor
Vitest E2E Target Results — ✅ All requested jobs passedRun: 28479446004
|
Hadar301
pushed a commit
to Hadar301/NemoClaw-OpenShift
that referenced
this pull request
Jul 12, 2026
<!-- markdownlint-disable MD041 --> ## Summary Fixes the `device-auth-health` live E2E wiring so the repo `NVIDIA_INFERENCE_API_KEY` is staged through the shared hosted-compatible inference config instead of being validated as the public NVIDIA endpoint provider. The install helper now starts each install attempt with `--fresh` so Vitest retries do not fail on leftover failed onboarding session state. ## Related Issue Fixes NVIDIA#2342 ## Changes - Stage `device-auth-health` installs with `requireHostedInferenceConfig`, including `COMPATIBLE_API_KEY`, `NEMOCLAW_PROVIDER=custom`, and the hosted-compatible default endpoint/model. - Run the live install path with `install.sh --non-interactive --fresh` to prevent retry attempts from tripping the failed-session guard. - Add E2E support coverage for the helper env contract and install arguments. ## Type of Change - [x] Code change (feature, bug fix, or refactor) - [ ] Code change with doc updates - [ ] Doc only (prose changes, no code sample modifications) - [ ] Doc only (includes code sample changes) ## Quality Gates <!-- Check all that apply. For any "covered by existing tests", "not applicable", or waiver entry, add a brief justification on the same line or in the Changes section. --> - [x] Tests added or updated for changed behavior - [ ] Existing tests cover changed behavior — justification: - [ ] Tests not applicable — justification: - [ ] Docs updated for user-facing behavior changes - [x] Docs not applicable — justification: internal E2E CI wiring only; no user-facing behavior change - [x] Sensitive paths changed (security, policy, credentials, preflight, onboarding, inference, runner, sandbox, or messaging) - [x] Sensitive-path review completed or maintainer-approved waiver recorded — reviewer/approval link/justification: self-reviewed credential/inference test wiring; secrets are still passed only via fixture env and redaction values - [ ] Non-success, skipped, or missing CI check accepted by maintainer — check name, approval link, and follow-up issue: ## Verification <!-- Check each item you ran and confirmed. Leave unchecked items you skipped. Doc-only changes do not require npm test unless you ran it. --> - [x] PR description includes the DCO sign-off declaration and every commit appears as `Verified` in GitHub - [ ] Git hooks passed during commit and push, or `npx prek run --from-ref main --to-ref HEAD` passes - [x] Targeted tests pass for changed behavior - [ ] Full `npm test` passes (broad runtime changes only) - [x] Quality Gates section completed with required justifications or waivers - [x] No secrets, API keys, or credentials committed - [ ] `npm run docs` builds without warnings (doc changes only) - [ ] Doc pages follow the [style guide](https://github.com/NVIDIA/NemoClaw/blob/main/docs/CONTRIBUTING.md) (doc changes only) - [ ] New doc pages include SPDX header and frontmatter (new pages only) Verification run: - `npx @biomejs/biome check test/e2e/live/device-auth-health-helpers.ts test/e2e/support/device-auth-health-helpers.test.ts` - `npx vitest run --project e2e-support test/e2e/support/device-auth-health-helpers.test.ts test/e2e/support/hosted-inference.test.ts --silent=false --reporter=default` - `npm run build:cli && npm run typecheck:cli` - Commit hook ran with `SKIP=test-cli`; the broad CLI coverage hook failed unrelated local macOS environment checks requiring GNU `timeout`, privileged control paths, and shell assumptions. Push TypeScript hooks passed, and targeted tests above passed. --- <!-- DCO sign-off is required in this PR description, and every commit must appear as Verified in GitHub. Run: git config user.name && git config user.email --> Signed-off-by: Julie Yaunches <jyaunches@nvidia.com> <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **Bug Fixes** * Improved device auth health setup to correctly use hosted inference credentials when available. * Updated sandbox installation to use a fresh install path during retries, helping avoid stale setup issues. * Added coverage for hosted inference environment wiring and install behavior to improve reliability of end-to-end checks. <!-- end of auto-generated comment: release notes by coderabbit.ai -->
wscurran
added
area: ci
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Fixes the
device-auth-healthlive E2E wiring so the repoNVIDIA_INFERENCE_API_KEYis staged through the shared hosted-compatible inference config instead of being validated as the public NVIDIA endpoint provider. The install helper now starts each install attempt with--freshso Vitest retries do not fail on leftover failed onboarding session state.Related Issue
Fixes #2342
Changes
device-auth-healthinstalls withrequireHostedInferenceConfig, includingCOMPATIBLE_API_KEY,NEMOCLAW_PROVIDER=custom, and the hosted-compatible default endpoint/model.install.sh --non-interactive --freshto prevent retry attempts from tripping the failed-session guard.Type of Change
Quality Gates
Verification
Verifiedin GitHubnpx prek run --from-ref main --to-ref HEADpassesnpm testpasses (broad runtime changes only)npm run docsbuilds without warnings (doc changes only)Verification run:
npx @biomejs/biome check test/e2e/live/device-auth-health-helpers.ts test/e2e/support/device-auth-health-helpers.test.tsnpx vitest run --project e2e-support test/e2e/support/device-auth-health-helpers.test.ts test/e2e/support/hosted-inference.test.ts --silent=false --reporter=defaultnpm run build:cli && npm run typecheck:cliSKIP=test-cli; the broad CLI coverage hook failed unrelated local macOS environment checks requiring GNUtimeout, privileged control paths, and shell assumptions. Push TypeScript hooks passed, and targeted tests above passed.Signed-off-by: Julie Yaunches jyaunches@nvidia.com
Summary by CodeRabbit