ci: finish executable workflow extraction

[cv]

Summary

This PR completes #6952 and #6958 by moving repeated Windows and WSL executable logic into the trusted helper from #7719. It recreates the #7737 extraction directly on main after the helper landed.

Related Issue

Fixes #6952
Fixes #6958

Changes

• Use tools/wsl/ci-helper.ps1 for WSL E2E and platform Vitest setup, script transfer, Node.js installation, and ext4 checkout synchronization. The workflow regression tests protect both consumers.
• Load the helper from the PR base SHA or workflow SHA before candidate checkout. Both workflows fail if the trusted helper is missing.
• Pass needs through NEEDS_JSON instead of interpolating GitHub expressions into executable source. The E2E operations boundary test rejects direct interpolation.
• Validate through the TypeScript AST that needs receives the parsed environment value. Isolated tests reject comments, unrelated assignments, and malformed wiring.
• Update watch triggers and the source-shape budget for the extracted logic.

Type of Change

• Code change (feature, bug fix, or refactor)
• Code change with doc updates
• Doc only (prose changes, no code sample modifications)
• Doc only (includes code sample changes)

Quality Gates

• Tests added or updated for changed behavior
• Existing tests cover changed behavior — justification:
• Tests not applicable — justification:
• Docs updated for user-facing behavior changes
• Docs not applicable — justification: This PR changes internal CI workflows and tests. It does not change a CLI, configuration, supported integration, or user-facing contract.
• Sensitive paths changed (security, policy, credentials, preflight, onboarding, inference, runner, sandbox, or messaging)
• Sensitive-path review completed or maintainer-approved waiver recorded — reviewer/approval link/justification: The trusted helper is loaded from the base or workflow SHA before candidate checkout. Focused tests verify trusted provenance, failure when the helper is missing, path overlap rejection, quoting, encoding, needs assignment and interpolation, and root separation.
• Non-success, skipped, or missing CI check accepted by maintainer — check name, approval link, and follow-up issue:

Documentation Writer Review

• Documentation writer subagent reviewed the completed changes
• Result: no-docs-needed
• Evidence: Reviewed head b56897529e166385464c7e8ec051174f3af4f2aa against base c3ab0526eba41d1c681e92bbad3d174925aeaa6a. The AST validator and its regressions change internal CI security enforcement only. No documentation source or user-facing contract changed. The review-fix suite passed 45 tests. Biome, repository checks, CLI type-checking, the diff check, source-shape budget, title check, gitleaks, and commitlint passed.
• Agent: Codex Desktop

DGX Station Hardware Evidence

• Tested on DGX Station
• Tested commit:
• Station profile/scenario:
• Result:
• Supporting evidence:

Verification

• PR description includes a Signed-off-by: line and every commit appears as Verified in GitHub
• Normal pre-commit, commit-msg, and pre-push hooks passed, or npm run check:diff passed when hooks were skipped or unavailable
• Targeted behavior tests pass for the current change set, or tests are marked not applicable above — command/result or justification: The original focused suite passed 50 tests and skipped 12 PowerShell-only tests. After the review fix, the E2E operations boundary suite passed 45 tests. npx biome check for the changed files, npm run checks, npm run typecheck:cli, and git diff --check passed.
• Applicable broad gate passed — npm test for broad runtime/test-harness changes; npm run check for repo-wide validation/coverage changes — command/result:
• Quality Gates section completed with required justifications or waivers
• No secrets, API keys, or credentials committed
• npm run docs builds without warnings (doc changes only)
• Doc pages follow the style guide (doc changes only)
• New doc pages include SPDX header and frontmatter (new pages only)

---

Signed-off-by: Carlos Villela cvillela@nvidia.com

[coderabbitai]

📝 Walkthrough

Walkthrough

The PR routes WSL provisioning and execution through a trusted PowerShell helper, updates WSL workflow security and trigger validation, and passes GitHub Actions needs data through NEEDS_JSON for runtime parsing.

Changes

Environment-based needs handling

Layer / File(s)	Summary
Needs environment wiring and validation .github/workflows/e2e.yaml, tools/e2e/operations-workflow-boundary.mts, test/e2e/support/e2e-operations-workflow-boundary.test.ts	The report-to-pr and scorecard scripts parse NEEDS_JSON; boundary validators and runtime tests enforce environment-based data transfer without script interpolation.

Trusted WSL workflow execution

Layer / File(s)	Summary
Platform Vitest helper integration .github/workflows/platform-vitest-main.yaml, test/platform-vitest-main-workflow.test.ts, ci/source-shape-test-budget.json	The platform Vitest workflow delegates WSL setup, synchronization, builds, and tests to the trusted helper while retaining root-only contract execution and updated command assertions.
WSL E2E helper integration .github/workflows/wsl-e2e.yaml	The WSL E2E workflow checks out the trusted helper, provisions WSL through helper functions, detects Docker, and runs the full suite with bash-safe environment exports.
Trigger and workflow coverage test/helpers/vitest-watch-triggers.ts, test/vitest-watch-triggers.test.ts	Watch-trigger mappings and opaque-input coverage include the WSL workflows and tools/wsl/ci-helper.ps1.

Estimated code review effort: 4 (Complex) | ~45 minutes

Sequence Diagram(s)

sequenceDiagram
  participant Workflow
  participant TrustedWslHelper
  participant WslWorkspace
  participant TestRunner
  Workflow->>TrustedWslHelper: Provision WSL and resolve paths
  TrustedWslHelper->>WslWorkspace: Install dependencies and sync source
  Workflow->>TrustedWslHelper: Invoke build and test commands
  TrustedWslHelper->>TestRunner: Run Vitest or E2E shards

Loading

sequenceDiagram
  participant E2EWorkflow
  participant GithubScript
  participant ProcessEnv
  E2EWorkflow->>GithubScript: Set NEEDS_JSON from toJSON(needs)
  GithubScript->>ProcessEnv: Read process.env.NEEDS_JSON
  ProcessEnv-->>GithubScript: Return JSON needs data
  GithubScript->>GithubScript: Parse and use needs

Loading

Possibly related PRs

• NVIDIA/NemoClaw#7670: Updates the Node.js archive pinning and related WSL workflow tests.
• NVIDIA/NemoClaw#7709: Also uses NEEDS_JSON and the trusted WSL helper in the affected workflows.
• NVIDIA/NemoClaw#7719: Introduces the trusted WSL helper integration and related coverage.

Suggested labels: area: ci, area: e2e, area: security, platform: wsl, v0.0.97

Suggested reviewers: brandonpelfrey, ericksoa

🚥 Pre-merge checks | ✅ 4 | ❌ 1

❌ Failed checks (1 warning)

Check name	Status	Explanation	Resolution
Docstring Coverage	⚠️ Warning	Docstring coverage is 0.00% which is insufficient. The required threshold is 80.00%.	Write docstrings for the functions missing them to satisfy the coverage threshold.

✅ Passed checks (4 passed)

Check name	Status	Explanation
Linked Issues check	✅ Passed	The workflow refactor and tests align with #6952 and #6958 by extracting trusted WSL logic and preserving the required trust boundary.
Out of Scope Changes check	✅ Passed	No clear out-of-scope changes are evident; the workflow, test, and budget updates support the helper extraction objectives.
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title is concise and matches the main change: extracting executable workflow logic into a trusted helper.

✨ Finishing Touches

📝 Generate docstrings

• Create stacked PR
• Commit on current branch

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch codex/issue-6952-completion-v3

---

_{Comment @coderabbitai help to get the list of available commands.}

[github-code-quality]

Code Coverage Overview

Languages: TypeScript

TypeScript / code-coverage/plugin

The overall coverage in commit b568975 in the codex/issue-6952-com... branch remains at 96%, unchanged from commit c3ab052 in the main branch.

---

_{Updated July 28, 2026 16:53 UTC}

[github-actions]

PR Review Advisor — No blocking findings reported

Advisor assessment: No blocking advisor findings reported
Next action: No advisor follow-up needed.
Findings: 0 blockers · 0 warnings · 0 suggestions

Model lanes

• GPT-5.6 Terra (primary): Completed · high confidence · 0 blockers · 0 warnings · 0 suggestions
• Nemotron 3 Ultra (second opinion): Completed · high confidence · 0 blockers · 0 warnings · 0 suggestions
• Model comparison: normalized findings match; normalized E2E selections differ; severity counts match.

Nemotron output stays in workflow artifacts and does not change the assessment above.

E2E guidance

Advisory only. E2E / PR Gate selects and runs jobs independently.

Recommended E2E: cloud-inference, cloud-onboard, security-posture

Workflow run details

This automated review informs maintainers. Warnings and suggestions do not require a response. A maintainer decides whether to merge.

[coderabbitai]

Actionable comments posted: 1

🧹 Nitpick comments (1)

.github/workflows/wsl-e2e.yaml (1)

113-123: 📐 Maintainability & Code Quality | 🔵 Trivial | 💤 Low value

Consider npm ci --ignore-scripts here to match the platform lane.

platform-vitest-main.yaml (Lines 243-246) uses npm ci, while this lane uses npm install, which can resolve versions outside package-lock.json and make WSL E2E results non-reproducible. If the divergence is deliberate (e.g. this lane intentionally tolerates lock drift), ignore this.

♻️ Align the install command

           set -euo pipefail
           cd $workdir
-          npm install --ignore-scripts
+          npm ci --ignore-scripts
           npm run build:cli
           cd nemoclaw
-          npm install --ignore-scripts
+          npm ci --ignore-scripts
           npm run build

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In @.github/workflows/wsl-e2e.yaml around lines 113 - 123, Update the dependency
installation commands in the WSL script around Invoke-WslScript to use npm ci
--ignore-scripts instead of npm install --ignore-scripts for both the root
project and nemoclaw, preserving the existing build and directory flow.

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In `@tools/e2e/operations-workflow-boundary.mts`:
- Around line 51-53: Make the NEEDS_JSON validation semantic in
tools/e2e/operations-workflow-boundary.mts at lines 51-53 by verifying that
process.env.NEEDS_JSON is parsed and assigned to the actual needs value,
preferably through syntax-aware inspection rather than matching any raw
JSON.parse substring. In
test/e2e/support/e2e-operations-workflow-boundary.test.ts at lines 68-92, rename
the test with behavior-oriented wording and add independent cases covering
missing or malformed environment data, interpolation, and commented or unrelated
parsing so each rejection behavior is tested in isolation.

---

Nitpick comments:
In @.github/workflows/wsl-e2e.yaml:
- Around line 113-123: Update the dependency installation commands in the WSL
script around Invoke-WslScript to use npm ci --ignore-scripts instead of npm
install --ignore-scripts for both the root project and nemoclaw, preserving the
existing build and directory flow.

🪄 Autofix (Beta)

Fix all unresolved CodeRabbit comments on this PR:

• Push a commit to this branch (recommended)
• Create a new PR with the fixes

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Enterprise

Run ID: d00a613d-1e6d-4ffc-8eec-1edda03540c2

📥 Commits

Reviewing files that changed from the base of the PR and between c3ab052 and ee619ff.

📒 Files selected for processing (9)

• .github/workflows/e2e.yaml
• .github/workflows/platform-vitest-main.yaml
• .github/workflows/wsl-e2e.yaml
• ci/source-shape-test-budget.json
• test/e2e/support/e2e-operations-workflow-boundary.test.ts
• test/helpers/vitest-watch-triggers.ts
• test/platform-vitest-main-workflow.test.ts
• test/vitest-watch-triggers.test.ts
• tools/e2e/operations-workflow-boundary.mts