ci: remove node-tar image scans

[cv]

Summary

Removes final-image node-tar scans and retained inventory artifacts that fail after the OpenClaw image defaults to the sandbox user. Existing bundled npm tar pins and remediation remain in each image.

Changes

• Remove build-time and workflow-level node-tar scans from OpenClaw, Hermes, and Deep Agents Code images.
• Remove node-tar inventory uploads and managed-image inventory validation.
• Remove scanner source staging, source-identity inputs, workflow contracts, and scanner tests.
• Preserve bundled npm tar remediation and its ordering contracts.
• Update the security dependency review to describe the remaining remediation boundary.

Type of Change

• Code change (feature, bug fix, or refactor)
• Code change with doc updates
• Doc only (prose changes, no code sample modifications)
• Doc only (includes code sample changes)

Quality Gates

• Tests added or updated for changed behavior
• Existing tests cover changed behavior — justification:
• Tests not applicable — justification:
• Docs updated for user-facing behavior changes
• Docs not applicable — justification:
• Sensitive paths changed (security, policy, credentials, preflight, onboarding, inference, runner, sandbox, or messaging)
• Sensitive-path review completed or maintainer-approved waiver recorded — reviewer/approval link/justification: Maintainer-directed removal accepts the loss of complete-filesystem node-tar detection and retained inventory evidence. Exact npm tar pins, transactional remediation, remediation ordering checks, and package metadata checks remain.
• Non-success, skipped, or missing CI check accepted by maintainer — check name, approval link, and follow-up issue:

Documentation Writer Review

• Documentation writer subagent reviewed the completed changes
• Result: docs-updated
• Evidence: Updated docs/security/sandbox-base-2026-07-25-dependency-review.md. The documented removal matches the Dockerfiles, image workflows, and contract tests. Final-image npm remediation remains for OpenClaw, Hermes, and LangChain Deep Agents Code.
• Agent: Pi CLI

DGX Station Hardware Evidence

• Tested on DGX Station
• Tested commit:
• Station profile/scenario:
• Result:
• Supporting evidence:

Verification

• PR description includes a Signed-off-by: line and every commit appears as Verified in GitHub
• Normal pre-commit, commit-msg, and pre-push hooks passed, or npm run validate:pr passed after refreshing origin/main when hooks were skipped or unavailable
• Targeted behavior tests pass for the current change set, or tests are marked not applicable above — 13 focused files passed 237 tests; the formatted npm remediation contract passed 13 tests; the final workflow contract passed 42 tests; npm run typecheck:cli, npm run checks:repository, and npm run docs passed.
• Applicable broad gate passed — npm test for broad runtime/test-harness changes; npm run check for repo-wide validation/coverage changes — command/result: The pre-commit stage passed. The local manual full-coverage stage did not finish and was stopped at maintainer direction. GitHub CI owns the broad result.
• Quality Gates section completed with required justifications or waivers
• No secrets, API keys, or credentials committed
• npm run docs builds without warnings (doc changes only)
• Doc pages follow the style guide (doc changes only)
• New doc pages include SPDX header and frontmatter (new pages only)

---

Signed-off-by: Carlos Villela cvillela@nvidia.com

Summary by CodeRabbit

• Bug Fixes

  • Updated container image validation to rely on final-stage dependency remediation and essential filesystem checks.
  • Removed outdated image inventory requirements from managed-image publication and verification.

• Refactor

  • Simplified image build and validation workflows by removing the legacy Node.js package scan and inventory artifact.

• Documentation

  • Updated security review guidance and verification requirements to reflect the revised image validation process.

• Tests

  • Updated image layout, workflow, build-context, and lifecycle checks for the streamlined validation flow.

[coderabbitai]

📝 Walkthrough

Walkthrough

The change removes node-tar image scanning, inventory generation, workflow enforcement, and related staging. Final-image checks, npm remediation validation, tests, and security documentation are updated to reflect the new validation flow.

Changes

Node-tar scanning removal

Layer / File(s)	Summary
Remove scanner contracts and staging src/lib/onboard/..., src/lib/sandbox/..., test/sandbox-build-context.test.ts	Build contexts, source identity, onboarding validation, and canonical instruction handling no longer reference the scanner.
Remove image scan gates Dockerfile*, agents/hermes/Dockerfile*, agents/langchain-deepagents-code/Dockerfile*	Image builds no longer copy or run the scanner or generate node-tar-inventory.json. Other metadata and file checks remain.
Remove workflow scan enforcement .github/workflows/..., tools/e2e/sandbox-images-workflow-boundary.mts	Image workflows stop running scans and uploading inventories. Workflow validation removes scan contracts and checks.
Update tests and dependency review test/..., docs/security/...	Tests remove scanner and inventory expectations. The dependency review documents final-stage npm remediation checks.

Estimated code review effort: 3 (Moderate) | ~25 minutes

Possibly related PRs

• NVIDIA/NemoClaw#7332: Introduced the node-tar scanning, inventory generation, workflow validation, and staging removed here.

Suggested labels: area: security, area: packaging

Suggested reviewers: apurvvkumaria, jyaunches, prekshivyas

🚥 Pre-merge checks | ✅ 4 | ❌ 1

❌ Failed checks (1 warning)

Check name	Status	Explanation	Resolution
Docstring Coverage	⚠️ Warning	Docstring coverage is 0.00% which is insufficient. The required threshold is 80.00%.	Write docstrings for the functions missing them to satisfy the coverage threshold.

✅ Passed checks (4 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly and concisely describes the primary change: removing node-tar image scans from CI and image builds.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

✨ Finishing Touches 💡 1

📝 Generate docstrings 💡

• Create stacked PR
• Commit on current branch

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch ci/remove-node-tar-image-scan

---

_{Comment @coderabbitai help to get the list of available commands.}

[github-code-quality]

Code Coverage Overview

Languages: TypeScript

TypeScript / code-coverage/plugin

The overall coverage in commit 75fc1cf in the ci/remove-node-tar-i... branch remains at 96%, unchanged from commit a816474 in the main branch.

[github-actions]

🌿 Preview your docs: https://nvidia-preview-pr-8628.docs.buildwithfern.com/nemoclaw

[coderabbitai]

🧹 Nitpick comments (1)

src/lib/onboard/dockerfile-remote-dashboard-bind-contract.ts (1)

59-59: 🗄️ Data Integrity & Integration | 🔵 Trivial | ⚡ Quick win

Add normalized digest contract coverage.

a619aead6cdf253dc7bf4504267e6b1d724fed672597072394b7400c08f81fd0 matches the normalized instruction at Dockerfile:1860; keep the digest unchanged. Add tests for hasRemoteDashboardBindGenerationContract() that accept the canonical instruction and reject it with an appended rewrite command.

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@src/lib/onboard/dockerfile-remote-dashboard-bind-contract.ts` at line 59,
Keep the digest in the Dockerfile bind contract unchanged, and add coverage for
hasRemoteDashboardBindGenerationContract() using the canonical normalized
instruction. Verify the contract is accepted as-is and rejected when an appended
rewrite command is present.

Source: Learnings

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Nitpick comments:
In `@src/lib/onboard/dockerfile-remote-dashboard-bind-contract.ts`:
- Line 59: Keep the digest in the Dockerfile bind contract unchanged, and add
coverage for hasRemoteDashboardBindGenerationContract() using the canonical
normalized instruction. Verify the contract is accepted as-is and rejected when
an appended rewrite command is present.

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Enterprise

Run ID: 9dd5fa84-572d-4f7a-86cc-abba1acae130

📥 Commits

Reviewing files that changed from the base of the PR and between a816474 and 75fc1cf.

📒 Files selected for processing (24)

• .github/workflows/base-image.yaml
• .github/workflows/managed-images.yaml
• .github/workflows/sandbox-images-and-e2e.yaml
• Dockerfile
• Dockerfile.base
• agents/hermes/Dockerfile
• agents/hermes/Dockerfile.base
• agents/langchain-deepagents-code/Dockerfile
• agents/langchain-deepagents-code/Dockerfile.base
• docs/security/sandbox-base-2026-07-25-dependency-review.md
• scripts/checks/node-tar-image-scan.mts
• src/lib/onboard/dockerfile-remote-dashboard-bind-contract.ts
• src/lib/sandbox-base-image/source-identity.test.ts
• src/lib/sandbox-base-image/source-identity.ts
• src/lib/sandbox/build-context.ts
• test/dashboard-remote-bind-lifecycle.test.ts
• test/e2e/support/sandbox-images-workflow-boundary.test.ts
• test/hermes-final-image-layout.test.ts
• test/managed-image-publication-workflow.test.ts
• test/node-tar-dockerfile-contract.test.ts
• test/node-tar-image-scan.test.ts
• test/openclaw-final-image-layout.test.ts
• test/sandbox-build-context.test.ts
• tools/e2e/sandbox-images-workflow-boundary.mts

💤 Files with no reviewable changes (13)

• .github/workflows/base-image.yaml
• agents/langchain-deepagents-code/Dockerfile.base
• Dockerfile.base
• test/managed-image-publication-workflow.test.ts
• src/lib/sandbox-base-image/source-identity.ts
• scripts/checks/node-tar-image-scan.mts
• .github/workflows/sandbox-images-and-e2e.yaml
• src/lib/sandbox-base-image/source-identity.test.ts
• test/openclaw-final-image-layout.test.ts
• .github/workflows/managed-images.yaml
• src/lib/sandbox/build-context.ts
• test/sandbox-build-context.test.ts
• test/node-tar-image-scan.test.ts

[github-actions]

PR Review Advisor — No blocking findings reported

Advisor assessment: No blocking advisor findings reported
Next action: Review the warnings below.
Findings: 0 blockers · 1 warning · 0 suggestions

Model lanes

• GPT-5.6 Terra (primary): Completed · high confidence · 0 blockers · 1 warning · 0 suggestions
• Nemotron 3 Ultra (second opinion): Failed after a partial review · low confidence · 0 blockers · 0 warnings · 1 suggestion

Second-opinion terminology and E2E selections are advisory. Live E2E does not run automatically for pull requests.

3 semantic terminology decisions

Terminology decisions are advisory. They affect the assessment only when a separate finding identifies concrete semantic impact.

• define — bundled npm dependency boundary at docs/security/sandbox-base-2026-07-25-dependency-review.md:111: Define the term at first use as the npm private-tree boundary, distinct from the complete image filesystem.
• justified — complete image filesystem at docs/security/sandbox-base-2026-07-25-dependency-review.md:112: Retain the term to distinguish the removed scan scope from bundled npm remediation.
• justified — node-tar inventory artifact at docs/security/sandbox-base-2026-07-25-dependency-review.md:113: Retain the term to identify the removed retained evidence precisely.

E2E guidance

Advisory only. A maintainer can dispatch the default E2E suite against this exact revision.

Recommended E2E: cloud-inference, cloud-onboard, full-e2e, hermes-e2e, hermes-inference-switch, managed-image-multiarch-startup, security-posture, onboard-repair, onboard-resume, ubuntu-repo-cloud-langchain-deepagents-code

1 warning · 0 suggestions

Warnings

Warnings do not block.

PRA-1 Warning — Restore completed-image tar dependency verification

• Location: docs/security/sandbox-base-2026-07-25-dependency-review.md:112
• Category: security
• Problem: The change removes completed-image discovery of node_modules/tar packages and the retained inventory evidence. The remaining helper verifies only npm's private tar path.
• Impact: An affected tar copy added by an agent install or another image layer can ship without a build, workflow, publication, or retained-evidence failure.
• Recommendation: Retain or replace the completed-image control with an isolated, read-only scan that rejects every affected installed tar package and records evidence for each shipped image and architecture.
• Verification: Inspect the completed-image qualification path and verify that it fails when a non-npm node_modules/tar package below 7.5.19 is present.
• Test coverage: Add a completed-image negative test that adds an affected non-npm tar package and asserts that the image qualification control rejects the image.
• Evidence: docs/security/sandbox-base-2026-07-25-dependency-review.md:112-113 states that complete-image scanning and inventory artifacts are removed. scripts/patch-bundled-npm-tar.mts:111-145 inspects only the supplied npm root and its node_modules/tar path. scripts/checks/node-tar-image-scan.mts and test/node-tar-image-scan.test.ts are deleted. test/node-tar-dockerfile-contract.test.ts now verifies remediation order without completed-image discovery.

Workflow run details

This automated review informs maintainers. Warnings and suggestions do not require a response. A maintainer decides whether to merge.