From c63596f083946b0151184af4b2d6f7d8b2439bf5 Mon Sep 17 00:00:00 2001 From: Prekshi Vyas Date: Thu, 6 Aug 2026 20:54:29 -0700 Subject: [PATCH 1/2] fix(e2e): keep main pushes outside PR risk signals Signed-off-by: Prekshi Vyas --- .github/workflows/e2e.yaml | 4 ++-- .../llama-cpp-dgx-spark-qualification-workflow-boundary.mts | 2 +- tools/e2e/managed-image-multiarch-workflow-boundary.mts | 2 +- 3 files changed, 4 insertions(+), 4 deletions(-) diff --git a/.github/workflows/e2e.yaml b/.github/workflows/e2e.yaml index 1c0e06319fd..c99266f4806 100644 --- a/.github/workflows/e2e.yaml +++ b/.github/workflows/e2e.yaml @@ -1970,7 +1970,7 @@ jobs: E2E_JOB: "1" E2E_TARGET_ID: "managed-image-multiarch-startup" RELEASE_E2E_ACTIVATION_PATH: ci/protected-managed-image-multiarch-activation-v1.json - NEMOCLAW_E2E_EXPECTED_SHA: ${{ inputs.checkout_sha || github.sha }} + NEMOCLAW_E2E_EXPECTED_SHA: ${{ inputs.checkout_sha }} NEMOCLAW_E2E_SHARD: ${{ matrix.shard }} NEMOCLAW_PROTECTED_MANAGED_IMAGE_BASE_SHA: ${{ inputs.base_sha || github.event.before || github.sha }} NEMOCLAW_PROTECTED_MANAGED_IMAGE_BUILD_CACHE: ${{ github.workspace }}/.protected-managed-image-build-cache/${{ matrix.shard }} @@ -2389,7 +2389,7 @@ jobs: E2E_ARTIFACT_DIR: ${{ github.workspace }}/e2e-artifacts/live/llama-cpp-dgx-spark-qualification E2E_JOB: "1" E2E_TARGET_ID: "llama-cpp-dgx-spark-qualification" - NEMOCLAW_E2E_EXPECTED_SHA: ${{ inputs.checkout_sha || github.sha }} + NEMOCLAW_E2E_EXPECTED_SHA: ${{ inputs.checkout_sha }} NEMOCLAW_E2E_SHARD: linux-arm64-gpu-dgx-spark-gb10 NEMOCLAW_LLAMA_CPP_QUALIFICATION_BASE_SHA: ${{ inputs.base_sha || github.event.before || github.sha }} NEMOCLAW_LLAMA_CPP_QUALIFICATION_CANDIDATE_ROOT: ${{ github.workspace }}/.candidate-llama-cpp diff --git a/tools/e2e/llama-cpp-dgx-spark-qualification-workflow-boundary.mts b/tools/e2e/llama-cpp-dgx-spark-qualification-workflow-boundary.mts index 6d182cdc56f..3ad47c4a5d4 100644 --- a/tools/e2e/llama-cpp-dgx-spark-qualification-workflow-boundary.mts +++ b/tools/e2e/llama-cpp-dgx-spark-qualification-workflow-boundary.mts @@ -223,7 +223,7 @@ export function validateLlamaCppDgxSparkQualificationWorkflow(workflow: RecordVa E2E_JOB: "1", E2E_TARGET_ID: LLAMA_CPP_DGX_SPARK_QUALIFICATION_JOB_ID, RELEASE_E2E_ACTIVATION_PATH: LLAMA_CPP_DGX_SPARK_QUALIFICATION_ACTIVATION_PATH, - NEMOCLAW_E2E_EXPECTED_SHA: "${{ inputs.checkout_sha || github.sha }}", + NEMOCLAW_E2E_EXPECTED_SHA: "${{ inputs.checkout_sha }}", NEMOCLAW_LLAMA_CPP_QUALIFICATION_BASE_SHA: "${{ inputs.base_sha || github.event.before || github.sha }}", NEMOCLAW_LLAMA_CPP_QUALIFICATION_PLAN: diff --git a/tools/e2e/managed-image-multiarch-workflow-boundary.mts b/tools/e2e/managed-image-multiarch-workflow-boundary.mts index 54f2ad07312..39c77ea3e0c 100644 --- a/tools/e2e/managed-image-multiarch-workflow-boundary.mts +++ b/tools/e2e/managed-image-multiarch-workflow-boundary.mts @@ -147,7 +147,7 @@ export function validateManagedImageMultiarchWorkflow(workflow: WorkflowRecord): "${{ github.workspace }}/e2e-artifacts/live/managed-image-multiarch-startup/${{ matrix.shard }}", E2E_JOB: "1", E2E_TARGET_ID: JOB_ID, - NEMOCLAW_E2E_EXPECTED_SHA: "${{ inputs.checkout_sha || github.sha }}", + NEMOCLAW_E2E_EXPECTED_SHA: "${{ inputs.checkout_sha }}", NEMOCLAW_E2E_SHARD: "${{ matrix.shard }}", NEMOCLAW_PROTECTED_MANAGED_IMAGE_BASE_SHA: "${{ inputs.base_sha || github.event.before || github.sha }}", From 25e7fa8dd85fb58fb7af65fe77c800c8fcb6a3d5 Mon Sep 17 00:00:00 2001 From: Prekshi Vyas Date: Thu, 6 Aug 2026 21:12:01 -0700 Subject: [PATCH 2/2] test(e2e): reject main-push PR risk metadata Signed-off-by: Prekshi Vyas --- .../llama-cpp-dgx-spark-qualification-workflow.test.ts | 10 ++++++++++ .../managed-image-protected-runtime-workflow.test.ts | 10 ++++++++++ 2 files changed, 20 insertions(+) diff --git a/test/e2e/support/llama-cpp-dgx-spark-qualification-workflow.test.ts b/test/e2e/support/llama-cpp-dgx-spark-qualification-workflow.test.ts index 23153984c42..37678598264 100644 --- a/test/e2e/support/llama-cpp-dgx-spark-qualification-workflow.test.ts +++ b/test/e2e/support/llama-cpp-dgx-spark-qualification-workflow.test.ts @@ -37,6 +37,16 @@ describe("llama.cpp DGX Spark qualification workflow boundary (#8260)", () => { expect(validateLlamaCppDgxSparkQualificationWorkflow(workflow())).toEqual([]); }); + it("does not record manual PR risk signals on main pushes", () => { + const value = workflow(); + const jobEnv = job(value, "llama-cpp-dgx-spark-qualification").env as Record; + jobEnv.NEMOCLAW_E2E_EXPECTED_SHA = "${{ inputs.checkout_sha || github.sha }}"; + + expect(validateLlamaCppDgxSparkQualificationWorkflow(value)).toContain( + "llama-cpp-dgx-spark-qualification env must bind NEMOCLAW_E2E_EXPECTED_SHA to ${{ inputs.checkout_sha }}", + ); + }); + it("rejects bypassing the declarative protected-runner plan", () => { const value = workflow(); job(value, "llama-cpp-dgx-spark-qualification")["runs-on"] = "self-hosted"; diff --git a/test/e2e/support/managed-image-protected-runtime-workflow.test.ts b/test/e2e/support/managed-image-protected-runtime-workflow.test.ts index baf901f51c0..6fe2b8c9e23 100644 --- a/test/e2e/support/managed-image-protected-runtime-workflow.test.ts +++ b/test/e2e/support/managed-image-protected-runtime-workflow.test.ts @@ -50,6 +50,16 @@ describe("protected managed-image runtime workflow boundary", () => { expect(validateManagedImageProtectedRuntimeWorkflow(value)).toEqual([]); }); + it("does not record manual PR risk signals on main pushes", () => { + const value = workflow(); + const jobEnv = multiarchJob(value).env as Record; + jobEnv.NEMOCLAW_E2E_EXPECTED_SHA = "${{ inputs.checkout_sha || github.sha }}"; + + expect(validateManagedImageMultiarchWorkflow(value)).toContain( + "managed-image-multiarch-startup env must bind NEMOCLAW_E2E_EXPECTED_SHA to ${{ inputs.checkout_sha }}", + ); + }); + it("ships the exact activation contract consumed by the trusted lane (#7744)", () => { const activation = JSON.parse( fs.readFileSync(