fix(ci): publish supported conflict resolutions

[cv]

Summary

The first production run created three valid resolution patches but did not update a PR branch. This change fixes the publisher and excludes workflow-file conflicts that the repository GITHUB_TOKEN cannot publish.

Related Issue

Follow-up to #7542

Changes

• Select clientMutationId from UpdateRefsPayload. The live GitHub schema does not expose refUpdates in that payload.
• Keep beforeOid and force: false as the atomic PR-head update contract.
• Skip a PR when its conflict paths include .github/workflows/**. A repository GITHUB_TOKEN cannot publish changed workflow files.
• Upload blobs only for resolved conflict paths. GitHub already stores blobs referenced by the PR and base parents.
• Update the behavior test to use the live GraphQL payload shape. The test also verifies mixed workflow-conflict selection and one conflict-blob upload.

The original test mock returned a response shape that the GitHub schema does not provide. The production run exposed this detection gap. The updated mock fails when the invalid selection returns.

Type of Change

• Code change (feature, bug fix, or refactor)
• Code change with doc updates
• Doc only (prose changes, no code sample modifications)
• Doc only (includes code sample changes)

Quality Gates

• Tests added or updated for changed behavior
• Existing tests cover changed behavior — justification:
• Tests not applicable — justification:
• Docs updated for user-facing behavior changes
• Docs not applicable — justification: This changes experimental repository-maintainer automation. It adds no command, configuration, integration, or documentation route.
• Sensitive paths changed (security, policy, credentials, preflight, onboarding, inference, runner, sandbox, or messaging)
• Sensitive-path review completed or maintainer-approved waiver recorded — reviewer/approval link/justification: Maintainers accepted the narrow no-PAT workflow-file exception in the production amendment. The original Minimal V1 approval and production run provide the surrounding contract and failure evidence.
• Non-success, skipped, or missing CI check accepted by maintainer — check name, approval link, and follow-up issue:

Documentation Writer Review

• Documentation writer subagent reviewed the completed changes
• Result: no-docs-needed
• Evidence: The revised mixed-path fixture changes test coverage only. The PR still has no user-documentation surface. Changed text follows NemoClaw terminology, structure, voice, and behavior-oriented test-title rules. No findings.
• Agent: Codex Desktop

DGX Station Hardware Evidence

• Tested on DGX Station
• Tested commit: Not applicable
• Station profile/scenario: Not applicable
• Result: Not applicable
• Supporting evidence: Not applicable

Verification

• PR description includes a Signed-off-by: line and every commit appears as Verified in GitHub
• Normal pre-commit, commit-msg, and pre-push hooks passed, or npm run check:diff passed when hooks were skipped or unavailable
• Targeted behavior tests pass for the current change set, or tests are marked not applicable above — command/result or justification: npx vitest run test/pr-merge-conflict-fixer.test.ts test/pr-merge-conflict-fixer-workflow-boundary.test.ts — 2 files and 17 tests passed.
• Applicable broad gate passed — npm test for broad runtime/test-harness changes; npm run check for repo-wide validation/coverage changes — command/result:
• Quality Gates section completed with required justifications or waivers
• No secrets, API keys, or credentials committed
• npm run docs builds without warnings (doc changes only)
• Doc pages follow the style guide (doc changes only)
• New doc pages include SPDX header and frontmatter (new pages only)

---

Signed-off-by: Carlos Villela cvillela@nvidia.com

Summary by CodeRabbit

• Bug Fixes
  • Pull requests with conflicts limited to GitHub workflow files are now skipped during conflict resolution.
  • Resolved updates now publish only the files that actually changed, avoiding unnecessary blob/tree uploads.
  • Branch updates now use stronger atomic verification to better ensure resolved changes are applied reliably.
• Tests
  • Added coverage for workflow-path conflict exclusion and tightened assertions around commit-related mutation behavior.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Enterprise

Run ID: 7e89ad28-3324-4041-9052-4481fba8119f

📥 Commits

Reviewing files that changed from the base of the PR and between ca05cc1 and 49792ea.

📒 Files selected for processing (1)

• test/pr-merge-conflict-fixer.test.ts

🚧 Files skipped from review as they are similar to previous changes (1)

• test/pr-merge-conflict-fixer.test.ts

---

📝 Walkthrough

Walkthrough

The conflict fixer skips workflow-file conflicts during discovery. Publication limits blob uploads to validated changed paths and verifies atomic ref updates with clientMutationId; tests cover both behaviors.

Changes

Conflict fixer safeguards

Layer / File(s)	Summary
Workflow conflict filtering tools/pr-merge-conflict-fixer/discover.mts, test/pr-merge-conflict-fixer.test.ts	Pull requests with conflicts under .github/workflows/ are excluded before model selection, with coverage for selecting a non-workflow conflict instead.
Selective tree publication and ref verification tools/pr-merge-conflict-fixer/publish.mts, test/pr-merge-conflict-fixer.test.ts	Validated changed paths are forwarded to tree creation, only matching blobs are uploaded, and the ref update is verified through the returned clientMutationId; tests assert the mutation identifier and uploaded content.

Estimated code review effort: 3 (Moderate) | ~20 minutes

Possibly related issues

• ci: resolve PR merge conflicts with a sandboxed Pi agent #7542 — Covers excluding .github/workflows/** conflicts and verifying merge publication updates.

Suggested labels: area: ci

🚥 Pre-merge checks | ✅ 4 | ❌ 1

❌ Failed checks (1 warning)

Check name	Status	Explanation	Resolution
Docstring Coverage	⚠️ Warning	Docstring coverage is 0.00% which is insufficient. The required threshold is 80.00%.	Write docstrings for the functions missing them to satisfy the coverage threshold.

✅ Passed checks (4 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title matches the main change: publishing supported conflict resolutions with CI-related safeguards.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

✨ Finishing Touches

📝 Generate docstrings

• Create stacked PR
• Commit on current branch

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch codex/fix-conflict-publisher

---

_{Comment @coderabbitai help to get the list of available commands.}

[github-code-quality]

Code Coverage Overview

Languages: TypeScript

TypeScript / code-coverage/plugin

The overall coverage in commit 49792ea in the codex/fix-conflict-p... branch remains at 96%, unchanged from commit d525e15 in the main branch.

TypeScript / code-coverage/cli

The overall coverage in commit 49792ea in the codex/fix-conflict-p... branch remains at 80%, unchanged from commit 29bd189 in the main branch.

Show a code coverage summary of the most impacted files.

File	main 29bd189	codex/fix-conflict-p... 49792ea	+/-
src/lib/actions...-add-restart.ts	19%	10%	-9%
src/lib/actions...x/mcp-bridge.ts	43%	36%	-7%
src/lib/actions...lution-probe.ts	93%	88%	-5%
src/lib/actions...e-validation.ts	84%	81%	-3%
src/lib/actions...dbox/destroy.ts	95%	93%	-2%
src/lib/onboard...eway-service.ts	82%	81%	-1%
src/lib/onboard...ndbox-create.ts	83%	91%	+8%
src/lib/domain/.../connect-env.ts	89%	97%	+8%
src/lib/onboard...-create-plan.ts	75%	88%	+13%
src/lib/onboard...ndbox-create.ts	33%	83%	+50%

---

_{Updated July 26, 2026 07:02 UTC}

[coderabbitai]

🧹 Nitpick comments (1)

test/pr-merge-conflict-fixer.test.ts (1)

214-226: 🎯 Functional Correctness | 🔵 Trivial | ⚡ Quick win

Cover mixed workflow conflicts.

The test only exercises a workflow-only conflict. Add a case containing both conflict.txt and .github/workflows/e2e.yaml so the test protects the intended .some(...) behavior and prevents an eligible textual conflict from bypassing the workflow exclusion.

Suggested test adjustment

        checkConflict: (candidate) =>
-          candidate.number === 1 ? [".github/workflows/e2e.yaml"] : ["conflict.txt"],
+          candidate.number === 1
+            ? ["conflict.txt", ".github/workflows/e2e.yaml"]
+            : ["conflict.txt"],

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@test/pr-merge-conflict-fixer.test.ts` around lines 214 - 226, Update the test
around selectConflictingPullRequests to include a candidate whose checkConflict
result contains both "conflict.txt" and ".github/workflows/e2e.yaml", while
retaining an eligible textual-conflict candidate and the workflow-only case as
appropriate. Assert that the mixed-conflict candidate is excluded, preserving
the intended .some(...) workflow exclusion behavior.

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Nitpick comments:
In `@test/pr-merge-conflict-fixer.test.ts`:
- Around line 214-226: Update the test around selectConflictingPullRequests to
include a candidate whose checkConflict result contains both "conflict.txt" and
".github/workflows/e2e.yaml", while retaining an eligible textual-conflict
candidate and the workflow-only case as appropriate. Assert that the
mixed-conflict candidate is excluded, preserving the intended .some(...)
workflow exclusion behavior.

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Enterprise

Run ID: e7a891ec-e198-45b6-9d4a-d71e797ca041

📥 Commits

Reviewing files that changed from the base of the PR and between d525e15 and ca05cc1.

📒 Files selected for processing (3)

• test/pr-merge-conflict-fixer.test.ts
• tools/pr-merge-conflict-fixer/discover.mts
• tools/pr-merge-conflict-fixer/publish.mts

[github-actions]

PR Review Advisor — No blocking findings reported

Advisor assessment: No blocking advisor findings reported
Next action: Review the warnings below.
Findings: 0 blockers · 1 warning · 0 suggestions

Model lanes

• GPT-5.6 Terra (primary): Completed · high confidence · 0 blockers · 1 warning · 0 suggestions
• Nemotron 3 Ultra (second opinion): Completed · high confidence · 0 blockers · 0 warnings · 0 suggestions
• Model comparison: normalized findings differ; normalized E2E selections match; Nemotron reported the same number of blockers, 1 fewer warning, the same number of suggestions.

Nemotron output stays in workflow artifacts and does not change the assessment above.

E2E guidance

Advisory only. E2E / PR Gate selects and runs jobs independently.

Recommended E2E: None

1 warning · 0 suggestions

Warnings

Warnings do not block.

PRA-1 Warning — Test rejected atomic-update confirmation

• Location: test/pr-merge-conflict-fixer.test.ts:306
• Category: tests
• Problem: The publication test covers only the response that echoes the supplied clientMutationId. It does not exercise the new rejection branch for a missing or mismatched updateRefs.clientMutationId.
• Impact: A future change can remove or invert the confirmation check without a regression test, allowing publishResolution to report success after an unconfirmed ref mutation.
• Recommendation: Add mocked GraphQL cases with a missing and a different clientMutationId. Assert publishResolution rejects with the atomic PR branch update confirmation error.
• Verification: Inspect publishValidatedTree in tools/pr-merge-conflict-fixer/publish.mts and run the focused Vitest file after adding the mocked GraphQL responses.
• Test coverage: publishResolution rejects when updateRefs returns no clientMutationId or a clientMutationId that differs from the created commit SHA.
• Evidence: tools/pr-merge-conflict-fixer/publish.mts rejects when result.updateRefs?.clientMutationId differs from the local commit SHA. test/pr-merge-conflict-fixer.test.ts configures the GraphQL mock to return the matching commit SHA and asserts only the success path.

Workflow run details

This automated review informs maintainers. Warnings and suggestions do not require a response. A maintainer decides whether to merge.