From 8c735cbb89c8d594b3ebf5b4673e2210c30d1449 Mon Sep 17 00:00:00 2001 From: Carlos Villela Date: Wed, 5 Aug 2026 04:34:37 -0700 Subject: [PATCH 01/12] fix(e2e): restore shared CLI boundaries --- .../restore-e2e-cli-artifact/action.yaml | 12 +++- .github/workflows/e2e.yaml | 10 ++- .../cli-artifact-workflow-boundary.test.ts | 66 +++++++++++++++++-- tools/e2e/cli-artifact-workflow-boundary.mts | 14 +++- 4 files changed, 93 insertions(+), 9 deletions(-) diff --git a/.github/actions/restore-e2e-cli-artifact/action.yaml b/.github/actions/restore-e2e-cli-artifact/action.yaml index d3e7784e9b..cd5a131d65 100644 --- a/.github/actions/restore-e2e-cli-artifact/action.yaml +++ b/.github/actions/restore-e2e-cli-artifact/action.yaml @@ -146,7 +146,7 @@ runs: { echo "::error::exact-commit CLI artifact payload digest mismatch"; exit 1; } while IFS= read -r member; do case "$member" in - dist | dist/*) ;; + dist | dist/* | nemoclaw/dist/shared | nemoclaw/dist/shared/*) ;; *) echo "::error::CLI artifact contains an unsafe member: $member"; exit 1 ;; esac case "/$member/" in @@ -158,11 +158,20 @@ runs: { echo "::error::CLI artifact contains a link or special file"; exit 1; } [[ ! -e "$GITHUB_WORKSPACE/dist" && ! -L "$GITHUB_WORKSPACE/dist" ]] || { echo "::error::consumer unexpectedly built dist before artifact restore"; exit 1; } + [[ ! -e "$GITHUB_WORKSPACE/nemoclaw/dist" && ! -L "$GITHUB_WORKSPACE/nemoclaw/dist" ]] || + { echo "::error::consumer unexpectedly built shared boundaries before artifact restore"; exit 1; } restore_dir="$(mktemp -d "${RUNNER_TEMP}/nemoclaw-cli-restore.XXXXXX")" trap 'rm -rf -- "$restore_dir"' EXIT tar --no-same-owner --no-same-permissions -xf "$payload" -C "$restore_dir" test -s "$restore_dir/dist/nemoclaw.js" || { echo "::error::restored CLI artifact is missing dist/nemoclaw.js"; exit 1; } + for boundary in \ + openshell-policy-boundary.cjs \ + sandbox-name.cjs \ + snapshot-sanitizer-boundary.cjs; do + test -s "$restore_dir/nemoclaw/dist/shared/$boundary" || + { echo "::error::restored CLI artifact is missing shared boundary $boundary"; exit 1; } + done jq -e --arg candidateSha "$CANDIDATE_SHA" ' type == "object" and (keys | sort) == ["nemoclawVersion", "sourceRevision"] and @@ -170,5 +179,6 @@ runs: .sourceRevision == $candidateSha ' "$restore_dir/dist/build-identity.json" >/dev/null || { echo "::error::restored CLI build identity does not match the candidate SHA"; exit 1; } + mv "$restore_dir/nemoclaw/dist" "$GITHUB_WORKSPACE/nemoclaw/dist" mv "$restore_dir/dist" "$GITHUB_WORKSPACE/dist" node "$GITHUB_WORKSPACE/bin/nemoclaw.js" --version >/dev/null diff --git a/.github/workflows/e2e.yaml b/.github/workflows/e2e.yaml index 8173c20f28..86aac534a0 100644 --- a/.github/workflows/e2e.yaml +++ b/.github/workflows/e2e.yaml @@ -396,6 +396,13 @@ jobs: { echo "::error::candidate CLI build did not produce dist/nemoclaw.js"; exit 1; } test -s dist/build-identity.json || { echo "::error::candidate CLI build did not produce dist/build-identity.json"; exit 1; } + test -s nemoclaw/dist/shared/openshell-policy-boundary.cjs || + { echo "::error::candidate CLI build did not produce the shared policy boundary"; exit 1; } + test -s nemoclaw/dist/shared/sandbox-name.cjs || + { echo "::error::candidate CLI build did not produce the shared sandbox-name boundary"; exit 1; } + test -s nemoclaw/dist/shared/snapshot-sanitizer-boundary.cjs || + { echo "::error::candidate CLI build did not produce the shared snapshot boundary"; exit 1; } + jq -e --arg candidateSha "$CANDIDATE_SHA" ' type == "object" and (keys | sort) == ["nemoclawVersion", "sourceRevision"] and @@ -415,7 +422,8 @@ jobs: --group=0 \ --numeric-owner \ -cf "$payload" \ - dist + dist \ + nemoclaw/dist/shared payload_sha256="$(sha256sum "$payload" | awk '{print $1}')" source_tree="$(git rev-parse 'HEAD^{tree}')" lockfile_sha256="$(sha256sum package-lock.json | awk '{print $1}')" diff --git a/test/e2e/support/cli-artifact-workflow-boundary.test.ts b/test/e2e/support/cli-artifact-workflow-boundary.test.ts index 1015e91df8..6ee2d0e7fd 100644 --- a/test/e2e/support/cli-artifact-workflow-boundary.test.ts +++ b/test/e2e/support/cli-artifact-workflow-boundary.test.ts @@ -71,7 +71,7 @@ type RestoreFixtureOptions = { buildIdentitySha?: string; expectedPayloadSha256?: string; manifestCandidateSha?: string; - preexistingDist?: "dangling-symlink" | "directory"; + preexistingDist?: "dangling-symlink" | "directory" | "plugin-directory"; }; type ArchiveFixtureContext = { @@ -84,13 +84,18 @@ function sha256File(file: string): string { return createHash("sha256").update(fs.readFileSync(file)).digest("hex"); } -function writeDistArchive( +function writeCliArchive( context: ArchiveFixtureContext, customizeDist: (dist: string) => void, ): void { const dist = path.join(context.payloadRoot, "dist"); + const shared = path.join(context.payloadRoot, "nemoclaw", "dist", "shared"); fs.mkdirSync(dist); - fs.writeFileSync(path.join(dist, "nemoclaw.js"), 'console.log("nemoclaw v0.0.0");\n'); + fs.mkdirSync(shared, { recursive: true }); + fs.writeFileSync( + path.join(dist, "nemoclaw.js"), + 'require("../nemoclaw/dist/shared/sandbox-name.cjs");\nconsole.log("nemoclaw v0.0.0");\n', + ); fs.writeFileSync( path.join(dist, "build-identity.json"), `${JSON.stringify({ @@ -98,16 +103,30 @@ function writeDistArchive( sourceRevision: context.buildIdentitySha, })}\n`, ); + for (const boundary of [ + "openshell-policy-boundary.cjs", + "sandbox-name.cjs", + "snapshot-sanitizer-boundary.cjs", + ]) { + fs.writeFileSync(path.join(shared, boundary), "module.exports = {};\n"); + } customizeDist(dist); - execFileSync("tar", ["-cf", context.payload, "-C", context.payloadRoot, "dist"]); + execFileSync("tar", [ + "-cf", + context.payload, + "-C", + context.payloadRoot, + "dist", + "nemoclaw/dist/shared", + ]); } function writeValidArchive(context: ArchiveFixtureContext): void { - writeDistArchive(context, () => undefined); + writeCliArchive(context, () => undefined); } function writeLinkArchive(context: ArchiveFixtureContext): void { - writeDistArchive(context, (dist) => { + writeCliArchive(context, (dist) => { fs.symlinkSync("nemoclaw.js", path.join(dist, "linked-cli.js")); }); } @@ -154,9 +173,17 @@ function writePreexistingDistDirectory(workspace: string): void { fs.writeFileSync(path.join(workspace, "dist", "existing.txt"), "preserve\n"); } +function writePreexistingPluginDistDirectory(workspace: string): void { + const shared = path.join(workspace, "nemoclaw", "dist", "shared"); + fs.mkdirSync(shared, { recursive: true }); + fs.writeFileSync(path.join(shared, "existing.cjs"), "module.exports = {};\n"); +} + const PREEXISTING_DIST_WRITERS = { "dangling-symlink": writeDanglingDistSymlink, directory: writePreexistingDistDirectory, + "plugin-directory": writePreexistingPluginDistDirectory, + none: () => undefined, } satisfies Record< NonNullable | "none", @@ -171,6 +198,8 @@ function runRestoreValidation(options: RestoreFixtureOptions = {}) { const payloadRoot = path.join(root, "payload-root"); const toolDirectory = path.join(root, "tools"); fs.mkdirSync(path.join(workspace, "bin"), { recursive: true }); + fs.mkdirSync(path.join(workspace, "nemoclaw"), { recursive: true }); + fs.mkdirSync(artifactDirectory, { recursive: true }); fs.mkdirSync(payloadRoot, { recursive: true }); fs.mkdirSync(toolDirectory, { recursive: true }); @@ -388,6 +417,12 @@ describe("exact-commit CLI artifact workflow boundary", () => { fs.readFileSync(path.join(fixture.workspace, "dist", "build-identity.json"), "utf8"), ), ).toEqual({ nemoclawVersion: "0.0.0", sourceRevision: fixture.candidateSha }); + expect( + fs.existsSync( + path.join(fixture.workspace, "nemoclaw", "dist", "shared", "sandbox-name.cjs"), + ), + ).toBe(true); + expect( fs .readdirSync(fixture.runnerTemp) @@ -440,6 +475,25 @@ describe("exact-commit CLI artifact workflow boundary", () => { } }); + it("does not overwrite preexisting shared boundaries (#7915)", () => { + const fixture = runRestoreValidation({ preexistingDist: "plugin-directory" }); + try { + expect(fixture.result.status, fixture.output).not.toBe(0); + expect(fixture.output).toContain( + "consumer unexpectedly built shared boundaries before artifact restore", + ); + expect( + fs.readFileSync( + path.join(fixture.workspace, "nemoclaw", "dist", "shared", "existing.cjs"), + "utf8", + ), + ).toBe("module.exports = {};\n"); + expect(fs.existsSync(path.join(fixture.workspace, "dist"))).toBe(false); + } finally { + fixture.cleanup(); + } + }); + it("does not overwrite a dangling dist symlink (#7915)", () => { const fixture = runRestoreValidation({ preexistingDist: "dangling-symlink" }); try { diff --git a/tools/e2e/cli-artifact-workflow-boundary.mts b/tools/e2e/cli-artifact-workflow-boundary.mts index 72272013c1..554cde2c54 100644 --- a/tools/e2e/cli-artifact-workflow-boundary.mts +++ b/tools/e2e/cli-artifact-workflow-boundary.mts @@ -33,7 +33,7 @@ const DEFAULT_RESTORE_ACTION_PATH = join( "action.yaml", ); const RESTORE_ACTION_CONTENT_SHA256 = - "bae2b6b99b46f7d007be9b792d7179fbef30c38d31623849e025d7341f179d0d"; + "0da26d1e8732a185271319888a5f7716596c315d78e5871c7e4125a298839741"; const CLI_ARTIFACT_DOWNLOAD_STEP = "Download exact-commit CLI artifact"; const CLI_ARTIFACT_VERIFY_STEP = "Verify and restore exact-commit CLI artifact"; const CLI_ARTIFACT_PROVENANCE_STEP = "Record CLI artifact provenance"; @@ -164,9 +164,15 @@ export function validateCliArtifactRestoreAction( '*) echo "::error::CLI artifact contains an unsafe member', "CLI artifact contains a link or special file", '[[ ! -e "$GITHUB_WORKSPACE/dist" && ! -L "$GITHUB_WORKSPACE/dist" ]]', + '[[ ! -e "$GITHUB_WORKSPACE/nemoclaw/dist" && ! -L "$GITHUB_WORKSPACE/nemoclaw/dist" ]]', + 'restore_dir="$(mktemp -d', 'tar --no-same-owner --no-same-permissions -xf "$payload" -C "$restore_dir"', + 'test -s "$restore_dir/nemoclaw/dist/shared/$boundary"', + ".sourceRevision == $candidateSha", + 'mv "$restore_dir/nemoclaw/dist" "$GITHUB_WORKSPACE/nemoclaw/dist"', + 'mv "$restore_dir/dist" "$GITHUB_WORKSPACE/dist"', 'node "$GITHUB_WORKSPACE/bin/nemoclaw.js" --version', ]); @@ -224,10 +230,16 @@ function validateProducer(errors: string[], producer: WorkflowRecord): void { 'git rev-parse --verify HEAD)" == "$CANDIDATE_SHA"', "test -s dist/nemoclaw.js", "test -s dist/build-identity.json", + "test -s nemoclaw/dist/shared/openshell-policy-boundary.cjs", + "test -s nemoclaw/dist/shared/sandbox-name.cjs", + "test -s nemoclaw/dist/shared/snapshot-sanitizer-boundary.cjs", + ".sourceRevision == $candidateSha", "candidate CLI build identity does not match the candidate commit SHA", "--sort=name", "--mtime=@0", + "nemoclaw/dist/shared", + "source_tree=\"$(git rev-parse 'HEAD^{tree}')\"", 'lockfile_sha256="$(sha256sum package-lock.json', 'artifact_name="nemoclaw-cli-${CANDIDATE_SHA}-${payload_sha256}"', From 86dab3ebb52f0bad6432eab070f502417ade3d61 Mon Sep 17 00:00:00 2001 From: Carlos Villela Date: Wed, 5 Aug 2026 04:35:49 -0700 Subject: [PATCH 02/12] ci(e2e): pin repaired CLI restore action --- .github/workflows/e2e.yaml | 124 +++++++++---------- tools/e2e/cli-artifact-workflow-boundary.mts | 2 +- 2 files changed, 63 insertions(+), 63 deletions(-) diff --git a/.github/workflows/e2e.yaml b/.github/workflows/e2e.yaml index 86aac534a0..49b5b6a536 100644 --- a/.github/workflows/e2e.yaml +++ b/.github/workflows/e2e.yaml @@ -628,7 +628,7 @@ jobs: build-cli: "false" - name: Restore exact-commit CLI artifact - uses: NVIDIA/NemoClaw/.github/actions/restore-e2e-cli-artifact@4b911e40f3f41ce500d69330ca9280b79ceede0f + uses: NVIDIA/NemoClaw/.github/actions/restore-e2e-cli-artifact@8c735cbb89c8d594b3ebf5b4673e2210c30d1449 with: provenance-json: ${{ needs.generate-matrix.outputs.cli_artifact_provenance }} @@ -806,7 +806,7 @@ jobs: build-cli: "false" - name: Restore exact-commit CLI artifact - uses: NVIDIA/NemoClaw/.github/actions/restore-e2e-cli-artifact@4b911e40f3f41ce500d69330ca9280b79ceede0f + uses: NVIDIA/NemoClaw/.github/actions/restore-e2e-cli-artifact@8c735cbb89c8d594b3ebf5b4673e2210c30d1449 with: provenance-json: ${{ needs.generate-matrix.outputs.cli_artifact_provenance }} @@ -969,7 +969,7 @@ jobs: build-cli: "false" - name: Restore exact-commit CLI artifact - uses: NVIDIA/NemoClaw/.github/actions/restore-e2e-cli-artifact@4b911e40f3f41ce500d69330ca9280b79ceede0f + uses: NVIDIA/NemoClaw/.github/actions/restore-e2e-cli-artifact@8c735cbb89c8d594b3ebf5b4673e2210c30d1449 with: provenance-json: ${{ needs.generate-matrix.outputs.cli_artifact_provenance }} @@ -1020,7 +1020,7 @@ jobs: build-cli: "false" - name: Restore exact-commit CLI artifact - uses: NVIDIA/NemoClaw/.github/actions/restore-e2e-cli-artifact@4b911e40f3f41ce500d69330ca9280b79ceede0f + uses: NVIDIA/NemoClaw/.github/actions/restore-e2e-cli-artifact@8c735cbb89c8d594b3ebf5b4673e2210c30d1449 with: provenance-json: ${{ needs.generate-matrix.outputs.cli_artifact_provenance }} @@ -1294,7 +1294,7 @@ jobs: build-cli: "false" - name: Restore exact-commit CLI artifact - uses: NVIDIA/NemoClaw/.github/actions/restore-e2e-cli-artifact@4b911e40f3f41ce500d69330ca9280b79ceede0f + uses: NVIDIA/NemoClaw/.github/actions/restore-e2e-cli-artifact@8c735cbb89c8d594b3ebf5b4673e2210c30d1449 with: provenance-json: ${{ needs.generate-matrix.outputs.cli_artifact_provenance }} @@ -1426,7 +1426,7 @@ jobs: build-cli: "false" - name: Restore exact-commit CLI artifact - uses: NVIDIA/NemoClaw/.github/actions/restore-e2e-cli-artifact@4b911e40f3f41ce500d69330ca9280b79ceede0f + uses: NVIDIA/NemoClaw/.github/actions/restore-e2e-cli-artifact@8c735cbb89c8d594b3ebf5b4673e2210c30d1449 with: provenance-json: ${{ needs.generate-matrix.outputs.cli_artifact_provenance }} @@ -1548,7 +1548,7 @@ jobs: build-cli: "false" - name: Restore exact-commit CLI artifact - uses: NVIDIA/NemoClaw/.github/actions/restore-e2e-cli-artifact@4b911e40f3f41ce500d69330ca9280b79ceede0f + uses: NVIDIA/NemoClaw/.github/actions/restore-e2e-cli-artifact@8c735cbb89c8d594b3ebf5b4673e2210c30d1449 with: provenance-json: ${{ needs.generate-matrix.outputs.cli_artifact_provenance }} @@ -1660,7 +1660,7 @@ jobs: build-cli: "false" - name: Restore exact-commit CLI artifact - uses: NVIDIA/NemoClaw/.github/actions/restore-e2e-cli-artifact@4b911e40f3f41ce500d69330ca9280b79ceede0f + uses: NVIDIA/NemoClaw/.github/actions/restore-e2e-cli-artifact@8c735cbb89c8d594b3ebf5b4673e2210c30d1449 with: provenance-json: ${{ needs.generate-matrix.outputs.cli_artifact_provenance }} @@ -1743,7 +1743,7 @@ jobs: build-cli: "false" - name: Restore exact-commit CLI artifact - uses: NVIDIA/NemoClaw/.github/actions/restore-e2e-cli-artifact@4b911e40f3f41ce500d69330ca9280b79ceede0f + uses: NVIDIA/NemoClaw/.github/actions/restore-e2e-cli-artifact@8c735cbb89c8d594b3ebf5b4673e2210c30d1449 with: provenance-json: ${{ needs.generate-matrix.outputs.cli_artifact_provenance }} @@ -1788,7 +1788,7 @@ jobs: build-cli: "false" - name: Restore exact-commit CLI artifact - uses: NVIDIA/NemoClaw/.github/actions/restore-e2e-cli-artifact@4b911e40f3f41ce500d69330ca9280b79ceede0f + uses: NVIDIA/NemoClaw/.github/actions/restore-e2e-cli-artifact@8c735cbb89c8d594b3ebf5b4673e2210c30d1449 with: provenance-json: ${{ needs.generate-matrix.outputs.cli_artifact_provenance }} @@ -1867,7 +1867,7 @@ jobs: build-cli: "false" - name: Restore exact-commit CLI artifact - uses: NVIDIA/NemoClaw/.github/actions/restore-e2e-cli-artifact@4b911e40f3f41ce500d69330ca9280b79ceede0f + uses: NVIDIA/NemoClaw/.github/actions/restore-e2e-cli-artifact@8c735cbb89c8d594b3ebf5b4673e2210c30d1449 with: provenance-json: ${{ needs.generate-matrix.outputs.cli_artifact_provenance }} @@ -1925,7 +1925,7 @@ jobs: build-cli: "false" - name: Restore exact-commit CLI artifact - uses: NVIDIA/NemoClaw/.github/actions/restore-e2e-cli-artifact@4b911e40f3f41ce500d69330ca9280b79ceede0f + uses: NVIDIA/NemoClaw/.github/actions/restore-e2e-cli-artifact@8c735cbb89c8d594b3ebf5b4673e2210c30d1449 with: provenance-json: ${{ needs.generate-matrix.outputs.cli_artifact_provenance }} - name: Install OpenShell CLI @@ -2884,7 +2884,7 @@ jobs: build-cli: "false" - name: Restore exact-commit CLI artifact - uses: NVIDIA/NemoClaw/.github/actions/restore-e2e-cli-artifact@4b911e40f3f41ce500d69330ca9280b79ceede0f + uses: NVIDIA/NemoClaw/.github/actions/restore-e2e-cli-artifact@8c735cbb89c8d594b3ebf5b4673e2210c30d1449 with: provenance-json: ${{ needs.generate-matrix.outputs.cli_artifact_provenance }} - name: Initialize runner comparison telemetry @@ -2958,7 +2958,7 @@ jobs: build-cli: "false" - name: Restore exact-commit CLI artifact - uses: NVIDIA/NemoClaw/.github/actions/restore-e2e-cli-artifact@4b911e40f3f41ce500d69330ca9280b79ceede0f + uses: NVIDIA/NemoClaw/.github/actions/restore-e2e-cli-artifact@8c735cbb89c8d594b3ebf5b4673e2210c30d1449 with: provenance-json: ${{ needs.generate-matrix.outputs.cli_artifact_provenance }} - name: Install OpenShell CLI @@ -3045,7 +3045,7 @@ jobs: build-cli: "false" - name: Restore exact-commit CLI artifact - uses: NVIDIA/NemoClaw/.github/actions/restore-e2e-cli-artifact@4b911e40f3f41ce500d69330ca9280b79ceede0f + uses: NVIDIA/NemoClaw/.github/actions/restore-e2e-cli-artifact@8c735cbb89c8d594b3ebf5b4673e2210c30d1449 with: provenance-json: ${{ needs.generate-matrix.outputs.cli_artifact_provenance }} - name: Initialize runner comparison telemetry @@ -3109,7 +3109,7 @@ jobs: build-cli: "false" - name: Restore exact-commit CLI artifact - uses: NVIDIA/NemoClaw/.github/actions/restore-e2e-cli-artifact@4b911e40f3f41ce500d69330ca9280b79ceede0f + uses: NVIDIA/NemoClaw/.github/actions/restore-e2e-cli-artifact@8c735cbb89c8d594b3ebf5b4673e2210c30d1449 with: provenance-json: ${{ needs.generate-matrix.outputs.cli_artifact_provenance }} @@ -3216,7 +3216,7 @@ jobs: build-cli: "false" - name: Restore exact-commit CLI artifact - uses: NVIDIA/NemoClaw/.github/actions/restore-e2e-cli-artifact@4b911e40f3f41ce500d69330ca9280b79ceede0f + uses: NVIDIA/NemoClaw/.github/actions/restore-e2e-cli-artifact@8c735cbb89c8d594b3ebf5b4673e2210c30d1449 with: provenance-json: ${{ needs.generate-matrix.outputs.cli_artifact_provenance }} @@ -3293,7 +3293,7 @@ jobs: build-cli: "false" - name: Restore exact-commit CLI artifact - uses: NVIDIA/NemoClaw/.github/actions/restore-e2e-cli-artifact@4b911e40f3f41ce500d69330ca9280b79ceede0f + uses: NVIDIA/NemoClaw/.github/actions/restore-e2e-cli-artifact@8c735cbb89c8d594b3ebf5b4673e2210c30d1449 with: provenance-json: ${{ needs.generate-matrix.outputs.cli_artifact_provenance }} @@ -3359,7 +3359,7 @@ jobs: build-cli: "false" - name: Restore exact-commit CLI artifact - uses: NVIDIA/NemoClaw/.github/actions/restore-e2e-cli-artifact@4b911e40f3f41ce500d69330ca9280b79ceede0f + uses: NVIDIA/NemoClaw/.github/actions/restore-e2e-cli-artifact@8c735cbb89c8d594b3ebf5b4673e2210c30d1449 with: provenance-json: ${{ needs.generate-matrix.outputs.cli_artifact_provenance }} @@ -3408,7 +3408,7 @@ jobs: build-cli: "false" - name: Restore exact-commit CLI artifact - uses: NVIDIA/NemoClaw/.github/actions/restore-e2e-cli-artifact@4b911e40f3f41ce500d69330ca9280b79ceede0f + uses: NVIDIA/NemoClaw/.github/actions/restore-e2e-cli-artifact@8c735cbb89c8d594b3ebf5b4673e2210c30d1449 with: provenance-json: ${{ needs.generate-matrix.outputs.cli_artifact_provenance }} @@ -3473,7 +3473,7 @@ jobs: build-cli: "false" - name: Restore exact-commit CLI artifact - uses: NVIDIA/NemoClaw/.github/actions/restore-e2e-cli-artifact@4b911e40f3f41ce500d69330ca9280b79ceede0f + uses: NVIDIA/NemoClaw/.github/actions/restore-e2e-cli-artifact@8c735cbb89c8d594b3ebf5b4673e2210c30d1449 with: provenance-json: ${{ needs.generate-matrix.outputs.cli_artifact_provenance }} @@ -3555,7 +3555,7 @@ jobs: build-cli: "false" - name: Restore exact-commit CLI artifact - uses: NVIDIA/NemoClaw/.github/actions/restore-e2e-cli-artifact@4b911e40f3f41ce500d69330ca9280b79ceede0f + uses: NVIDIA/NemoClaw/.github/actions/restore-e2e-cli-artifact@8c735cbb89c8d594b3ebf5b4673e2210c30d1449 with: provenance-json: ${{ needs.generate-matrix.outputs.cli_artifact_provenance }} @@ -3700,7 +3700,7 @@ jobs: build-cli: "false" - name: Restore exact-commit CLI artifact - uses: NVIDIA/NemoClaw/.github/actions/restore-e2e-cli-artifact@4b911e40f3f41ce500d69330ca9280b79ceede0f + uses: NVIDIA/NemoClaw/.github/actions/restore-e2e-cli-artifact@8c735cbb89c8d594b3ebf5b4673e2210c30d1449 with: provenance-json: ${{ needs.generate-matrix.outputs.cli_artifact_provenance }} @@ -3908,7 +3908,7 @@ jobs: build-cli: "false" - name: Restore exact-commit CLI artifact - uses: NVIDIA/NemoClaw/.github/actions/restore-e2e-cli-artifact@4b911e40f3f41ce500d69330ca9280b79ceede0f + uses: NVIDIA/NemoClaw/.github/actions/restore-e2e-cli-artifact@8c735cbb89c8d594b3ebf5b4673e2210c30d1449 with: provenance-json: ${{ needs.generate-matrix.outputs.cli_artifact_provenance }} @@ -3998,7 +3998,7 @@ jobs: build-cli: "false" - name: Restore exact-commit CLI artifact - uses: NVIDIA/NemoClaw/.github/actions/restore-e2e-cli-artifact@4b911e40f3f41ce500d69330ca9280b79ceede0f + uses: NVIDIA/NemoClaw/.github/actions/restore-e2e-cli-artifact@8c735cbb89c8d594b3ebf5b4673e2210c30d1449 with: provenance-json: ${{ needs.generate-matrix.outputs.cli_artifact_provenance }} @@ -4097,7 +4097,7 @@ jobs: build-cli: "false" - name: Restore exact-commit CLI artifact - uses: NVIDIA/NemoClaw/.github/actions/restore-e2e-cli-artifact@4b911e40f3f41ce500d69330ca9280b79ceede0f + uses: NVIDIA/NemoClaw/.github/actions/restore-e2e-cli-artifact@8c735cbb89c8d594b3ebf5b4673e2210c30d1449 with: provenance-json: ${{ needs.generate-matrix.outputs.cli_artifact_provenance }} @@ -4261,7 +4261,7 @@ jobs: build-cli: "false" - name: Restore exact-commit CLI artifact - uses: NVIDIA/NemoClaw/.github/actions/restore-e2e-cli-artifact@4b911e40f3f41ce500d69330ca9280b79ceede0f + uses: NVIDIA/NemoClaw/.github/actions/restore-e2e-cli-artifact@8c735cbb89c8d594b3ebf5b4673e2210c30d1449 with: provenance-json: ${{ needs.generate-matrix.outputs.cli_artifact_provenance }} @@ -4320,7 +4320,7 @@ jobs: build-cli: "false" - name: Restore exact-commit CLI artifact - uses: NVIDIA/NemoClaw/.github/actions/restore-e2e-cli-artifact@4b911e40f3f41ce500d69330ca9280b79ceede0f + uses: NVIDIA/NemoClaw/.github/actions/restore-e2e-cli-artifact@8c735cbb89c8d594b3ebf5b4673e2210c30d1449 with: provenance-json: ${{ needs.generate-matrix.outputs.cli_artifact_provenance }} @@ -4398,7 +4398,7 @@ jobs: build-cli: "false" - name: Restore exact-commit CLI artifact - uses: NVIDIA/NemoClaw/.github/actions/restore-e2e-cli-artifact@4b911e40f3f41ce500d69330ca9280b79ceede0f + uses: NVIDIA/NemoClaw/.github/actions/restore-e2e-cli-artifact@8c735cbb89c8d594b3ebf5b4673e2210c30d1449 with: provenance-json: ${{ needs.generate-matrix.outputs.cli_artifact_provenance }} @@ -4520,7 +4520,7 @@ jobs: build-cli: "false" - name: Restore exact-commit CLI artifact - uses: NVIDIA/NemoClaw/.github/actions/restore-e2e-cli-artifact@4b911e40f3f41ce500d69330ca9280b79ceede0f + uses: NVIDIA/NemoClaw/.github/actions/restore-e2e-cli-artifact@8c735cbb89c8d594b3ebf5b4673e2210c30d1449 with: provenance-json: ${{ needs.generate-matrix.outputs.cli_artifact_provenance }} @@ -4636,7 +4636,7 @@ jobs: build-cli: "false" - name: Restore exact-commit CLI artifact - uses: NVIDIA/NemoClaw/.github/actions/restore-e2e-cli-artifact@4b911e40f3f41ce500d69330ca9280b79ceede0f + uses: NVIDIA/NemoClaw/.github/actions/restore-e2e-cli-artifact@8c735cbb89c8d594b3ebf5b4673e2210c30d1449 with: provenance-json: ${{ needs.generate-matrix.outputs.cli_artifact_provenance }} @@ -4687,7 +4687,7 @@ jobs: build-cli: "false" - name: Restore exact-commit CLI artifact - uses: NVIDIA/NemoClaw/.github/actions/restore-e2e-cli-artifact@4b911e40f3f41ce500d69330ca9280b79ceede0f + uses: NVIDIA/NemoClaw/.github/actions/restore-e2e-cli-artifact@8c735cbb89c8d594b3ebf5b4673e2210c30d1449 with: provenance-json: ${{ needs.generate-matrix.outputs.cli_artifact_provenance }} @@ -4754,7 +4754,7 @@ jobs: build-cli: "false" - name: Restore exact-commit CLI artifact - uses: NVIDIA/NemoClaw/.github/actions/restore-e2e-cli-artifact@4b911e40f3f41ce500d69330ca9280b79ceede0f + uses: NVIDIA/NemoClaw/.github/actions/restore-e2e-cli-artifact@8c735cbb89c8d594b3ebf5b4673e2210c30d1449 with: provenance-json: ${{ needs.generate-matrix.outputs.cli_artifact_provenance }} @@ -4839,7 +4839,7 @@ jobs: build-cli: "false" - name: Restore exact-commit CLI artifact - uses: NVIDIA/NemoClaw/.github/actions/restore-e2e-cli-artifact@4b911e40f3f41ce500d69330ca9280b79ceede0f + uses: NVIDIA/NemoClaw/.github/actions/restore-e2e-cli-artifact@8c735cbb89c8d594b3ebf5b4673e2210c30d1449 with: provenance-json: ${{ needs.generate-matrix.outputs.cli_artifact_provenance }} @@ -4901,7 +4901,7 @@ jobs: build-cli: "false" - name: Restore exact-commit CLI artifact - uses: NVIDIA/NemoClaw/.github/actions/restore-e2e-cli-artifact@4b911e40f3f41ce500d69330ca9280b79ceede0f + uses: NVIDIA/NemoClaw/.github/actions/restore-e2e-cli-artifact@8c735cbb89c8d594b3ebf5b4673e2210c30d1449 with: provenance-json: ${{ needs.generate-matrix.outputs.cli_artifact_provenance }} @@ -4964,7 +4964,7 @@ jobs: build-cli: "false" - name: Restore exact-commit CLI artifact - uses: NVIDIA/NemoClaw/.github/actions/restore-e2e-cli-artifact@4b911e40f3f41ce500d69330ca9280b79ceede0f + uses: NVIDIA/NemoClaw/.github/actions/restore-e2e-cli-artifact@8c735cbb89c8d594b3ebf5b4673e2210c30d1449 with: provenance-json: ${{ needs.generate-matrix.outputs.cli_artifact_provenance }} @@ -5026,7 +5026,7 @@ jobs: build-cli: "false" - name: Restore exact-commit CLI artifact - uses: NVIDIA/NemoClaw/.github/actions/restore-e2e-cli-artifact@4b911e40f3f41ce500d69330ca9280b79ceede0f + uses: NVIDIA/NemoClaw/.github/actions/restore-e2e-cli-artifact@8c735cbb89c8d594b3ebf5b4673e2210c30d1449 with: provenance-json: ${{ needs.generate-matrix.outputs.cli_artifact_provenance }} @@ -5220,7 +5220,7 @@ jobs: build-cli: "false" - name: Restore exact-commit CLI artifact - uses: NVIDIA/NemoClaw/.github/actions/restore-e2e-cli-artifact@4b911e40f3f41ce500d69330ca9280b79ceede0f + uses: NVIDIA/NemoClaw/.github/actions/restore-e2e-cli-artifact@8c735cbb89c8d594b3ebf5b4673e2210c30d1449 with: provenance-json: ${{ needs.generate-matrix.outputs.cli_artifact_provenance }} @@ -5318,7 +5318,7 @@ jobs: build-cli: "false" - name: Restore exact-commit CLI artifact - uses: NVIDIA/NemoClaw/.github/actions/restore-e2e-cli-artifact@4b911e40f3f41ce500d69330ca9280b79ceede0f + uses: NVIDIA/NemoClaw/.github/actions/restore-e2e-cli-artifact@8c735cbb89c8d594b3ebf5b4673e2210c30d1449 with: provenance-json: ${{ needs.generate-matrix.outputs.cli_artifact_provenance }} @@ -5379,7 +5379,7 @@ jobs: build-cli: "false" - name: Restore exact-commit CLI artifact - uses: NVIDIA/NemoClaw/.github/actions/restore-e2e-cli-artifact@4b911e40f3f41ce500d69330ca9280b79ceede0f + uses: NVIDIA/NemoClaw/.github/actions/restore-e2e-cli-artifact@8c735cbb89c8d594b3ebf5b4673e2210c30d1449 with: provenance-json: ${{ needs.generate-matrix.outputs.cli_artifact_provenance }} @@ -5441,7 +5441,7 @@ jobs: build-cli: "false" - name: Restore exact-commit CLI artifact - uses: NVIDIA/NemoClaw/.github/actions/restore-e2e-cli-artifact@4b911e40f3f41ce500d69330ca9280b79ceede0f + uses: NVIDIA/NemoClaw/.github/actions/restore-e2e-cli-artifact@8c735cbb89c8d594b3ebf5b4673e2210c30d1449 with: provenance-json: ${{ needs.generate-matrix.outputs.cli_artifact_provenance }} @@ -5501,7 +5501,7 @@ jobs: build-cli: "false" - name: Restore exact-commit CLI artifact - uses: NVIDIA/NemoClaw/.github/actions/restore-e2e-cli-artifact@4b911e40f3f41ce500d69330ca9280b79ceede0f + uses: NVIDIA/NemoClaw/.github/actions/restore-e2e-cli-artifact@8c735cbb89c8d594b3ebf5b4673e2210c30d1449 with: provenance-json: ${{ needs.generate-matrix.outputs.cli_artifact_provenance }} @@ -5560,7 +5560,7 @@ jobs: build-cli: "false" - name: Restore exact-commit CLI artifact - uses: NVIDIA/NemoClaw/.github/actions/restore-e2e-cli-artifact@4b911e40f3f41ce500d69330ca9280b79ceede0f + uses: NVIDIA/NemoClaw/.github/actions/restore-e2e-cli-artifact@8c735cbb89c8d594b3ebf5b4673e2210c30d1449 with: provenance-json: ${{ needs.generate-matrix.outputs.cli_artifact_provenance }} @@ -5676,7 +5676,7 @@ jobs: build-cli: "false" - name: Restore exact-commit CLI artifact - uses: NVIDIA/NemoClaw/.github/actions/restore-e2e-cli-artifact@4b911e40f3f41ce500d69330ca9280b79ceede0f + uses: NVIDIA/NemoClaw/.github/actions/restore-e2e-cli-artifact@8c735cbb89c8d594b3ebf5b4673e2210c30d1449 with: provenance-json: ${{ needs.generate-matrix.outputs.cli_artifact_provenance }} @@ -5734,7 +5734,7 @@ jobs: build-cli: "false" - name: Restore exact-commit CLI artifact - uses: NVIDIA/NemoClaw/.github/actions/restore-e2e-cli-artifact@4b911e40f3f41ce500d69330ca9280b79ceede0f + uses: NVIDIA/NemoClaw/.github/actions/restore-e2e-cli-artifact@8c735cbb89c8d594b3ebf5b4673e2210c30d1449 with: provenance-json: ${{ needs.generate-matrix.outputs.cli_artifact_provenance }} @@ -5846,7 +5846,7 @@ jobs: build-cli: "false" - name: Restore exact-commit CLI artifact - uses: NVIDIA/NemoClaw/.github/actions/restore-e2e-cli-artifact@4b911e40f3f41ce500d69330ca9280b79ceede0f + uses: NVIDIA/NemoClaw/.github/actions/restore-e2e-cli-artifact@8c735cbb89c8d594b3ebf5b4673e2210c30d1449 with: provenance-json: ${{ needs.generate-matrix.outputs.cli_artifact_provenance }} @@ -5949,7 +5949,7 @@ jobs: build-cli: "false" - name: Restore exact-commit CLI artifact - uses: NVIDIA/NemoClaw/.github/actions/restore-e2e-cli-artifact@4b911e40f3f41ce500d69330ca9280b79ceede0f + uses: NVIDIA/NemoClaw/.github/actions/restore-e2e-cli-artifact@8c735cbb89c8d594b3ebf5b4673e2210c30d1449 with: provenance-json: ${{ needs.generate-matrix.outputs.cli_artifact_provenance }} @@ -6015,7 +6015,7 @@ jobs: build-cli: "false" - name: Restore exact-commit CLI artifact - uses: NVIDIA/NemoClaw/.github/actions/restore-e2e-cli-artifact@4b911e40f3f41ce500d69330ca9280b79ceede0f + uses: NVIDIA/NemoClaw/.github/actions/restore-e2e-cli-artifact@8c735cbb89c8d594b3ebf5b4673e2210c30d1449 with: provenance-json: ${{ needs.generate-matrix.outputs.cli_artifact_provenance }} @@ -6087,7 +6087,7 @@ jobs: build-cli: "false" - name: Restore exact-commit CLI artifact - uses: NVIDIA/NemoClaw/.github/actions/restore-e2e-cli-artifact@4b911e40f3f41ce500d69330ca9280b79ceede0f + uses: NVIDIA/NemoClaw/.github/actions/restore-e2e-cli-artifact@8c735cbb89c8d594b3ebf5b4673e2210c30d1449 with: provenance-json: ${{ needs.generate-matrix.outputs.cli_artifact_provenance }} @@ -6162,7 +6162,7 @@ jobs: build-cli: "false" - name: Restore exact-commit CLI artifact - uses: NVIDIA/NemoClaw/.github/actions/restore-e2e-cli-artifact@4b911e40f3f41ce500d69330ca9280b79ceede0f + uses: NVIDIA/NemoClaw/.github/actions/restore-e2e-cli-artifact@8c735cbb89c8d594b3ebf5b4673e2210c30d1449 with: provenance-json: ${{ needs.generate-matrix.outputs.cli_artifact_provenance }} @@ -6241,7 +6241,7 @@ jobs: build-cli: "false" - name: Restore exact-commit CLI artifact - uses: NVIDIA/NemoClaw/.github/actions/restore-e2e-cli-artifact@4b911e40f3f41ce500d69330ca9280b79ceede0f + uses: NVIDIA/NemoClaw/.github/actions/restore-e2e-cli-artifact@8c735cbb89c8d594b3ebf5b4673e2210c30d1449 with: provenance-json: ${{ needs.generate-matrix.outputs.cli_artifact_provenance }} @@ -6310,7 +6310,7 @@ jobs: build-cli: "false" - name: Restore exact-commit CLI artifact - uses: NVIDIA/NemoClaw/.github/actions/restore-e2e-cli-artifact@4b911e40f3f41ce500d69330ca9280b79ceede0f + uses: NVIDIA/NemoClaw/.github/actions/restore-e2e-cli-artifact@8c735cbb89c8d594b3ebf5b4673e2210c30d1449 with: provenance-json: ${{ needs.generate-matrix.outputs.cli_artifact_provenance }} @@ -6406,7 +6406,7 @@ jobs: build-cli: "false" - name: Restore exact-commit CLI artifact - uses: NVIDIA/NemoClaw/.github/actions/restore-e2e-cli-artifact@4b911e40f3f41ce500d69330ca9280b79ceede0f + uses: NVIDIA/NemoClaw/.github/actions/restore-e2e-cli-artifact@8c735cbb89c8d594b3ebf5b4673e2210c30d1449 with: provenance-json: ${{ needs.generate-matrix.outputs.cli_artifact_provenance }} @@ -6488,7 +6488,7 @@ jobs: build-cli: "false" - name: Restore exact-commit CLI artifact - uses: NVIDIA/NemoClaw/.github/actions/restore-e2e-cli-artifact@4b911e40f3f41ce500d69330ca9280b79ceede0f + uses: NVIDIA/NemoClaw/.github/actions/restore-e2e-cli-artifact@8c735cbb89c8d594b3ebf5b4673e2210c30d1449 with: provenance-json: ${{ needs.generate-matrix.outputs.cli_artifact_provenance }} @@ -6543,7 +6543,7 @@ jobs: build-cli: "false" - name: Restore exact-commit CLI artifact - uses: NVIDIA/NemoClaw/.github/actions/restore-e2e-cli-artifact@4b911e40f3f41ce500d69330ca9280b79ceede0f + uses: NVIDIA/NemoClaw/.github/actions/restore-e2e-cli-artifact@8c735cbb89c8d594b3ebf5b4673e2210c30d1449 with: provenance-json: ${{ needs.generate-matrix.outputs.cli_artifact_provenance }} @@ -6606,7 +6606,7 @@ jobs: build-cli: "false" - name: Restore exact-commit CLI artifact - uses: NVIDIA/NemoClaw/.github/actions/restore-e2e-cli-artifact@4b911e40f3f41ce500d69330ca9280b79ceede0f + uses: NVIDIA/NemoClaw/.github/actions/restore-e2e-cli-artifact@8c735cbb89c8d594b3ebf5b4673e2210c30d1449 with: provenance-json: ${{ needs.generate-matrix.outputs.cli_artifact_provenance }} @@ -6683,7 +6683,7 @@ jobs: build-cli: "false" - name: Restore exact-commit CLI artifact - uses: NVIDIA/NemoClaw/.github/actions/restore-e2e-cli-artifact@4b911e40f3f41ce500d69330ca9280b79ceede0f + uses: NVIDIA/NemoClaw/.github/actions/restore-e2e-cli-artifact@8c735cbb89c8d594b3ebf5b4673e2210c30d1449 with: provenance-json: ${{ needs.generate-matrix.outputs.cli_artifact_provenance }} @@ -6783,7 +6783,7 @@ jobs: build-cli: "false" - name: Restore exact-commit CLI artifact - uses: NVIDIA/NemoClaw/.github/actions/restore-e2e-cli-artifact@4b911e40f3f41ce500d69330ca9280b79ceede0f + uses: NVIDIA/NemoClaw/.github/actions/restore-e2e-cli-artifact@8c735cbb89c8d594b3ebf5b4673e2210c30d1449 with: provenance-json: ${{ needs.generate-matrix.outputs.cli_artifact_provenance }} @@ -6876,7 +6876,7 @@ jobs: build-cli: "false" - name: Restore exact-commit CLI artifact - uses: NVIDIA/NemoClaw/.github/actions/restore-e2e-cli-artifact@4b911e40f3f41ce500d69330ca9280b79ceede0f + uses: NVIDIA/NemoClaw/.github/actions/restore-e2e-cli-artifact@8c735cbb89c8d594b3ebf5b4673e2210c30d1449 with: provenance-json: ${{ needs.generate-matrix.outputs.cli_artifact_provenance }} @@ -6948,7 +6948,7 @@ jobs: build-cli: "false" - name: Restore exact-commit CLI artifact - uses: NVIDIA/NemoClaw/.github/actions/restore-e2e-cli-artifact@4b911e40f3f41ce500d69330ca9280b79ceede0f + uses: NVIDIA/NemoClaw/.github/actions/restore-e2e-cli-artifact@8c735cbb89c8d594b3ebf5b4673e2210c30d1449 with: provenance-json: ${{ needs.generate-matrix.outputs.cli_artifact_provenance }} @@ -7013,7 +7013,7 @@ jobs: build-cli: "false" - name: Restore exact-commit CLI artifact - uses: NVIDIA/NemoClaw/.github/actions/restore-e2e-cli-artifact@4b911e40f3f41ce500d69330ca9280b79ceede0f + uses: NVIDIA/NemoClaw/.github/actions/restore-e2e-cli-artifact@8c735cbb89c8d594b3ebf5b4673e2210c30d1449 with: provenance-json: ${{ needs.generate-matrix.outputs.cli_artifact_provenance }} @@ -7085,7 +7085,7 @@ jobs: build-cli: "false" - name: Restore exact-commit CLI artifact - uses: NVIDIA/NemoClaw/.github/actions/restore-e2e-cli-artifact@4b911e40f3f41ce500d69330ca9280b79ceede0f + uses: NVIDIA/NemoClaw/.github/actions/restore-e2e-cli-artifact@8c735cbb89c8d594b3ebf5b4673e2210c30d1449 with: provenance-json: ${{ needs.generate-matrix.outputs.cli_artifact_provenance }} diff --git a/tools/e2e/cli-artifact-workflow-boundary.mts b/tools/e2e/cli-artifact-workflow-boundary.mts index 554cde2c54..aa8533cb89 100644 --- a/tools/e2e/cli-artifact-workflow-boundary.mts +++ b/tools/e2e/cli-artifact-workflow-boundary.mts @@ -19,7 +19,7 @@ export const CLI_ARTIFACT_DOWNLOAD_ACTION = export const CLI_ARTIFACT_UPLOAD_ACTION = "actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a"; export const CLI_ARTIFACT_RESTORE_ACTION = - "NVIDIA/NemoClaw/.github/actions/restore-e2e-cli-artifact@4b911e40f3f41ce500d69330ca9280b79ceede0f"; + "NVIDIA/NemoClaw/.github/actions/restore-e2e-cli-artifact@8c735cbb89c8d594b3ebf5b4673e2210c30d1449"; export const CLI_ARTIFACT_PACKAGE_STEP = "Package exact-commit CLI"; export const CLI_ARTIFACT_PUBLISH_STEP = "Publish content-addressed CLI artifact"; export const CLI_ARTIFACT_RESTORE_STEP = "Restore exact-commit CLI artifact"; From d7d3af204bd0a259a6e4cac2a14fcc8d97ab86f4 Mon Sep 17 00:00:00 2001 From: Carlos Villela Date: Wed, 5 Aug 2026 04:37:07 -0700 Subject: [PATCH 03/12] test(e2e): reject incomplete shared CLI artifacts --- .../cli-artifact-workflow-boundary.test.ts | 22 ++++++++++++++++++- 1 file changed, 21 insertions(+), 1 deletion(-) diff --git a/test/e2e/support/cli-artifact-workflow-boundary.test.ts b/test/e2e/support/cli-artifact-workflow-boundary.test.ts index 6ee2d0e7fd..6e74bfa9cd 100644 --- a/test/e2e/support/cli-artifact-workflow-boundary.test.ts +++ b/test/e2e/support/cli-artifact-workflow-boundary.test.ts @@ -67,7 +67,7 @@ function workflowFixture(): Workflow { } type RestoreFixtureOptions = { - archive?: "valid" | "non-dist" | "link" | "traversal"; + archive?: "valid" | "missing-shared" | "non-dist" | "link" | "traversal"; buildIdentitySha?: string; expectedPayloadSha256?: string; manifestCandidateSha?: string; @@ -87,6 +87,7 @@ function sha256File(file: string): string { function writeCliArchive( context: ArchiveFixtureContext, customizeDist: (dist: string) => void, + customizeShared: (shared: string) => void = () => undefined, ): void { const dist = path.join(context.payloadRoot, "dist"); const shared = path.join(context.payloadRoot, "nemoclaw", "dist", "shared"); @@ -110,6 +111,8 @@ function writeCliArchive( ]) { fs.writeFileSync(path.join(shared, boundary), "module.exports = {};\n"); } + customizeShared(shared); + customizeDist(dist); execFileSync("tar", [ "-cf", @@ -131,6 +134,14 @@ function writeLinkArchive(context: ArchiveFixtureContext): void { }); } +function writeMissingSharedArchive(context: ArchiveFixtureContext): void { + writeCliArchive( + context, + () => undefined, + (shared) => fs.rmSync(path.join(shared, "sandbox-name.cjs")), + ); +} + function writeNonDistArchive(context: ArchiveFixtureContext): void { fs.writeFileSync(path.join(context.payloadRoot, "outside.txt"), "outside dist\n"); execFileSync("tar", ["-cf", context.payload, "-C", context.payloadRoot, "outside.txt"]); @@ -154,6 +165,8 @@ function writeTraversalArchive(context: ArchiveFixtureContext): void { const ARCHIVE_FIXTURE_WRITERS = { link: writeLinkArchive, + "missing-shared": writeMissingSharedArchive, + "non-dist": writeNonDistArchive, traversal: writeTraversalArchive, valid: writeValidArchive, @@ -447,6 +460,13 @@ describe("exact-commit CLI artifact workflow boundary", () => { ); }); + it("rejects a payload missing a compiled shared boundary before activation (#7915)", () => { + expectRestoreFailure( + { archive: "missing-shared" }, + "restored CLI artifact is missing shared boundary sandbox-name.cjs", + ); + }); + it("rejects an archive member outside dist before artifact extraction (#7915)", () => { expectRestoreFailure( { archive: "non-dist" }, From 186323bdb45e2266777b13eb6c48dac4600d8449 Mon Sep 17 00:00:00 2001 From: Carlos Villela Date: Wed, 5 Aug 2026 04:44:46 -0700 Subject: [PATCH 04/12] fix(e2e): reject symlinked artifact parents --- .../restore-e2e-cli-artifact/action.yaml | 3 ++ .../cli-artifact-workflow-boundary.test.ts | 31 ++++++++++++++++++- tools/e2e/cli-artifact-workflow-boundary.mts | 4 ++- 3 files changed, 36 insertions(+), 2 deletions(-) diff --git a/.github/actions/restore-e2e-cli-artifact/action.yaml b/.github/actions/restore-e2e-cli-artifact/action.yaml index cd5a131d65..5171edf49a 100644 --- a/.github/actions/restore-e2e-cli-artifact/action.yaml +++ b/.github/actions/restore-e2e-cli-artifact/action.yaml @@ -158,6 +158,9 @@ runs: { echo "::error::CLI artifact contains a link or special file"; exit 1; } [[ ! -e "$GITHUB_WORKSPACE/dist" && ! -L "$GITHUB_WORKSPACE/dist" ]] || { echo "::error::consumer unexpectedly built dist before artifact restore"; exit 1; } + [[ -d "$GITHUB_WORKSPACE/nemoclaw" && ! -L "$GITHUB_WORKSPACE/nemoclaw" ]] || + { echo "::error::consumer nemoclaw directory must be a non-symlink directory"; exit 1; } + [[ ! -e "$GITHUB_WORKSPACE/nemoclaw/dist" && ! -L "$GITHUB_WORKSPACE/nemoclaw/dist" ]] || { echo "::error::consumer unexpectedly built shared boundaries before artifact restore"; exit 1; } restore_dir="$(mktemp -d "${RUNNER_TEMP}/nemoclaw-cli-restore.XXXXXX")" diff --git a/test/e2e/support/cli-artifact-workflow-boundary.test.ts b/test/e2e/support/cli-artifact-workflow-boundary.test.ts index 6e74bfa9cd..6322847d49 100644 --- a/test/e2e/support/cli-artifact-workflow-boundary.test.ts +++ b/test/e2e/support/cli-artifact-workflow-boundary.test.ts @@ -71,7 +71,11 @@ type RestoreFixtureOptions = { buildIdentitySha?: string; expectedPayloadSha256?: string; manifestCandidateSha?: string; - preexistingDist?: "dangling-symlink" | "directory" | "plugin-directory"; + preexistingDist?: + | "dangling-symlink" + | "directory" + | "plugin-directory" + | "symlinked-plugin-parent"; }; type ArchiveFixtureContext = { @@ -192,10 +196,18 @@ function writePreexistingPluginDistDirectory(workspace: string): void { fs.writeFileSync(path.join(shared, "existing.cjs"), "module.exports = {};\n"); } +function writeSymlinkedPluginParent(workspace: string): void { + const escaped = path.join(path.dirname(workspace), "escaped"); + fs.rmSync(path.join(workspace, "nemoclaw"), { force: true, recursive: true }); + fs.mkdirSync(escaped); + fs.symlinkSync(escaped, path.join(workspace, "nemoclaw"), "dir"); +} + const PREEXISTING_DIST_WRITERS = { "dangling-symlink": writeDanglingDistSymlink, directory: writePreexistingDistDirectory, "plugin-directory": writePreexistingPluginDistDirectory, + "symlinked-plugin-parent": writeSymlinkedPluginParent, none: () => undefined, } satisfies Record< @@ -514,6 +526,23 @@ describe("exact-commit CLI artifact workflow boundary", () => { } }); + it("rejects a symlinked shared-boundary parent without escaping the workspace (#7915)", () => { + const fixture = runRestoreValidation({ preexistingDist: "symlinked-plugin-parent" }); + try { + expect(fixture.result.status, fixture.output).not.toBe(0); + expect(fixture.output).toContain( + "consumer nemoclaw directory must be a non-symlink directory", + ); + expect(fs.lstatSync(path.join(fixture.workspace, "nemoclaw")).isSymbolicLink()).toBe(true); + expect(fs.existsSync(path.join(path.dirname(fixture.workspace), "escaped", "dist"))).toBe( + false, + ); + expect(fs.existsSync(path.join(fixture.workspace, "dist"))).toBe(false); + } finally { + fixture.cleanup(); + } + }); + it("does not overwrite a dangling dist symlink (#7915)", () => { const fixture = runRestoreValidation({ preexistingDist: "dangling-symlink" }); try { diff --git a/tools/e2e/cli-artifact-workflow-boundary.mts b/tools/e2e/cli-artifact-workflow-boundary.mts index aa8533cb89..332e70c451 100644 --- a/tools/e2e/cli-artifact-workflow-boundary.mts +++ b/tools/e2e/cli-artifact-workflow-boundary.mts @@ -33,7 +33,7 @@ const DEFAULT_RESTORE_ACTION_PATH = join( "action.yaml", ); const RESTORE_ACTION_CONTENT_SHA256 = - "0da26d1e8732a185271319888a5f7716596c315d78e5871c7e4125a298839741"; + "9c463207f5d69db9f8e5b380c9ede2541d00bd6f5484de955f4593bca0069f14"; const CLI_ARTIFACT_DOWNLOAD_STEP = "Download exact-commit CLI artifact"; const CLI_ARTIFACT_VERIFY_STEP = "Verify and restore exact-commit CLI artifact"; const CLI_ARTIFACT_PROVENANCE_STEP = "Record CLI artifact provenance"; @@ -164,6 +164,8 @@ export function validateCliArtifactRestoreAction( '*) echo "::error::CLI artifact contains an unsafe member', "CLI artifact contains a link or special file", '[[ ! -e "$GITHUB_WORKSPACE/dist" && ! -L "$GITHUB_WORKSPACE/dist" ]]', + '[[ -d "$GITHUB_WORKSPACE/nemoclaw" && ! -L "$GITHUB_WORKSPACE/nemoclaw" ]]', + '[[ ! -e "$GITHUB_WORKSPACE/nemoclaw/dist" && ! -L "$GITHUB_WORKSPACE/nemoclaw/dist" ]]', 'restore_dir="$(mktemp -d', From ef6b7a7cdcab708cecb7e045dfdf3cf0ec257e2d Mon Sep 17 00:00:00 2001 From: Carlos Villela Date: Wed, 5 Aug 2026 04:45:44 -0700 Subject: [PATCH 05/12] ci(e2e): pin symlink-safe restore action --- .github/workflows/e2e.yaml | 124 +++++++++---------- tools/e2e/cli-artifact-workflow-boundary.mts | 2 +- 2 files changed, 63 insertions(+), 63 deletions(-) diff --git a/.github/workflows/e2e.yaml b/.github/workflows/e2e.yaml index 49b5b6a536..deede384f6 100644 --- a/.github/workflows/e2e.yaml +++ b/.github/workflows/e2e.yaml @@ -628,7 +628,7 @@ jobs: build-cli: "false" - name: Restore exact-commit CLI artifact - uses: NVIDIA/NemoClaw/.github/actions/restore-e2e-cli-artifact@8c735cbb89c8d594b3ebf5b4673e2210c30d1449 + uses: NVIDIA/NemoClaw/.github/actions/restore-e2e-cli-artifact@186323bdb45e2266777b13eb6c48dac4600d8449 with: provenance-json: ${{ needs.generate-matrix.outputs.cli_artifact_provenance }} @@ -806,7 +806,7 @@ jobs: build-cli: "false" - name: Restore exact-commit CLI artifact - uses: NVIDIA/NemoClaw/.github/actions/restore-e2e-cli-artifact@8c735cbb89c8d594b3ebf5b4673e2210c30d1449 + uses: NVIDIA/NemoClaw/.github/actions/restore-e2e-cli-artifact@186323bdb45e2266777b13eb6c48dac4600d8449 with: provenance-json: ${{ needs.generate-matrix.outputs.cli_artifact_provenance }} @@ -969,7 +969,7 @@ jobs: build-cli: "false" - name: Restore exact-commit CLI artifact - uses: NVIDIA/NemoClaw/.github/actions/restore-e2e-cli-artifact@8c735cbb89c8d594b3ebf5b4673e2210c30d1449 + uses: NVIDIA/NemoClaw/.github/actions/restore-e2e-cli-artifact@186323bdb45e2266777b13eb6c48dac4600d8449 with: provenance-json: ${{ needs.generate-matrix.outputs.cli_artifact_provenance }} @@ -1020,7 +1020,7 @@ jobs: build-cli: "false" - name: Restore exact-commit CLI artifact - uses: NVIDIA/NemoClaw/.github/actions/restore-e2e-cli-artifact@8c735cbb89c8d594b3ebf5b4673e2210c30d1449 + uses: NVIDIA/NemoClaw/.github/actions/restore-e2e-cli-artifact@186323bdb45e2266777b13eb6c48dac4600d8449 with: provenance-json: ${{ needs.generate-matrix.outputs.cli_artifact_provenance }} @@ -1294,7 +1294,7 @@ jobs: build-cli: "false" - name: Restore exact-commit CLI artifact - uses: NVIDIA/NemoClaw/.github/actions/restore-e2e-cli-artifact@8c735cbb89c8d594b3ebf5b4673e2210c30d1449 + uses: NVIDIA/NemoClaw/.github/actions/restore-e2e-cli-artifact@186323bdb45e2266777b13eb6c48dac4600d8449 with: provenance-json: ${{ needs.generate-matrix.outputs.cli_artifact_provenance }} @@ -1426,7 +1426,7 @@ jobs: build-cli: "false" - name: Restore exact-commit CLI artifact - uses: NVIDIA/NemoClaw/.github/actions/restore-e2e-cli-artifact@8c735cbb89c8d594b3ebf5b4673e2210c30d1449 + uses: NVIDIA/NemoClaw/.github/actions/restore-e2e-cli-artifact@186323bdb45e2266777b13eb6c48dac4600d8449 with: provenance-json: ${{ needs.generate-matrix.outputs.cli_artifact_provenance }} @@ -1548,7 +1548,7 @@ jobs: build-cli: "false" - name: Restore exact-commit CLI artifact - uses: NVIDIA/NemoClaw/.github/actions/restore-e2e-cli-artifact@8c735cbb89c8d594b3ebf5b4673e2210c30d1449 + uses: NVIDIA/NemoClaw/.github/actions/restore-e2e-cli-artifact@186323bdb45e2266777b13eb6c48dac4600d8449 with: provenance-json: ${{ needs.generate-matrix.outputs.cli_artifact_provenance }} @@ -1660,7 +1660,7 @@ jobs: build-cli: "false" - name: Restore exact-commit CLI artifact - uses: NVIDIA/NemoClaw/.github/actions/restore-e2e-cli-artifact@8c735cbb89c8d594b3ebf5b4673e2210c30d1449 + uses: NVIDIA/NemoClaw/.github/actions/restore-e2e-cli-artifact@186323bdb45e2266777b13eb6c48dac4600d8449 with: provenance-json: ${{ needs.generate-matrix.outputs.cli_artifact_provenance }} @@ -1743,7 +1743,7 @@ jobs: build-cli: "false" - name: Restore exact-commit CLI artifact - uses: NVIDIA/NemoClaw/.github/actions/restore-e2e-cli-artifact@8c735cbb89c8d594b3ebf5b4673e2210c30d1449 + uses: NVIDIA/NemoClaw/.github/actions/restore-e2e-cli-artifact@186323bdb45e2266777b13eb6c48dac4600d8449 with: provenance-json: ${{ needs.generate-matrix.outputs.cli_artifact_provenance }} @@ -1788,7 +1788,7 @@ jobs: build-cli: "false" - name: Restore exact-commit CLI artifact - uses: NVIDIA/NemoClaw/.github/actions/restore-e2e-cli-artifact@8c735cbb89c8d594b3ebf5b4673e2210c30d1449 + uses: NVIDIA/NemoClaw/.github/actions/restore-e2e-cli-artifact@186323bdb45e2266777b13eb6c48dac4600d8449 with: provenance-json: ${{ needs.generate-matrix.outputs.cli_artifact_provenance }} @@ -1867,7 +1867,7 @@ jobs: build-cli: "false" - name: Restore exact-commit CLI artifact - uses: NVIDIA/NemoClaw/.github/actions/restore-e2e-cli-artifact@8c735cbb89c8d594b3ebf5b4673e2210c30d1449 + uses: NVIDIA/NemoClaw/.github/actions/restore-e2e-cli-artifact@186323bdb45e2266777b13eb6c48dac4600d8449 with: provenance-json: ${{ needs.generate-matrix.outputs.cli_artifact_provenance }} @@ -1925,7 +1925,7 @@ jobs: build-cli: "false" - name: Restore exact-commit CLI artifact - uses: NVIDIA/NemoClaw/.github/actions/restore-e2e-cli-artifact@8c735cbb89c8d594b3ebf5b4673e2210c30d1449 + uses: NVIDIA/NemoClaw/.github/actions/restore-e2e-cli-artifact@186323bdb45e2266777b13eb6c48dac4600d8449 with: provenance-json: ${{ needs.generate-matrix.outputs.cli_artifact_provenance }} - name: Install OpenShell CLI @@ -2884,7 +2884,7 @@ jobs: build-cli: "false" - name: Restore exact-commit CLI artifact - uses: NVIDIA/NemoClaw/.github/actions/restore-e2e-cli-artifact@8c735cbb89c8d594b3ebf5b4673e2210c30d1449 + uses: NVIDIA/NemoClaw/.github/actions/restore-e2e-cli-artifact@186323bdb45e2266777b13eb6c48dac4600d8449 with: provenance-json: ${{ needs.generate-matrix.outputs.cli_artifact_provenance }} - name: Initialize runner comparison telemetry @@ -2958,7 +2958,7 @@ jobs: build-cli: "false" - name: Restore exact-commit CLI artifact - uses: NVIDIA/NemoClaw/.github/actions/restore-e2e-cli-artifact@8c735cbb89c8d594b3ebf5b4673e2210c30d1449 + uses: NVIDIA/NemoClaw/.github/actions/restore-e2e-cli-artifact@186323bdb45e2266777b13eb6c48dac4600d8449 with: provenance-json: ${{ needs.generate-matrix.outputs.cli_artifact_provenance }} - name: Install OpenShell CLI @@ -3045,7 +3045,7 @@ jobs: build-cli: "false" - name: Restore exact-commit CLI artifact - uses: NVIDIA/NemoClaw/.github/actions/restore-e2e-cli-artifact@8c735cbb89c8d594b3ebf5b4673e2210c30d1449 + uses: NVIDIA/NemoClaw/.github/actions/restore-e2e-cli-artifact@186323bdb45e2266777b13eb6c48dac4600d8449 with: provenance-json: ${{ needs.generate-matrix.outputs.cli_artifact_provenance }} - name: Initialize runner comparison telemetry @@ -3109,7 +3109,7 @@ jobs: build-cli: "false" - name: Restore exact-commit CLI artifact - uses: NVIDIA/NemoClaw/.github/actions/restore-e2e-cli-artifact@8c735cbb89c8d594b3ebf5b4673e2210c30d1449 + uses: NVIDIA/NemoClaw/.github/actions/restore-e2e-cli-artifact@186323bdb45e2266777b13eb6c48dac4600d8449 with: provenance-json: ${{ needs.generate-matrix.outputs.cli_artifact_provenance }} @@ -3216,7 +3216,7 @@ jobs: build-cli: "false" - name: Restore exact-commit CLI artifact - uses: NVIDIA/NemoClaw/.github/actions/restore-e2e-cli-artifact@8c735cbb89c8d594b3ebf5b4673e2210c30d1449 + uses: NVIDIA/NemoClaw/.github/actions/restore-e2e-cli-artifact@186323bdb45e2266777b13eb6c48dac4600d8449 with: provenance-json: ${{ needs.generate-matrix.outputs.cli_artifact_provenance }} @@ -3293,7 +3293,7 @@ jobs: build-cli: "false" - name: Restore exact-commit CLI artifact - uses: NVIDIA/NemoClaw/.github/actions/restore-e2e-cli-artifact@8c735cbb89c8d594b3ebf5b4673e2210c30d1449 + uses: NVIDIA/NemoClaw/.github/actions/restore-e2e-cli-artifact@186323bdb45e2266777b13eb6c48dac4600d8449 with: provenance-json: ${{ needs.generate-matrix.outputs.cli_artifact_provenance }} @@ -3359,7 +3359,7 @@ jobs: build-cli: "false" - name: Restore exact-commit CLI artifact - uses: NVIDIA/NemoClaw/.github/actions/restore-e2e-cli-artifact@8c735cbb89c8d594b3ebf5b4673e2210c30d1449 + uses: NVIDIA/NemoClaw/.github/actions/restore-e2e-cli-artifact@186323bdb45e2266777b13eb6c48dac4600d8449 with: provenance-json: ${{ needs.generate-matrix.outputs.cli_artifact_provenance }} @@ -3408,7 +3408,7 @@ jobs: build-cli: "false" - name: Restore exact-commit CLI artifact - uses: NVIDIA/NemoClaw/.github/actions/restore-e2e-cli-artifact@8c735cbb89c8d594b3ebf5b4673e2210c30d1449 + uses: NVIDIA/NemoClaw/.github/actions/restore-e2e-cli-artifact@186323bdb45e2266777b13eb6c48dac4600d8449 with: provenance-json: ${{ needs.generate-matrix.outputs.cli_artifact_provenance }} @@ -3473,7 +3473,7 @@ jobs: build-cli: "false" - name: Restore exact-commit CLI artifact - uses: NVIDIA/NemoClaw/.github/actions/restore-e2e-cli-artifact@8c735cbb89c8d594b3ebf5b4673e2210c30d1449 + uses: NVIDIA/NemoClaw/.github/actions/restore-e2e-cli-artifact@186323bdb45e2266777b13eb6c48dac4600d8449 with: provenance-json: ${{ needs.generate-matrix.outputs.cli_artifact_provenance }} @@ -3555,7 +3555,7 @@ jobs: build-cli: "false" - name: Restore exact-commit CLI artifact - uses: NVIDIA/NemoClaw/.github/actions/restore-e2e-cli-artifact@8c735cbb89c8d594b3ebf5b4673e2210c30d1449 + uses: NVIDIA/NemoClaw/.github/actions/restore-e2e-cli-artifact@186323bdb45e2266777b13eb6c48dac4600d8449 with: provenance-json: ${{ needs.generate-matrix.outputs.cli_artifact_provenance }} @@ -3700,7 +3700,7 @@ jobs: build-cli: "false" - name: Restore exact-commit CLI artifact - uses: NVIDIA/NemoClaw/.github/actions/restore-e2e-cli-artifact@8c735cbb89c8d594b3ebf5b4673e2210c30d1449 + uses: NVIDIA/NemoClaw/.github/actions/restore-e2e-cli-artifact@186323bdb45e2266777b13eb6c48dac4600d8449 with: provenance-json: ${{ needs.generate-matrix.outputs.cli_artifact_provenance }} @@ -3908,7 +3908,7 @@ jobs: build-cli: "false" - name: Restore exact-commit CLI artifact - uses: NVIDIA/NemoClaw/.github/actions/restore-e2e-cli-artifact@8c735cbb89c8d594b3ebf5b4673e2210c30d1449 + uses: NVIDIA/NemoClaw/.github/actions/restore-e2e-cli-artifact@186323bdb45e2266777b13eb6c48dac4600d8449 with: provenance-json: ${{ needs.generate-matrix.outputs.cli_artifact_provenance }} @@ -3998,7 +3998,7 @@ jobs: build-cli: "false" - name: Restore exact-commit CLI artifact - uses: NVIDIA/NemoClaw/.github/actions/restore-e2e-cli-artifact@8c735cbb89c8d594b3ebf5b4673e2210c30d1449 + uses: NVIDIA/NemoClaw/.github/actions/restore-e2e-cli-artifact@186323bdb45e2266777b13eb6c48dac4600d8449 with: provenance-json: ${{ needs.generate-matrix.outputs.cli_artifact_provenance }} @@ -4097,7 +4097,7 @@ jobs: build-cli: "false" - name: Restore exact-commit CLI artifact - uses: NVIDIA/NemoClaw/.github/actions/restore-e2e-cli-artifact@8c735cbb89c8d594b3ebf5b4673e2210c30d1449 + uses: NVIDIA/NemoClaw/.github/actions/restore-e2e-cli-artifact@186323bdb45e2266777b13eb6c48dac4600d8449 with: provenance-json: ${{ needs.generate-matrix.outputs.cli_artifact_provenance }} @@ -4261,7 +4261,7 @@ jobs: build-cli: "false" - name: Restore exact-commit CLI artifact - uses: NVIDIA/NemoClaw/.github/actions/restore-e2e-cli-artifact@8c735cbb89c8d594b3ebf5b4673e2210c30d1449 + uses: NVIDIA/NemoClaw/.github/actions/restore-e2e-cli-artifact@186323bdb45e2266777b13eb6c48dac4600d8449 with: provenance-json: ${{ needs.generate-matrix.outputs.cli_artifact_provenance }} @@ -4320,7 +4320,7 @@ jobs: build-cli: "false" - name: Restore exact-commit CLI artifact - uses: NVIDIA/NemoClaw/.github/actions/restore-e2e-cli-artifact@8c735cbb89c8d594b3ebf5b4673e2210c30d1449 + uses: NVIDIA/NemoClaw/.github/actions/restore-e2e-cli-artifact@186323bdb45e2266777b13eb6c48dac4600d8449 with: provenance-json: ${{ needs.generate-matrix.outputs.cli_artifact_provenance }} @@ -4398,7 +4398,7 @@ jobs: build-cli: "false" - name: Restore exact-commit CLI artifact - uses: NVIDIA/NemoClaw/.github/actions/restore-e2e-cli-artifact@8c735cbb89c8d594b3ebf5b4673e2210c30d1449 + uses: NVIDIA/NemoClaw/.github/actions/restore-e2e-cli-artifact@186323bdb45e2266777b13eb6c48dac4600d8449 with: provenance-json: ${{ needs.generate-matrix.outputs.cli_artifact_provenance }} @@ -4520,7 +4520,7 @@ jobs: build-cli: "false" - name: Restore exact-commit CLI artifact - uses: NVIDIA/NemoClaw/.github/actions/restore-e2e-cli-artifact@8c735cbb89c8d594b3ebf5b4673e2210c30d1449 + uses: NVIDIA/NemoClaw/.github/actions/restore-e2e-cli-artifact@186323bdb45e2266777b13eb6c48dac4600d8449 with: provenance-json: ${{ needs.generate-matrix.outputs.cli_artifact_provenance }} @@ -4636,7 +4636,7 @@ jobs: build-cli: "false" - name: Restore exact-commit CLI artifact - uses: NVIDIA/NemoClaw/.github/actions/restore-e2e-cli-artifact@8c735cbb89c8d594b3ebf5b4673e2210c30d1449 + uses: NVIDIA/NemoClaw/.github/actions/restore-e2e-cli-artifact@186323bdb45e2266777b13eb6c48dac4600d8449 with: provenance-json: ${{ needs.generate-matrix.outputs.cli_artifact_provenance }} @@ -4687,7 +4687,7 @@ jobs: build-cli: "false" - name: Restore exact-commit CLI artifact - uses: NVIDIA/NemoClaw/.github/actions/restore-e2e-cli-artifact@8c735cbb89c8d594b3ebf5b4673e2210c30d1449 + uses: NVIDIA/NemoClaw/.github/actions/restore-e2e-cli-artifact@186323bdb45e2266777b13eb6c48dac4600d8449 with: provenance-json: ${{ needs.generate-matrix.outputs.cli_artifact_provenance }} @@ -4754,7 +4754,7 @@ jobs: build-cli: "false" - name: Restore exact-commit CLI artifact - uses: NVIDIA/NemoClaw/.github/actions/restore-e2e-cli-artifact@8c735cbb89c8d594b3ebf5b4673e2210c30d1449 + uses: NVIDIA/NemoClaw/.github/actions/restore-e2e-cli-artifact@186323bdb45e2266777b13eb6c48dac4600d8449 with: provenance-json: ${{ needs.generate-matrix.outputs.cli_artifact_provenance }} @@ -4839,7 +4839,7 @@ jobs: build-cli: "false" - name: Restore exact-commit CLI artifact - uses: NVIDIA/NemoClaw/.github/actions/restore-e2e-cli-artifact@8c735cbb89c8d594b3ebf5b4673e2210c30d1449 + uses: NVIDIA/NemoClaw/.github/actions/restore-e2e-cli-artifact@186323bdb45e2266777b13eb6c48dac4600d8449 with: provenance-json: ${{ needs.generate-matrix.outputs.cli_artifact_provenance }} @@ -4901,7 +4901,7 @@ jobs: build-cli: "false" - name: Restore exact-commit CLI artifact - uses: NVIDIA/NemoClaw/.github/actions/restore-e2e-cli-artifact@8c735cbb89c8d594b3ebf5b4673e2210c30d1449 + uses: NVIDIA/NemoClaw/.github/actions/restore-e2e-cli-artifact@186323bdb45e2266777b13eb6c48dac4600d8449 with: provenance-json: ${{ needs.generate-matrix.outputs.cli_artifact_provenance }} @@ -4964,7 +4964,7 @@ jobs: build-cli: "false" - name: Restore exact-commit CLI artifact - uses: NVIDIA/NemoClaw/.github/actions/restore-e2e-cli-artifact@8c735cbb89c8d594b3ebf5b4673e2210c30d1449 + uses: NVIDIA/NemoClaw/.github/actions/restore-e2e-cli-artifact@186323bdb45e2266777b13eb6c48dac4600d8449 with: provenance-json: ${{ needs.generate-matrix.outputs.cli_artifact_provenance }} @@ -5026,7 +5026,7 @@ jobs: build-cli: "false" - name: Restore exact-commit CLI artifact - uses: NVIDIA/NemoClaw/.github/actions/restore-e2e-cli-artifact@8c735cbb89c8d594b3ebf5b4673e2210c30d1449 + uses: NVIDIA/NemoClaw/.github/actions/restore-e2e-cli-artifact@186323bdb45e2266777b13eb6c48dac4600d8449 with: provenance-json: ${{ needs.generate-matrix.outputs.cli_artifact_provenance }} @@ -5220,7 +5220,7 @@ jobs: build-cli: "false" - name: Restore exact-commit CLI artifact - uses: NVIDIA/NemoClaw/.github/actions/restore-e2e-cli-artifact@8c735cbb89c8d594b3ebf5b4673e2210c30d1449 + uses: NVIDIA/NemoClaw/.github/actions/restore-e2e-cli-artifact@186323bdb45e2266777b13eb6c48dac4600d8449 with: provenance-json: ${{ needs.generate-matrix.outputs.cli_artifact_provenance }} @@ -5318,7 +5318,7 @@ jobs: build-cli: "false" - name: Restore exact-commit CLI artifact - uses: NVIDIA/NemoClaw/.github/actions/restore-e2e-cli-artifact@8c735cbb89c8d594b3ebf5b4673e2210c30d1449 + uses: NVIDIA/NemoClaw/.github/actions/restore-e2e-cli-artifact@186323bdb45e2266777b13eb6c48dac4600d8449 with: provenance-json: ${{ needs.generate-matrix.outputs.cli_artifact_provenance }} @@ -5379,7 +5379,7 @@ jobs: build-cli: "false" - name: Restore exact-commit CLI artifact - uses: NVIDIA/NemoClaw/.github/actions/restore-e2e-cli-artifact@8c735cbb89c8d594b3ebf5b4673e2210c30d1449 + uses: NVIDIA/NemoClaw/.github/actions/restore-e2e-cli-artifact@186323bdb45e2266777b13eb6c48dac4600d8449 with: provenance-json: ${{ needs.generate-matrix.outputs.cli_artifact_provenance }} @@ -5441,7 +5441,7 @@ jobs: build-cli: "false" - name: Restore exact-commit CLI artifact - uses: NVIDIA/NemoClaw/.github/actions/restore-e2e-cli-artifact@8c735cbb89c8d594b3ebf5b4673e2210c30d1449 + uses: NVIDIA/NemoClaw/.github/actions/restore-e2e-cli-artifact@186323bdb45e2266777b13eb6c48dac4600d8449 with: provenance-json: ${{ needs.generate-matrix.outputs.cli_artifact_provenance }} @@ -5501,7 +5501,7 @@ jobs: build-cli: "false" - name: Restore exact-commit CLI artifact - uses: NVIDIA/NemoClaw/.github/actions/restore-e2e-cli-artifact@8c735cbb89c8d594b3ebf5b4673e2210c30d1449 + uses: NVIDIA/NemoClaw/.github/actions/restore-e2e-cli-artifact@186323bdb45e2266777b13eb6c48dac4600d8449 with: provenance-json: ${{ needs.generate-matrix.outputs.cli_artifact_provenance }} @@ -5560,7 +5560,7 @@ jobs: build-cli: "false" - name: Restore exact-commit CLI artifact - uses: NVIDIA/NemoClaw/.github/actions/restore-e2e-cli-artifact@8c735cbb89c8d594b3ebf5b4673e2210c30d1449 + uses: NVIDIA/NemoClaw/.github/actions/restore-e2e-cli-artifact@186323bdb45e2266777b13eb6c48dac4600d8449 with: provenance-json: ${{ needs.generate-matrix.outputs.cli_artifact_provenance }} @@ -5676,7 +5676,7 @@ jobs: build-cli: "false" - name: Restore exact-commit CLI artifact - uses: NVIDIA/NemoClaw/.github/actions/restore-e2e-cli-artifact@8c735cbb89c8d594b3ebf5b4673e2210c30d1449 + uses: NVIDIA/NemoClaw/.github/actions/restore-e2e-cli-artifact@186323bdb45e2266777b13eb6c48dac4600d8449 with: provenance-json: ${{ needs.generate-matrix.outputs.cli_artifact_provenance }} @@ -5734,7 +5734,7 @@ jobs: build-cli: "false" - name: Restore exact-commit CLI artifact - uses: NVIDIA/NemoClaw/.github/actions/restore-e2e-cli-artifact@8c735cbb89c8d594b3ebf5b4673e2210c30d1449 + uses: NVIDIA/NemoClaw/.github/actions/restore-e2e-cli-artifact@186323bdb45e2266777b13eb6c48dac4600d8449 with: provenance-json: ${{ needs.generate-matrix.outputs.cli_artifact_provenance }} @@ -5846,7 +5846,7 @@ jobs: build-cli: "false" - name: Restore exact-commit CLI artifact - uses: NVIDIA/NemoClaw/.github/actions/restore-e2e-cli-artifact@8c735cbb89c8d594b3ebf5b4673e2210c30d1449 + uses: NVIDIA/NemoClaw/.github/actions/restore-e2e-cli-artifact@186323bdb45e2266777b13eb6c48dac4600d8449 with: provenance-json: ${{ needs.generate-matrix.outputs.cli_artifact_provenance }} @@ -5949,7 +5949,7 @@ jobs: build-cli: "false" - name: Restore exact-commit CLI artifact - uses: NVIDIA/NemoClaw/.github/actions/restore-e2e-cli-artifact@8c735cbb89c8d594b3ebf5b4673e2210c30d1449 + uses: NVIDIA/NemoClaw/.github/actions/restore-e2e-cli-artifact@186323bdb45e2266777b13eb6c48dac4600d8449 with: provenance-json: ${{ needs.generate-matrix.outputs.cli_artifact_provenance }} @@ -6015,7 +6015,7 @@ jobs: build-cli: "false" - name: Restore exact-commit CLI artifact - uses: NVIDIA/NemoClaw/.github/actions/restore-e2e-cli-artifact@8c735cbb89c8d594b3ebf5b4673e2210c30d1449 + uses: NVIDIA/NemoClaw/.github/actions/restore-e2e-cli-artifact@186323bdb45e2266777b13eb6c48dac4600d8449 with: provenance-json: ${{ needs.generate-matrix.outputs.cli_artifact_provenance }} @@ -6087,7 +6087,7 @@ jobs: build-cli: "false" - name: Restore exact-commit CLI artifact - uses: NVIDIA/NemoClaw/.github/actions/restore-e2e-cli-artifact@8c735cbb89c8d594b3ebf5b4673e2210c30d1449 + uses: NVIDIA/NemoClaw/.github/actions/restore-e2e-cli-artifact@186323bdb45e2266777b13eb6c48dac4600d8449 with: provenance-json: ${{ needs.generate-matrix.outputs.cli_artifact_provenance }} @@ -6162,7 +6162,7 @@ jobs: build-cli: "false" - name: Restore exact-commit CLI artifact - uses: NVIDIA/NemoClaw/.github/actions/restore-e2e-cli-artifact@8c735cbb89c8d594b3ebf5b4673e2210c30d1449 + uses: NVIDIA/NemoClaw/.github/actions/restore-e2e-cli-artifact@186323bdb45e2266777b13eb6c48dac4600d8449 with: provenance-json: ${{ needs.generate-matrix.outputs.cli_artifact_provenance }} @@ -6241,7 +6241,7 @@ jobs: build-cli: "false" - name: Restore exact-commit CLI artifact - uses: NVIDIA/NemoClaw/.github/actions/restore-e2e-cli-artifact@8c735cbb89c8d594b3ebf5b4673e2210c30d1449 + uses: NVIDIA/NemoClaw/.github/actions/restore-e2e-cli-artifact@186323bdb45e2266777b13eb6c48dac4600d8449 with: provenance-json: ${{ needs.generate-matrix.outputs.cli_artifact_provenance }} @@ -6310,7 +6310,7 @@ jobs: build-cli: "false" - name: Restore exact-commit CLI artifact - uses: NVIDIA/NemoClaw/.github/actions/restore-e2e-cli-artifact@8c735cbb89c8d594b3ebf5b4673e2210c30d1449 + uses: NVIDIA/NemoClaw/.github/actions/restore-e2e-cli-artifact@186323bdb45e2266777b13eb6c48dac4600d8449 with: provenance-json: ${{ needs.generate-matrix.outputs.cli_artifact_provenance }} @@ -6406,7 +6406,7 @@ jobs: build-cli: "false" - name: Restore exact-commit CLI artifact - uses: NVIDIA/NemoClaw/.github/actions/restore-e2e-cli-artifact@8c735cbb89c8d594b3ebf5b4673e2210c30d1449 + uses: NVIDIA/NemoClaw/.github/actions/restore-e2e-cli-artifact@186323bdb45e2266777b13eb6c48dac4600d8449 with: provenance-json: ${{ needs.generate-matrix.outputs.cli_artifact_provenance }} @@ -6488,7 +6488,7 @@ jobs: build-cli: "false" - name: Restore exact-commit CLI artifact - uses: NVIDIA/NemoClaw/.github/actions/restore-e2e-cli-artifact@8c735cbb89c8d594b3ebf5b4673e2210c30d1449 + uses: NVIDIA/NemoClaw/.github/actions/restore-e2e-cli-artifact@186323bdb45e2266777b13eb6c48dac4600d8449 with: provenance-json: ${{ needs.generate-matrix.outputs.cli_artifact_provenance }} @@ -6543,7 +6543,7 @@ jobs: build-cli: "false" - name: Restore exact-commit CLI artifact - uses: NVIDIA/NemoClaw/.github/actions/restore-e2e-cli-artifact@8c735cbb89c8d594b3ebf5b4673e2210c30d1449 + uses: NVIDIA/NemoClaw/.github/actions/restore-e2e-cli-artifact@186323bdb45e2266777b13eb6c48dac4600d8449 with: provenance-json: ${{ needs.generate-matrix.outputs.cli_artifact_provenance }} @@ -6606,7 +6606,7 @@ jobs: build-cli: "false" - name: Restore exact-commit CLI artifact - uses: NVIDIA/NemoClaw/.github/actions/restore-e2e-cli-artifact@8c735cbb89c8d594b3ebf5b4673e2210c30d1449 + uses: NVIDIA/NemoClaw/.github/actions/restore-e2e-cli-artifact@186323bdb45e2266777b13eb6c48dac4600d8449 with: provenance-json: ${{ needs.generate-matrix.outputs.cli_artifact_provenance }} @@ -6683,7 +6683,7 @@ jobs: build-cli: "false" - name: Restore exact-commit CLI artifact - uses: NVIDIA/NemoClaw/.github/actions/restore-e2e-cli-artifact@8c735cbb89c8d594b3ebf5b4673e2210c30d1449 + uses: NVIDIA/NemoClaw/.github/actions/restore-e2e-cli-artifact@186323bdb45e2266777b13eb6c48dac4600d8449 with: provenance-json: ${{ needs.generate-matrix.outputs.cli_artifact_provenance }} @@ -6783,7 +6783,7 @@ jobs: build-cli: "false" - name: Restore exact-commit CLI artifact - uses: NVIDIA/NemoClaw/.github/actions/restore-e2e-cli-artifact@8c735cbb89c8d594b3ebf5b4673e2210c30d1449 + uses: NVIDIA/NemoClaw/.github/actions/restore-e2e-cli-artifact@186323bdb45e2266777b13eb6c48dac4600d8449 with: provenance-json: ${{ needs.generate-matrix.outputs.cli_artifact_provenance }} @@ -6876,7 +6876,7 @@ jobs: build-cli: "false" - name: Restore exact-commit CLI artifact - uses: NVIDIA/NemoClaw/.github/actions/restore-e2e-cli-artifact@8c735cbb89c8d594b3ebf5b4673e2210c30d1449 + uses: NVIDIA/NemoClaw/.github/actions/restore-e2e-cli-artifact@186323bdb45e2266777b13eb6c48dac4600d8449 with: provenance-json: ${{ needs.generate-matrix.outputs.cli_artifact_provenance }} @@ -6948,7 +6948,7 @@ jobs: build-cli: "false" - name: Restore exact-commit CLI artifact - uses: NVIDIA/NemoClaw/.github/actions/restore-e2e-cli-artifact@8c735cbb89c8d594b3ebf5b4673e2210c30d1449 + uses: NVIDIA/NemoClaw/.github/actions/restore-e2e-cli-artifact@186323bdb45e2266777b13eb6c48dac4600d8449 with: provenance-json: ${{ needs.generate-matrix.outputs.cli_artifact_provenance }} @@ -7013,7 +7013,7 @@ jobs: build-cli: "false" - name: Restore exact-commit CLI artifact - uses: NVIDIA/NemoClaw/.github/actions/restore-e2e-cli-artifact@8c735cbb89c8d594b3ebf5b4673e2210c30d1449 + uses: NVIDIA/NemoClaw/.github/actions/restore-e2e-cli-artifact@186323bdb45e2266777b13eb6c48dac4600d8449 with: provenance-json: ${{ needs.generate-matrix.outputs.cli_artifact_provenance }} @@ -7085,7 +7085,7 @@ jobs: build-cli: "false" - name: Restore exact-commit CLI artifact - uses: NVIDIA/NemoClaw/.github/actions/restore-e2e-cli-artifact@8c735cbb89c8d594b3ebf5b4673e2210c30d1449 + uses: NVIDIA/NemoClaw/.github/actions/restore-e2e-cli-artifact@186323bdb45e2266777b13eb6c48dac4600d8449 with: provenance-json: ${{ needs.generate-matrix.outputs.cli_artifact_provenance }} diff --git a/tools/e2e/cli-artifact-workflow-boundary.mts b/tools/e2e/cli-artifact-workflow-boundary.mts index 332e70c451..5bd6484057 100644 --- a/tools/e2e/cli-artifact-workflow-boundary.mts +++ b/tools/e2e/cli-artifact-workflow-boundary.mts @@ -19,7 +19,7 @@ export const CLI_ARTIFACT_DOWNLOAD_ACTION = export const CLI_ARTIFACT_UPLOAD_ACTION = "actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a"; export const CLI_ARTIFACT_RESTORE_ACTION = - "NVIDIA/NemoClaw/.github/actions/restore-e2e-cli-artifact@8c735cbb89c8d594b3ebf5b4673e2210c30d1449"; + "NVIDIA/NemoClaw/.github/actions/restore-e2e-cli-artifact@186323bdb45e2266777b13eb6c48dac4600d8449"; export const CLI_ARTIFACT_PACKAGE_STEP = "Package exact-commit CLI"; export const CLI_ARTIFACT_PUBLISH_STEP = "Publish content-addressed CLI artifact"; export const CLI_ARTIFACT_RESTORE_STEP = "Restore exact-commit CLI artifact"; From f6209b1de70861b56eca70bda0805a5c61426528 Mon Sep 17 00:00:00 2001 From: Carlos Villela Date: Wed, 5 Aug 2026 04:59:26 -0700 Subject: [PATCH 06/12] docs(e2e): document shared CLI artifact Signed-off-by: Carlos Villela --- test/e2e/README.md | 14 ++++++++------ 1 file changed, 8 insertions(+), 6 deletions(-) diff --git a/test/e2e/README.md b/test/e2e/README.md index bf1815f95b..4b8153e1a0 100644 --- a/test/e2e/README.md +++ b/test/e2e/README.md @@ -26,7 +26,8 @@ before those targets run; local runners must provide it themselves. ### Candidate CLI Artifact The candidate CLI comes from the source commit that an E2E run tests. -The `generate-matrix` job builds it once and publishes `dist/` as a content-addressed artifact. +The `generate-matrix` job builds it once. +The job publishes root `dist/` and `nemoclaw/dist/shared/` in one content-addressed artifact. The workflow has 62 artifact-using job definitions. Each selected job execution restores the artifact instead of running `npm run build:cli`. Each selected job still runs the pinned preparation action to install Node.js and project dependencies. @@ -58,17 +59,18 @@ Before download, the action rejects extra or missing provenance fields. It also compares the candidate checkout, repository, workflow SHA, run ID, and attempt with the provenance object. The action downloads the artifact by immutable ID and sets digest mismatch handling to `error`. -Before the action restores `dist/` into the workspace, it verifies these conditions: +Before the action restores root `dist/` and `nemoclaw/dist/shared/` into the workspace, it verifies these conditions: - The upload digest is present and well formed. - The candidate SHA matches the expected commit. - The manifest matches the source, workflow run, toolchain contract, and payload. -- The archive contains no path traversal, links, special files, or files outside `dist/`. -- The candidate checkout has no preexisting `dist/` path. +- The archive contains no path traversal, links, special files, or files outside root `dist/` and `nemoclaw/dist/shared/`. +- Neither root `dist/` nor `nemoclaw/dist/` already exists, including as a dangling symbolic link. +- The candidate checkout's `nemoclaw/` path is a directory and is not a symbolic link. - The staged `dist/build-identity.json` names the candidate commit SHA. -If a pre-restore check fails, the action stops before it moves `dist/` into the workspace. -After the checks pass, the action moves `dist/` and runs `bin/nemoclaw.js --version`. +If a pre-restore check fails, the action stops before it adds either directory to the workspace. +After the checks pass, the action restores root `dist/` and `nemoclaw/dist/shared/`, then runs `bin/nemoclaw.js --version`. If the version command fails, the action stops before the live test runs. This boundary keeps candidate source separate from the trusted workflow implementation. From d2c2b6511e947346289f3d5b1a7a03f3af650339 Mon Sep 17 00:00:00 2001 From: Carlos Villela Date: Wed, 5 Aug 2026 06:13:20 -0700 Subject: [PATCH 07/12] fix(e2e): require regular CLI artifact files Signed-off-by: Carlos Villela --- .../restore-e2e-cli-artifact/action.yaml | 10 ++-- .github/workflows/e2e.yaml | 22 +++++---- test/e2e/README.md | 1 + .../cli-artifact-workflow-boundary.test.ts | 49 ++++++++++++++++++- tools/e2e/cli-artifact-workflow-boundary.mts | 13 +++-- 5 files changed, 72 insertions(+), 23 deletions(-) diff --git a/.github/actions/restore-e2e-cli-artifact/action.yaml b/.github/actions/restore-e2e-cli-artifact/action.yaml index 5171edf49a..456c84905c 100644 --- a/.github/actions/restore-e2e-cli-artifact/action.yaml +++ b/.github/actions/restore-e2e-cli-artifact/action.yaml @@ -166,14 +166,16 @@ runs: restore_dir="$(mktemp -d "${RUNNER_TEMP}/nemoclaw-cli-restore.XXXXXX")" trap 'rm -rf -- "$restore_dir"' EXIT tar --no-same-owner --no-same-permissions -xf "$payload" -C "$restore_dir" - test -s "$restore_dir/dist/nemoclaw.js" || - { echo "::error::restored CLI artifact is missing dist/nemoclaw.js"; exit 1; } + cli_entrypoint="$restore_dir/dist/nemoclaw.js" + [[ -f "$cli_entrypoint" && ! -L "$cli_entrypoint" && -s "$cli_entrypoint" ]] || + { echo "::error::restored CLI artifact entry point is missing or is not a nonempty regular file"; exit 1; } for boundary in \ openshell-policy-boundary.cjs \ sandbox-name.cjs \ snapshot-sanitizer-boundary.cjs; do - test -s "$restore_dir/nemoclaw/dist/shared/$boundary" || - { echo "::error::restored CLI artifact is missing shared boundary $boundary"; exit 1; } + boundary_path="$restore_dir/nemoclaw/dist/shared/$boundary" + [[ -f "$boundary_path" && ! -L "$boundary_path" && -s "$boundary_path" ]] || + { echo "::error::restored CLI artifact shared module is missing or is not a nonempty regular file: $boundary"; exit 1; } done jq -e --arg candidateSha "$CANDIDATE_SHA" ' type == "object" and diff --git a/.github/workflows/e2e.yaml b/.github/workflows/e2e.yaml index deede384f6..69229a39fa 100644 --- a/.github/workflows/e2e.yaml +++ b/.github/workflows/e2e.yaml @@ -392,16 +392,18 @@ jobs: { echo "::error::checked-out commit does not match the artifact candidate SHA"; exit 1; } [[ "$RUN_ATTEMPT" =~ ^[1-9][0-9]*$ && "$RUN_ID" =~ ^[1-9][0-9]*$ ]] || { echo "::error::workflow run identity is invalid"; exit 1; } - test -s dist/nemoclaw.js || - { echo "::error::candidate CLI build did not produce dist/nemoclaw.js"; exit 1; } - test -s dist/build-identity.json || - { echo "::error::candidate CLI build did not produce dist/build-identity.json"; exit 1; } - test -s nemoclaw/dist/shared/openshell-policy-boundary.cjs || - { echo "::error::candidate CLI build did not produce the shared policy boundary"; exit 1; } - test -s nemoclaw/dist/shared/sandbox-name.cjs || - { echo "::error::candidate CLI build did not produce the shared sandbox-name boundary"; exit 1; } - test -s nemoclaw/dist/shared/snapshot-sanitizer-boundary.cjs || - { echo "::error::candidate CLI build did not produce the shared snapshot boundary"; exit 1; } + for required_file in dist/nemoclaw.js dist/build-identity.json; do + [[ -f "$required_file" && ! -L "$required_file" && -s "$required_file" ]] || + { echo "::error::candidate CLI build output is missing or is not a nonempty regular file: $required_file"; exit 1; } + done + for boundary in \ + openshell-policy-boundary.cjs \ + sandbox-name.cjs \ + snapshot-sanitizer-boundary.cjs; do + boundary_path="nemoclaw/dist/shared/$boundary" + [[ -f "$boundary_path" && ! -L "$boundary_path" && -s "$boundary_path" ]] || + { echo "::error::candidate CLI build shared module is missing or is not a nonempty regular file: $boundary"; exit 1; } + done jq -e --arg candidateSha "$CANDIDATE_SHA" ' type == "object" and diff --git a/test/e2e/README.md b/test/e2e/README.md index 4b8153e1a0..c015d15e29 100644 --- a/test/e2e/README.md +++ b/test/e2e/README.md @@ -67,6 +67,7 @@ Before the action restores root `dist/` and `nemoclaw/dist/shared/` into the wor - The archive contains no path traversal, links, special files, or files outside root `dist/` and `nemoclaw/dist/shared/`. - Neither root `dist/` nor `nemoclaw/dist/` already exists, including as a dangling symbolic link. - The candidate checkout's `nemoclaw/` path is a directory and is not a symbolic link. +- The CLI entry point and required shared modules are nonempty regular files. - The staged `dist/build-identity.json` names the candidate commit SHA. If a pre-restore check fails, the action stops before it adds either directory to the workspace. diff --git a/test/e2e/support/cli-artifact-workflow-boundary.test.ts b/test/e2e/support/cli-artifact-workflow-boundary.test.ts index 6322847d49..513a649fa2 100644 --- a/test/e2e/support/cli-artifact-workflow-boundary.test.ts +++ b/test/e2e/support/cli-artifact-workflow-boundary.test.ts @@ -67,7 +67,14 @@ function workflowFixture(): Workflow { } type RestoreFixtureOptions = { - archive?: "valid" | "missing-shared" | "non-dist" | "link" | "traversal"; + archive?: + | "valid" + | "cli-directory" + | "missing-shared" + | "non-dist" + | "link" + | "shared-module-directory" + | "traversal"; buildIdentitySha?: string; expectedPayloadSha256?: string; manifestCandidateSha?: string; @@ -138,6 +145,15 @@ function writeLinkArchive(context: ArchiveFixtureContext): void { }); } +function writeCliDirectoryArchive(context: ArchiveFixtureContext): void { + writeCliArchive(context, (dist) => { + const entrypoint = path.join(dist, "nemoclaw.js"); + fs.rmSync(entrypoint); + fs.mkdirSync(entrypoint); + fs.writeFileSync(path.join(entrypoint, "index.js"), 'console.log("nemoclaw v0.0.0");\n'); + }); +} + function writeMissingSharedArchive(context: ArchiveFixtureContext): void { writeCliArchive( context, @@ -146,6 +162,19 @@ function writeMissingSharedArchive(context: ArchiveFixtureContext): void { ); } +function writeSharedModuleDirectoryArchive(context: ArchiveFixtureContext): void { + writeCliArchive( + context, + () => undefined, + (shared) => { + const modulePath = path.join(shared, "sandbox-name.cjs"); + fs.rmSync(modulePath); + fs.mkdirSync(modulePath); + fs.writeFileSync(path.join(modulePath, "index.js"), "module.exports = {};\n"); + }, + ); +} + function writeNonDistArchive(context: ArchiveFixtureContext): void { fs.writeFileSync(path.join(context.payloadRoot, "outside.txt"), "outside dist\n"); execFileSync("tar", ["-cf", context.payload, "-C", context.payloadRoot, "outside.txt"]); @@ -168,10 +197,12 @@ function writeTraversalArchive(context: ArchiveFixtureContext): void { } const ARCHIVE_FIXTURE_WRITERS = { + "cli-directory": writeCliDirectoryArchive, link: writeLinkArchive, "missing-shared": writeMissingSharedArchive, "non-dist": writeNonDistArchive, + "shared-module-directory": writeSharedModuleDirectoryArchive, traversal: writeTraversalArchive, valid: writeValidArchive, } satisfies Record< @@ -475,7 +506,21 @@ describe("exact-commit CLI artifact workflow boundary", () => { it("rejects a payload missing a compiled shared boundary before activation (#7915)", () => { expectRestoreFailure( { archive: "missing-shared" }, - "restored CLI artifact is missing shared boundary sandbox-name.cjs", + "restored CLI artifact shared module is missing or is not a nonempty regular file: sandbox-name.cjs", + ); + }); + + it("rejects a directory in place of the CLI entry point before activation (#7915)", () => { + expectRestoreFailure( + { archive: "cli-directory" }, + "restored CLI artifact entry point is missing or is not a nonempty regular file", + ); + }); + + it("rejects a directory in place of a shared module before activation (#7915)", () => { + expectRestoreFailure( + { archive: "shared-module-directory" }, + "restored CLI artifact shared module is missing or is not a nonempty regular file: sandbox-name.cjs", ); }); diff --git a/tools/e2e/cli-artifact-workflow-boundary.mts b/tools/e2e/cli-artifact-workflow-boundary.mts index 5bd6484057..f66fef70c3 100644 --- a/tools/e2e/cli-artifact-workflow-boundary.mts +++ b/tools/e2e/cli-artifact-workflow-boundary.mts @@ -33,7 +33,7 @@ const DEFAULT_RESTORE_ACTION_PATH = join( "action.yaml", ); const RESTORE_ACTION_CONTENT_SHA256 = - "9c463207f5d69db9f8e5b380c9ede2541d00bd6f5484de955f4593bca0069f14"; + "0d03759f9b069c20a2d9fd5c6136a2845c1f5d6c0c5539578f4dfd168163a4eb"; const CLI_ARTIFACT_DOWNLOAD_STEP = "Download exact-commit CLI artifact"; const CLI_ARTIFACT_VERIFY_STEP = "Verify and restore exact-commit CLI artifact"; const CLI_ARTIFACT_PROVENANCE_STEP = "Record CLI artifact provenance"; @@ -170,7 +170,8 @@ export function validateCliArtifactRestoreAction( 'restore_dir="$(mktemp -d', 'tar --no-same-owner --no-same-permissions -xf "$payload" -C "$restore_dir"', - 'test -s "$restore_dir/nemoclaw/dist/shared/$boundary"', + '[[ -f "$cli_entrypoint" && ! -L "$cli_entrypoint" && -s "$cli_entrypoint" ]]', + '[[ -f "$boundary_path" && ! -L "$boundary_path" && -s "$boundary_path" ]]', ".sourceRevision == $candidateSha", 'mv "$restore_dir/nemoclaw/dist" "$GITHUB_WORKSPACE/nemoclaw/dist"', @@ -230,11 +231,9 @@ function validateProducer(errors: string[], producer: WorkflowRecord): void { } requireFragments(errors, "CLI artifact package step", packageStep.run, [ 'git rev-parse --verify HEAD)" == "$CANDIDATE_SHA"', - "test -s dist/nemoclaw.js", - "test -s dist/build-identity.json", - "test -s nemoclaw/dist/shared/openshell-policy-boundary.cjs", - "test -s nemoclaw/dist/shared/sandbox-name.cjs", - "test -s nemoclaw/dist/shared/snapshot-sanitizer-boundary.cjs", + 'for required_file in dist/nemoclaw.js dist/build-identity.json; do', + '[[ -f "$required_file" && ! -L "$required_file" && -s "$required_file" ]]', + '[[ -f "$boundary_path" && ! -L "$boundary_path" && -s "$boundary_path" ]]', ".sourceRevision == $candidateSha", "candidate CLI build identity does not match the candidate commit SHA", From 64ed03ba4292821002a53f9207abe200423a0aae Mon Sep 17 00:00:00 2001 From: Carlos Villela Date: Wed, 5 Aug 2026 06:15:11 -0700 Subject: [PATCH 08/12] ci(e2e): pin validated CLI artifact restore Signed-off-by: Carlos Villela --- .github/workflows/e2e.yaml | 124 +++++++++---------- tools/e2e/cli-artifact-workflow-boundary.mts | 2 +- 2 files changed, 63 insertions(+), 63 deletions(-) diff --git a/.github/workflows/e2e.yaml b/.github/workflows/e2e.yaml index 69229a39fa..086966ad67 100644 --- a/.github/workflows/e2e.yaml +++ b/.github/workflows/e2e.yaml @@ -630,7 +630,7 @@ jobs: build-cli: "false" - name: Restore exact-commit CLI artifact - uses: NVIDIA/NemoClaw/.github/actions/restore-e2e-cli-artifact@186323bdb45e2266777b13eb6c48dac4600d8449 + uses: NVIDIA/NemoClaw/.github/actions/restore-e2e-cli-artifact@d2c2b6511e947346289f3d5b1a7a03f3af650339 with: provenance-json: ${{ needs.generate-matrix.outputs.cli_artifact_provenance }} @@ -808,7 +808,7 @@ jobs: build-cli: "false" - name: Restore exact-commit CLI artifact - uses: NVIDIA/NemoClaw/.github/actions/restore-e2e-cli-artifact@186323bdb45e2266777b13eb6c48dac4600d8449 + uses: NVIDIA/NemoClaw/.github/actions/restore-e2e-cli-artifact@d2c2b6511e947346289f3d5b1a7a03f3af650339 with: provenance-json: ${{ needs.generate-matrix.outputs.cli_artifact_provenance }} @@ -971,7 +971,7 @@ jobs: build-cli: "false" - name: Restore exact-commit CLI artifact - uses: NVIDIA/NemoClaw/.github/actions/restore-e2e-cli-artifact@186323bdb45e2266777b13eb6c48dac4600d8449 + uses: NVIDIA/NemoClaw/.github/actions/restore-e2e-cli-artifact@d2c2b6511e947346289f3d5b1a7a03f3af650339 with: provenance-json: ${{ needs.generate-matrix.outputs.cli_artifact_provenance }} @@ -1022,7 +1022,7 @@ jobs: build-cli: "false" - name: Restore exact-commit CLI artifact - uses: NVIDIA/NemoClaw/.github/actions/restore-e2e-cli-artifact@186323bdb45e2266777b13eb6c48dac4600d8449 + uses: NVIDIA/NemoClaw/.github/actions/restore-e2e-cli-artifact@d2c2b6511e947346289f3d5b1a7a03f3af650339 with: provenance-json: ${{ needs.generate-matrix.outputs.cli_artifact_provenance }} @@ -1296,7 +1296,7 @@ jobs: build-cli: "false" - name: Restore exact-commit CLI artifact - uses: NVIDIA/NemoClaw/.github/actions/restore-e2e-cli-artifact@186323bdb45e2266777b13eb6c48dac4600d8449 + uses: NVIDIA/NemoClaw/.github/actions/restore-e2e-cli-artifact@d2c2b6511e947346289f3d5b1a7a03f3af650339 with: provenance-json: ${{ needs.generate-matrix.outputs.cli_artifact_provenance }} @@ -1428,7 +1428,7 @@ jobs: build-cli: "false" - name: Restore exact-commit CLI artifact - uses: NVIDIA/NemoClaw/.github/actions/restore-e2e-cli-artifact@186323bdb45e2266777b13eb6c48dac4600d8449 + uses: NVIDIA/NemoClaw/.github/actions/restore-e2e-cli-artifact@d2c2b6511e947346289f3d5b1a7a03f3af650339 with: provenance-json: ${{ needs.generate-matrix.outputs.cli_artifact_provenance }} @@ -1550,7 +1550,7 @@ jobs: build-cli: "false" - name: Restore exact-commit CLI artifact - uses: NVIDIA/NemoClaw/.github/actions/restore-e2e-cli-artifact@186323bdb45e2266777b13eb6c48dac4600d8449 + uses: NVIDIA/NemoClaw/.github/actions/restore-e2e-cli-artifact@d2c2b6511e947346289f3d5b1a7a03f3af650339 with: provenance-json: ${{ needs.generate-matrix.outputs.cli_artifact_provenance }} @@ -1662,7 +1662,7 @@ jobs: build-cli: "false" - name: Restore exact-commit CLI artifact - uses: NVIDIA/NemoClaw/.github/actions/restore-e2e-cli-artifact@186323bdb45e2266777b13eb6c48dac4600d8449 + uses: NVIDIA/NemoClaw/.github/actions/restore-e2e-cli-artifact@d2c2b6511e947346289f3d5b1a7a03f3af650339 with: provenance-json: ${{ needs.generate-matrix.outputs.cli_artifact_provenance }} @@ -1745,7 +1745,7 @@ jobs: build-cli: "false" - name: Restore exact-commit CLI artifact - uses: NVIDIA/NemoClaw/.github/actions/restore-e2e-cli-artifact@186323bdb45e2266777b13eb6c48dac4600d8449 + uses: NVIDIA/NemoClaw/.github/actions/restore-e2e-cli-artifact@d2c2b6511e947346289f3d5b1a7a03f3af650339 with: provenance-json: ${{ needs.generate-matrix.outputs.cli_artifact_provenance }} @@ -1790,7 +1790,7 @@ jobs: build-cli: "false" - name: Restore exact-commit CLI artifact - uses: NVIDIA/NemoClaw/.github/actions/restore-e2e-cli-artifact@186323bdb45e2266777b13eb6c48dac4600d8449 + uses: NVIDIA/NemoClaw/.github/actions/restore-e2e-cli-artifact@d2c2b6511e947346289f3d5b1a7a03f3af650339 with: provenance-json: ${{ needs.generate-matrix.outputs.cli_artifact_provenance }} @@ -1869,7 +1869,7 @@ jobs: build-cli: "false" - name: Restore exact-commit CLI artifact - uses: NVIDIA/NemoClaw/.github/actions/restore-e2e-cli-artifact@186323bdb45e2266777b13eb6c48dac4600d8449 + uses: NVIDIA/NemoClaw/.github/actions/restore-e2e-cli-artifact@d2c2b6511e947346289f3d5b1a7a03f3af650339 with: provenance-json: ${{ needs.generate-matrix.outputs.cli_artifact_provenance }} @@ -1927,7 +1927,7 @@ jobs: build-cli: "false" - name: Restore exact-commit CLI artifact - uses: NVIDIA/NemoClaw/.github/actions/restore-e2e-cli-artifact@186323bdb45e2266777b13eb6c48dac4600d8449 + uses: NVIDIA/NemoClaw/.github/actions/restore-e2e-cli-artifact@d2c2b6511e947346289f3d5b1a7a03f3af650339 with: provenance-json: ${{ needs.generate-matrix.outputs.cli_artifact_provenance }} - name: Install OpenShell CLI @@ -2886,7 +2886,7 @@ jobs: build-cli: "false" - name: Restore exact-commit CLI artifact - uses: NVIDIA/NemoClaw/.github/actions/restore-e2e-cli-artifact@186323bdb45e2266777b13eb6c48dac4600d8449 + uses: NVIDIA/NemoClaw/.github/actions/restore-e2e-cli-artifact@d2c2b6511e947346289f3d5b1a7a03f3af650339 with: provenance-json: ${{ needs.generate-matrix.outputs.cli_artifact_provenance }} - name: Initialize runner comparison telemetry @@ -2960,7 +2960,7 @@ jobs: build-cli: "false" - name: Restore exact-commit CLI artifact - uses: NVIDIA/NemoClaw/.github/actions/restore-e2e-cli-artifact@186323bdb45e2266777b13eb6c48dac4600d8449 + uses: NVIDIA/NemoClaw/.github/actions/restore-e2e-cli-artifact@d2c2b6511e947346289f3d5b1a7a03f3af650339 with: provenance-json: ${{ needs.generate-matrix.outputs.cli_artifact_provenance }} - name: Install OpenShell CLI @@ -3047,7 +3047,7 @@ jobs: build-cli: "false" - name: Restore exact-commit CLI artifact - uses: NVIDIA/NemoClaw/.github/actions/restore-e2e-cli-artifact@186323bdb45e2266777b13eb6c48dac4600d8449 + uses: NVIDIA/NemoClaw/.github/actions/restore-e2e-cli-artifact@d2c2b6511e947346289f3d5b1a7a03f3af650339 with: provenance-json: ${{ needs.generate-matrix.outputs.cli_artifact_provenance }} - name: Initialize runner comparison telemetry @@ -3111,7 +3111,7 @@ jobs: build-cli: "false" - name: Restore exact-commit CLI artifact - uses: NVIDIA/NemoClaw/.github/actions/restore-e2e-cli-artifact@186323bdb45e2266777b13eb6c48dac4600d8449 + uses: NVIDIA/NemoClaw/.github/actions/restore-e2e-cli-artifact@d2c2b6511e947346289f3d5b1a7a03f3af650339 with: provenance-json: ${{ needs.generate-matrix.outputs.cli_artifact_provenance }} @@ -3218,7 +3218,7 @@ jobs: build-cli: "false" - name: Restore exact-commit CLI artifact - uses: NVIDIA/NemoClaw/.github/actions/restore-e2e-cli-artifact@186323bdb45e2266777b13eb6c48dac4600d8449 + uses: NVIDIA/NemoClaw/.github/actions/restore-e2e-cli-artifact@d2c2b6511e947346289f3d5b1a7a03f3af650339 with: provenance-json: ${{ needs.generate-matrix.outputs.cli_artifact_provenance }} @@ -3295,7 +3295,7 @@ jobs: build-cli: "false" - name: Restore exact-commit CLI artifact - uses: NVIDIA/NemoClaw/.github/actions/restore-e2e-cli-artifact@186323bdb45e2266777b13eb6c48dac4600d8449 + uses: NVIDIA/NemoClaw/.github/actions/restore-e2e-cli-artifact@d2c2b6511e947346289f3d5b1a7a03f3af650339 with: provenance-json: ${{ needs.generate-matrix.outputs.cli_artifact_provenance }} @@ -3361,7 +3361,7 @@ jobs: build-cli: "false" - name: Restore exact-commit CLI artifact - uses: NVIDIA/NemoClaw/.github/actions/restore-e2e-cli-artifact@186323bdb45e2266777b13eb6c48dac4600d8449 + uses: NVIDIA/NemoClaw/.github/actions/restore-e2e-cli-artifact@d2c2b6511e947346289f3d5b1a7a03f3af650339 with: provenance-json: ${{ needs.generate-matrix.outputs.cli_artifact_provenance }} @@ -3410,7 +3410,7 @@ jobs: build-cli: "false" - name: Restore exact-commit CLI artifact - uses: NVIDIA/NemoClaw/.github/actions/restore-e2e-cli-artifact@186323bdb45e2266777b13eb6c48dac4600d8449 + uses: NVIDIA/NemoClaw/.github/actions/restore-e2e-cli-artifact@d2c2b6511e947346289f3d5b1a7a03f3af650339 with: provenance-json: ${{ needs.generate-matrix.outputs.cli_artifact_provenance }} @@ -3475,7 +3475,7 @@ jobs: build-cli: "false" - name: Restore exact-commit CLI artifact - uses: NVIDIA/NemoClaw/.github/actions/restore-e2e-cli-artifact@186323bdb45e2266777b13eb6c48dac4600d8449 + uses: NVIDIA/NemoClaw/.github/actions/restore-e2e-cli-artifact@d2c2b6511e947346289f3d5b1a7a03f3af650339 with: provenance-json: ${{ needs.generate-matrix.outputs.cli_artifact_provenance }} @@ -3557,7 +3557,7 @@ jobs: build-cli: "false" - name: Restore exact-commit CLI artifact - uses: NVIDIA/NemoClaw/.github/actions/restore-e2e-cli-artifact@186323bdb45e2266777b13eb6c48dac4600d8449 + uses: NVIDIA/NemoClaw/.github/actions/restore-e2e-cli-artifact@d2c2b6511e947346289f3d5b1a7a03f3af650339 with: provenance-json: ${{ needs.generate-matrix.outputs.cli_artifact_provenance }} @@ -3702,7 +3702,7 @@ jobs: build-cli: "false" - name: Restore exact-commit CLI artifact - uses: NVIDIA/NemoClaw/.github/actions/restore-e2e-cli-artifact@186323bdb45e2266777b13eb6c48dac4600d8449 + uses: NVIDIA/NemoClaw/.github/actions/restore-e2e-cli-artifact@d2c2b6511e947346289f3d5b1a7a03f3af650339 with: provenance-json: ${{ needs.generate-matrix.outputs.cli_artifact_provenance }} @@ -3910,7 +3910,7 @@ jobs: build-cli: "false" - name: Restore exact-commit CLI artifact - uses: NVIDIA/NemoClaw/.github/actions/restore-e2e-cli-artifact@186323bdb45e2266777b13eb6c48dac4600d8449 + uses: NVIDIA/NemoClaw/.github/actions/restore-e2e-cli-artifact@d2c2b6511e947346289f3d5b1a7a03f3af650339 with: provenance-json: ${{ needs.generate-matrix.outputs.cli_artifact_provenance }} @@ -4000,7 +4000,7 @@ jobs: build-cli: "false" - name: Restore exact-commit CLI artifact - uses: NVIDIA/NemoClaw/.github/actions/restore-e2e-cli-artifact@186323bdb45e2266777b13eb6c48dac4600d8449 + uses: NVIDIA/NemoClaw/.github/actions/restore-e2e-cli-artifact@d2c2b6511e947346289f3d5b1a7a03f3af650339 with: provenance-json: ${{ needs.generate-matrix.outputs.cli_artifact_provenance }} @@ -4099,7 +4099,7 @@ jobs: build-cli: "false" - name: Restore exact-commit CLI artifact - uses: NVIDIA/NemoClaw/.github/actions/restore-e2e-cli-artifact@186323bdb45e2266777b13eb6c48dac4600d8449 + uses: NVIDIA/NemoClaw/.github/actions/restore-e2e-cli-artifact@d2c2b6511e947346289f3d5b1a7a03f3af650339 with: provenance-json: ${{ needs.generate-matrix.outputs.cli_artifact_provenance }} @@ -4263,7 +4263,7 @@ jobs: build-cli: "false" - name: Restore exact-commit CLI artifact - uses: NVIDIA/NemoClaw/.github/actions/restore-e2e-cli-artifact@186323bdb45e2266777b13eb6c48dac4600d8449 + uses: NVIDIA/NemoClaw/.github/actions/restore-e2e-cli-artifact@d2c2b6511e947346289f3d5b1a7a03f3af650339 with: provenance-json: ${{ needs.generate-matrix.outputs.cli_artifact_provenance }} @@ -4322,7 +4322,7 @@ jobs: build-cli: "false" - name: Restore exact-commit CLI artifact - uses: NVIDIA/NemoClaw/.github/actions/restore-e2e-cli-artifact@186323bdb45e2266777b13eb6c48dac4600d8449 + uses: NVIDIA/NemoClaw/.github/actions/restore-e2e-cli-artifact@d2c2b6511e947346289f3d5b1a7a03f3af650339 with: provenance-json: ${{ needs.generate-matrix.outputs.cli_artifact_provenance }} @@ -4400,7 +4400,7 @@ jobs: build-cli: "false" - name: Restore exact-commit CLI artifact - uses: NVIDIA/NemoClaw/.github/actions/restore-e2e-cli-artifact@186323bdb45e2266777b13eb6c48dac4600d8449 + uses: NVIDIA/NemoClaw/.github/actions/restore-e2e-cli-artifact@d2c2b6511e947346289f3d5b1a7a03f3af650339 with: provenance-json: ${{ needs.generate-matrix.outputs.cli_artifact_provenance }} @@ -4522,7 +4522,7 @@ jobs: build-cli: "false" - name: Restore exact-commit CLI artifact - uses: NVIDIA/NemoClaw/.github/actions/restore-e2e-cli-artifact@186323bdb45e2266777b13eb6c48dac4600d8449 + uses: NVIDIA/NemoClaw/.github/actions/restore-e2e-cli-artifact@d2c2b6511e947346289f3d5b1a7a03f3af650339 with: provenance-json: ${{ needs.generate-matrix.outputs.cli_artifact_provenance }} @@ -4638,7 +4638,7 @@ jobs: build-cli: "false" - name: Restore exact-commit CLI artifact - uses: NVIDIA/NemoClaw/.github/actions/restore-e2e-cli-artifact@186323bdb45e2266777b13eb6c48dac4600d8449 + uses: NVIDIA/NemoClaw/.github/actions/restore-e2e-cli-artifact@d2c2b6511e947346289f3d5b1a7a03f3af650339 with: provenance-json: ${{ needs.generate-matrix.outputs.cli_artifact_provenance }} @@ -4689,7 +4689,7 @@ jobs: build-cli: "false" - name: Restore exact-commit CLI artifact - uses: NVIDIA/NemoClaw/.github/actions/restore-e2e-cli-artifact@186323bdb45e2266777b13eb6c48dac4600d8449 + uses: NVIDIA/NemoClaw/.github/actions/restore-e2e-cli-artifact@d2c2b6511e947346289f3d5b1a7a03f3af650339 with: provenance-json: ${{ needs.generate-matrix.outputs.cli_artifact_provenance }} @@ -4756,7 +4756,7 @@ jobs: build-cli: "false" - name: Restore exact-commit CLI artifact - uses: NVIDIA/NemoClaw/.github/actions/restore-e2e-cli-artifact@186323bdb45e2266777b13eb6c48dac4600d8449 + uses: NVIDIA/NemoClaw/.github/actions/restore-e2e-cli-artifact@d2c2b6511e947346289f3d5b1a7a03f3af650339 with: provenance-json: ${{ needs.generate-matrix.outputs.cli_artifact_provenance }} @@ -4841,7 +4841,7 @@ jobs: build-cli: "false" - name: Restore exact-commit CLI artifact - uses: NVIDIA/NemoClaw/.github/actions/restore-e2e-cli-artifact@186323bdb45e2266777b13eb6c48dac4600d8449 + uses: NVIDIA/NemoClaw/.github/actions/restore-e2e-cli-artifact@d2c2b6511e947346289f3d5b1a7a03f3af650339 with: provenance-json: ${{ needs.generate-matrix.outputs.cli_artifact_provenance }} @@ -4903,7 +4903,7 @@ jobs: build-cli: "false" - name: Restore exact-commit CLI artifact - uses: NVIDIA/NemoClaw/.github/actions/restore-e2e-cli-artifact@186323bdb45e2266777b13eb6c48dac4600d8449 + uses: NVIDIA/NemoClaw/.github/actions/restore-e2e-cli-artifact@d2c2b6511e947346289f3d5b1a7a03f3af650339 with: provenance-json: ${{ needs.generate-matrix.outputs.cli_artifact_provenance }} @@ -4966,7 +4966,7 @@ jobs: build-cli: "false" - name: Restore exact-commit CLI artifact - uses: NVIDIA/NemoClaw/.github/actions/restore-e2e-cli-artifact@186323bdb45e2266777b13eb6c48dac4600d8449 + uses: NVIDIA/NemoClaw/.github/actions/restore-e2e-cli-artifact@d2c2b6511e947346289f3d5b1a7a03f3af650339 with: provenance-json: ${{ needs.generate-matrix.outputs.cli_artifact_provenance }} @@ -5028,7 +5028,7 @@ jobs: build-cli: "false" - name: Restore exact-commit CLI artifact - uses: NVIDIA/NemoClaw/.github/actions/restore-e2e-cli-artifact@186323bdb45e2266777b13eb6c48dac4600d8449 + uses: NVIDIA/NemoClaw/.github/actions/restore-e2e-cli-artifact@d2c2b6511e947346289f3d5b1a7a03f3af650339 with: provenance-json: ${{ needs.generate-matrix.outputs.cli_artifact_provenance }} @@ -5222,7 +5222,7 @@ jobs: build-cli: "false" - name: Restore exact-commit CLI artifact - uses: NVIDIA/NemoClaw/.github/actions/restore-e2e-cli-artifact@186323bdb45e2266777b13eb6c48dac4600d8449 + uses: NVIDIA/NemoClaw/.github/actions/restore-e2e-cli-artifact@d2c2b6511e947346289f3d5b1a7a03f3af650339 with: provenance-json: ${{ needs.generate-matrix.outputs.cli_artifact_provenance }} @@ -5320,7 +5320,7 @@ jobs: build-cli: "false" - name: Restore exact-commit CLI artifact - uses: NVIDIA/NemoClaw/.github/actions/restore-e2e-cli-artifact@186323bdb45e2266777b13eb6c48dac4600d8449 + uses: NVIDIA/NemoClaw/.github/actions/restore-e2e-cli-artifact@d2c2b6511e947346289f3d5b1a7a03f3af650339 with: provenance-json: ${{ needs.generate-matrix.outputs.cli_artifact_provenance }} @@ -5381,7 +5381,7 @@ jobs: build-cli: "false" - name: Restore exact-commit CLI artifact - uses: NVIDIA/NemoClaw/.github/actions/restore-e2e-cli-artifact@186323bdb45e2266777b13eb6c48dac4600d8449 + uses: NVIDIA/NemoClaw/.github/actions/restore-e2e-cli-artifact@d2c2b6511e947346289f3d5b1a7a03f3af650339 with: provenance-json: ${{ needs.generate-matrix.outputs.cli_artifact_provenance }} @@ -5443,7 +5443,7 @@ jobs: build-cli: "false" - name: Restore exact-commit CLI artifact - uses: NVIDIA/NemoClaw/.github/actions/restore-e2e-cli-artifact@186323bdb45e2266777b13eb6c48dac4600d8449 + uses: NVIDIA/NemoClaw/.github/actions/restore-e2e-cli-artifact@d2c2b6511e947346289f3d5b1a7a03f3af650339 with: provenance-json: ${{ needs.generate-matrix.outputs.cli_artifact_provenance }} @@ -5503,7 +5503,7 @@ jobs: build-cli: "false" - name: Restore exact-commit CLI artifact - uses: NVIDIA/NemoClaw/.github/actions/restore-e2e-cli-artifact@186323bdb45e2266777b13eb6c48dac4600d8449 + uses: NVIDIA/NemoClaw/.github/actions/restore-e2e-cli-artifact@d2c2b6511e947346289f3d5b1a7a03f3af650339 with: provenance-json: ${{ needs.generate-matrix.outputs.cli_artifact_provenance }} @@ -5562,7 +5562,7 @@ jobs: build-cli: "false" - name: Restore exact-commit CLI artifact - uses: NVIDIA/NemoClaw/.github/actions/restore-e2e-cli-artifact@186323bdb45e2266777b13eb6c48dac4600d8449 + uses: NVIDIA/NemoClaw/.github/actions/restore-e2e-cli-artifact@d2c2b6511e947346289f3d5b1a7a03f3af650339 with: provenance-json: ${{ needs.generate-matrix.outputs.cli_artifact_provenance }} @@ -5678,7 +5678,7 @@ jobs: build-cli: "false" - name: Restore exact-commit CLI artifact - uses: NVIDIA/NemoClaw/.github/actions/restore-e2e-cli-artifact@186323bdb45e2266777b13eb6c48dac4600d8449 + uses: NVIDIA/NemoClaw/.github/actions/restore-e2e-cli-artifact@d2c2b6511e947346289f3d5b1a7a03f3af650339 with: provenance-json: ${{ needs.generate-matrix.outputs.cli_artifact_provenance }} @@ -5736,7 +5736,7 @@ jobs: build-cli: "false" - name: Restore exact-commit CLI artifact - uses: NVIDIA/NemoClaw/.github/actions/restore-e2e-cli-artifact@186323bdb45e2266777b13eb6c48dac4600d8449 + uses: NVIDIA/NemoClaw/.github/actions/restore-e2e-cli-artifact@d2c2b6511e947346289f3d5b1a7a03f3af650339 with: provenance-json: ${{ needs.generate-matrix.outputs.cli_artifact_provenance }} @@ -5848,7 +5848,7 @@ jobs: build-cli: "false" - name: Restore exact-commit CLI artifact - uses: NVIDIA/NemoClaw/.github/actions/restore-e2e-cli-artifact@186323bdb45e2266777b13eb6c48dac4600d8449 + uses: NVIDIA/NemoClaw/.github/actions/restore-e2e-cli-artifact@d2c2b6511e947346289f3d5b1a7a03f3af650339 with: provenance-json: ${{ needs.generate-matrix.outputs.cli_artifact_provenance }} @@ -5951,7 +5951,7 @@ jobs: build-cli: "false" - name: Restore exact-commit CLI artifact - uses: NVIDIA/NemoClaw/.github/actions/restore-e2e-cli-artifact@186323bdb45e2266777b13eb6c48dac4600d8449 + uses: NVIDIA/NemoClaw/.github/actions/restore-e2e-cli-artifact@d2c2b6511e947346289f3d5b1a7a03f3af650339 with: provenance-json: ${{ needs.generate-matrix.outputs.cli_artifact_provenance }} @@ -6017,7 +6017,7 @@ jobs: build-cli: "false" - name: Restore exact-commit CLI artifact - uses: NVIDIA/NemoClaw/.github/actions/restore-e2e-cli-artifact@186323bdb45e2266777b13eb6c48dac4600d8449 + uses: NVIDIA/NemoClaw/.github/actions/restore-e2e-cli-artifact@d2c2b6511e947346289f3d5b1a7a03f3af650339 with: provenance-json: ${{ needs.generate-matrix.outputs.cli_artifact_provenance }} @@ -6089,7 +6089,7 @@ jobs: build-cli: "false" - name: Restore exact-commit CLI artifact - uses: NVIDIA/NemoClaw/.github/actions/restore-e2e-cli-artifact@186323bdb45e2266777b13eb6c48dac4600d8449 + uses: NVIDIA/NemoClaw/.github/actions/restore-e2e-cli-artifact@d2c2b6511e947346289f3d5b1a7a03f3af650339 with: provenance-json: ${{ needs.generate-matrix.outputs.cli_artifact_provenance }} @@ -6164,7 +6164,7 @@ jobs: build-cli: "false" - name: Restore exact-commit CLI artifact - uses: NVIDIA/NemoClaw/.github/actions/restore-e2e-cli-artifact@186323bdb45e2266777b13eb6c48dac4600d8449 + uses: NVIDIA/NemoClaw/.github/actions/restore-e2e-cli-artifact@d2c2b6511e947346289f3d5b1a7a03f3af650339 with: provenance-json: ${{ needs.generate-matrix.outputs.cli_artifact_provenance }} @@ -6243,7 +6243,7 @@ jobs: build-cli: "false" - name: Restore exact-commit CLI artifact - uses: NVIDIA/NemoClaw/.github/actions/restore-e2e-cli-artifact@186323bdb45e2266777b13eb6c48dac4600d8449 + uses: NVIDIA/NemoClaw/.github/actions/restore-e2e-cli-artifact@d2c2b6511e947346289f3d5b1a7a03f3af650339 with: provenance-json: ${{ needs.generate-matrix.outputs.cli_artifact_provenance }} @@ -6312,7 +6312,7 @@ jobs: build-cli: "false" - name: Restore exact-commit CLI artifact - uses: NVIDIA/NemoClaw/.github/actions/restore-e2e-cli-artifact@186323bdb45e2266777b13eb6c48dac4600d8449 + uses: NVIDIA/NemoClaw/.github/actions/restore-e2e-cli-artifact@d2c2b6511e947346289f3d5b1a7a03f3af650339 with: provenance-json: ${{ needs.generate-matrix.outputs.cli_artifact_provenance }} @@ -6408,7 +6408,7 @@ jobs: build-cli: "false" - name: Restore exact-commit CLI artifact - uses: NVIDIA/NemoClaw/.github/actions/restore-e2e-cli-artifact@186323bdb45e2266777b13eb6c48dac4600d8449 + uses: NVIDIA/NemoClaw/.github/actions/restore-e2e-cli-artifact@d2c2b6511e947346289f3d5b1a7a03f3af650339 with: provenance-json: ${{ needs.generate-matrix.outputs.cli_artifact_provenance }} @@ -6490,7 +6490,7 @@ jobs: build-cli: "false" - name: Restore exact-commit CLI artifact - uses: NVIDIA/NemoClaw/.github/actions/restore-e2e-cli-artifact@186323bdb45e2266777b13eb6c48dac4600d8449 + uses: NVIDIA/NemoClaw/.github/actions/restore-e2e-cli-artifact@d2c2b6511e947346289f3d5b1a7a03f3af650339 with: provenance-json: ${{ needs.generate-matrix.outputs.cli_artifact_provenance }} @@ -6545,7 +6545,7 @@ jobs: build-cli: "false" - name: Restore exact-commit CLI artifact - uses: NVIDIA/NemoClaw/.github/actions/restore-e2e-cli-artifact@186323bdb45e2266777b13eb6c48dac4600d8449 + uses: NVIDIA/NemoClaw/.github/actions/restore-e2e-cli-artifact@d2c2b6511e947346289f3d5b1a7a03f3af650339 with: provenance-json: ${{ needs.generate-matrix.outputs.cli_artifact_provenance }} @@ -6608,7 +6608,7 @@ jobs: build-cli: "false" - name: Restore exact-commit CLI artifact - uses: NVIDIA/NemoClaw/.github/actions/restore-e2e-cli-artifact@186323bdb45e2266777b13eb6c48dac4600d8449 + uses: NVIDIA/NemoClaw/.github/actions/restore-e2e-cli-artifact@d2c2b6511e947346289f3d5b1a7a03f3af650339 with: provenance-json: ${{ needs.generate-matrix.outputs.cli_artifact_provenance }} @@ -6685,7 +6685,7 @@ jobs: build-cli: "false" - name: Restore exact-commit CLI artifact - uses: NVIDIA/NemoClaw/.github/actions/restore-e2e-cli-artifact@186323bdb45e2266777b13eb6c48dac4600d8449 + uses: NVIDIA/NemoClaw/.github/actions/restore-e2e-cli-artifact@d2c2b6511e947346289f3d5b1a7a03f3af650339 with: provenance-json: ${{ needs.generate-matrix.outputs.cli_artifact_provenance }} @@ -6785,7 +6785,7 @@ jobs: build-cli: "false" - name: Restore exact-commit CLI artifact - uses: NVIDIA/NemoClaw/.github/actions/restore-e2e-cli-artifact@186323bdb45e2266777b13eb6c48dac4600d8449 + uses: NVIDIA/NemoClaw/.github/actions/restore-e2e-cli-artifact@d2c2b6511e947346289f3d5b1a7a03f3af650339 with: provenance-json: ${{ needs.generate-matrix.outputs.cli_artifact_provenance }} @@ -6878,7 +6878,7 @@ jobs: build-cli: "false" - name: Restore exact-commit CLI artifact - uses: NVIDIA/NemoClaw/.github/actions/restore-e2e-cli-artifact@186323bdb45e2266777b13eb6c48dac4600d8449 + uses: NVIDIA/NemoClaw/.github/actions/restore-e2e-cli-artifact@d2c2b6511e947346289f3d5b1a7a03f3af650339 with: provenance-json: ${{ needs.generate-matrix.outputs.cli_artifact_provenance }} @@ -6950,7 +6950,7 @@ jobs: build-cli: "false" - name: Restore exact-commit CLI artifact - uses: NVIDIA/NemoClaw/.github/actions/restore-e2e-cli-artifact@186323bdb45e2266777b13eb6c48dac4600d8449 + uses: NVIDIA/NemoClaw/.github/actions/restore-e2e-cli-artifact@d2c2b6511e947346289f3d5b1a7a03f3af650339 with: provenance-json: ${{ needs.generate-matrix.outputs.cli_artifact_provenance }} @@ -7015,7 +7015,7 @@ jobs: build-cli: "false" - name: Restore exact-commit CLI artifact - uses: NVIDIA/NemoClaw/.github/actions/restore-e2e-cli-artifact@186323bdb45e2266777b13eb6c48dac4600d8449 + uses: NVIDIA/NemoClaw/.github/actions/restore-e2e-cli-artifact@d2c2b6511e947346289f3d5b1a7a03f3af650339 with: provenance-json: ${{ needs.generate-matrix.outputs.cli_artifact_provenance }} @@ -7087,7 +7087,7 @@ jobs: build-cli: "false" - name: Restore exact-commit CLI artifact - uses: NVIDIA/NemoClaw/.github/actions/restore-e2e-cli-artifact@186323bdb45e2266777b13eb6c48dac4600d8449 + uses: NVIDIA/NemoClaw/.github/actions/restore-e2e-cli-artifact@d2c2b6511e947346289f3d5b1a7a03f3af650339 with: provenance-json: ${{ needs.generate-matrix.outputs.cli_artifact_provenance }} diff --git a/tools/e2e/cli-artifact-workflow-boundary.mts b/tools/e2e/cli-artifact-workflow-boundary.mts index f66fef70c3..ea781a1d3e 100644 --- a/tools/e2e/cli-artifact-workflow-boundary.mts +++ b/tools/e2e/cli-artifact-workflow-boundary.mts @@ -19,7 +19,7 @@ export const CLI_ARTIFACT_DOWNLOAD_ACTION = export const CLI_ARTIFACT_UPLOAD_ACTION = "actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a"; export const CLI_ARTIFACT_RESTORE_ACTION = - "NVIDIA/NemoClaw/.github/actions/restore-e2e-cli-artifact@186323bdb45e2266777b13eb6c48dac4600d8449"; + "NVIDIA/NemoClaw/.github/actions/restore-e2e-cli-artifact@d2c2b6511e947346289f3d5b1a7a03f3af650339"; export const CLI_ARTIFACT_PACKAGE_STEP = "Package exact-commit CLI"; export const CLI_ARTIFACT_PUBLISH_STEP = "Publish content-addressed CLI artifact"; export const CLI_ARTIFACT_RESTORE_STEP = "Restore exact-commit CLI artifact"; From 76b034489474ce9af0334f59196c5b1403c34722 Mon Sep 17 00:00:00 2001 From: Carlos Villela Date: Wed, 5 Aug 2026 07:06:51 -0700 Subject: [PATCH 09/12] chore(e2e): format artifact boundary check Signed-off-by: Carlos Villela --- tools/e2e/cli-artifact-workflow-boundary.mts | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/tools/e2e/cli-artifact-workflow-boundary.mts b/tools/e2e/cli-artifact-workflow-boundary.mts index ea781a1d3e..f6b771bfcb 100644 --- a/tools/e2e/cli-artifact-workflow-boundary.mts +++ b/tools/e2e/cli-artifact-workflow-boundary.mts @@ -231,7 +231,7 @@ function validateProducer(errors: string[], producer: WorkflowRecord): void { } requireFragments(errors, "CLI artifact package step", packageStep.run, [ 'git rev-parse --verify HEAD)" == "$CANDIDATE_SHA"', - 'for required_file in dist/nemoclaw.js dist/build-identity.json; do', + "for required_file in dist/nemoclaw.js dist/build-identity.json; do", '[[ -f "$required_file" && ! -L "$required_file" && -s "$required_file" ]]', '[[ -f "$boundary_path" && ! -L "$boundary_path" && -s "$boundary_path" ]]', From 54c3e8d976ce716161d13df3e958d9d059820812 Mon Sep 17 00:00:00 2001 From: Carlos Villela Date: Wed, 5 Aug 2026 07:11:15 -0700 Subject: [PATCH 10/12] test(e2e): verify failed restore leaves destinations absent Signed-off-by: Carlos Villela --- test/e2e/support/cli-artifact-workflow-boundary.test.ts | 1 + 1 file changed, 1 insertion(+) diff --git a/test/e2e/support/cli-artifact-workflow-boundary.test.ts b/test/e2e/support/cli-artifact-workflow-boundary.test.ts index 513a649fa2..bf146fbccd 100644 --- a/test/e2e/support/cli-artifact-workflow-boundary.test.ts +++ b/test/e2e/support/cli-artifact-workflow-boundary.test.ts @@ -368,6 +368,7 @@ function expectRestoreFailure(options: RestoreFixtureOptions, message: string): expect(fixture.result.status, fixture.output).not.toBe(0); expect(fixture.output).toContain(message); expect(fs.existsSync(path.join(fixture.workspace, "dist"))).toBe(false); + expect(fs.existsSync(path.join(fixture.workspace, "nemoclaw", "dist"))).toBe(false); } finally { fixture.cleanup(); } From d34b11e8b895760d6505d54e2cfc520332cb2a9c Mon Sep 17 00:00:00 2001 From: Carlos Villela Date: Wed, 5 Aug 2026 12:24:57 -0700 Subject: [PATCH 11/12] fix(e2e): name artifact restore paths Signed-off-by: Carlos Villela --- .github/actions/restore-e2e-cli-artifact/action.yaml | 2 +- test/e2e/support/cli-artifact-workflow-boundary.test.ts | 8 ++++---- 2 files changed, 5 insertions(+), 5 deletions(-) diff --git a/.github/actions/restore-e2e-cli-artifact/action.yaml b/.github/actions/restore-e2e-cli-artifact/action.yaml index 456c84905c..868bb0d20d 100644 --- a/.github/actions/restore-e2e-cli-artifact/action.yaml +++ b/.github/actions/restore-e2e-cli-artifact/action.yaml @@ -162,7 +162,7 @@ runs: { echo "::error::consumer nemoclaw directory must be a non-symlink directory"; exit 1; } [[ ! -e "$GITHUB_WORKSPACE/nemoclaw/dist" && ! -L "$GITHUB_WORKSPACE/nemoclaw/dist" ]] || - { echo "::error::consumer unexpectedly built shared boundaries before artifact restore"; exit 1; } + { echo "::error::consumer unexpectedly built nemoclaw/dist before artifact restore"; exit 1; } restore_dir="$(mktemp -d "${RUNNER_TEMP}/nemoclaw-cli-restore.XXXXXX")" trap 'rm -rf -- "$restore_dir"' EXIT tar --no-same-owner --no-same-permissions -xf "$payload" -C "$restore_dir" diff --git a/test/e2e/support/cli-artifact-workflow-boundary.test.ts b/test/e2e/support/cli-artifact-workflow-boundary.test.ts index bf146fbccd..792abccdd4 100644 --- a/test/e2e/support/cli-artifact-workflow-boundary.test.ts +++ b/test/e2e/support/cli-artifact-workflow-boundary.test.ts @@ -504,7 +504,7 @@ describe("exact-commit CLI artifact workflow boundary", () => { ); }); - it("rejects a payload missing a compiled shared boundary before activation (#7915)", () => { + it("rejects a payload missing a compiled shared module before activation (#7915)", () => { expectRestoreFailure( { archive: "missing-shared" }, "restored CLI artifact shared module is missing or is not a nonempty regular file: sandbox-name.cjs", @@ -553,12 +553,12 @@ describe("exact-commit CLI artifact workflow boundary", () => { } }); - it("does not overwrite preexisting shared boundaries (#7915)", () => { + it("does not overwrite a preexisting nemoclaw/dist directory (#7915)", () => { const fixture = runRestoreValidation({ preexistingDist: "plugin-directory" }); try { expect(fixture.result.status, fixture.output).not.toBe(0); expect(fixture.output).toContain( - "consumer unexpectedly built shared boundaries before artifact restore", + "consumer unexpectedly built nemoclaw/dist before artifact restore", ); expect( fs.readFileSync( @@ -572,7 +572,7 @@ describe("exact-commit CLI artifact workflow boundary", () => { } }); - it("rejects a symlinked shared-boundary parent without escaping the workspace (#7915)", () => { + it("rejects a symlinked nemoclaw directory without writing outside the workspace (#7915)", () => { const fixture = runRestoreValidation({ preexistingDist: "symlinked-plugin-parent" }); try { expect(fixture.result.status, fixture.output).not.toBe(0); From 39d5713cf40b81836d80e21bc9d2e8d2e8323074 Mon Sep 17 00:00:00 2001 From: Carlos Villela Date: Wed, 5 Aug 2026 12:30:16 -0700 Subject: [PATCH 12/12] ci(e2e): repin artifact restore action Signed-off-by: Carlos Villela --- .github/workflows/e2e.yaml | 124 +++++++++---------- tools/e2e/cli-artifact-workflow-boundary.mts | 4 +- 2 files changed, 64 insertions(+), 64 deletions(-) diff --git a/.github/workflows/e2e.yaml b/.github/workflows/e2e.yaml index 086966ad67..c107939f8a 100644 --- a/.github/workflows/e2e.yaml +++ b/.github/workflows/e2e.yaml @@ -630,7 +630,7 @@ jobs: build-cli: "false" - name: Restore exact-commit CLI artifact - uses: NVIDIA/NemoClaw/.github/actions/restore-e2e-cli-artifact@d2c2b6511e947346289f3d5b1a7a03f3af650339 + uses: NVIDIA/NemoClaw/.github/actions/restore-e2e-cli-artifact@d34b11e8b895760d6505d54e2cfc520332cb2a9c with: provenance-json: ${{ needs.generate-matrix.outputs.cli_artifact_provenance }} @@ -808,7 +808,7 @@ jobs: build-cli: "false" - name: Restore exact-commit CLI artifact - uses: NVIDIA/NemoClaw/.github/actions/restore-e2e-cli-artifact@d2c2b6511e947346289f3d5b1a7a03f3af650339 + uses: NVIDIA/NemoClaw/.github/actions/restore-e2e-cli-artifact@d34b11e8b895760d6505d54e2cfc520332cb2a9c with: provenance-json: ${{ needs.generate-matrix.outputs.cli_artifact_provenance }} @@ -971,7 +971,7 @@ jobs: build-cli: "false" - name: Restore exact-commit CLI artifact - uses: NVIDIA/NemoClaw/.github/actions/restore-e2e-cli-artifact@d2c2b6511e947346289f3d5b1a7a03f3af650339 + uses: NVIDIA/NemoClaw/.github/actions/restore-e2e-cli-artifact@d34b11e8b895760d6505d54e2cfc520332cb2a9c with: provenance-json: ${{ needs.generate-matrix.outputs.cli_artifact_provenance }} @@ -1022,7 +1022,7 @@ jobs: build-cli: "false" - name: Restore exact-commit CLI artifact - uses: NVIDIA/NemoClaw/.github/actions/restore-e2e-cli-artifact@d2c2b6511e947346289f3d5b1a7a03f3af650339 + uses: NVIDIA/NemoClaw/.github/actions/restore-e2e-cli-artifact@d34b11e8b895760d6505d54e2cfc520332cb2a9c with: provenance-json: ${{ needs.generate-matrix.outputs.cli_artifact_provenance }} @@ -1296,7 +1296,7 @@ jobs: build-cli: "false" - name: Restore exact-commit CLI artifact - uses: NVIDIA/NemoClaw/.github/actions/restore-e2e-cli-artifact@d2c2b6511e947346289f3d5b1a7a03f3af650339 + uses: NVIDIA/NemoClaw/.github/actions/restore-e2e-cli-artifact@d34b11e8b895760d6505d54e2cfc520332cb2a9c with: provenance-json: ${{ needs.generate-matrix.outputs.cli_artifact_provenance }} @@ -1428,7 +1428,7 @@ jobs: build-cli: "false" - name: Restore exact-commit CLI artifact - uses: NVIDIA/NemoClaw/.github/actions/restore-e2e-cli-artifact@d2c2b6511e947346289f3d5b1a7a03f3af650339 + uses: NVIDIA/NemoClaw/.github/actions/restore-e2e-cli-artifact@d34b11e8b895760d6505d54e2cfc520332cb2a9c with: provenance-json: ${{ needs.generate-matrix.outputs.cli_artifact_provenance }} @@ -1550,7 +1550,7 @@ jobs: build-cli: "false" - name: Restore exact-commit CLI artifact - uses: NVIDIA/NemoClaw/.github/actions/restore-e2e-cli-artifact@d2c2b6511e947346289f3d5b1a7a03f3af650339 + uses: NVIDIA/NemoClaw/.github/actions/restore-e2e-cli-artifact@d34b11e8b895760d6505d54e2cfc520332cb2a9c with: provenance-json: ${{ needs.generate-matrix.outputs.cli_artifact_provenance }} @@ -1662,7 +1662,7 @@ jobs: build-cli: "false" - name: Restore exact-commit CLI artifact - uses: NVIDIA/NemoClaw/.github/actions/restore-e2e-cli-artifact@d2c2b6511e947346289f3d5b1a7a03f3af650339 + uses: NVIDIA/NemoClaw/.github/actions/restore-e2e-cli-artifact@d34b11e8b895760d6505d54e2cfc520332cb2a9c with: provenance-json: ${{ needs.generate-matrix.outputs.cli_artifact_provenance }} @@ -1745,7 +1745,7 @@ jobs: build-cli: "false" - name: Restore exact-commit CLI artifact - uses: NVIDIA/NemoClaw/.github/actions/restore-e2e-cli-artifact@d2c2b6511e947346289f3d5b1a7a03f3af650339 + uses: NVIDIA/NemoClaw/.github/actions/restore-e2e-cli-artifact@d34b11e8b895760d6505d54e2cfc520332cb2a9c with: provenance-json: ${{ needs.generate-matrix.outputs.cli_artifact_provenance }} @@ -1790,7 +1790,7 @@ jobs: build-cli: "false" - name: Restore exact-commit CLI artifact - uses: NVIDIA/NemoClaw/.github/actions/restore-e2e-cli-artifact@d2c2b6511e947346289f3d5b1a7a03f3af650339 + uses: NVIDIA/NemoClaw/.github/actions/restore-e2e-cli-artifact@d34b11e8b895760d6505d54e2cfc520332cb2a9c with: provenance-json: ${{ needs.generate-matrix.outputs.cli_artifact_provenance }} @@ -1869,7 +1869,7 @@ jobs: build-cli: "false" - name: Restore exact-commit CLI artifact - uses: NVIDIA/NemoClaw/.github/actions/restore-e2e-cli-artifact@d2c2b6511e947346289f3d5b1a7a03f3af650339 + uses: NVIDIA/NemoClaw/.github/actions/restore-e2e-cli-artifact@d34b11e8b895760d6505d54e2cfc520332cb2a9c with: provenance-json: ${{ needs.generate-matrix.outputs.cli_artifact_provenance }} @@ -1927,7 +1927,7 @@ jobs: build-cli: "false" - name: Restore exact-commit CLI artifact - uses: NVIDIA/NemoClaw/.github/actions/restore-e2e-cli-artifact@d2c2b6511e947346289f3d5b1a7a03f3af650339 + uses: NVIDIA/NemoClaw/.github/actions/restore-e2e-cli-artifact@d34b11e8b895760d6505d54e2cfc520332cb2a9c with: provenance-json: ${{ needs.generate-matrix.outputs.cli_artifact_provenance }} - name: Install OpenShell CLI @@ -2886,7 +2886,7 @@ jobs: build-cli: "false" - name: Restore exact-commit CLI artifact - uses: NVIDIA/NemoClaw/.github/actions/restore-e2e-cli-artifact@d2c2b6511e947346289f3d5b1a7a03f3af650339 + uses: NVIDIA/NemoClaw/.github/actions/restore-e2e-cli-artifact@d34b11e8b895760d6505d54e2cfc520332cb2a9c with: provenance-json: ${{ needs.generate-matrix.outputs.cli_artifact_provenance }} - name: Initialize runner comparison telemetry @@ -2960,7 +2960,7 @@ jobs: build-cli: "false" - name: Restore exact-commit CLI artifact - uses: NVIDIA/NemoClaw/.github/actions/restore-e2e-cli-artifact@d2c2b6511e947346289f3d5b1a7a03f3af650339 + uses: NVIDIA/NemoClaw/.github/actions/restore-e2e-cli-artifact@d34b11e8b895760d6505d54e2cfc520332cb2a9c with: provenance-json: ${{ needs.generate-matrix.outputs.cli_artifact_provenance }} - name: Install OpenShell CLI @@ -3047,7 +3047,7 @@ jobs: build-cli: "false" - name: Restore exact-commit CLI artifact - uses: NVIDIA/NemoClaw/.github/actions/restore-e2e-cli-artifact@d2c2b6511e947346289f3d5b1a7a03f3af650339 + uses: NVIDIA/NemoClaw/.github/actions/restore-e2e-cli-artifact@d34b11e8b895760d6505d54e2cfc520332cb2a9c with: provenance-json: ${{ needs.generate-matrix.outputs.cli_artifact_provenance }} - name: Initialize runner comparison telemetry @@ -3111,7 +3111,7 @@ jobs: build-cli: "false" - name: Restore exact-commit CLI artifact - uses: NVIDIA/NemoClaw/.github/actions/restore-e2e-cli-artifact@d2c2b6511e947346289f3d5b1a7a03f3af650339 + uses: NVIDIA/NemoClaw/.github/actions/restore-e2e-cli-artifact@d34b11e8b895760d6505d54e2cfc520332cb2a9c with: provenance-json: ${{ needs.generate-matrix.outputs.cli_artifact_provenance }} @@ -3218,7 +3218,7 @@ jobs: build-cli: "false" - name: Restore exact-commit CLI artifact - uses: NVIDIA/NemoClaw/.github/actions/restore-e2e-cli-artifact@d2c2b6511e947346289f3d5b1a7a03f3af650339 + uses: NVIDIA/NemoClaw/.github/actions/restore-e2e-cli-artifact@d34b11e8b895760d6505d54e2cfc520332cb2a9c with: provenance-json: ${{ needs.generate-matrix.outputs.cli_artifact_provenance }} @@ -3295,7 +3295,7 @@ jobs: build-cli: "false" - name: Restore exact-commit CLI artifact - uses: NVIDIA/NemoClaw/.github/actions/restore-e2e-cli-artifact@d2c2b6511e947346289f3d5b1a7a03f3af650339 + uses: NVIDIA/NemoClaw/.github/actions/restore-e2e-cli-artifact@d34b11e8b895760d6505d54e2cfc520332cb2a9c with: provenance-json: ${{ needs.generate-matrix.outputs.cli_artifact_provenance }} @@ -3361,7 +3361,7 @@ jobs: build-cli: "false" - name: Restore exact-commit CLI artifact - uses: NVIDIA/NemoClaw/.github/actions/restore-e2e-cli-artifact@d2c2b6511e947346289f3d5b1a7a03f3af650339 + uses: NVIDIA/NemoClaw/.github/actions/restore-e2e-cli-artifact@d34b11e8b895760d6505d54e2cfc520332cb2a9c with: provenance-json: ${{ needs.generate-matrix.outputs.cli_artifact_provenance }} @@ -3410,7 +3410,7 @@ jobs: build-cli: "false" - name: Restore exact-commit CLI artifact - uses: NVIDIA/NemoClaw/.github/actions/restore-e2e-cli-artifact@d2c2b6511e947346289f3d5b1a7a03f3af650339 + uses: NVIDIA/NemoClaw/.github/actions/restore-e2e-cli-artifact@d34b11e8b895760d6505d54e2cfc520332cb2a9c with: provenance-json: ${{ needs.generate-matrix.outputs.cli_artifact_provenance }} @@ -3475,7 +3475,7 @@ jobs: build-cli: "false" - name: Restore exact-commit CLI artifact - uses: NVIDIA/NemoClaw/.github/actions/restore-e2e-cli-artifact@d2c2b6511e947346289f3d5b1a7a03f3af650339 + uses: NVIDIA/NemoClaw/.github/actions/restore-e2e-cli-artifact@d34b11e8b895760d6505d54e2cfc520332cb2a9c with: provenance-json: ${{ needs.generate-matrix.outputs.cli_artifact_provenance }} @@ -3557,7 +3557,7 @@ jobs: build-cli: "false" - name: Restore exact-commit CLI artifact - uses: NVIDIA/NemoClaw/.github/actions/restore-e2e-cli-artifact@d2c2b6511e947346289f3d5b1a7a03f3af650339 + uses: NVIDIA/NemoClaw/.github/actions/restore-e2e-cli-artifact@d34b11e8b895760d6505d54e2cfc520332cb2a9c with: provenance-json: ${{ needs.generate-matrix.outputs.cli_artifact_provenance }} @@ -3702,7 +3702,7 @@ jobs: build-cli: "false" - name: Restore exact-commit CLI artifact - uses: NVIDIA/NemoClaw/.github/actions/restore-e2e-cli-artifact@d2c2b6511e947346289f3d5b1a7a03f3af650339 + uses: NVIDIA/NemoClaw/.github/actions/restore-e2e-cli-artifact@d34b11e8b895760d6505d54e2cfc520332cb2a9c with: provenance-json: ${{ needs.generate-matrix.outputs.cli_artifact_provenance }} @@ -3910,7 +3910,7 @@ jobs: build-cli: "false" - name: Restore exact-commit CLI artifact - uses: NVIDIA/NemoClaw/.github/actions/restore-e2e-cli-artifact@d2c2b6511e947346289f3d5b1a7a03f3af650339 + uses: NVIDIA/NemoClaw/.github/actions/restore-e2e-cli-artifact@d34b11e8b895760d6505d54e2cfc520332cb2a9c with: provenance-json: ${{ needs.generate-matrix.outputs.cli_artifact_provenance }} @@ -4000,7 +4000,7 @@ jobs: build-cli: "false" - name: Restore exact-commit CLI artifact - uses: NVIDIA/NemoClaw/.github/actions/restore-e2e-cli-artifact@d2c2b6511e947346289f3d5b1a7a03f3af650339 + uses: NVIDIA/NemoClaw/.github/actions/restore-e2e-cli-artifact@d34b11e8b895760d6505d54e2cfc520332cb2a9c with: provenance-json: ${{ needs.generate-matrix.outputs.cli_artifact_provenance }} @@ -4099,7 +4099,7 @@ jobs: build-cli: "false" - name: Restore exact-commit CLI artifact - uses: NVIDIA/NemoClaw/.github/actions/restore-e2e-cli-artifact@d2c2b6511e947346289f3d5b1a7a03f3af650339 + uses: NVIDIA/NemoClaw/.github/actions/restore-e2e-cli-artifact@d34b11e8b895760d6505d54e2cfc520332cb2a9c with: provenance-json: ${{ needs.generate-matrix.outputs.cli_artifact_provenance }} @@ -4263,7 +4263,7 @@ jobs: build-cli: "false" - name: Restore exact-commit CLI artifact - uses: NVIDIA/NemoClaw/.github/actions/restore-e2e-cli-artifact@d2c2b6511e947346289f3d5b1a7a03f3af650339 + uses: NVIDIA/NemoClaw/.github/actions/restore-e2e-cli-artifact@d34b11e8b895760d6505d54e2cfc520332cb2a9c with: provenance-json: ${{ needs.generate-matrix.outputs.cli_artifact_provenance }} @@ -4322,7 +4322,7 @@ jobs: build-cli: "false" - name: Restore exact-commit CLI artifact - uses: NVIDIA/NemoClaw/.github/actions/restore-e2e-cli-artifact@d2c2b6511e947346289f3d5b1a7a03f3af650339 + uses: NVIDIA/NemoClaw/.github/actions/restore-e2e-cli-artifact@d34b11e8b895760d6505d54e2cfc520332cb2a9c with: provenance-json: ${{ needs.generate-matrix.outputs.cli_artifact_provenance }} @@ -4400,7 +4400,7 @@ jobs: build-cli: "false" - name: Restore exact-commit CLI artifact - uses: NVIDIA/NemoClaw/.github/actions/restore-e2e-cli-artifact@d2c2b6511e947346289f3d5b1a7a03f3af650339 + uses: NVIDIA/NemoClaw/.github/actions/restore-e2e-cli-artifact@d34b11e8b895760d6505d54e2cfc520332cb2a9c with: provenance-json: ${{ needs.generate-matrix.outputs.cli_artifact_provenance }} @@ -4522,7 +4522,7 @@ jobs: build-cli: "false" - name: Restore exact-commit CLI artifact - uses: NVIDIA/NemoClaw/.github/actions/restore-e2e-cli-artifact@d2c2b6511e947346289f3d5b1a7a03f3af650339 + uses: NVIDIA/NemoClaw/.github/actions/restore-e2e-cli-artifact@d34b11e8b895760d6505d54e2cfc520332cb2a9c with: provenance-json: ${{ needs.generate-matrix.outputs.cli_artifact_provenance }} @@ -4638,7 +4638,7 @@ jobs: build-cli: "false" - name: Restore exact-commit CLI artifact - uses: NVIDIA/NemoClaw/.github/actions/restore-e2e-cli-artifact@d2c2b6511e947346289f3d5b1a7a03f3af650339 + uses: NVIDIA/NemoClaw/.github/actions/restore-e2e-cli-artifact@d34b11e8b895760d6505d54e2cfc520332cb2a9c with: provenance-json: ${{ needs.generate-matrix.outputs.cli_artifact_provenance }} @@ -4689,7 +4689,7 @@ jobs: build-cli: "false" - name: Restore exact-commit CLI artifact - uses: NVIDIA/NemoClaw/.github/actions/restore-e2e-cli-artifact@d2c2b6511e947346289f3d5b1a7a03f3af650339 + uses: NVIDIA/NemoClaw/.github/actions/restore-e2e-cli-artifact@d34b11e8b895760d6505d54e2cfc520332cb2a9c with: provenance-json: ${{ needs.generate-matrix.outputs.cli_artifact_provenance }} @@ -4756,7 +4756,7 @@ jobs: build-cli: "false" - name: Restore exact-commit CLI artifact - uses: NVIDIA/NemoClaw/.github/actions/restore-e2e-cli-artifact@d2c2b6511e947346289f3d5b1a7a03f3af650339 + uses: NVIDIA/NemoClaw/.github/actions/restore-e2e-cli-artifact@d34b11e8b895760d6505d54e2cfc520332cb2a9c with: provenance-json: ${{ needs.generate-matrix.outputs.cli_artifact_provenance }} @@ -4841,7 +4841,7 @@ jobs: build-cli: "false" - name: Restore exact-commit CLI artifact - uses: NVIDIA/NemoClaw/.github/actions/restore-e2e-cli-artifact@d2c2b6511e947346289f3d5b1a7a03f3af650339 + uses: NVIDIA/NemoClaw/.github/actions/restore-e2e-cli-artifact@d34b11e8b895760d6505d54e2cfc520332cb2a9c with: provenance-json: ${{ needs.generate-matrix.outputs.cli_artifact_provenance }} @@ -4903,7 +4903,7 @@ jobs: build-cli: "false" - name: Restore exact-commit CLI artifact - uses: NVIDIA/NemoClaw/.github/actions/restore-e2e-cli-artifact@d2c2b6511e947346289f3d5b1a7a03f3af650339 + uses: NVIDIA/NemoClaw/.github/actions/restore-e2e-cli-artifact@d34b11e8b895760d6505d54e2cfc520332cb2a9c with: provenance-json: ${{ needs.generate-matrix.outputs.cli_artifact_provenance }} @@ -4966,7 +4966,7 @@ jobs: build-cli: "false" - name: Restore exact-commit CLI artifact - uses: NVIDIA/NemoClaw/.github/actions/restore-e2e-cli-artifact@d2c2b6511e947346289f3d5b1a7a03f3af650339 + uses: NVIDIA/NemoClaw/.github/actions/restore-e2e-cli-artifact@d34b11e8b895760d6505d54e2cfc520332cb2a9c with: provenance-json: ${{ needs.generate-matrix.outputs.cli_artifact_provenance }} @@ -5028,7 +5028,7 @@ jobs: build-cli: "false" - name: Restore exact-commit CLI artifact - uses: NVIDIA/NemoClaw/.github/actions/restore-e2e-cli-artifact@d2c2b6511e947346289f3d5b1a7a03f3af650339 + uses: NVIDIA/NemoClaw/.github/actions/restore-e2e-cli-artifact@d34b11e8b895760d6505d54e2cfc520332cb2a9c with: provenance-json: ${{ needs.generate-matrix.outputs.cli_artifact_provenance }} @@ -5222,7 +5222,7 @@ jobs: build-cli: "false" - name: Restore exact-commit CLI artifact - uses: NVIDIA/NemoClaw/.github/actions/restore-e2e-cli-artifact@d2c2b6511e947346289f3d5b1a7a03f3af650339 + uses: NVIDIA/NemoClaw/.github/actions/restore-e2e-cli-artifact@d34b11e8b895760d6505d54e2cfc520332cb2a9c with: provenance-json: ${{ needs.generate-matrix.outputs.cli_artifact_provenance }} @@ -5320,7 +5320,7 @@ jobs: build-cli: "false" - name: Restore exact-commit CLI artifact - uses: NVIDIA/NemoClaw/.github/actions/restore-e2e-cli-artifact@d2c2b6511e947346289f3d5b1a7a03f3af650339 + uses: NVIDIA/NemoClaw/.github/actions/restore-e2e-cli-artifact@d34b11e8b895760d6505d54e2cfc520332cb2a9c with: provenance-json: ${{ needs.generate-matrix.outputs.cli_artifact_provenance }} @@ -5381,7 +5381,7 @@ jobs: build-cli: "false" - name: Restore exact-commit CLI artifact - uses: NVIDIA/NemoClaw/.github/actions/restore-e2e-cli-artifact@d2c2b6511e947346289f3d5b1a7a03f3af650339 + uses: NVIDIA/NemoClaw/.github/actions/restore-e2e-cli-artifact@d34b11e8b895760d6505d54e2cfc520332cb2a9c with: provenance-json: ${{ needs.generate-matrix.outputs.cli_artifact_provenance }} @@ -5443,7 +5443,7 @@ jobs: build-cli: "false" - name: Restore exact-commit CLI artifact - uses: NVIDIA/NemoClaw/.github/actions/restore-e2e-cli-artifact@d2c2b6511e947346289f3d5b1a7a03f3af650339 + uses: NVIDIA/NemoClaw/.github/actions/restore-e2e-cli-artifact@d34b11e8b895760d6505d54e2cfc520332cb2a9c with: provenance-json: ${{ needs.generate-matrix.outputs.cli_artifact_provenance }} @@ -5503,7 +5503,7 @@ jobs: build-cli: "false" - name: Restore exact-commit CLI artifact - uses: NVIDIA/NemoClaw/.github/actions/restore-e2e-cli-artifact@d2c2b6511e947346289f3d5b1a7a03f3af650339 + uses: NVIDIA/NemoClaw/.github/actions/restore-e2e-cli-artifact@d34b11e8b895760d6505d54e2cfc520332cb2a9c with: provenance-json: ${{ needs.generate-matrix.outputs.cli_artifact_provenance }} @@ -5562,7 +5562,7 @@ jobs: build-cli: "false" - name: Restore exact-commit CLI artifact - uses: NVIDIA/NemoClaw/.github/actions/restore-e2e-cli-artifact@d2c2b6511e947346289f3d5b1a7a03f3af650339 + uses: NVIDIA/NemoClaw/.github/actions/restore-e2e-cli-artifact@d34b11e8b895760d6505d54e2cfc520332cb2a9c with: provenance-json: ${{ needs.generate-matrix.outputs.cli_artifact_provenance }} @@ -5678,7 +5678,7 @@ jobs: build-cli: "false" - name: Restore exact-commit CLI artifact - uses: NVIDIA/NemoClaw/.github/actions/restore-e2e-cli-artifact@d2c2b6511e947346289f3d5b1a7a03f3af650339 + uses: NVIDIA/NemoClaw/.github/actions/restore-e2e-cli-artifact@d34b11e8b895760d6505d54e2cfc520332cb2a9c with: provenance-json: ${{ needs.generate-matrix.outputs.cli_artifact_provenance }} @@ -5736,7 +5736,7 @@ jobs: build-cli: "false" - name: Restore exact-commit CLI artifact - uses: NVIDIA/NemoClaw/.github/actions/restore-e2e-cli-artifact@d2c2b6511e947346289f3d5b1a7a03f3af650339 + uses: NVIDIA/NemoClaw/.github/actions/restore-e2e-cli-artifact@d34b11e8b895760d6505d54e2cfc520332cb2a9c with: provenance-json: ${{ needs.generate-matrix.outputs.cli_artifact_provenance }} @@ -5848,7 +5848,7 @@ jobs: build-cli: "false" - name: Restore exact-commit CLI artifact - uses: NVIDIA/NemoClaw/.github/actions/restore-e2e-cli-artifact@d2c2b6511e947346289f3d5b1a7a03f3af650339 + uses: NVIDIA/NemoClaw/.github/actions/restore-e2e-cli-artifact@d34b11e8b895760d6505d54e2cfc520332cb2a9c with: provenance-json: ${{ needs.generate-matrix.outputs.cli_artifact_provenance }} @@ -5951,7 +5951,7 @@ jobs: build-cli: "false" - name: Restore exact-commit CLI artifact - uses: NVIDIA/NemoClaw/.github/actions/restore-e2e-cli-artifact@d2c2b6511e947346289f3d5b1a7a03f3af650339 + uses: NVIDIA/NemoClaw/.github/actions/restore-e2e-cli-artifact@d34b11e8b895760d6505d54e2cfc520332cb2a9c with: provenance-json: ${{ needs.generate-matrix.outputs.cli_artifact_provenance }} @@ -6017,7 +6017,7 @@ jobs: build-cli: "false" - name: Restore exact-commit CLI artifact - uses: NVIDIA/NemoClaw/.github/actions/restore-e2e-cli-artifact@d2c2b6511e947346289f3d5b1a7a03f3af650339 + uses: NVIDIA/NemoClaw/.github/actions/restore-e2e-cli-artifact@d34b11e8b895760d6505d54e2cfc520332cb2a9c with: provenance-json: ${{ needs.generate-matrix.outputs.cli_artifact_provenance }} @@ -6089,7 +6089,7 @@ jobs: build-cli: "false" - name: Restore exact-commit CLI artifact - uses: NVIDIA/NemoClaw/.github/actions/restore-e2e-cli-artifact@d2c2b6511e947346289f3d5b1a7a03f3af650339 + uses: NVIDIA/NemoClaw/.github/actions/restore-e2e-cli-artifact@d34b11e8b895760d6505d54e2cfc520332cb2a9c with: provenance-json: ${{ needs.generate-matrix.outputs.cli_artifact_provenance }} @@ -6164,7 +6164,7 @@ jobs: build-cli: "false" - name: Restore exact-commit CLI artifact - uses: NVIDIA/NemoClaw/.github/actions/restore-e2e-cli-artifact@d2c2b6511e947346289f3d5b1a7a03f3af650339 + uses: NVIDIA/NemoClaw/.github/actions/restore-e2e-cli-artifact@d34b11e8b895760d6505d54e2cfc520332cb2a9c with: provenance-json: ${{ needs.generate-matrix.outputs.cli_artifact_provenance }} @@ -6243,7 +6243,7 @@ jobs: build-cli: "false" - name: Restore exact-commit CLI artifact - uses: NVIDIA/NemoClaw/.github/actions/restore-e2e-cli-artifact@d2c2b6511e947346289f3d5b1a7a03f3af650339 + uses: NVIDIA/NemoClaw/.github/actions/restore-e2e-cli-artifact@d34b11e8b895760d6505d54e2cfc520332cb2a9c with: provenance-json: ${{ needs.generate-matrix.outputs.cli_artifact_provenance }} @@ -6312,7 +6312,7 @@ jobs: build-cli: "false" - name: Restore exact-commit CLI artifact - uses: NVIDIA/NemoClaw/.github/actions/restore-e2e-cli-artifact@d2c2b6511e947346289f3d5b1a7a03f3af650339 + uses: NVIDIA/NemoClaw/.github/actions/restore-e2e-cli-artifact@d34b11e8b895760d6505d54e2cfc520332cb2a9c with: provenance-json: ${{ needs.generate-matrix.outputs.cli_artifact_provenance }} @@ -6408,7 +6408,7 @@ jobs: build-cli: "false" - name: Restore exact-commit CLI artifact - uses: NVIDIA/NemoClaw/.github/actions/restore-e2e-cli-artifact@d2c2b6511e947346289f3d5b1a7a03f3af650339 + uses: NVIDIA/NemoClaw/.github/actions/restore-e2e-cli-artifact@d34b11e8b895760d6505d54e2cfc520332cb2a9c with: provenance-json: ${{ needs.generate-matrix.outputs.cli_artifact_provenance }} @@ -6490,7 +6490,7 @@ jobs: build-cli: "false" - name: Restore exact-commit CLI artifact - uses: NVIDIA/NemoClaw/.github/actions/restore-e2e-cli-artifact@d2c2b6511e947346289f3d5b1a7a03f3af650339 + uses: NVIDIA/NemoClaw/.github/actions/restore-e2e-cli-artifact@d34b11e8b895760d6505d54e2cfc520332cb2a9c with: provenance-json: ${{ needs.generate-matrix.outputs.cli_artifact_provenance }} @@ -6545,7 +6545,7 @@ jobs: build-cli: "false" - name: Restore exact-commit CLI artifact - uses: NVIDIA/NemoClaw/.github/actions/restore-e2e-cli-artifact@d2c2b6511e947346289f3d5b1a7a03f3af650339 + uses: NVIDIA/NemoClaw/.github/actions/restore-e2e-cli-artifact@d34b11e8b895760d6505d54e2cfc520332cb2a9c with: provenance-json: ${{ needs.generate-matrix.outputs.cli_artifact_provenance }} @@ -6608,7 +6608,7 @@ jobs: build-cli: "false" - name: Restore exact-commit CLI artifact - uses: NVIDIA/NemoClaw/.github/actions/restore-e2e-cli-artifact@d2c2b6511e947346289f3d5b1a7a03f3af650339 + uses: NVIDIA/NemoClaw/.github/actions/restore-e2e-cli-artifact@d34b11e8b895760d6505d54e2cfc520332cb2a9c with: provenance-json: ${{ needs.generate-matrix.outputs.cli_artifact_provenance }} @@ -6685,7 +6685,7 @@ jobs: build-cli: "false" - name: Restore exact-commit CLI artifact - uses: NVIDIA/NemoClaw/.github/actions/restore-e2e-cli-artifact@d2c2b6511e947346289f3d5b1a7a03f3af650339 + uses: NVIDIA/NemoClaw/.github/actions/restore-e2e-cli-artifact@d34b11e8b895760d6505d54e2cfc520332cb2a9c with: provenance-json: ${{ needs.generate-matrix.outputs.cli_artifact_provenance }} @@ -6785,7 +6785,7 @@ jobs: build-cli: "false" - name: Restore exact-commit CLI artifact - uses: NVIDIA/NemoClaw/.github/actions/restore-e2e-cli-artifact@d2c2b6511e947346289f3d5b1a7a03f3af650339 + uses: NVIDIA/NemoClaw/.github/actions/restore-e2e-cli-artifact@d34b11e8b895760d6505d54e2cfc520332cb2a9c with: provenance-json: ${{ needs.generate-matrix.outputs.cli_artifact_provenance }} @@ -6878,7 +6878,7 @@ jobs: build-cli: "false" - name: Restore exact-commit CLI artifact - uses: NVIDIA/NemoClaw/.github/actions/restore-e2e-cli-artifact@d2c2b6511e947346289f3d5b1a7a03f3af650339 + uses: NVIDIA/NemoClaw/.github/actions/restore-e2e-cli-artifact@d34b11e8b895760d6505d54e2cfc520332cb2a9c with: provenance-json: ${{ needs.generate-matrix.outputs.cli_artifact_provenance }} @@ -6950,7 +6950,7 @@ jobs: build-cli: "false" - name: Restore exact-commit CLI artifact - uses: NVIDIA/NemoClaw/.github/actions/restore-e2e-cli-artifact@d2c2b6511e947346289f3d5b1a7a03f3af650339 + uses: NVIDIA/NemoClaw/.github/actions/restore-e2e-cli-artifact@d34b11e8b895760d6505d54e2cfc520332cb2a9c with: provenance-json: ${{ needs.generate-matrix.outputs.cli_artifact_provenance }} @@ -7015,7 +7015,7 @@ jobs: build-cli: "false" - name: Restore exact-commit CLI artifact - uses: NVIDIA/NemoClaw/.github/actions/restore-e2e-cli-artifact@d2c2b6511e947346289f3d5b1a7a03f3af650339 + uses: NVIDIA/NemoClaw/.github/actions/restore-e2e-cli-artifact@d34b11e8b895760d6505d54e2cfc520332cb2a9c with: provenance-json: ${{ needs.generate-matrix.outputs.cli_artifact_provenance }} @@ -7087,7 +7087,7 @@ jobs: build-cli: "false" - name: Restore exact-commit CLI artifact - uses: NVIDIA/NemoClaw/.github/actions/restore-e2e-cli-artifact@d2c2b6511e947346289f3d5b1a7a03f3af650339 + uses: NVIDIA/NemoClaw/.github/actions/restore-e2e-cli-artifact@d34b11e8b895760d6505d54e2cfc520332cb2a9c with: provenance-json: ${{ needs.generate-matrix.outputs.cli_artifact_provenance }} diff --git a/tools/e2e/cli-artifact-workflow-boundary.mts b/tools/e2e/cli-artifact-workflow-boundary.mts index f6b771bfcb..002a3dc263 100644 --- a/tools/e2e/cli-artifact-workflow-boundary.mts +++ b/tools/e2e/cli-artifact-workflow-boundary.mts @@ -19,7 +19,7 @@ export const CLI_ARTIFACT_DOWNLOAD_ACTION = export const CLI_ARTIFACT_UPLOAD_ACTION = "actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a"; export const CLI_ARTIFACT_RESTORE_ACTION = - "NVIDIA/NemoClaw/.github/actions/restore-e2e-cli-artifact@d2c2b6511e947346289f3d5b1a7a03f3af650339"; + "NVIDIA/NemoClaw/.github/actions/restore-e2e-cli-artifact@d34b11e8b895760d6505d54e2cfc520332cb2a9c"; export const CLI_ARTIFACT_PACKAGE_STEP = "Package exact-commit CLI"; export const CLI_ARTIFACT_PUBLISH_STEP = "Publish content-addressed CLI artifact"; export const CLI_ARTIFACT_RESTORE_STEP = "Restore exact-commit CLI artifact"; @@ -33,7 +33,7 @@ const DEFAULT_RESTORE_ACTION_PATH = join( "action.yaml", ); const RESTORE_ACTION_CONTENT_SHA256 = - "0d03759f9b069c20a2d9fd5c6136a2845c1f5d6c0c5539578f4dfd168163a4eb"; + "f90d4532a64473817b183856e225b401b201d71aaafa75bd7cf8d63a3deeb76f"; const CLI_ARTIFACT_DOWNLOAD_STEP = "Download exact-commit CLI artifact"; const CLI_ARTIFACT_VERIFY_STEP = "Verify and restore exact-commit CLI artifact"; const CLI_ARTIFACT_PROVENANCE_STEP = "Record CLI artifact provenance";