[prekshivyas]

Outcome

Publish base and managed images after the root package manifest or lockfile changes. Downstream PR gates can then use publication evidence built from the dependency graph on main.

Reason

PR #11264 updated the root dependency graph, but the base-image workflow did not run because its push.paths list omitted the root package files. As a result, PR #11098 still sees the earlier failed publication instead of a new audited publication from main.

Related issues

Unblocks #11098.
Relates to #11264.

Changes

• Add package.json and package-lock.json to the base-image workflow's exact push paths.
• Add a regression test that reads the checked-in workflow and proves that either root package file selects publication.
• Keep the existing push-only publication evidence boundary unchanged. A manual dispatch is insufficient because the downstream verifier accepts trusted push runs from main.

Verification

• npx vitest run --project e2e-support test/e2e/support/base-image-publication.test.ts --reporter=dot — passed, 62 tests.
• npm run format:check — passed.
• npm run test:titles:check — passed.
• npm run build:cli — passed.
• npm --prefix nemoclaw run build — passed.
• npm run validate:pr — passed.
• git diff --check and manual diff review — passed; the diff contains no secrets, API keys, or credentials.

Review notes

This changes the sensitive workflow path .github/workflows/base-image.yaml in NVIDIA/NemoClaw at commit efd8d768676feeac545b6ab4140590e16cfacf6e. Author self-review and the focused workflow contract test found no change to permissions, credentials, job code, or publication trust boundaries. No independent pre-publication review is verified; this draft awaits independent review.

---

Signed-off-by: Prekshi Vyas prekshiv@nvidia.com

Summary by CodeRabbit

• Bug Fixes

  • Base image publication workflows now trigger when the root package manifest or lockfile changes.

• Tests

  • Added coverage to verify that changes to these package files correctly trigger base image publication.

[copy-pr-bot]

Auto-sync is disabled for draft pull requests in this repository. Workflows must be run manually.

Contributors can view more details about this message here.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Enterprise

Run ID: 1f2e979c-8dc9-415e-b69c-2a83fdbdb700

📥 Commits

Reviewing files that changed from the base of the PR and between de7f565 and efd8d76.

📒 Files selected for processing (2)

• .github/workflows/base-image.yaml
• test/e2e/support/base-image-publication.test.ts

Included review availability: Your plan provides up to 12 included reviews per hour; 8 remain after this review.

---

📝 Walkthrough

Walkthrough

The base-image workflow now triggers for root package.json and package-lock.json changes. End-to-end coverage verifies that both paths are treated as base-image publication inputs.

Changes

Base image publication

Layer / File(s)	Summary
Publication input detection .github/workflows/base-image.yaml, test/e2e/support/base-image-publication.test.ts	The workflow reviews root package manifests. The end-to-end test verifies that both manifest paths trigger base-image publication.

Priority: ⬇️ Low

Estimated code review effort: 2 (Simple) | ~10 minutes

Severity of issue fixed: Low

Merge Risk: ⚪ Minimal · up to efd8d

Root package manifest changes now trigger base-image publication, with coverage for both package.json and package-lock.json. The change is ready to merge with no identified current-head risk.

Suggested reviewers: cv, senthilr-nv

🚥 Pre-merge checks | ✅ 4 | ❌ 1

❌ Failed checks (1 warning)

Check name	Status	Explanation	Resolution
Docstring Coverage	⚠️ Warning	Docstring coverage is 0.00% which is insufficient. The required threshold is 80.00%. Docstring coverage is scoped to functions touched by this diff. Analyzed 1 functions across 1 files. (1 skipped: 1 …	Write docstrings for the functions missing them to satisfy the coverage threshold.

✅ Passed checks (4 passed)

Check name	Status	Explanation
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly and concisely describes the main change: publishing base images when root dependency files change in CI.

Full details: Docstring Coverage

Explanation

Docstring coverage is 0.00% which is insufficient. The required threshold is 80.00%. Docstring coverage is scoped to functions touched by this diff. Analyzed 1 functions across 1 files. (1 skipped: 1 unsupported.)

• Fix all pre-merge checks with AI

✨ Finishing Touches 💡 1

📝 Generate docstrings 💡

• Create stacked PR
• Commit on current branch

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch fix/base-image-root-package-trigger

---

_{Comment @coderabbitai help to get the list of available commands.}

[prekshivyas]

@coderabbitai review

[coderabbitai]

✅ Action performed

Review finished.

Note: CodeRabbit is an incremental review system and does not re-review already reviewed commits. This command is applicable only when automatic reviews are paused.

[github-code-quality]

Code Coverage Overview

Languages: TypeScript

TypeScript / code-coverage/plugin

The overall line coverage in commit efd8d76 in the fix/base-image-root-... branch remains at 96%, unchanged from commit 87d6dfa in the main branch.

TypeScript / code-coverage/cli

The overall line coverage in commit efd8d76 in the fix/base-image-root-... branch remains at 83%, unchanged from commit de7f565 in the main branch.

Show a line coverage summary of the most impacted files.

File	main de7f565	fix/base-image-root-... efd8d76	+/-
src/lib/inferen...ycle-adapter.ts	86%	77%	-9%
src/lib/onboard...ntime-marker.ts	71%	65%	-6%
src/lib/onboard...eate-journal.ts	87%	82%	-5%
src/lib/inferen...file/cleanup.ts	81%	82%	+1%
src/lib/onboard...ce-lifecycle.ts	83%	84%	+1%
src/lib/actions...dbox/destroy.ts	89%	91%	+2%
src/lib/actions...oy-execution.ts	91%	94%	+3%
src/lib/onboard...box-prebuild.ts	91%	94%	+3%
src/lib/onboard...wn-authority.ts	91%	98%	+7%
src/lib/onboard...dns-fallback.ts	65%	85%	+20%

---

_{Updated September 09, 2026 04:42 UTC}

[sandl99]

Independent review of efd8d768676feeac545b6ab4140590e16cfacf6e against de7f565dd062b6f5affe12218ad825c97efee042: PASS. No blocking or advisory code findings.

The two added root package paths repair the missing publication trigger. The E2E selector reads the same workflow path list, so future root dependency changes also advance its required publication revision. This preserves the existing push-only evidence boundary. The main advance inspected during this review to 87d6dfae852ede67a5acb63e2beae17020a754b6 does not change either reviewed file or the selector.

Validation:

• Ran the focused base-image-publication.test.ts suite in an isolated worktree with Vitest 4.1.9: all 62 tests passed.
• Ran the added regression with the original base workflow substituted: it failed because the root package paths were absent. Restored the candidate file byte-for-byte afterward.
• Reviewed the complete two-file diff, the publication selector, the source-graph audit consumer, and existing review feedback. GitHub marks the candidate commit Verified.
• CodeRabbit's docstring coverage warning concerns a test callback and does not identify a behavior or security defect.

Security categories:

Category	Verdict	Evidence
Secrets and credentials	PASS	No new credentials, secret expressions, or credential recipients.
Input validation and sanitization	PASS	Adds two fixed paths accepted by the existing parser and matcher.
Authentication and authorization	PASS	Repository, branch, event, and permission restrictions remain intact.
Dependencies and third-party libraries	PASS	Adds no dependency; publication now follows changes to its audited root graph.
Error handling and logging	PASS	Failed audits and failed publishers continue to block consumers.
Cryptography and data protection	PASS	SHA, run-attempt, artifact, and digest validation remain intact.
Configuration and security headers	PASS	Only the two push paths change; job configuration and permissions are unchanged.
Security testing	PASS	62 tests passed, including provenance rejection; the new regression distinguishes the base.
System security	PASS	Audit-before-publish ordering, immutable cohort validation, and first-parent selection remain intact.

Files reviewed: .github/workflows/base-image.yaml and test/e2e/support/base-image-publication.test.ts; adjacent consumers: tools/e2e/base-image-publication.mts and scripts/audit-reviewed-npm-graph.mts.

At review time, CI and automated evaluation were still completing. This approval records the code review and does not waive the remaining merge requirements.