fix(images): refresh shared curl pin - #6684
Closed
chengjiew wants to merge 5 commits into
Closed
Conversation
Signed-off-by: Chengjie Wang <chengjiew@nvidia.com>
Contributor
📝 WalkthroughWalkthroughUpdates pinned Debian ChangesCurl pin alignment
Estimated code review effort: 2 (Simple) | ~10 minutes 🚥 Pre-merge checks | ✅ 5✅ Passed checks (5 passed)
✨ Finishing Touches📝 Generate docstrings
🧪 Generate unit tests (beta)
Comment |
Contributor
Code Coverage OverviewLanguages: TypeScript TypeScript / code-coverage/pluginThe overall coverage remains at 96%, unchanged from the TypeScript / code-coverage/cliThe overall coverage in the Show a code coverage summary of the most impacted files.
Updated |
Contributor
E2E Advisor RecommendationRequired E2E: Dispatch hint: Full advisor summaryE2E Recommendation AdvisorBase: Required E2E
Optional E2E
New E2E recommendations
Dispatch hint
|
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
Contributor
There was a problem hiding this comment.
Actionable comments posted: 1
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In `@test/dcode-base-image-workflow.test.ts`:
- Around line 74-79: Update the test case “keeps shared apt package pins aligned
across all sandbox base images (`#6679`)” to explicitly assert that the pinned
curl version is 8.14.1-2+deb13u4, while retaining the existing Set-based
assertion that all Dockerfiles use the same version.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Path: .coderabbit.yaml
Review profile: CHILL
Plan: Enterprise
Run ID: a684490d-8de2-4ecb-9f5d-6dad890f3311
📒 Files selected for processing (4)
Dockerfile.baseagents/hermes/Dockerfile.baseagents/langchain-deepagents-code/Dockerfile.basetest/dcode-base-image-workflow.test.ts
Contributor
PR Review Advisor (Nemotron Ultra) — No blocking findingsMerge posture: No blocking advisor findings Action checklist
Test follow-ups to resolve or justifyIf these cover changed behavior, prefer adding them in this PR; otherwise state why existing coverage is enough or link the follow-up.
This is an automated, non-binding review; it still expects maintainers and agents to respond to each required or warning item. Treat suggestions as current-PR improvements when they touch changed code; defer only with maintainer rationale or a linked follow-up. A human maintainer must make the final merge decision. |
Contributor
PR Review Advisor — No blocking findingsMerge posture: No blocking advisor findings This is an automated review. Required findings need action before merge. Warnings and optional suggestions do not require a response or follow-up. A human maintainer makes the final merge decision. |
2 tasks
Signed-off-by: Julie Yaunches <jyaunches@nvidia.com>
Signed-off-by: Julie Yaunches <jyaunches@nvidia.com>
Contributor
|
Superseded by #6689, which carries the same curl pin update and regression coverage on a clean, fully verified branch and includes the integration-fixture CI fix. This PR contains an unverified published commit and cannot be repaired without rewriting published history. |
Contributor
|
Thank you @chengjiew for identifying the shared curl pin problem, updating both base images, and adding the regression coverage. Your work directly informed the clean replacement in #6689. For future NemoClaw PRs, could you please set up commit signing so every commit appears as Verified on GitHub before it is pushed? The repository requires verified commits in contributor-owned PRs, and published unverified history cannot be rewritten here. GitHub’s official setup guide covers the supported GPG, SSH, and S/MIME options: https://docs.github.com/en/authentication/managing-commit-signature-verification/signing-commits |
23 tasks
ericksoa
pushed a commit
that referenced
this pull request
Aug 1, 2026
<!-- markdownlint-disable MD041 --> ## Summary The #6684/#6689 supersession exposed that the maintainer workflow could select a replacement and recommend closing its source without checking whether transferred work retained machine-readable contributor attribution. This change treats supersession as relationship evidence, requires exact source-commit authorship or co-authorship before selection and closure, and preserves the existing authorization boundaries. ## Changes - Add canonical policy for superseded PR attribution, safe DCO handling, and independent implementations. - Classify replacement work as `independent`, `transferred`, or `unclear`, and leave the winner unset when attribution evidence is missing. - Remove supersession as a comparator tiebreaker. - Sequence transferred work before revalidation, merge, and source-PR closure in the comparator verdict and review finder. - Add a focused source-contract test for attribution, contributor identity, ranking, and operation order. - Keep `render-verdict.py` and `validation/backtest.md` unchanged because this is a reviewer workflow contract, not a renderer gate. ## Type of Change - [x] Code change (feature, bug fix, or refactor) - [ ] Code change with doc updates - [ ] Doc only (prose changes, no code sample modifications) - [ ] Doc only (includes code sample changes) ## Quality Gates - [x] Tests added or updated for changed behavior - [ ] Existing tests cover changed behavior — justification: - [ ] Tests not applicable — justification: - [ ] Docs updated for user-facing behavior changes - [x] Docs not applicable — justification: This changes maintainer-agent policy and skill behavior, not a NemoClaw API, CLI, configuration, UI, runtime workflow, or published documentation page. - [x] Sensitive paths changed (security, policy, credentials, preflight, onboarding, inference, runner, sandbox, or messaging) - [x] Sensitive-path review completed or maintainer-approved waiver recorded — reviewer/approval link/justification: Maintainer-directed attribution policy change; canonical write-authorization boundaries remain explicit, the focused contract passes, and the independent review found no issues. - [ ] Non-success, skipped, or missing CI check accepted by maintainer — check name, approval link, and follow-up issue: ## Documentation Writer Review - [x] Documentation writer subagent reviewed the completed changes - Result: `no-docs-needed` - Evidence: Reviewed the complete seven-file diff, including the active/passive parser direction fix and duplicate-edge regression coverage, after hook formatting. No `docs/` change is needed because the change affects only maintainer-agent behavior. The final review found no issues; the focused contract passed 18/18, and repository-managed shfmt and ShellCheck passed. - Agent: Codex Desktop <!-- docs-review-head-sha: 52fdd4a --> <!-- docs-review-agents-blob-sha: c052d60 --> ## DGX Station Hardware Evidence - [ ] Tested on DGX Station - Tested commit: - Station profile/scenario: - Result: - Supporting evidence: ## Verification - [x] PR description includes a `Signed-off-by:` line and every commit appears as `Verified` in GitHub - [x] Normal `pre-commit`, `commit-msg`, and `pre-push` hooks passed, or `npm run validate:pr` passed after refreshing `origin/main` when hooks were skipped or unavailable - [x] Targeted behavior tests pass for the current change set, or tests are marked not applicable above — `npx vitest run --project integration test/maintainer-skills-policy.test.ts`: 18/18 passed; `npx vitest run --project integration test/skills-frontmatter.test.ts`: 29/29 passed; repository-managed shfmt and ShellCheck: passed; `npm run checks:repository`: passed. - [ ] Applicable broad gate passed — `npm test` for broad runtime/test-harness changes; `npm run check` for repo-wide validation/coverage changes — command/result: Not applicable to scoped maintainer skill guidance and its source-contract test. - [x] Quality Gates section completed with required justifications or waivers - [x] No secrets, API keys, or credentials committed - [ ] `npm run docs` builds without warnings (doc changes only) - [ ] Doc pages follow the [style guide](https://github.com/NVIDIA/NemoClaw/blob/main/docs/CONTRIBUTING.md) (doc changes only) - [ ] New doc pages include SPDX header and frontmatter (new pages only) --- Signed-off-by: Carlos Villela <cvillela@nvidia.com> <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **Documentation** * Added guidance for handling superseded pull requests, including contribution attribution, authorship preservation, DCO verification, and maintainer authorization. * Clarified how to distinguish independent, transferred, and unclear work relationships. * Updated comparison and verdict guidance to require attribution, commit, and diff verification before selecting a replacement or closing a pull request. * **Bug Fixes** * Improved recognition and direction of active and passive supersession statements. * Prevented duplicate supersession relationships from affecting evaluations. * **Tests** * Added coverage for attribution requirements, supersession phrase parsing, and comparator reruns. <!-- end of auto-generated comment: release notes by coderabbit.ai --> --------- Signed-off-by: Carlos Villela <cvillela@nvidia.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
8.14.1-2+deb13u3to8.14.1-2+deb13u4in all sandbox base imagesReproduction
On
aits-log-worker-6, a cleandebian:trixie-slimreports8.14.1-2+deb13u4as the candidate and fails to install the old pin withVersion ... was not found.Validation
vitest run test/dcode-base-image-workflow.test.ts(6/6 passed)Dockerfile.basefiles on LinuxFixes #6679
Refs #6686
Summary by CodeRabbit
curlDebian package revision.curlto the expected revision and that versions match across images.Signed-off-by: Chengjie Wang chengjiew@nvidia.com
Signed-off-by: Julie Yaunches jyaunches@nvidia.com