ci(main): start sandbox validation after preflight

[cjagwani]

Summary

Starts sandbox image validation after the static and build/type-check preflight instead of serializing it behind the complete main test suite. The final checks job still waits for the reusable workflow and now fails unless that workflow succeeds. The branch was refreshed onto current main and its accepted-success fixture now supplies the required sandbox result.

Related Issue

Part of #7451.

Changes

• Make sandbox-images-and-e2e depend only on static-checks and build-typecheck.
• Keep sandbox-images-and-e2e in the final checks dependency list.
• Require the reusable workflow result to be success in the final gate.
• Extend the sandbox workflow validator and negative test to reject late scheduling or an omitted final gate.
• Cover the required sandbox result in both successful and failed main-workflow contract fixtures.

Type of Change

• Code change (feature, bug fix, or refactor)
• Code change with doc updates
• Doc only (prose changes, no code sample modifications)
• Doc only (includes code sample changes)

Quality Gates

• Tests added or updated for changed behavior
• Existing tests cover changed behavior — justification:
• Tests not applicable — justification:
• Docs updated for user-facing behavior changes
• Docs not applicable — justification: This changes internal main-branch CI dependency ordering and its contract fixtures only; no repository docs name these jobs or their ordering.
• Sensitive paths changed (security, policy, credentials, preflight, onboarding, inference, runner, sandbox, or messaging)
• Sensitive-path review completed or maintainer-approved waiver recorded — reviewer/approval link/justification: Nine-category review found no findings. Secret mappings and read-only workflow permissions are unchanged, and the validator proves that earlier scheduling cannot bypass the final required gate.
• Non-success, skipped, or missing CI check accepted by maintainer — check name, approval link, and follow-up issue:

Documentation Writer Review

• Documentation writer subagent reviewed the completed changes
• Result: no-docs-needed
• Evidence: The exact four-file patch changes only internal main-branch CI scheduling, final-gate enforcement, its validator, and regression fixtures; no CLI, user configuration, supported product behavior, or documented workflow changes.
• Agent: Codex Desktop

DGX Station Hardware Evidence

• Tested on DGX Station
• Tested commit:
• Station profile/scenario:
• Result:
• Supporting evidence:

Verification

• PR description includes a Signed-off-by: line and every commit appears as Verified in GitHub
• Normal pre-commit, commit-msg, and pre-push hooks passed, or npm run check:diff passed when hooks were skipped or unavailable — Normal pre-commit, commit-msg, and pre-push hooks passed at exact head b0b414fbf25d06fb0750c6a5601957264a3b4d1b.
• Targeted behavior tests pass for the current change set, or tests are marked not applicable above — test/pr-workflow-contract.test.ts passed 22/22 and test/e2e/support/sandbox-images-workflow-boundary.test.ts passed 24/24 at the final head.
• Applicable broad gate passed — npm test for broad runtime/test-harness changes; npm run check for repo-wide validation/coverage changes — command/result: Not applicable to one focused workflow dependency contract.
• Quality Gates section completed with required justifications or waivers
• No secrets, API keys, or credentials committed
• npm run docs builds without warnings (doc changes only)
• Doc pages follow the style guide (doc changes only)
• New doc pages include SPDX header and frontmatter (new pages only)

---

Signed-off-by: Charan Jagwani cjagwani@nvidia.com

Summary by CodeRabbit

• CI Improvements

  • Main checks now wait for sandbox image and end-to-end validation before completing.
  • Sandbox workflow results are explicitly verified, with failures surfaced in the main check.

• Bug Fixes

  • Prevented successful main checks from being reported when sandbox validation fails or is skipped.

• Tests

  • Added coverage to verify workflow ordering, dependency handoffs, and failure reporting.

[coderabbitai]

📝 Walkthrough

Walkthrough

The main CI workflow now schedules the sandbox image and E2E job after preflight checks, waits for it in the main gate, and requires its result. Boundary validation and tests enforce this dependency and result handoff.

Changes

Sandbox workflow integrity

Layer / File(s)	Summary
Workflow gate wiring .github/workflows/main.yaml	The checks job waits for sandbox-images-and-e2e, exposes and validates its result, resolves its dependency URL, and the sandbox job depends directly on static-checks and build-typecheck.
Boundary validation and regression coverage tools/e2e/sandbox-images-workflow-boundary.mts, test/e2e/support/sandbox-images-workflow-boundary.test.ts, test/pr-workflow-contract.test.ts	Validation and tests enforce sandbox caller ordering, main-gate waiting, result propagation, the required success check, and aggregate success and failure fixtures.

Estimated code review effort: 2 (Simple) | ~10 minutes

Suggested labels: area: ci, area: e2e, area: sandbox, github_actions

Suggested reviewers: cv, laitingsheng, apurvvkumaria

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly matches the main change: sandbox validation now starts after preflight rather than waiting for the full main suite.

✨ Finishing Touches

📝 Generate docstrings

• Create stacked PR
• Commit on current branch

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch codex/7451-main-scheduling

---

_{Comment @coderabbitai help to get the list of available commands.}

[github-code-quality]

Code Coverage Overview

Languages: TypeScript

TypeScript / code-coverage/plugin

The overall coverage in commit b0b414f in the codex/7451-main-sche... branch remains at 96%, unchanged from commit 4fdbb79 in the main branch.

TypeScript / code-coverage/cli

The overall coverage in commit b0b414f in the codex/7451-main-sche... branch is 80%. The coverage in commit 4fdbb79 in the main branch is 81%.

Show a code coverage summary of the most impacted files.

File	main 4fdbb79	codex/7451-main-sche... b0b414f	+/-
src/lib/onboard/docker-cdi.ts	80%	70%	-10%
src/lib/shields/index.ts	72%	67%	-5%
src/lib/onboard...host-anchors.ts	94%	90%	-4%
src/lib/onboard/preflight.ts	79%	79%	0%
src/lib/actions...light-guards.ts	86%	90%	+4%
src/lib/onboard...box-gpu-mode.ts	92%	97%	+5%
src/lib/domain/.../connect-env.ts	89%	97%	+8%
src/lib/actions...confirmation.ts	69%	79%	+10%
src/lib/actions...ocker-health.ts	65%	82%	+17%
src/lib/onboard...box-prebuild.ts	74%	92%	+18%

---

_{Updated July 26, 2026 03:13 UTC}

[github-actions]

PR Review Advisor — No blocking findings reported

Advisor assessment: No blocking advisor findings reported
Next action: No advisor follow-up needed.
Findings: 0 blockers · 0 warnings · 0 suggestions

Model lanes

• GPT-5.6 Terra (primary): Completed · high confidence · 0 blockers · 0 warnings · 0 suggestions
• Nemotron 3 Ultra (second opinion): Completed · high confidence · 0 blockers · 0 warnings · 0 suggestions
• Model comparison: normalized findings match; normalized E2E selections differ; severity counts match.

Nemotron output stays in workflow artifacts and does not change the assessment above.

Since last review: 0 prior items resolved · 0 still apply · 0 new items found

E2E guidance

Advisory only. E2E / PR Gate selects and runs jobs independently.

Recommended E2E: cloud-onboard, credential-sanitization, security-posture

Workflow run details

This automated review informs maintainers. Warnings and suggestions do not require a response. A maintainer decides whether to merge.

[cjagwani]

Addressed the Advisor warning in b0b414f. The existing main-gate failure fixture now targets sandbox-images-and-e2e, asserts aggregate failure, and reports the exact failed-job URL. This preserves the 1,500-line test budget instead of duplicating an equivalent main-gate case. Focused contract: 22/22 passed; normal hooks passed.

[cv]

Reviewed exact head: CI, fallback credentialed E2E, compliance, review threads, and merge gates pass.