Skip to content

test(vitest): enforce exact discovery and credential-free tags - #6707

Merged
cv merged 3 commits into
mainfrom
codex/vitest-discovery-tag-safeguards-main
Jul 12, 2026
Merged

test(vitest): enforce exact discovery and credential-free tags#6707
cv merged 3 commits into
mainfrom
codex/vitest-discovery-tag-safeguards-main

Conversation

@cv

@cv cv commented Jul 12, 2026

Copy link
Copy Markdown
Collaborator

Summary

Vitest project validation now compares every filesystem test candidate with Vitest's complete eight-project roster, rejecting omissions, overlaps, wrong routing, unexpected files, and unexpected project names. The shared credential-free E2E workflow now applies Vitest's native e2e/credential-free tag filter in addition to the existing safe matrix scanner. The dashboard-port regression fixture also uses a coherent fake OpenShell 0.0.72 component set and an OS-assigned gateway port so the repo-wide gate stays hermetic.

This is the final entry in the ordered #6692 stack after #6693, #6696, #6697, #6699, #6700, #6701, #6702, and #6705 landed.

Related Issue

Closes #6692

Changes

  • Discover broad test/spec JavaScript and TypeScript candidates under src, test, and nemoclaw/src, including nested dist, coverage, and .venv paths that Vitest would see.
  • Compare candidate routing with Vitest file listings and the complete roster from list-tags JSON, including empty and opt-in projects.
  • Produce sorted diagnostics for zero membership, overlap, wrong project, unsupported candidates, unexpected listed files, and missing or extra projects.
  • Invoke Vitest portably through process.execPath and node_modules/vitest/vitest.mjs.
  • Require the exact native credential-free tag filter in the shared E2E workflow contract while retaining the TypeScript scanner's path, project, ID, and declaration checks.
  • Keep the dashboard-port exhaustion regression independent of port 8080, developer OpenShell overrides, channel selection, and network installation.

Type of Change

  • Code change (feature, bug fix, or refactor)
  • Code change with doc updates
  • Doc only (prose changes, no code sample modifications)
  • Doc only (includes code sample changes)

Quality Gates

  • Tests added or updated for changed behavior
  • Existing tests cover changed behavior — justification:
  • Tests not applicable — justification:
  • Docs updated for user-facing behavior changes
  • Docs not applicable — justification: these are contributor/test-harness safeguards; AGENTS.md now states the exhaustive project-membership contract, the E2E README already documents the native module tag, and the required documentation-writer review found no user-facing change.
  • Sensitive paths changed (security, policy, credentials, preflight, onboarding, inference, runner, sandbox, or messaging)
  • Sensitive-path review completed or maintainer-approved waiver recorded — reviewer/approval link/justification: independent review covered the shared credential-free workflow and onboarding regression fixture; it confirmed the filter preserves the existing scanner and the fixture's child-only environment cannot reach a real OpenShell install.
  • Non-success, skipped, or missing CI check accepted by maintainer — check name, approval link, and follow-up issue:

Verification

  • PR description includes the DCO sign-off declaration and every commit appears as Verified in GitHub
  • Normal pre-commit, commit-msg, and pre-push hooks passed, or npm run check:diff passed when hooks were skipped or unavailable
  • Targeted behavior tests pass for the current change set, or tests are marked not applicable above — 46 integration tests passed across the boundary and dashboard-port files; 4 E2E-support workflow tests passed; project membership is exact for 1,537 candidates across 8 projects; CLI type-check, title style, Biome, and diff checks passed. The fixture also passed with hostile inherited OpenShell paths and dev-channel selection.
  • Applicable broad gate passed — npm test passed 1,456 files / 16,515 tests before the final focused hardening; npm run check passed the repo-wide structural, CLI coverage, and plugin coverage gates, followed by focused reruns and normal hooks after the final child-environment pin.
  • Quality Gates section completed with required justifications or waivers
  • No secrets, API keys, or credentials committed
  • npm run docs builds without warnings (doc changes only)
  • Doc pages follow the style guide (doc changes only)
  • New doc pages include SPDX header and frontmatter (new pages only)

Signed-off-by: Carlos Villela cvillela@nvidia.com

Summary by CodeRabbit

  • Tests
    • Credential-free end-to-end test runs now execute only tests matching the credential-free tag.
    • Vitest project validation now checks for missing, overlapping, unsupported, wrong, zero-membership, and unexpected test-to-project assignments, plus roster mismatches.
    • Expanded boundary tests cover test candidate discovery, expected project mapping, Vitest invocation resolution, and listing/roster parsing.
    • Improved onboarding “dashboard port exhaustion” assertions for more hermetic, reliable verification.
  • Documentation
    • Updated testing guidance to require Vitest project globs be disjoint and exhaustive, enforced by the projects check.

cv added 2 commits July 12, 2026 01:23
Signed-off-by: Carlos Villela <cvillela@nvidia.com>
Signed-off-by: Carlos Villela <cvillela@nvidia.com>
@coderabbitai

coderabbitai Bot commented Jul 12, 2026

Copy link
Copy Markdown
Contributor

Review Change Stack

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info
⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Enterprise

Run ID: cc4e3756-99e6-4bba-bd70-927274f49171

📥 Commits

Reviewing files that changed from the base of the PR and between 5cdbbd9 and e299aec.

📒 Files selected for processing (1)
  • test/exit-code-user-error-surfaces.test.ts
🚧 Files skipped from review as they are similar to previous changes (1)
  • test/exit-code-user-error-surfaces.test.ts

📝 Walkthrough

Walkthrough

The PR expands Vitest project membership validation, enforces credential-free E2E tag filtering, adds boundary coverage, and makes dashboard-port exhaustion testing hermetic.

Changes

Vitest validation and E2E safeguards

Layer / File(s) Summary
Exhaustive Vitest project contract
AGENTS.md, scripts/checks/vitest-project-overlap.ts
Vitest candidates, expected projects, rosters, membership mismatches, and Node-based invocation are validated with structured failure reporting.
Vitest contract boundary coverage
test/test-boundary-guards.test.ts
Tests cover discovery, mappings, mismatch categories, roster differences, invocation resolution, and parse failures.
Credential-free E2E tag enforcement
.github/workflows/e2e.yaml, tools/e2e/workflow-boundary.mts, test/e2e/support/shared-e2e-workflow-boundary.test.ts
The shared credential-free E2E command includes the e2e/credential-free tag filter, with validator and boundary-test assertions.
Hermetic onboard exit coverage
test/exit-code-user-error-surfaces.test.ts
The dashboard-port exhaustion test uses an ephemeral port, separate OpenShell shims, explicit environment paths, and installation-message exclusions.

Estimated code review effort: 4 (Complex) | ~45 minutes

Sequence Diagram(s)

sequenceDiagram
  participant Workflow
  participant Vitest
  participant WorkflowValidator
  Workflow->>Vitest: Run credential-free tests with e2e/credential-free tag filter
  Vitest-->>Workflow: Execute matching tests
  WorkflowValidator->>Workflow: Inspect shared E2E command
  WorkflowValidator-->>Workflow: Require the tag filter argument
Loading

Suggested labels: bug-fix, UAT, area: cli

Suggested reviewers: jyaunches, ericksoa

🚥 Pre-merge checks | ✅ 3 | ❌ 2

❌ Failed checks (2 warnings)

Check name Status Explanation Resolution
Out of Scope Changes check ⚠️ Warning The dashboard-port/OpenShell onboarding regression test changes are unrelated to Vitest discovery and tag-filter enforcement. Move the onboarding regression fixture updates to a separate PR unless they are required for the linked Vitest objectives.
Docstring Coverage ⚠️ Warning Docstring coverage is 0.00% which is insufficient. The required threshold is 80.00%. Write docstrings for the functions missing them to satisfy the coverage threshold.
✅ Passed checks (3 passed)
Check name Status Explanation
Description Check ✅ Passed Check skipped - CodeRabbit’s high-level summary is enabled.
Title check ✅ Passed The title concisely describes the main Vitest discovery and credential-free tag enforcement changes.
Linked Issues check ✅ Passed The PR implements the linked #6692 goals for exact Vitest project ownership checks and native credential-free tag filtering.
✨ Finishing Touches
📝 Generate docstrings
  • Create stacked PR
  • Commit on current branch
🧪 Generate unit tests (beta)
  • Create PR with unit tests
  • Commit unit tests in branch codex/vitest-discovery-tag-safeguards-main

Comment @coderabbitai help to get the list of available commands.

@github-code-quality

github-code-quality Bot commented Jul 12, 2026

Copy link
Copy Markdown
Contributor

Code Coverage Overview

Languages: TypeScript

TypeScript / code-coverage/plugin

The overall coverage remains at 96%, unchanged from the main branch.

TypeScript / code-coverage/cli

The overall coverage in the codex/vitest-discove... branch remains at 79%, unchanged from the main branch.

Show a code coverage summary of the most impacted files.
File main ed72cd0 codex/vitest-discove... e299aec +/-
src/lib/onboard...eway-cleanup.ts 70% 58% -12%
src/lib/messagi...ate-resolver.ts 88% 76% -12%
src/lib/messagi...ate-resolver.ts 100% 95% -5%
src/lib/messagi...parser-utils.ts 90% 86% -4%
src/lib/security/redact-url.ts 100% 97% -3%
src/lib/security/redact.ts 100% 99% -1%
src/lib/policy/index.ts 70% 70% 0%
src/lib/agent/s...store-reader.ts 88% 88% 0%
src/lib/adapter...shell/client.ts 83% 85% +2%
src/lib/runner.ts 73% 75% +2%

Updated July 12, 2026 08:44 UTC
Code Coverage is in Public Preview. Learn more and provide us with your feedback.

@github-actions

github-actions Bot commented Jul 12, 2026

Copy link
Copy Markdown
Contributor

E2E Advisor Recommendation

Required E2E: cloud-onboard
Optional E2E: openshell-version-pin, onboard-negative-paths

Dispatch hint: cloud-onboard,openshell-version-pin,onboard-negative-paths

Workflow run

Full advisor summary

E2E Recommendation Advisor

Base: origin/main
Head: HEAD
Confidence: high

Required E2E

  • cloud-onboard: Required by the deterministic platform-install risk plan because the unified E2E workflow can affect clean-host installation and usable onboarding validation.

Optional E2E

  • openshell-version-pin: Exercises the credential-free shared-E2E execution path and the pinned OpenShell installer/version behavior adjacent to this workflow and platform-validation change.
  • onboard-negative-paths: Provides an additional real CLI onboarding check through the modified credential-free shared-E2E tag-filter path.

New E2E recommendations

  • None.

Dispatch hint

  • Workflow: .github/workflows/e2e.yaml
  • jobs input: cloud-onboard,openshell-version-pin,onboard-negative-paths

@cv cv self-assigned this Jul 12, 2026
@github-actions

github-actions Bot commented Jul 12, 2026

Copy link
Copy Markdown
Contributor

PR Review Advisor — No blocking findings

Merge posture: No blocking advisor findings
Primary next action: No advisor follow-up required beyond maintainer review.
Findings: 0 required · 0 warnings · 0 optional suggestions
Since last review: 0 prior items resolved · 0 still apply · 0 new items found

Workflow run details

This is an automated review. Required findings need action before merge. Warnings and optional suggestions do not require a response or follow-up. A human maintainer makes the final merge decision.

@coderabbitai coderabbitai Bot left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Actionable comments posted: 1

🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In `@test/exit-code-user-error-surfaces.test.ts`:
- Line 347: Broaden the negative assertion’s regex in the exit-code user-error
surface test to match all OpenShell installation, reinstallation, and upgrade
wording, including “Still installing OpenShell components...” and “openshell CLI
not found. Installing...”. Use case-insensitive matching so capitalization
differences cannot bypass the assertion.
🪄 Autofix (Beta)

Fix all unresolved CodeRabbit comments on this PR:

  • Push a commit to this branch (recommended)
  • Create a new PR with the fixes

ℹ️ Review info
⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Enterprise

Run ID: 855ba6fe-1911-4455-9b58-135dd9c478c0

📥 Commits

Reviewing files that changed from the base of the PR and between c0117dc and 5cdbbd9.

📒 Files selected for processing (7)
  • .github/workflows/e2e.yaml
  • AGENTS.md
  • scripts/checks/vitest-project-overlap.ts
  • test/e2e/support/shared-e2e-workflow-boundary.test.ts
  • test/exit-code-user-error-surfaces.test.ts
  • test/test-boundary-guards.test.ts
  • tools/e2e/workflow-boundary.mts

Comment thread test/exit-code-user-error-surfaces.test.ts Outdated
Signed-off-by: Carlos Villela <cvillela@nvidia.com>
@cv
cv merged commit e04a344 into main Jul 12, 2026
55 checks passed
@cv
cv deleted the codex/vitest-discovery-tag-safeguards-main branch July 12, 2026 08:57
Hadar301 pushed a commit to Hadar301/NemoClaw-OpenShift that referenced this pull request Jul 12, 2026
…A#6707)

## Summary
Vitest project validation now compares every filesystem test candidate
with Vitest's complete eight-project roster, rejecting omissions,
overlaps, wrong routing, unexpected files, and unexpected project names.
The shared credential-free E2E workflow now applies Vitest's native
e2e/credential-free tag filter in addition to the existing safe matrix
scanner. The dashboard-port regression fixture also uses a coherent fake
OpenShell 0.0.72 component set and an OS-assigned gateway port so the
repo-wide gate stays hermetic.

This is the final entry in the ordered NVIDIA#6692 stack after NVIDIA#6693, NVIDIA#6696,
NVIDIA#6697, NVIDIA#6699, NVIDIA#6700, NVIDIA#6701, NVIDIA#6702, and NVIDIA#6705 landed.

## Related Issue
Closes NVIDIA#6692

## Changes
- Discover broad test/spec JavaScript and TypeScript candidates under
src, test, and nemoclaw/src, including nested dist, coverage, and .venv
paths that Vitest would see.
- Compare candidate routing with Vitest file listings and the complete
roster from list-tags JSON, including empty and opt-in projects.
- Produce sorted diagnostics for zero membership, overlap, wrong
project, unsupported candidates, unexpected listed files, and missing or
extra projects.
- Invoke Vitest portably through process.execPath and
node_modules/vitest/vitest.mjs.
- Require the exact native credential-free tag filter in the shared E2E
workflow contract while retaining the TypeScript scanner's path,
project, ID, and declaration checks.
- Keep the dashboard-port exhaustion regression independent of port
8080, developer OpenShell overrides, channel selection, and network
installation.

## Type of Change

- [x] Code change (feature, bug fix, or refactor)
- [ ] Code change with doc updates
- [ ] Doc only (prose changes, no code sample modifications)
- [ ] Doc only (includes code sample changes)

## Quality Gates

- [x] Tests added or updated for changed behavior
- [ ] Existing tests cover changed behavior — justification:
- [ ] Tests not applicable — justification:
- [ ] Docs updated for user-facing behavior changes
- [x] Docs not applicable — justification: these are
contributor/test-harness safeguards; AGENTS.md now states the exhaustive
project-membership contract, the E2E README already documents the native
module tag, and the required documentation-writer review found no
user-facing change.
- [x] Sensitive paths changed (security, policy, credentials, preflight,
onboarding, inference, runner, sandbox, or messaging)
- [x] Sensitive-path review completed or maintainer-approved waiver
recorded — reviewer/approval link/justification: independent review
covered the shared credential-free workflow and onboarding regression
fixture; it confirmed the filter preserves the existing scanner and the
fixture's child-only environment cannot reach a real OpenShell install.
- [ ] Non-success, skipped, or missing CI check accepted by maintainer —
check name, approval link, and follow-up issue:

## Verification

- [x] PR description includes the DCO sign-off declaration and every
commit appears as Verified in GitHub
- [x] Normal pre-commit, commit-msg, and pre-push hooks passed, or npm
run check:diff passed when hooks were skipped or unavailable
- [x] Targeted behavior tests pass for the current change set, or tests
are marked not applicable above — 46 integration tests passed across the
boundary and dashboard-port files; 4 E2E-support workflow tests passed;
project membership is exact for 1,537 candidates across 8 projects; CLI
type-check, title style, Biome, and diff checks passed. The fixture also
passed with hostile inherited OpenShell paths and dev-channel selection.
- [x] Applicable broad gate passed — npm test passed 1,456 files /
16,515 tests before the final focused hardening; npm run check passed
the repo-wide structural, CLI coverage, and plugin coverage gates,
followed by focused reruns and normal hooks after the final
child-environment pin.
- [x] Quality Gates section completed with required justifications or
waivers
- [x] No secrets, API keys, or credentials committed
- [ ] npm run docs builds without warnings (doc changes only)
- [ ] Doc pages follow the style guide (doc changes only)
- [ ] New doc pages include SPDX header and frontmatter (new pages only)

---
Signed-off-by: Carlos Villela <cvillela@nvidia.com>


<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit

- **Tests**
- Credential-free end-to-end test runs now execute only tests matching
the credential-free tag.
- Vitest project validation now checks for missing, overlapping,
unsupported, wrong, zero-membership, and unexpected test-to-project
assignments, plus roster mismatches.
- Expanded boundary tests cover test candidate discovery, expected
project mapping, Vitest invocation resolution, and listing/roster
parsing.
- Improved onboarding “dashboard port exhaustion” assertions for more
hermetic, reliable verification.
- **Documentation**
- Updated testing guidance to require Vitest project globs be disjoint
and exhaustive, enforced by the projects check.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->

---------

Signed-off-by: Carlos Villela <cvillela@nvidia.com>
@wscurran wscurran added the chore Build, CI, dependency, or tooling maintenance label Jul 30, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

chore Build, CI, dependency, or tooling maintenance

Projects

None yet

Development

Successfully merging this pull request may close these issues.

test: harden Vitest execution, isolation, and feedback loops

2 participants