fix(e2e): extend Docker Hub login retries

[jyaunches]

Summary

The linked Slack E2E never reached the test because one runner exhausted the shared three-attempt Docker Hub authentication budget during a transient registry connectivity stall. This change gives the shared login path five bounded attempts while preserving credential isolation, immutable provenance, and fail-closed behavior.

Changes

• Extend Docker Hub authentication from three to five bounded attempts in the shared E2E helper and the equivalent sandbox-image workflow path.
• Pin the E2E workflow to the signed helper commit and update the enforced action, helper, and workflow provenance hashes.
• Add regression coverage for recovery on attempts four and five, five-attempt exhaustion, exact sleep counts, and opaque-input changed-test routing.

Failure evidence: E2E run 31428738562, OpenClaw Slack pairing job 93595566444.

Type of Change

• Code change (feature, bug fix, or refactor)
• Code change with doc updates
• Doc only (prose changes, no code sample modifications)
• Doc only (includes code sample changes)

Quality Gates

• Tests added or updated for changed behavior
• Existing tests cover changed behavior — justification:
• Tests not applicable — justification:
• Docs updated for user-facing behavior changes
• Docs not applicable — justification: This changes an internal CI authentication retry budget; it does not change a public API, CLI, configuration, onboarding flow, UI, or supported runtime behavior, and existing docs do not define the retry count.
• Sensitive paths changed (security, policy, credentials, preflight, onboarding, inference, runner, sandbox, or messaging)
• Sensitive-path review completed or maintainer-approved waiver recorded — reviewer/approval link/justification: Independent Codex security review passed all nine required categories with no findings; trusted-run gating, stdin-only token transfer, isolated Docker config, immutable pinning, bounded timeouts, cleanup, and fail-closed behavior remain intact.
• Non-success, skipped, or missing CI check accepted by maintainer — check name, approval link, and follow-up issue:

Documentation Writer Review

• Documentation writer subagent reviewed the completed changes
• Result: no-docs-needed
• Evidence: Internal CI Docker Hub authentication retry and regression-contract updates only; no public or supported user-facing behavior changed, and existing documentation does not define the retry budget.
• Agent: Codex Desktop

Verification

• PR description includes a Signed-off-by: line and every commit appears as Verified in GitHub
• Normal pre-commit, commit-msg, and pre-push hooks passed, or npm run validate:pr passed after refreshing origin/main when hooks were skipped or unavailable
• Targeted behavior tests pass for the current change set, or tests are marked not applicable above — 94/94 focused E2E-support boundary tests, 5/5 watch-trigger integration tests, 500/500 affected tests, and the final 12/12 Docker-auth rerun passed.
• Applicable broad gate passed — npm test for broad runtime/test-harness changes; npm run check for repo-wide validation/coverage changes — command/result:
• Quality Gates section completed with required justifications or waivers
• No secrets, API keys, or credentials committed
• npm run docs builds without warnings (doc changes only)
• Doc pages follow the style guide (doc changes only)
• New doc pages include SPDX header and frontmatter (new pages only)

---

Signed-off-by: Julie Yaunches jyaunches@nvidia.com

Summary by CodeRabbit

• Bug Fixes

  • Improved Docker Hub authentication reliability by retrying failed logins up to five times with five-second delays.
  • Enhanced warning and error messages to clearly report retry settings.

• Tests

  • Expanded end-to-end coverage for authentication retries and workflow validation.
  • Added monitoring so relevant workflow and authentication changes trigger the appropriate tests.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Enterprise

Run ID: d53ee2fc-e128-442b-906b-fb0b60c0dc22

📥 Commits

Reviewing files that changed from the base of the PR and between 3362694 and 9499c8c.

📒 Files selected for processing (1)

• test/e2e/support/dockerhub-auth-workflow-boundary.test.ts

---

📝 Walkthrough

Walkthrough

Docker Hub authentication now retries five times with five-second delays. Workflows, provenance checks, boundary tests, and Vitest watch triggers use the updated contract. The CLI artifact workflow boundary hash is also updated.

Changes

Docker authentication retry

Layer / File(s)	Summary
Retry behavior and workflow wiring .github/scripts/docker-auth-setup.sh, .github/workflows/sandbox-images-and-e2e.yaml, .github/workflows/e2e.yaml	Authentication uses five attempts, five-second delays, and dynamic retry messages. The E2E workflow uses the updated action revision.
Boundary validation and provenance test/e2e/support/dockerhub-auth-workflow-boundary.test.ts, tools/e2e/sandbox-images-workflow-boundary.mts, tools/e2e/workflow-boundary-policy.mts	Tests validate retry counts, delays, tokens, and failure messages. Boundary requirements and action provenance use the updated contract.
Watch-trigger coverage test/helpers/vitest-watch-triggers.ts, test/vitest-watch-triggers.test.ts	Watch mappings and tests cover Docker authentication and sandbox-images workflow changes.

CLI workflow contract refresh

Layer / File(s)	Summary
CLI artifact contract hash tools/e2e/cli-artifact-workflow-boundary.mts	The expected CLI artifact workflow contract SHA-256 digest is updated.

Estimated code review effort: 3 (Moderate) | ~20 minutes

Sequence Diagram(s)

sequenceDiagram
  participant E2EWorkflow
  participant DockerAuthSetup
  participant DockerHub
  E2EWorkflow->>DockerAuthSetup: invoke authentication action
  DockerAuthSetup->>DockerHub: submit login token
  DockerHub-->>DockerAuthSetup: return authentication result
  DockerAuthSetup->>DockerAuthSetup: wait five seconds before retry

Loading

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly and concisely describes the main change: extending Docker Hub login retries in E2E workflows.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

✨ Finishing Touches

📝 Generate docstrings

• Create stacked PR
• Commit on current branch

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch codex/fix-e2e-docker-auth-timeout

---

_{Comment @coderabbitai help to get the list of available commands.}

[github-code-quality]

Code Coverage Overview

Languages: TypeScript

TypeScript / code-coverage/plugin

The overall coverage in commit 9499c8c in the codex/fix-e2e-docker... branch remains at 96%, unchanged from commit 567a033 in the main branch.

TypeScript / code-coverage/cli

The overall coverage in commit 9499c8c in the codex/fix-e2e-docker... branch remains at 82%, unchanged from commit 567a033 in the main branch.

Show a code coverage summary of the most impacted files.

File	main 567a033	codex/fix-e2e-docker... 9499c8c	+/-
src/lib/messagi...annel-config.ts	99%	95%	-4%
src/lib/sandbox...rce-identity.ts	86%	86%	0%
src/lib/tunnel/services.ts	80%	80%	0%
src/lib/adapter...shell/client.ts	88%	90%	+2%
src/lib/core/bo...e-transcript.ts	93%	97%	+4%

---

_{Updated August 10, 2026 22:41 UTC}

[coderabbitai]

Actionable comments posted: 1

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In `@test/e2e/support/dockerhub-auth-workflow-boundary.test.ts`:
- Around line 514-546: Add a separate runAuth recovery case with successAttempt:
5 in the test covering Docker Hub authentication retries. Assert status 0, five
Docker calls, five token writes, and four sleep entries, while preserving the
existing attempt-four recovery and exhaustion assertions.

🪄 Autofix

Fix all unresolved CodeRabbit comments on this PR:

• Push a commit to this branch (recommended)
• Create a new PR with the fixes

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Enterprise

Run ID: b9ee2bd5-60f4-414f-9358-ce7932deb874

📥 Commits

Reviewing files that changed from the base of the PR and between 567a033 and 3362694.

📒 Files selected for processing (9)

• .github/scripts/docker-auth-setup.sh
• .github/workflows/e2e.yaml
• .github/workflows/sandbox-images-and-e2e.yaml
• test/e2e/support/dockerhub-auth-workflow-boundary.test.ts
• test/helpers/vitest-watch-triggers.ts
• test/vitest-watch-triggers.test.ts
• tools/e2e/cli-artifact-workflow-boundary.mts
• tools/e2e/sandbox-images-workflow-boundary.mts
• tools/e2e/workflow-boundary-policy.mts

[github-actions]

PR Review Advisor — No blocking findings reported

Advisor assessment: No blocking advisor findings reported
Next action: No advisor follow-up needed.
Findings: 0 blockers · 0 warnings · 0 suggestions

Model lanes

• GPT-5.6 Terra (primary): Completed · high confidence · 0 blockers · 0 warnings · 0 suggestions
• Nemotron 3 Ultra (second opinion): Failed after a partial review · low confidence · 0 blockers · 0 warnings · 0 suggestions

Second-opinion terminology and E2E selections are advisory. Live E2E does not run automatically for pull requests.

E2E guidance

Advisory only. A maintainer can dispatch the default E2E suite against this exact revision.

Recommended E2E: cloud-inference, cloud-onboard, security-posture

Workflow run details

This automated review informs maintainers. Warnings and suggestions do not require a response. A maintainer decides whether to merge.

[jyaunches]

Live E2E evidence: trusted main push run 31437795324 at 567a033 completed the OpenClaw Slack pairing job successfully: https://github.com/NVIDIA/NemoClaw/actions/runs/31437795324/job/93623045829. Docker Hub authentication, the live pairing test, artifact upload, and Docker-auth cleanup all passed. This trusted-main run still uses the pre-PR three-attempt helper, so it confirms the original auth failure was transient and that the previously skipped Slack test is green. The PR retry change itself is covered by the five-attempt boundary tests and can exercise authenticated live behavior only after merge, because manual PR E2E intentionally disables Docker Hub credentials.