ci: remove full E2E PR merge gate - #8625
Conversation
Signed-off-by: Aaron Erickson <aerickson@nvidia.com>
📝 WalkthroughWalkthroughThe installer hash workflow now uses read-only contents access, a five-minute timeout, and a minimal sparse checkout. OpenShell E2E qualification is removed. Contract tests verify installer hash independence and the updated security description. ChangesInstaller hash workflow isolation
Estimated code review effort: 2 (Simple) | ~10 minutes Possibly related PRs
Suggested reviewers: 🚥 Pre-merge checks | ✅ 5✅ Passed checks (5 passed)
✨ Finishing Touches 💡 1🛠️ Fix failing CI checks 💡
📝 Generate docstrings
🧪 Generate unit tests (beta)
Comment |
Code Coverage OverviewLanguages: TypeScript TypeScript / code-coverage/pluginThe overall coverage in commit 2ccf849 in the TypeScript / code-coverage/cliThe overall coverage in commit 2ccf849 in the Show a code coverage summary of the most impacted files.
Updated |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 2
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In `@test/openshell-e2e-qualification-workflow.test.ts`:
- Around line 31-45: Extend the workflow assertions around requiredWorkflowStep
and sparseCheckout to verify workflow.jobs["check-hash"]["timeout-minutes"]
equals 5, and assert the immutable bootstrap checkout’s sparse-checkout list
alongside the existing base-trusted list. Preserve exact path-list expectations
for both trusted checkout steps.
- Line 15: Expand the InstallerHashAction contract assertions to cover
check-hash.timeout-minutes and the immutable bootstrap checkout and sparse
paths, using the existing workflow validation patterns and preserving the
current installer hash checks.
🪄 Autofix
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Path: .coderabbit.yaml
Review profile: CHILL
Plan: Enterprise
Run ID: 1aee2332-5429-4300-be4c-6da9a35c8693
📒 Files selected for processing (4)
.github/actions/ci-installer-hash-check/action.yaml.github/workflows/installer-hash-check.yamlci/source-shape-test-budget.jsontest/openshell-e2e-qualification-workflow.test.ts
💤 Files with no reviewable changes (1)
- .github/actions/ci-installer-hash-check/action.yaml
Signed-off-by: Aaron Erickson <aerickson@nvidia.com>
PR Review Advisor — No blocking findings reportedAdvisor assessment: No blocking advisor findings reported Model lanes
3 terminology differences from the second opinionAdvisory only. These are normalized differences from the primary terminology receipt.
Second-opinion terminology and E2E selections are advisory. Live E2E does not run automatically for pull requests. 2 semantic terminology decisionsTerminology decisions are advisory. They affect the assessment only when a separate finding identifies concrete semantic impact.
E2E guidanceAdvisory only. A maintainer can dispatch the default E2E suite against this exact revision. Recommended E2E: None This automated review informs maintainers. Warnings and suggestions do not require a response. A maintainer decides whether to merge. |
Signed-off-by: Aaron Erickson <aerickson@nvidia.com>
2 participants
Summary
Restores the installer hash check to its installer-integrity scope. Pull requests no longer require the full default E2E matrix to complete before merge; targeted, protected, and release E2E workflows remain available independently.
Changes
Type of Change
Quality Gates
Documentation Writer Review
no-docs-neededDGX Station Hardware Evidence
Verification
Signed-off-by:line and every commit appears asVerifiedin GitHubpre-commit,commit-msg, andpre-pushhooks passed, ornpm run validate:prpassed after refreshingorigin/mainwhen hooks were skipped or unavailablenpx vitest run --project integration test/openshell-e2e-qualification-workflow.test.ts test/pr-workflow-contract.test.ts test/openshell-e2e-qualification.test.ts --coverage=false(41 passed);npm run source-shape:check;npm run typecheck:cli; and Biome check passed.npm testfor broad runtime/test-harness changes;npm run checkfor repo-wide validation/coverage changes — command/result:npm run docsbuilds without warnings (doc changes only)Signed-off-by: Aaron Erickson aerickson@nvidia.com
Summary by CodeRabbit
Security
Reliability