ci(release): dispatch Brev image on lkg promotion - #6774
Merged
Conversation
jyaunches
added
area: ci
Contributor
|
No actionable comments were generated in the recent review. 🎉 ℹ️ Recent review info⚙️ Run configurationConfiguration used: Path: .coderabbit.yaml Review profile: CHILL Plan: Enterprise Run ID: 📒 Files selected for processing (1)
🚧 Files skipped from review as they are similar to previous changes (1)
📝 WalkthroughWalkthroughAdds a GitHub Actions workflow and Bash dispatcher that resolve an exact release tag from ChangesLKG production image dispatch
Estimated code review effort: 3 (Moderate) | ~20 minutes Possibly related PRs
Suggested labels: Sequence Diagram(s)sequenceDiagram
participant LKGPush
participant ReleaseLKGWorkflow
participant DispatcherScript
participant GitHub
participant ProductionImageWorkflow
LKGPush->>ReleaseLKGWorkflow: push lkg tag
ReleaseLKGWorkflow->>DispatcherScript: pass LKG_SHA and token
DispatcherScript->>DispatcherScript: resolve exact vX.Y.Z tag
DispatcherScript->>GitHub: dispatch build-scheduled.yml on main
GitHub->>ProductionImageWorkflow: start with nemoclaw_ref
🚥 Pre-merge checks | ✅ 5✅ Passed checks (5 passed)
✨ Finishing Touches🧪 Generate unit tests (beta)
Comment |
Contributor
PR Review Advisor — No blocking findingsMerge posture: No blocking advisor findings This is an automated review. Required findings need action before merge. Warnings and optional suggestions do not require a response or follow-up. A human maintainer makes the final merge decision. |
Contributor
E2E Advisor RecommendationRequired E2E: None Full advisor summaryE2E Recommendation AdvisorBase: Required E2E
Optional E2E
New E2E recommendations
|
Contributor
Code Coverage OverviewLanguages: TypeScript TypeScript / code-coverage/pluginThe overall coverage remains at 96%, unchanged from the TypeScript / code-coverage/cliThe overall coverage in the Show a code coverage summary of the most impacted files.
Updated |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
Contributor
There was a problem hiding this comment.
Actionable comments posted: 1
🧹 Nitpick comments (1)
.github/workflows/release-lkg-brev-image.yaml (1)
18-34: 🩺 Stability & Availability | 🔵 Trivial | ⚡ Quick winAdd a job-level
timeout-minutesto bound the dispatch.No timeout is set, so a network stall on
gh apior checkout would let the job run for up to the default 360-minute ceiling before GitHub kills it, needlessly consuming CI minutes for what should be a sub-minute dispatch.⏱️ Proposed fix
dispatch-production-image: if: ${{ github.repository == 'NVIDIA/NemoClaw' && github.event.deleted == false }} runs-on: ubuntu-latest + timeout-minutes: 5 steps:🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In @.github/workflows/release-lkg-brev-image.yaml around lines 18 - 34, Add a job-level timeout-minutes setting to the dispatch-production-image job, using a short bound appropriate for the checkout and sub-minute gh api dispatch. Keep the existing job condition, checkout configuration, and dispatch script unchanged.
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In `@ci/source-shape-test-budget.json`:
- Around line 369-373: Reorder the `test/release-lkg-brev-image.test.ts` entry
in `ci/source-shape-test-budget.json` so it appears after all
`regression-e2e-workflow` entries, preserving the file-name sort order and
leaving the entry’s contents unchanged.
---
Nitpick comments:
In @.github/workflows/release-lkg-brev-image.yaml:
- Around line 18-34: Add a job-level timeout-minutes setting to the
dispatch-production-image job, using a short bound appropriate for the checkout
and sub-minute gh api dispatch. Keep the existing job condition, checkout
configuration, and dispatch script unchanged.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Path: .coderabbit.yaml
Review profile: CHILL
Plan: Enterprise
Run ID: 6e86c8a9-aa6f-4396-b8f3-b36b7e8a877d
📒 Files selected for processing (5)
.agents/skills/nemoclaw-maintainer-cut-release-tag/SKILL.md.github/workflows/release-lkg-brev-image.yamlci/source-shape-test-budget.jsonscripts/release-lkg-brev-image.shtest/release-lkg-brev-image.test.ts
cv
approved these changes
Jul 13, 2026
21 tasks
jyaunches
added a commit
that referenced
this pull request
Jul 20, 2026
<!-- markdownlint-disable MD041 --> ## Summary This follow-up to #6774 captures the downstream Brev image workflow run returned by GitHub and links it from the LKG trigger summary. The maintainer release skill now explains how to hand that link to the maintainer and treats downstream runtime validation and production-family promotion as the success gate. ## Related Issue Follow-up to #6772 and #6774. ## Changes - Request `return_run_details` when dispatching `brevdev/nemoclaw-image` and validate the returned numeric run ID and exact repository Actions URL. - Include the downstream run ID, clickable URL, and follow-through instruction in the source workflow summary and log output. - Fail safely when GitHub accepts a dispatch without valid run details, while preserving the existing secret and `lkg` immutability boundaries. - Teach `nemoclaw-maintainer-cut-release-tag` how to locate the source run, extract the downstream link, and require runtime E2E plus `nemoclaw-brev-cpu` family promotion. - Add a five-minute timeout to the short source dispatch job and expand its contract tests. ## Type of Change - [x] Code change (feature, bug fix, or refactor) - [ ] Code change with doc updates - [ ] Doc only (prose changes, no code sample modifications) - [ ] Doc only (includes code sample changes) ## Quality Gates <!-- Check exactly one tests line and one docs line. Check other lines when applicable. Add every requested justification or approval reference. --> - [x] Tests added or updated for changed behavior - [ ] Existing tests cover changed behavior — justification: - [ ] Tests not applicable — justification: - [ ] Docs updated for user-facing behavior changes - [x] Docs not applicable — justification: This is internal maintainer release automation; the required documentation-writer review confirmed the maintainer skill is the canonical guidance and no published user behavior changes. - [x] Sensitive paths changed (security, policy, credentials, preflight, onboarding, inference, runner, sandbox, or messaging) - [x] Sensitive-path review completed or maintainer-approved waiver recorded — reviewer/approval link/justification: The response is validated as a numeric run ID plus the exact expected repository Actions URL; the PAT remains environment-only, the summary remains secret-free, and the security contract plus gitleaks passed. - [ ] Non-success, skipped, or missing CI check accepted by maintainer — check name, approval link, and follow-up issue: ## Verification <!-- Check each applicable item only when supported by the requested evidence. Run targeted tests once per relevant change set and rerun after later edits or hook autofixes that can affect the tested behavior. Do not rerun hook-covered checks. --> - [x] PR description includes the DCO sign-off declaration and every commit appears as `Verified` in GitHub - [x] Normal `pre-commit`, `commit-msg`, and `pre-push` hooks passed, or `npm run check:diff` passed when hooks were skipped or unavailable - [x] Targeted behavior tests pass for the current change set, or tests are marked not applicable above — command/result or justification: `npx vitest run test/release-lkg-brev-image.test.ts test/skills-frontmatter.test.ts test/changelog-docs.test.ts` (41/41 after merging current main). - [ ] Applicable broad gate passed — `npm test` for broad runtime/test-harness changes; `npm run check` for repo-wide validation/coverage changes — command/result: - [x] Quality Gates section completed with required justifications or waivers - [x] No secrets, API keys, or credentials committed - [ ] `npm run docs` builds without warnings (doc changes only) - [ ] Doc pages follow the [style guide](https://github.com/NVIDIA/NemoClaw/blob/main/docs/CONTRIBUTING.md) (doc changes only) - [ ] New doc pages include SPDX header and frontmatter (new pages only) --- <!-- DCO sign-off is required in this PR description, and every commit must appear as Verified in GitHub. Run: git config user.name && git config user.email --> Signed-off-by: Julie Yaunches <jyaunches@nvidia.com> <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **Release Process** * Release automation now includes downstream production image workflow run details in the job summary, with a direct run link when available. * Production image dispatches are rejected when returned downstream run details are missing or inconsistent. * Updated production image promotion guidance with clearer trigger steps and success validation. * **Reliability** * The production image dispatch job now auto-terminates after five minutes. * **Tests** * Extended workflow contract checks for optional timeouts and added negative coverage for invalid downstream run details. <!-- end of auto-generated comment: release notes by coderabbit.ai --> --------- Signed-off-by: Julie Yaunches <jyaunches@nvidia.com> Co-authored-by: Carlos Villela <cvillela@nvidia.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
3 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Promoting
lkgnow dispatches the downstream Brev production-image workflow with the immutable NemoClaw release tag. The source workflow validates the tag target, records non-secret correlation details, and leaves downstream image validation and promotion unchanged.Related Issue
Fixes #6772
Changes
lkgtag workflow with read-only repository permissions and an immutable checkout action pin.vX.Y.Ztag before callingbrevdev/nemoclaw-imageonmain.lkgfor rejected requests, and skip tag deletions.Type of Change
Quality Gates
Verification
Verifiedin GitHubpre-commit,commit-msg, andpre-pushhooks passed, ornpm run check:diffpassed when hooks were skipped or unavailablenpx vitest run test/release-lkg-brev-image.test.ts(1 file, 6 tests),bash -n scripts/release-lkg-brev-image.sh, andnpm run source-shape:checkpassed.npm testfor broad runtime/test-harness changes;npm run checkfor repo-wide validation/coverage changes — command/result: Not applicable to this focused workflow change.npm run docsbuilds without warnings (doc changes only)Signed-off-by: Julie Yaunches jyaunches@nvidia.com
Summary by CodeRabbit
lkgtag targets a commit with an exact immutablevX.Y.Zrelease tag.vX.Y.Ztag to improve release reliability.lkgtags and reports clear accepted/rejected outcomes.