Skip to content

fix(e2e): load private file helper as ESM - #7229

Closed
sandl99 wants to merge 10 commits into
mainfrom
fix/e2e-private-file-esm
Closed

fix(e2e): load private file helper as ESM#7229
sandl99 wants to merge 10 commits into
mainfrom
fix/e2e-private-file-esm

Conversation

@sandl99

@sandl99 sandl99 commented Jul 20, 2026

Copy link
Copy Markdown
Collaborator

Summary

The scheduled Hermes rebuild jobs failed before their tests started because an .mts entrypoint imported named exports from a .ts helper that tsx classified as CommonJS. After the ESM correction let the live jobs proceed, their minute-by-minute Docker inspection blocked behind the large BuildKit export, exhausted the hosted runners, and canceled both lanes. This change makes the helper explicitly ESM, protects the production invocation boundary, and keeps in-flight rebuild heartbeats on host-only resource collection while preserving Docker evidence at the workflow baseline and terminal classifier.

Changes

  • Rename tools/e2e/private-file.ts to tools/e2e/private-file.mts without changing its file-safety logic.
  • Update the live outcome, runner-pressure, PR gate, risk reporter, and risk-plan consumers to use the explicit ESM path.
  • Execute the real npx tsx tools/e2e/live-test-outcome.mts entrypoint in the private-file integration test so Vitest module transformation cannot mask this failure class again.
  • Record the escaped-defect cause: existing tests imported the helper through Vitest or Node type stripping instead of the production tsx entrypoint used by the rebuild workflows.
  • Keep long Hermes rebuild heartbeats from invoking docker stats or docker system df while BuildKit is active; host memory, pressure, top-RSS, load, and filesystem evidence remain.
  • Add a fake-Docker regression check proving heartbeat collection does not enter the Docker CLI boundary.

Type of Change

  • Code change (feature, bug fix, or refactor)
  • Code change with doc updates
  • Doc only (prose changes, no code sample modifications)
  • Doc only (includes code sample changes)

Quality Gates

  • Tests added or updated for changed behavior
  • Existing tests cover changed behavior — justification:
  • Tests not applicable — justification:
  • Docs updated for user-facing behavior changes
  • Docs not applicable — justification: internal E2E module-format correction; no user-facing command, configuration, output, supported integration, or contributor workflow changes, and the documentation review found no references to the renamed helper.
  • Sensitive paths changed (security, policy, credentials, preflight, onboarding, inference, runner, sandbox, or messaging)
  • Sensitive-path review completed or maintainer-approved waiver recorded — reviewer/approval link/justification: the private regular-file implementation is unchanged byte-for-byte; only its module extension and import paths changed, and its no-follow, regular-file, link-count, size, permission, and fsync tests pass.
  • Non-success, skipped, or missing CI check accepted by maintainer — check name, approval link, and follow-up issue:

Verification

  • PR description includes a Signed-off-by: line and every commit appears as Verified in GitHub
  • Normal pre-commit, commit-msg, and pre-push hooks passed, or npm run check:diff passed when hooks were skipped or unavailable
  • Targeted behavior tests pass for the current change set, or tests are marked not applicable above — npx vitest run --project integration --project e2e-support test/e2e-private-file.test.ts test/e2e-risk-signal-reporter.test.ts test/pr-risk-plan.test.ts test/pr-e2e-gate-lifecycle.test.ts test/e2e/support/live-test-outcome-invocation.test.ts test/e2e/support/runner-pressure.test.ts (6 files, 157 tests passed); npx tsx tools/e2e/live-test-outcome.mts passed; env E2E_PHASE=verify npx tsx tools/e2e/runner-pressure.mts snapshot passed.; after the heartbeat fix, npx vitest run --project e2e-support passed 131 files and 1,260 tests with 2 skipped, npm run build:cli and npm --prefix nemoclaw run build passed, and the normal pre-push CLI type-check passed.
  • Applicable broad gate passed — npm test for broad runtime/test-harness changes; npm run check for repo-wide validation/coverage changes — command/result:
  • Quality Gates section completed with required justifications or waivers
  • No secrets, API keys, or credentials committed
  • npm run docs builds without warnings (doc changes only)
  • Doc pages follow the style guide (doc changes only)
  • New doc pages include SPDX header and frontmatter (new pages only)

Signed-off-by: San Dang sdang@nvidia.com

Summary by CodeRabbit

  • New Features
    • Added a symlink-safe private-file utility for end-to-end workflows with exclusive creation and strict 0o600 permissions, including max-size enforcement for read/write/append.
  • Bug Fixes
    • Updated end-to-end tooling and tests to consistently use the .mts module entrypoint.
    • Improved resource snapshot collection to support skipping Docker probing, with heartbeat snapshots emitting empty container/disk fields when disabled.
    • Adjusted E2E risk-plan/guard test coverage to exercise the fail-closed control-plane runtime floor.
  • Tests
    • Added an e2e contract test ensuring live-test-outcome exits successfully.
    • Added coverage confirming long-build heartbeats avoid Docker inspection, and updated the Hermes “old sandbox” flow to use a pinned Python entrypoint.

Signed-off-by: San Dang <sdang@nvidia.com>
@sandl99 sandl99 self-assigned this Jul 20, 2026
@coderabbitai

coderabbitai Bot commented Jul 20, 2026

Copy link
Copy Markdown
Contributor

Review Change Stack

Note

Reviews paused

It looks like this branch is under active development. To avoid overwhelming you with review comments due to an influx of new commits, CodeRabbit has automatically paused this review. You can configure this behavior by changing the reviews.auto_review.auto_pause_after_reviewed_commits setting.

Use the following commands to manage reviews:

  • @coderabbitai resume to resume automatic reviews.
  • @coderabbitai review to trigger a single review.

Use the checkboxes below for quick actions:

  • ▶️ Resume reviews
  • 🔍 Trigger review
📝 Walkthrough

Walkthrough

The PR adds protected private-file helpers in tools/e2e/private-file.mts, migrates E2E consumers and tests to that entrypoint, adds optional Docker-probe suppression for rebuild-progress snapshots, and pins the Hermes kanban seeding Python entrypoint.

Changes

Private file handling and E2E migration

Layer / File(s) Summary
Private regular-file helper implementation
tools/e2e/private-file.mts
Adds symlink-resistant read, write, and append helpers with validation, size limits, permissions, flushing, and descriptor cleanup.
E2E .mts entrypoint migration and validation
tools/e2e/*.mts, test/e2e-private-file.test.ts, test/e2e/risk-signal-reporter.ts, test/pr-risk-plan.test.ts, test/e2e/support/live-test-outcome-invocation.test.ts
Updates consumers and fixtures to import .mts and verifies live tsx loading and FIFO-path behavior.
Conditional Docker resource probing
tools/e2e/runner-pressure.mts, test/e2e/live/rebuild-hermes-progress.ts, test/e2e/support/rebuild-hermes-progress.test.ts
Adds includeDocker control to snapshots and verifies rebuild heartbeats emit empty Docker data without invoking Docker.
Pinned Hermes seeding entrypoint
test/e2e/live/rebuild-hermes.test.ts
Runs old-sandbox Hermes kanban initialization and task creation through the pinned old Hermes Python module entrypoint.

Estimated code review effort: 3 (Moderate) | ~20 minutes

Possibly related PRs

Suggested labels: bug-fix, area: e2e

Suggested reviewers: atulya-singh, tyeth-ai-assisted

🚥 Pre-merge checks | ✅ 4 | ❌ 1

❌ Failed checks (1 warning)

Check name Status Explanation Resolution
Docstring Coverage ⚠️ Warning Docstring coverage is 40.00% which is insufficient. The required threshold is 80.00%. Write docstrings for the functions missing them to satisfy the coverage threshold.
✅ Passed checks (4 passed)
Check name Status Explanation
Description Check ✅ Passed Check skipped - CodeRabbit’s high-level summary is enabled.
Title check ✅ Passed The title accurately reflects the main change: moving the private-file helper to an ESM .mts module and updating E2E consumers.
Linked Issues check ✅ Passed Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check ✅ Passed Check skipped because no linked issues were found for this pull request.
✨ Finishing Touches
🧪 Generate unit tests (beta)
  • Create PR with unit tests
  • Commit unit tests in branch fix/e2e-private-file-esm

Comment @coderabbitai help to get the list of available commands.

@github-code-quality

github-code-quality Bot commented Jul 20, 2026

Copy link
Copy Markdown
Contributor

Code Coverage Overview

Languages: TypeScript

TypeScript / code-coverage/plugin

The overall coverage in commit b4c0214 in the fix/e2e-private-file... branch remains at 96%, unchanged from commit a5ccdca in the main branch.

TypeScript / code-coverage/cli

The overall coverage in commit b4c0214 in the fix/e2e-private-file... branch remains at 80%, unchanged from commit a5ccdca in the main branch.

Show a code coverage summary of the most impacted files.
File main a5ccdca fix/e2e-private-file... b4c0214 +/-
src/lib/onboard...box-prebuild.ts 88% 69% -19%
src/lib/domain/.../connect-env.ts 97% 89% -8%
src/lib/actions...ess-recovery.ts 78% 77% -1%
src/lib/messagi...flow-planner.ts 93% 93% 0%
src/lib/actions...ary-recovery.ts 100% 100% 0%
src/lib/onboard...-patch-clone.ts 94% 94% 0%
src/lib/actions...eway-restart.ts 90% 93% +3%
src/lib/onboard...host-anchors.ts 90% 94% +4%
src/lib/onboard...corporate-ca.ts 92% 100% +8%
src/lib/actions...post-restore.ts 60% 85% +25%

Updated July 20, 2026 15:15 UTC

@coderabbitai coderabbitai Bot left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Actionable comments posted: 1

🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In `@test/e2e-private-file.test.ts`:
- Around line 15-25: Move the live tsx process assertion from the root-level
test into the test/e2e suite, preserving the spawnSync invocation of
tools/e2e/live-test-outcome.mts and its real process-boundary validation. Remove
the root test’s internal private-file helper import and keep root-level tests
limited to CLI source imports.
🪄 Autofix (Beta)

Fix all unresolved CodeRabbit comments on this PR:

  • Push a commit to this branch (recommended)
  • Create a new PR with the fixes

ℹ️ Review info
⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Enterprise

Run ID: 4e341b46-ec72-477d-ab40-0df22b81807d

📥 Commits

Reviewing files that changed from the base of the PR and between 3c4ea5a and 4e960f2.

📒 Files selected for processing (7)
  • test/e2e-private-file.test.ts
  • test/e2e/risk-signal-reporter.ts
  • test/pr-risk-plan.test.ts
  • tools/e2e/live-test-outcome.mts
  • tools/e2e/pr-e2e-gate.mts
  • tools/e2e/private-file.mts
  • tools/e2e/runner-pressure.mts

Comment thread test/e2e-private-file.test.ts Outdated
@github-actions

github-actions Bot commented Jul 20, 2026

Copy link
Copy Markdown
Contributor

PR Review Advisor — Blocking findings reported

Advisor assessment: Blockers require maintainer review
Next action: Review the blockers below.
Findings: 1 blocker · 1 warning · 0 suggestions

Model lanes

  • GPT-5.6 Terra (primary): Completed · high confidence · 1 blocker · 1 warning · 0 suggestions
  • Nemotron 3 Ultra (second opinion): Completed · high confidence · 0 blockers · 4 warnings · 0 suggestions
  • Model comparison: normalized findings differ; normalized E2E selections match; Nemotron reported 1 fewer blocker, 3 more warnings, the same number of suggestions.

Nemotron output stays in workflow artifacts and does not change the assessment above.

E2E guidance

Advisory only. E2E / PR Gate selects and runs jobs independently.

Recommended E2E: cloud-onboard, credential-sanitization, security-posture, onboard-repair, onboard-resume, rebuild-hermes, rebuild-hermes-stale-base, state-backup-restore, upgrade-stale-sandbox

Blockers

PRA-1 Blocker — Keep definitive supervisor-unavailable failures fail-closed

  • Location: src/lib/actions/sandbox/hermes-secret-boundary-recovery.ts:38
  • Category: correctness
  • Problem: The patch treats any otherwise exact `SUPERVISOR_UNAVAILABLE` response accompanied by a syntactically valid `NEMOCLAW_CONTROL_STAGE` line as transient churn and triggers post-restore retries. The current source contract in `process-recovery.ts` explicitly says this marker also represents integrity refusal, ambiguous discovery, and process-identity changes and must remain definitive. The controller producer confirms the stage is generic diagnostic context: it attaches the current fixed control stage to any previously-unstaged `SUPERVISOR_UNAVAILABLE`, including detect-agent, discovery, proof, and preflight failures. Thus the stage line cannot establish harmless replacement churn, and one of those definitive failures can be retried and subsequently reported healthy.
  • Impact: A post-restore rebuild can accept a Hermes gateway after a supervisor response that the active recovery contract treats as an integrity or identity failure, weakening the required fail-closed health verification.
  • Fix: Use a distinct controller-produced, documented churn-only result whose producer guarantees it cannot accompany integrity, discovery, or identity failures, then classify only that result as retryable; otherwise leave `SUPERVISOR_UNAVAILABLE` terminal.
  • Verification: Read `src/lib/actions/sandbox/process-recovery.ts:364-370`, the classifier at `hermes-secret-boundary-recovery.ts:38-50`, and `scripts/managed-gateway-control.py:112-127,1593-1597`; the producer adds a stage to generic unavailable errors rather than emitting a churn-only result.
  • Test coverage: Add a controller-to-post-restore integration test showing a staged `SUPERVISOR_UNAVAILABLE` caused by an integrity/identity/ambiguous-discovery failure remains `unverified`, then change the controller to emit a separate churn-only marker and test that only it retries and can become healthy.
  • Evidence: `process-recovery.ts:364-370` documents `SUPERVISOR_UNAVAILABLE` as covering integrity refusals, ambiguous discovery, and process-identity changes and says it must remain definitive. `hermes-secret-boundary-recovery.ts:38-50` accepts `SUPERVISOR_UNAVAILABLE` plus any regex-valid control-stage line as `supervisor-churn`. `rebuild-hermes-post-restore.ts:77-87` retries that classification and returns the later observation's health state. `scripts/managed-gateway-control.py:112-127` wraps any unstaged `SUPERVISOR_UNAVAILABLE` in the active stage. `scripts/managed-gateway-control.py:1593-1597` emits `NEMOCLAW_CONTROL_STAGE` whenever an unavailable error carries a stage. The existing F-001 evidence identifies the consumer classifier and post-restore retry path.
1 warning · 0 suggestions

Warnings

Warnings do not block.

PRA-2 Warning — Cover bounded supervisor-churn retry exhaustion

  • Location: src/lib/actions/sandbox/rebuild-hermes-post-restore.ts:77
  • Category: tests
  • Problem: The new three-attempt recovery loop has coverage for one transient churn response followed by healthy state, but no checked-in test verifies the exhaustion boundary. A regression could accept the final churn response, make an extra wait, or lose the bounded-attempt guarantee without failing the existing test.
  • Impact: Post-restore health verification could incorrectly report a gateway healthy after all retryable failures persist, or delay rebuild completion beyond the intended bounded retry window.
  • Recommendation: Add a unit test that returns `supervisor-churn` for all three checks and asserts `unverified`, exactly three recovery calls, and exactly two three-second waits.
  • Verification: Inspect `rebuild-hermes-post-restore.test.ts:16-42`: it has one churn-then-healthy sequence but no three-churn sequence; compare it with the attempt and wait guards at this line.
  • Test coverage: `ensureHermesGatewayAfterStateRestore` with three sequential observations `{ checked: true, wasRunning: true, recovered: false, secretBoundaryRefused: true, secretBoundaryReason: "supervisor-churn" }` returns `"unverified"`, calls the checker three times, and calls `sleepSeconds(3)` twice.
  • Evidence: `POST_RESTORE_SUPERVISOR_ATTEMPTS` is 3 and retries occur only while `attempt < POST_RESTORE_SUPERVISOR_ATTEMPTS` in `rebuild-hermes-post-restore.ts:77-87`. The added test at `rebuild-hermes-post-restore.test.ts:16-42` exercises only one churn observation followed by a healthy observation.

Workflow run details

This automated review informs maintainers. Warnings and suggestions do not require a response. A maintainer decides whether to merge.

Signed-off-by: San Dang <sdang@nvidia.com>
@NVIDIA NVIDIA deleted a comment from github-actions Bot Jul 20, 2026
@github-actions

Copy link
Copy Markdown
Contributor

E2E Target Results — ❌ Some tests failed

Run: 29732601939
Workflow ref: fix/e2e-private-file-esm
Requested targets: rebuild-hermes,rebuild-hermes-stale-base,cloud-onboard,credential-sanitization,security-posture
Requested test IDs: (default — all default-enabled tests; explicit-only tests openshell-gateway-auth-contract, mcp-bridge-dev, hermes-gpu-startup, sandbox-rlimits-connect, and jetson-nvmap-gpu are skipped unless selected)
Summary: 3 passed, 2 failed, 0 cancelled, 0 skipped, 0 unknown

Test Result Total wall clock time
cloud-onboard ✅ success 5m 42s
credential-sanitization ✅ success 5m 18s
rebuild-hermes ❌ failure 6m 9s
rebuild-hermes-stale-base ❌ failure 5m 28s
security-posture ✅ success 13m 21s

Failed tests: rebuild-hermes, rebuild-hermes-stale-base. Check the workflow run for all logs and artifacts.

Signed-off-by: San Dang <sdang@nvidia.com>

@coderabbitai coderabbitai Bot left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Actionable comments posted: 1

🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In `@test/e2e/support/rebuild-hermes-progress.test.ts`:
- Around line 51-52: Update the fake Docker script generation in
rebuild-hermes-progress.test.ts to avoid embedding dockerMarker directly in
shell source. Pass the marker through a safely quoted environment variable or
derive it from the script path, while preserving the existing marker-touch
behavior when the generated docker executable runs.
🪄 Autofix (Beta)

Fix all unresolved CodeRabbit comments on this PR:

  • Push a commit to this branch (recommended)
  • Create a new PR with the fixes

ℹ️ Review info
⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Enterprise

Run ID: 3e26fdca-07eb-4555-839b-4726fe8463d4

📥 Commits

Reviewing files that changed from the base of the PR and between 2a2df02 and bc33a85.

📒 Files selected for processing (3)
  • test/e2e/live/rebuild-hermes-progress.ts
  • test/e2e/support/rebuild-hermes-progress.test.ts
  • tools/e2e/runner-pressure.mts

Comment thread test/e2e/support/rebuild-hermes-progress.test.ts Outdated
sandl99 added 4 commits July 20, 2026 17:16
Signed-off-by: San Dang <sdang@nvidia.com>
Signed-off-by: San Dang <sdang@nvidia.com>
Signed-off-by: San Dang <sdang@nvidia.com>
Signed-off-by: San Dang <sdang@nvidia.com>
@github-actions

Copy link
Copy Markdown
Contributor

E2E Target Results — ❌ Some tests failed

Run: 29744383264
Workflow ref: fix/e2e-private-file-esm
Requested targets: (default — all supported)
Requested test IDs: rebuild-hermes,rebuild-hermes-stale-base
Summary: 1 passed, 1 failed, 0 cancelled, 0 skipped, 0 unknown

Test Result Total wall clock time
rebuild-hermes ✅ success 16m 50s
rebuild-hermes-stale-base ❌ failure 1h 12m 51s

Failed tests: rebuild-hermes-stale-base. Check the workflow run for all logs and artifacts.

@github-actions

Copy link
Copy Markdown
Contributor

E2E Target Results — ❌ Some tests failed

Run: 29750575389
Workflow ref: fix/e2e-private-file-esm
Requested targets: security-posture
Requested test IDs: (default — all default-enabled tests; explicit-only tests openshell-gateway-auth-contract, mcp-bridge-dev, hermes-gpu-startup, sandbox-rlimits-connect, and jetson-nvmap-gpu are skipped unless selected)
Summary: 0 passed, 1 failed, 0 cancelled, 0 skipped, 0 unknown

Test Result Total wall clock time
security-posture ❌ failure 7m 4s

Failed tests: security-posture. Check the workflow run for all logs and artifacts.

@github-actions

Copy link
Copy Markdown
Contributor

E2E Target Results — ✅ All selected tests passed

Run: 29751393619
Workflow ref: fix/e2e-private-file-esm
Requested targets: security-posture
Requested test IDs: (default — all default-enabled tests; explicit-only tests openshell-gateway-auth-contract, mcp-bridge-dev, hermes-gpu-startup, sandbox-rlimits-connect, and jetson-nvmap-gpu are skipped unless selected)
Summary: 1 passed, 0 failed, 0 cancelled, 0 skipped, 0 unknown

Test Result Total wall clock time
security-posture ✅ success 9m 8s

@github-actions

Copy link
Copy Markdown
Contributor

E2E Target Results — ❌ Some tests failed

Run: 29751393624
Workflow ref: fix/e2e-private-file-esm
Requested targets: rebuild-hermes-stale-base
Requested test IDs: (default — all default-enabled tests; explicit-only tests openshell-gateway-auth-contract, mcp-bridge-dev, hermes-gpu-startup, sandbox-rlimits-connect, and jetson-nvmap-gpu are skipped unless selected)
Summary: 0 passed, 1 failed, 0 cancelled, 0 skipped, 0 unknown

Test Result Total wall clock time
rebuild-hermes-stale-base ❌ failure 16m 52s

Failed tests: rebuild-hermes-stale-base. Check the workflow run for all logs and artifacts.

@github-actions

Copy link
Copy Markdown
Contributor

E2E Target Results — ❌ Some tests failed

Run: 29751740423
Workflow ref: fix/e2e-private-file-esm
Requested targets: security-posture
Requested test IDs: (default — all default-enabled tests; explicit-only tests openshell-gateway-auth-contract, mcp-bridge-dev, hermes-gpu-startup, sandbox-rlimits-connect, and jetson-nvmap-gpu are skipped unless selected)
Summary: 0 passed, 1 failed, 0 cancelled, 0 skipped, 0 unknown

Test Result Total wall clock time
security-posture ❌ failure 8m 15s

Failed tests: security-posture. Check the workflow run for all logs and artifacts.

@github-actions

Copy link
Copy Markdown
Contributor

E2E Target Results — ✅ All requested tests passed

Run: 29744383264
Workflow ref: fix/e2e-private-file-esm
Requested targets: (default — all supported)
Requested test IDs: rebuild-hermes,rebuild-hermes-stale-base
Summary: 2 passed, 0 failed, 0 cancelled, 0 skipped, 0 unknown

Test Result Total wall clock time
rebuild-hermes ✅ success 16m 50s
rebuild-hermes-stale-base ✅ success 15m 59s

@github-actions

Copy link
Copy Markdown
Contributor

E2E Target Results — ❌ Some tests failed

Run: 29749845209
Workflow ref: fix/e2e-private-file-esm
Requested targets: rebuild-hermes,rebuild-hermes-stale-base,cloud-onboard,credential-sanitization,security-posture
Requested test IDs: (default — all default-enabled tests; explicit-only tests openshell-gateway-auth-contract, mcp-bridge-dev, hermes-gpu-startup, sandbox-rlimits-connect, and jetson-nvmap-gpu are skipped unless selected)
Summary: 2 passed, 2 failed, 1 cancelled, 0 skipped, 0 unknown

Test Result Total wall clock time
cloud-onboard ✅ success 5m 31s
credential-sanitization ✅ success 5m 11s
rebuild-hermes ⚠️ cancelled 43m 45s
rebuild-hermes-stale-base ❌ failure 15m 58s
security-posture ❌ failure 7m 57s

Failed tests: rebuild-hermes-stale-base, security-posture. Check the workflow run for all logs and artifacts.

@NVIDIA NVIDIA deleted a comment from github-actions Bot Jul 20, 2026
Signed-off-by: San Dang <sdang@nvidia.com>
@github-actions

Copy link
Copy Markdown
Contributor

E2E Target Results — ❌ Some tests failed

Run: 29753559103
Workflow ref: fix/e2e-private-file-esm
Requested targets: rebuild-hermes,rebuild-hermes-stale-base,cloud-onboard,credential-sanitization,security-posture
Requested test IDs: (default — all default-enabled tests; explicit-only tests openshell-gateway-auth-contract, mcp-bridge-dev, hermes-gpu-startup, sandbox-rlimits-connect, and jetson-nvmap-gpu are skipped unless selected)
Summary: 3 passed, 2 failed, 0 cancelled, 0 skipped, 0 unknown

Test Result Total wall clock time
cloud-onboard ✅ success 5m 37s
credential-sanitization ✅ success 4m 46s
rebuild-hermes ✅ success 15m 57s
rebuild-hermes-stale-base ❌ failure 16m 23s
security-posture ❌ failure 13m 51s

Failed tests: rebuild-hermes-stale-base, security-posture. Check the workflow run for all logs and artifacts.

@github-actions

Copy link
Copy Markdown
Contributor

E2E Target Results — ❌ Some tests failed

Run: 29753559103
Workflow ref: fix/e2e-private-file-esm
Requested targets: rebuild-hermes,rebuild-hermes-stale-base,cloud-onboard,credential-sanitization,security-posture
Requested test IDs: (default — all default-enabled tests; explicit-only tests openshell-gateway-auth-contract, mcp-bridge-dev, hermes-gpu-startup, sandbox-rlimits-connect, and jetson-nvmap-gpu are skipped unless selected)
Summary: 3 passed, 1 failed, 1 cancelled, 0 skipped, 0 unknown

Test Result Total wall clock time
cloud-onboard ✅ success 5m 37s
credential-sanitization ✅ success 4m 46s
rebuild-hermes ✅ success 15m 57s
rebuild-hermes-stale-base ⚠️ cancelled 42m 27s
security-posture ❌ failure 20m 1s

Failed tests: security-posture. Check the workflow run for all logs and artifacts.

@github-actions

Copy link
Copy Markdown
Contributor

E2E Target Results — ❌ Some tests failed

Run: 29758219713
Workflow ref: fix/e2e-private-file-esm
Requested targets: rebuild-hermes,rebuild-hermes-stale-base,cloud-onboard,credential-sanitization,security-posture
Requested test IDs: (default — all default-enabled tests; explicit-only tests openshell-gateway-auth-contract, mcp-bridge-dev, hermes-gpu-startup, sandbox-rlimits-connect, and jetson-nvmap-gpu are skipped unless selected)
Summary: 3 passed, 2 failed, 0 cancelled, 0 skipped, 0 unknown

Test Result Total wall clock time
cloud-onboard ✅ success 5m 21s
credential-sanitization ✅ success 4m 54s
rebuild-hermes ❌ failure 18m 57s
rebuild-hermes-stale-base ✅ success 16m 43s
security-posture ❌ failure 5m 40s

Failed tests: rebuild-hermes, security-posture. Check the workflow run for all logs and artifacts.

@wscurran wscurran added area: ci CI workflows, checks, release automation, or GitHub Actions area: e2e End-to-end tests, nightly failures, or validation infrastructure bug-fix PR fixes a bug or regression integration: hermes Hermes integration behavior labels Jul 20, 2026
@github-actions

Copy link
Copy Markdown
Contributor

E2E Target Results — ❌ Some tests failed

Run: 29758219713
Workflow ref: fix/e2e-private-file-esm
Requested targets: rebuild-hermes,rebuild-hermes-stale-base,cloud-onboard,credential-sanitization,security-posture
Requested test IDs: (default — all default-enabled tests; explicit-only tests openshell-gateway-auth-contract, mcp-bridge-dev, hermes-gpu-startup, sandbox-rlimits-connect, and jetson-nvmap-gpu are skipped unless selected)
Summary: 3 passed, 2 failed, 0 cancelled, 0 skipped, 0 unknown

Test Result Total wall clock time
cloud-onboard ✅ success 5m 21s
credential-sanitization ✅ success 4m 54s
rebuild-hermes ❌ failure 52m 2s
rebuild-hermes-stale-base ✅ success 16m 43s
security-posture ❌ failure 1h 18m 32s

Failed tests: rebuild-hermes, security-posture. Check the workflow run for all logs and artifacts.

@sandl99

sandl99 commented Jul 20, 2026

Copy link
Copy Markdown
Collaborator Author

Closing as superseded by #7217, which already merged the original private-file ESM loader fix into main. Any remaining distinct follow-up changes can be proposed separately if still needed.

@sandl99 sandl99 closed this Jul 20, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

area: ci CI workflows, checks, release automation, or GitHub Actions area: e2e End-to-end tests, nightly failures, or validation infrastructure bug-fix PR fixes a bug or regression integration: hermes Hermes integration behavior

Projects

None yet

Development

Successfully merging this pull request may close these issues.

3 participants