ci(e2e): restore Docker Hub authentication coverage - #6100
Merged
Conversation
Signed-off-by: Carlos Villela <cvillela@nvidia.com>
Contributor
Code Coverage OverviewLanguages: TypeScript TypeScript / code-coverage/pluginThe overall coverage in the Show a code coverage summary of the most covered files.
TypeScript / code-coverage/cliThe overall coverage in the Show a code coverage summary of the most covered files.
Updated |
Contributor
E2E Advisor RecommendationRequired E2E: Dispatch hint: Full advisor summaryE2E Recommendation AdvisorBase: Required E2E
Optional E2E
New E2E recommendations
Dispatch hint
|
Contributor
E2E Target RecommendationRequired E2E targets: Dispatch required E2E targets:
Full E2E target advisor summaryE2E Target AdvisorBase: Required E2E targets
Optional E2E targets
Relevant changed files
|
Contributor
PR Review Advisor (Nemotron Ultra) — InformationalMerge posture: Informational / low confidence Action checklist
Findings index
Review findings by urgency: 0 required fixes, 1 item to resolve/justify, 0 in-scope improvements
|
Contributor
PR Review Advisor — BlockedMerge posture: Do not merge until addressed Action checklist
Findings index
🚨 Required before mergeAddress these before merging unless a maintainer explicitly overrides the advisor with rationale.
|
Signed-off-by: Carlos Villela <cvillela@nvidia.com>
Contributor
|
No actionable comments were generated in the recent review. 🎉 ℹ️ Recent review info⚙️ Run configurationConfiguration used: Path: .coderabbit.yaml Review profile: CHILL Plan: Enterprise Run ID: 📒 Files selected for processing (2)
🚧 Files skipped from review as they are similar to previous changes (2)
📝 WalkthroughWalkthroughThis PR centralizes Docker Hub authentication and cleanup for E2E workflows, adds a shared cleanup script and shared auth step, and updates workflow boundary validation plus tests to enforce the new canonical shared-auth contract. ChangesDocker Hub Auth Centralization
Estimated code review effort: 5 (Critical) | ~120 minutes Sequence Diagram(s)sequenceDiagram
participant E2EJob
participant dockerhub-auth
participant DockerHub
participant docker-auth-cleanup.sh
E2EJob->>dockerhub-auth: run after checkout
dockerhub-auth->>DockerHub: docker login or skip for untrusted refs
E2EJob->>E2EJob: run build and test steps
E2EJob->>docker-auth-cleanup.sh: bash .github/scripts/docker-auth-cleanup.sh
docker-auth-cleanup.sh->>DockerHub: docker logout docker.io
Suggested labels: 🚥 Pre-merge checks | ✅ 3 | ❌ 2❌ Failed checks (2 warnings)
✅ Passed checks (3 passed)
✨ Finishing Touches📝 Generate docstrings
🧪 Generate unit tests (beta)
Comment |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
Contributor
There was a problem hiding this comment.
Actionable comments posted: 1
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In `@tools/e2e/workflow-boundary.mts`:
- Around line 2578-2595: The step validation in workflow-boundary.mts still
allows a later step to bypass the isolated Docker auth config by setting
env.DOCKER_CONFIG, even though job-level checks exist. Update the per-step loop
that builds stepName/stepEnv and runs the auth/cleanup checks to also reject any
step-level DOCKER_CONFIG override outside the auth step, using the existing
error collection pattern alongside requireEnvDoesNotExposeSecret and the
runScript validation.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Path: .coderabbit.yaml
Review profile: CHILL
Plan: Enterprise
Run ID: fc0192ee-1e55-4367-8416-ca576a4ad4c9
📒 Files selected for processing (13)
.github/scripts/docker-auth-cleanup.sh.github/workflows/e2e.yamltest/e2e-release-gate-workflow.test.tstest/e2e/support/dockerhub-auth-workflow-boundary.test.tstest/e2e/support/e2e-workflow.test.tstest/e2e/support/hermes-secret-boundary-workflow.test.tstest/e2e/support/inference-switch-workflow-boundary.test.tstest/e2e/support/openclaw-slack-workflow-boundary.test.tstest/e2e/support/sandbox-operations-workflow-boundary.test.tstest/e2e/support/tunnel-lifecycle-workflow-boundary.test.tstools/e2e/inference-switch-workflow-boundary.mtstools/e2e/sandbox-operations-workflow-boundary.mtstools/e2e/workflow-boundary.mts
💤 Files with no reviewable changes (2)
- test/e2e/support/openclaw-slack-workflow-boundary.test.ts
- test/e2e/support/tunnel-lifecycle-workflow-boundary.test.ts
Signed-off-by: Carlos Villela <cvillela@nvidia.com>
Hadar301
pushed a commit
to Hadar301/NemoClaw-OpenShift
that referenced
this pull request
Jul 12, 2026
<!-- markdownlint-disable MD041 --> ## Summary <!-- 1-3 sentences: what this PR does and why. --> Restores Docker Hub authentication across every image-consuming scheduled/manual-main E2E job after the legacy nightly workflow retirement left 27 jobs anonymous. Trusted main runs now use one guarded login contract, while untrusted refs retain isolated anonymous Docker configs. ## Related Issue <!-- Fixes #NNN or Closes #NNN. Remove this section if none. --> Fixes NVIDIA#4036 ## Changes <!-- Bullet list of key changes. --> - Apply the canonical guarded login to all 67 image-consuming E2E jobs, with six no-image jobs kept as explicit exemptions. - Add hardened isolated cleanup, a trusted-login marker, bounded retries, and fail-closed behavior for trusted runs. - Centralize regression validation and behavior tests so future E2E jobs cannot silently omit authentication. ## Type of Change - [x] Code change (feature, bug fix, or refactor) - [ ] Code change with doc updates - [ ] Doc only (prose changes, no code sample modifications) - [ ] Doc only (includes code sample changes) ## Quality Gates <!-- Check all that apply. For any "covered by existing tests", "not applicable", or waiver entry, add a brief justification on the same line or in the Changes section. --> - [x] Tests added or updated for changed behavior - [ ] Existing tests cover changed behavior — justification: - [ ] Tests not applicable — justification: - [ ] Docs updated for user-facing behavior changes - [x] Docs not applicable — justification: Internal CI workflow/auth boundary only; no user-facing behavior or documentation surface changes. - [x] Sensitive paths changed (security, policy, credentials, preflight, onboarding, inference, runner, sandbox, or messaging) - [x] Sensitive-path review completed or maintainer-approved waiver recorded — reviewer/approval link/justification: Credential scope and cleanup boundaries were reviewed locally; guards restrict secrets to NVIDIA/NemoClaw main schedule/manual runs, and focused adversarial tests cover traversal and symlink attacks. - [ ] Non-success, skipped, or missing CI check accepted by maintainer — check name, approval link, and follow-up issue: ## Verification <!-- Check each item you ran and confirmed. Leave unchecked items you skipped. Doc-only changes do not require npm test unless you ran it. --> - [x] PR description includes the DCO sign-off declaration and every commit appears as `Verified` in GitHub - [x] Git hooks passed during commit and push, or `npx prek run --from-ref main --to-ref HEAD` passes - [x] Targeted tests pass for changed behavior - [x] Full `npm test` passes (broad runtime changes only) - [x] Quality Gates section completed with required justifications or waivers - [x] No secrets, API keys, or credentials committed - [ ] `npm run docs` builds without warnings (doc changes only) - [ ] Doc pages follow the [style guide](https://github.com/NVIDIA/NemoClaw/blob/main/docs/CONTRIBUTING.md) (doc changes only) - [ ] New doc pages include SPDX header and frontmatter (new pages only) --- <!-- DCO sign-off is required in this PR description, and every commit must appear as Verified in GitHub. Run: git config user.name && git config user.email --> Signed-off-by: Carlos Villela <cvillela@nvidia.com> <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **New Features** * Centralized Docker Hub authentication and cleanup across E2E workflows for more consistent CI behavior. * Standardized guarded login and cleanup so image jobs follow the same audited process. * **Bug Fixes** * Reduced the risk of leftover Docker credentials by cleaning up auth state reliably after runs. * Improved handling when authentication is skipped or fails, preventing unsafe credential persistence. * **Tests** * Expanded workflow boundary coverage to enforce the canonical auth/cleanup steps, ordering, and secret-safety rules. <!-- end of auto-generated comment: release notes by coderabbit.ai --> --------- Signed-off-by: Carlos Villela <cvillela@nvidia.com>
This was referenced Jul 18, 2026
wscurran
added
area: ci
23 tasks
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Restores Docker Hub authentication across every image-consuming scheduled/manual-main E2E job after the legacy nightly workflow retirement left 27 jobs anonymous. Trusted main runs now use one guarded login contract, while untrusted refs retain isolated anonymous Docker configs.
Related Issue
Fixes #4036
Changes
Type of Change
Quality Gates
Verification
Verifiedin GitHubnpx prek run --from-ref main --to-ref HEADpassesnpm testpasses (broad runtime changes only)npm run docsbuilds without warnings (doc changes only)Signed-off-by: Carlos Villela cvillela@nvidia.com
Summary by CodeRabbit