Skip to content

test(e2e): migrate device auth health to vitest - #5543

Merged
cv merged 10 commits into
mainfrom
e2e-migrate/test-device-auth-health
Jun 20, 2026
Merged

cv merged 10 commits into
mainfrom
e2e-migrate/test-device-auth-health

Conversation

@cv

@cv cv commented Jun 18, 2026 •

Copy link
Copy Markdown
Collaborator

Summary

Migrates test/e2e/test-device-auth-health.sh into a typed live Vitest scenario. The new coverage preserves the #2342 device-auth health contract through real install.sh onboard, sandbox HTTP probes, host port-forward probing, nemoclaw status, and gateway recovery checks.

Related Issue

Refs #5098

Changes

  • Add test/e2e-scenario/live/device-auth-health.test.ts with typed artifact capture, cleanup, and secret redaction.
  • Wire device-auth-health-vitest into .github/workflows/e2e-vitest-scenarios.yaml as a free-standing dispatchable Vitest job.
  • Preserve legacy shell deletion for Phase 11 cleanup per the migration governance in Epic: Migrate legacy bash E2E into the Vitest E2E system #5098.

Type of Change

  • Code change (feature, bug fix, or refactor)
  • Code change with doc updates
  • Doc only (prose changes, no code sample modifications)
  • Doc only (includes code sample changes)

Verification

  • PR description includes the DCO sign-off declaration and every commit appears as Verified in GitHub
  • Git hooks passed during commit and push, or npx prek run --from-ref main --to-ref HEAD passes
  • Targeted tests pass for changed behavior
  • Full npm test passes (broad runtime changes only)
  • Tests added or updated for new or changed behavior
  • No secrets, API keys, or credentials committed
  • Docs updated for user-facing behavior changes
  • npm run docs builds without warnings (doc changes only)
  • Doc pages follow the style guide (doc changes only)
  • New doc pages include SPDX header and frontmatter (new pages only)

Targeted commands run:

  • npx biome check --write test/e2e-scenario/live/device-auth-health.test.ts
  • NEMOCLAW_RUN_E2E_SCENARIOS=1 npx vitest run --project e2e-scenarios-live test/e2e-scenario/live/device-auth-health.test.ts -t __compile_only_nomatch__ --silent=false --reporter=default --passWithNoTests
  • npx vitest run --project e2e-vitest-support test/e2e-scenario/support-tests/e2e-scenarios-workflow.test.ts
  • npx tsx scripts/check-test-file-size-budget.ts test/e2e-scenario/live/device-auth-health.test.ts

Signed-off-by: Carlos Villela cvillela@nvidia.com

Summary by CodeRabbit

  • Tests

    • Added a new live end-to-end device-auth health verification scenario that replaces the legacy script, including sandbox setup, /health and dashboard availability checks, health status validation (including after a simulated gateway outage), and recovery verification.
  • CI / Release Operations

    • Added a dedicated end-to-end CI job for this scenario and wired its results into pull request reporting, with automated upload of test artifacts.
    • Improved e2e workflow boundary test stability by adjusting import formatting and setting an explicit timeout for one test.

Signed-off-by: Carlos Villela <cvillela@nvidia.com>
@cv cv self-assigned this Jun 18, 2026
@coderabbitai

coderabbitai Bot commented Jun 18, 2026 •

Copy link
Copy Markdown
Contributor

Review Change Stack

Note

Reviews paused

It looks like this branch is under active development. To avoid overwhelming you with review comments due to an influx of new commits, CodeRabbit has automatically paused this review. You can configure this behavior by changing the reviews.auto_review.auto_pause_after_reviewed_commits setting.

Use the following commands to manage reviews:

  • @coderabbitai resume to resume automatic reviews.
  • @coderabbitai review to trigger a single review.

Use the checkboxes below for quick actions:

  • ▶️ Resume reviews
  • 🔍 Trigger review
📝 Walkthrough

Walkthrough

Adds a new live Vitest e2e test file device-auth-health.test.ts that provisions a sandbox, installs NemoClaw with retry logic, validates /health and dashboard HTTP responses, simulates gateway failure and recovery, and persists artifacts. A corresponding device-auth-health-vitest CI job is wired into .github/workflows/e2e-vitest-scenarios.yaml, added to report-to-pr.needs, and the workflow metadata tests are updated to reflect the new job.

Changes

Device Auth Health Vitest Migration

Layer / File(s) Summary
Test module setup and helper functions
test/e2e-scenario/live/device-auth-health.scenario.ts, test/e2e-scenario/live/device-auth-health.test.ts
Defines sandbox name, dashboard port, install attempt count, and live timeout constants; adds helpers for env construction, best-effort cleanup, offline-status assertion, and sandbox HTTP probing via curl artifacts.
Core live scenario implementation
test/e2e-scenario/live/device-auth-health.scenario.ts
Implements the full live test: gating/skip checks, Docker validation, cleanup hook registration, pre-cleanup best-effort destroy/delete, install retry/backoff loop, /health (200) and dashboard root (200/401) validation, nemoclaw status non-offline assertion, gateway process kill, recovery status check, and up to 30-poll /health loop writing success or inconclusive JSON artifact.
CI workflow job definition and PR reporting
.github/workflows/e2e-vitest-scenarios.yaml
Adds the device-auth-health-vitest free-standing job with isolated Docker config directory for Docker Hub auth (retry/anonymous fallback), Node/OpenShell setup, environment variables for port/gateway/sandbox, device-auth-health artifact upload, and Docker cleanup; extends report-to-pr.needs to include the new job for PR result reporting.
Workflow metadata test updates
test/e2e-scenario/support-tests/e2e-scenarios-workflow.test.ts
Reorders test module imports and adds explicit 60-second timeout option to the workflow job inventory derivation test to accommodate the new device-auth-health job metadata.

Estimated code review effort

🎯 3 (Moderate) | ⏱️ ~25 minutes

Possibly related PRs

  • NVIDIA/NemoClaw#5243: Modifies the same e2e-vitest-scenarios.yaml workflow to wire free-standing Vitest jobs into the shared job-selector and report-to-pr.needs reporting flow.
  • NVIDIA/NemoClaw#5347: Both PRs add new free-standing live Vitest jobs to .github/workflows/e2e-vitest-scenarios.yaml and update the workflow boundary test suite plus report-to-pr.needs wiring.
  • NVIDIA/NemoClaw#5494: Both PRs update .github/workflows/e2e-vitest-scenarios.yaml by adding a free-standing live Vitest job and including that job in report-to-pr.needs for different scenarios.

Suggested labels

area: e2e, chore

Poem

🐇 Hop, hop! The gateway falls—
But health checks bounce right off the walls.
Retry the install, poll the /health,
Collect those artifacts by stealth.
If 401 says "who goes there?"
That's not offline—it's just auth-aware! ✨

🚥 Pre-merge checks | ✅ 4 | ❌ 1

❌ Failed checks (1 warning)

Check name Status Explanation Resolution
Docstring Coverage ⚠️ Warning Docstring coverage is 0.00% which is insufficient. The required threshold is 80.00%. Write docstrings for the functions missing them to satisfy the coverage threshold.
✅ Passed checks (4 passed)
Check name Status Explanation
Description Check ✅ Passed Check skipped - CodeRabbit’s high-level summary is enabled.
Title check ✅ Passed The PR title 'test(e2e): migrate device auth health to vitest' directly and specifically describes the main change: migrating a legacy bash E2E test to TypeScript/Vitest, which aligns with the core objective of converting test/e2e/test-device-auth-health.sh to the new test framework.
Linked Issues check ✅ Passed Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check ✅ Passed Check skipped because no linked issues were found for this pull request.

✏️ Tip: You can configure your own custom pre-merge checks in the settings.

✨ Finishing Touches
🧪 Generate unit tests (beta)
  • Create PR with unit tests
  • Commit unit tests in branch e2e-migrate/test-device-auth-health

Comment @coderabbitai help to get the list of available commands and usage tips.

@github-code-quality

github-code-quality Bot commented Jun 18, 2026 •

Copy link
Copy Markdown
Contributor

Code Coverage Overview

Languages: TypeScript

TypeScript / code-coverage/plugin

The overall coverage in the e2e-migrate/test-dev... branch is 96%. Coverage data for the main branch is not yet available.

Show a code coverage summary of the most covered files.
File main e2e-migrate/test-dev... b8d45e7 +/-
nemoclaw/src/se...cret-scanner.ts — 100% —
nemoclaw/src/commands/slash.ts — 100% —
nemoclaw/src/li...bprocess-env.ts — 100% —
nemoclaw/src/bl...eprint/state.ts — 98% —
nemoclaw/src/onboard/config.ts — 98% —
nemoclaw/src/bl...int/snapshot.ts — 97% —
nemoclaw/src/bl...print/runner.ts — 95% —
nemoclaw/src/co...ration-state.ts — 94% —
nemoclaw/src/bl...ate-networks.ts — 94% —
nemoclaw/src/index.ts — 94% —

TypeScript / code-coverage/cli

The overall coverage in the e2e-migrate/test-dev... branch is 46%. Coverage data for the main branch is not yet available.

Show a code coverage summary of the most covered files.
File main e2e-migrate/test-dev... b8d45e7 +/-
src/lib/state/o...oard-session.ts — 90% —
src/lib/inference/local.ts — 76% —
src/lib/sandbox/config.ts — 72% —
src/lib/actions...dbox/rebuild.ts — 67% —
src/lib/onboard/preflight.ts — 64% —
src/lib/actions...licy-channel.ts — 56% —
src/lib/state/sandbox.ts — 55% —
src/lib/policy/index.ts — 49% —
src/lib/onboard...er-gpu-patch.ts — 44% —
src/lib/onboard.ts — 18% —

Updated June 20, 2026 16:47 UTC
Code Coverage is in Public Preview. Learn more and provide us with your feedback.

@github-actions

github-actions Bot commented Jun 18, 2026 •

Copy link
Copy Markdown
Contributor

E2E Advisor Recommendation

Required E2E: None
Optional E2E: device-auth-health-vitest, gateway-health-honest-vitest

Dispatch hint: device-auth-health-vitest,gateway-health-honest-vitest

Workflow run

Full advisor summary

E2E Recommendation Advisor

Base: origin/main
Head: HEAD
Confidence: high

Required E2E

  • None. No merge-blocking E2E is required because the PR changes only E2E workflow/test files and does not modify installer, onboarding, sandbox lifecycle, credentials, gateway, or runtime product code.

Optional E2E

  • device-auth-health-vitest (high): This PR adds the device-auth-health live scenario and workflow job. Running the new job validates that the added E2E path is dispatchable and that the scenario works against the real install/onboard/sandbox/status boundary, but it is not merge-blocking for product runtime because the changed files are test/workflow-only.
  • gateway-health-honest-vitest (medium): Adjacent confidence check for gateway health/status honesty and crashed gateway handling. Useful because the new scenario also asserts health is not misreported as offline, but no runtime health code changed.

New E2E recommendations

  • None.

Dispatch hint

  • Workflow: .github/workflows/e2e-vitest-scenarios.yaml
  • jobs input: device-auth-health-vitest,gateway-health-honest-vitest

@github-actions

github-actions Bot commented Jun 18, 2026 •

Copy link
Copy Markdown
Contributor

Vitest E2E Scenario Recommendation

Required Vitest E2E scenarios: device-auth-health-vitest
Optional Vitest E2E scenarios: None

Dispatch required Vitest E2E scenarios:

  • gh workflow run e2e-vitest-scenarios.yaml --ref <pr-head-ref> --field jobs=device-auth-health-vitest

Workflow run

Full Vitest E2E advisor summary

Vitest E2E Scenario Advisor

Base: origin/main
Head: HEAD
Confidence: high

Required Vitest E2E scenarios

  • device-auth-health-vitest: Focused free-standing Vitest job wired for changed live test test/e2e-scenario/live/device-auth-health.test.ts.
    • Dispatch: gh workflow run e2e-vitest-scenarios.yaml --ref <pr-head-ref> --field jobs=device-auth-health-vitest

Optional Vitest E2E scenarios

  • None.

Relevant changed files

  • .github/workflows/e2e-vitest-scenarios.yaml
  • test/e2e-scenario/live/device-auth-health-helpers.ts
  • test/e2e-scenario/live/device-auth-health.test.ts
  • test/e2e-scenario/support-tests/e2e-scenarios-workflow.test.ts

@coderabbitai coderabbitai Bot left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Actionable comments posted: 1

🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In `@test/e2e-scenario/live/device-auth-health.test.ts`:
- Around line 233-239: The recovery status validation in the nemoclaw status
check only validates the output text does not contain offline but does not
verify that the nemoclaw command itself succeeded. Update the test to check that
the recoveryStatus indicates successful command execution (verify the exit code
or success property) in addition to calling assertStatusNotOffline on the
result. This ensures that a failed nemoclaw status command does not silently
pass the recovery check.
🪄 Autofix (Beta)

Fix all unresolved CodeRabbit comments on this PR:

  • Push a commit to this branch (recommended)
  • Create a new PR with the fixes

ℹ️ Review info
⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Enterprise

Run ID: 1141229f-aedd-4378-9701-4501bbbd4efc

📥 Commits

Reviewing files that changed from the base of the PR and between c4bd014 and 679b7b3.

📒 Files selected for processing (2)
  • .github/workflows/e2e-vitest-scenarios.yaml
  • test/e2e-scenario/live/device-auth-health.test.ts

Comment thread test/e2e-scenario/live/device-auth-health.test.ts Outdated
@github-actions

github-actions Bot commented Jun 18, 2026 •

Copy link
Copy Markdown
Contributor

PR Review Advisor

Findings: 0 needs attention, 7 worth checking, 0 nice ideas
Since last review: 0 prior items resolved, 7 still apply, 0 new items found

Review findings

🛠️ Needs attention

  • None.

🔎 Worth checking

  • Source-of-truth review needed: Dashboard root 200/401 tolerance: The advisor marked localized patch analysis as needs_followup.
    • Recommendation: Identify the invalid state, source boundary, source-fix constraint, regression test, and removal condition before merging the localized behavior.
    • Evidence: New code accepts `expect(["200", "401"]).toContain(root.stdout.trim())`; legacy code treated 401 as pass and 200 as skip-like evidence that device auth was not active.
  • Source-of-truth review needed: Dashboard port selection: The advisor marked localized patch analysis as missing.
    • Recommendation: Identify the invalid state, source boundary, source-fix constraint, regression test, and removal condition before merging the localized behavior.
    • Evidence: Legacy shell test updated DASHBOARD_PORT from `openshell forward list`; new code assigns `DASHBOARD_PORT` once from env/default and uses it for all probes.
  • Keep Docker auth out of the OpenShell installer step (.github/workflows/e2e-vitest-scenarios.yaml:3524): The new device-auth-health job logs in to Docker Hub, persists DOCKER_CONFIG through GITHUB_ENV, and then runs the OpenShell installer in that Docker credential context. That widens the trusted-code boundary for installer code and any subprocesses it invokes.
    • Recommendation: Install OpenShell before Docker login, or run the installer with Docker/token-related variables removed, for example: env -u DOCKER_CONFIG -u DOCKERHUB_USERNAME -u DOCKERHUB_TOKEN -u NVIDIA_INFERENCE_API_KEY -u GITHUB_TOKEN bash scripts/install-openshell.sh.
    • Evidence: The job writes DOCKER_CONFIG at line 3482, authenticates with DOCKERHUB_TOKEN in the following step, and then runs plain `bash scripts/install-openshell.sh` at line 3525. Nearby secret-bearing jobs use `env -u DOCKER_CONFIG -u DOCKERHUB_USERNAME -u DOCKERHUB_TOKEN ... bash scripts/install-openshell.sh`.
  • Validate the dashboard port before sandbox shell interpolation (test/e2e-scenario/live/device-auth-health-helpers.ts:21): NEMOCLAW_DASHBOARD_PORT is read as a raw string and later interpolated into a command executed via `openshell sandbox exec ... sh -lc`. The workflow sets a numeric value, but local or self-hosted overrides could include malformed values or shell metacharacters that alter the command run inside the sandbox.
    • Recommendation: Parse and validate NEMOCLAW_DASHBOARD_PORT as an integer TCP port in range 1-65535 before use, or avoid shell interpolation by passing validated arguments through a non-shell helper.
    • Evidence: `DASHBOARD_PORT` is assigned from `process.env.NEMOCLAW_DASHBOARD_PORT ?? "18789"` at line 21 and interpolated into `trustedSandboxShellScript(`curl ... http://localhost:${DASHBOARD\_PORT}${urlPath}\`\)\` at lines 67-68. `trustedSandboxShellScript` only brands non-empty strings; it does not escape embedded values.
  • Do not pass the 401 regression path when the dashboard root returns 200 (test/e2e-scenario/live/device-auth-health.test.ts:88): The migrated test is named and documented as protecting the device-auth 401 health contract, but it accepts both 200 and 401 from `/` and then continues with the same status assertions. If the environment returns 200, the test can pass without exercising the 401 behavior it is meant to protect.
    • Recommendation: When `/` returns 200, record the device-auth premise as not exercised and skip or mark the 401-specific assertion inconclusive. Keep a path that requires a 401 response for the device-auth regression contract.
    • Evidence: The legacy shell test treated root 401 as a premise-confirming pass and root 200 as skip-like compatibility evidence: `/ returns 200 — device auth not active on this image`. The new Vitest scenario uses `expect(["200", "401"], ...).toContain(root.stdout.trim())` under the 401-specific test name.
  • Preserve actual dashboard port detection from the legacy test (test/e2e-scenario/live/device-auth-health-helpers.ts:21): The legacy shell test updated DASHBOARD_PORT from `openshell forward list` after install because the forwarded host port may differ from the requested default if the port was already taken. The Vitest migration always uses the configured/default port, which can fail or probe the wrong endpoint in reused or self-hosted environments.
    • Recommendation: After install/onboard, detect the actual forwarded dashboard port for the sandbox and use that value for subsequent sandbox and host HTTP probes, or explicitly assert that this free-standing job requires the configured port to be honored.
    • Evidence: Legacy `test/e2e/test-device-auth-health.sh` assigned `ACTUAL_PORT=$(openshell forward list ...); DASHBOARD_PORT="$ACTUAL_PORT"` when present. The new scenario sets `DASHBOARD_PORT` once from env/default at line 21 and uses it for sandbox curl and host curl without updating it.
  • Add targeted boundary coverage for the new secret-bearing free-standing job (test/e2e-scenario/support-tests/e2e-scenarios-workflow.test.ts:487): The workflow inventory tests validate free-standing metadata generically, but this PR does not add behavior-specific assertions for the new device-auth-health selector or for the installer secret-boundary expectation. Because the added job is secret-bearing and dispatch-selectable, targeted regression coverage would improve confidence.
    • Recommendation: Add explicit tests showing `scenarios=device-auth-health` selects only `device-auth-health-vitest` and `jobs=device-auth-health-vitest` selects only that job. Also add or identify coverage that the OpenShell installer step runs without Docker/NVIDIA/GitHub token environment in scope.
    • Evidence: The diff adds workflow metadata `FREE_STANDING_SCENARIO_ID: "device-auth-health"` and a Docker/NVIDIA-secret-bearing job, but `test/e2e-scenario/support-tests/e2e-scenarios-workflow.test.ts` only changes import ordering and an inventory test timeout.

🌱 Nice ideas

  • None.
Consider writing more tests for
  • **Runtime validation** — NEMOCLAW_DASHBOARD_PORT rejects empty, non-numeric, shell-metacharacter, and out-of-range values before any `openshell sandbox exec ... sh -lc` command is constructed.. This PR changes a secret-bearing GitHub Actions workflow plus a live installer/OpenShell/sandbox E2E path. The highest-risk behavior crosses Docker credentials, installer trust, sandbox shell execution, runtime port-forwarding, and external inference boundaries.
  • **Runtime validation** — Workflow dispatch with `scenarios=device-auth-health` selects only `device-auth-health-vitest`.. This PR changes a secret-bearing GitHub Actions workflow plus a live installer/OpenShell/sandbox E2E path. The highest-risk behavior crosses Docker credentials, installer trust, sandbox shell execution, runtime port-forwarding, and external inference boundaries.
  • **Runtime validation** — Workflow dispatch with `jobs=device-auth-health-vitest` selects only `device-auth-health-vitest`.. This PR changes a secret-bearing GitHub Actions workflow plus a live installer/OpenShell/sandbox E2E path. The highest-risk behavior crosses Docker credentials, installer trust, sandbox shell execution, runtime port-forwarding, and external inference boundaries.
  • **Runtime validation** — The device-auth-health OpenShell installer step runs with `DOCKER_CONFIG`, `DOCKERHUB_USERNAME`, `DOCKERHUB_TOKEN`, `NVIDIA_INFERENCE_API_KEY`, and `GITHUB_TOKEN` removed from its environment.. This PR changes a secret-bearing GitHub Actions workflow plus a live installer/OpenShell/sandbox E2E path. The highest-risk behavior crosses Docker credentials, installer trust, sandbox shell execution, runtime port-forwarding, and external inference boundaries.
  • **Runtime validation** — When dashboard `/` returns 401, `nemoclaw status` exits 0, does not contain `Offline`, and shows a live/ready/running indicator.. This PR changes a secret-bearing GitHub Actions workflow plus a live installer/OpenShell/sandbox E2E path. The highest-risk behavior crosses Docker credentials, installer trust, sandbox shell execution, runtime port-forwarding, and external inference boundaries.
  • **Add targeted boundary coverage for the new secret-bearing free-standing job** — Add explicit tests showing `scenarios=device-auth-health` selects only `device-auth-health-vitest` and `jobs=device-auth-health-vitest` selects only that job. Also add or identify coverage that the OpenShell installer step runs without Docker/NVIDIA/GitHub token environment in scope.
  • **Acceptance clause:** No deterministic linked issue clauses were provided — add test evidence or identify existing coverage. The validation context reported `linkedIssues: []`. PR-body references such as `Refs Epic: Migrate legacy bash E2E into the Vitest E2E system #5098` and comments about `[NemoClaw][Brev Launchable] OpenClaw Gateway Dashboard shows "Version n/a" and "Health Offline" after Brev Launchable deployment succeeds #2342` were treated as untrusted context rather than deterministic acceptance clauses.
  • **Dashboard root 200/401 tolerance** — Missing for the required 401 path: when dashboard `/` returns 401, `nemoclaw status` exits 0, does not contain `Offline`, and shows a live/ready/running indicator.. New code accepts `expect(["200", "401"]).toContain(root.stdout.trim())`; legacy code treated 401 as pass and 200 as skip-like evidence that device auth was not active.
Since last review details

Current findings:

  • Source-of-truth review needed: Dashboard root 200/401 tolerance: The advisor marked localized patch analysis as needs_followup.
    • Recommendation: Identify the invalid state, source boundary, source-fix constraint, regression test, and removal condition before merging the localized behavior.
    • Evidence: New code accepts `expect(["200", "401"]).toContain(root.stdout.trim())`; legacy code treated 401 as pass and 200 as skip-like evidence that device auth was not active.
  • Source-of-truth review needed: Dashboard port selection: The advisor marked localized patch analysis as missing.
    • Recommendation: Identify the invalid state, source boundary, source-fix constraint, regression test, and removal condition before merging the localized behavior.
    • Evidence: Legacy shell test updated DASHBOARD_PORT from `openshell forward list`; new code assigns `DASHBOARD_PORT` once from env/default and uses it for all probes.
  • Keep Docker auth out of the OpenShell installer step (.github/workflows/e2e-vitest-scenarios.yaml:3524): The new device-auth-health job logs in to Docker Hub, persists DOCKER_CONFIG through GITHUB_ENV, and then runs the OpenShell installer in that Docker credential context. That widens the trusted-code boundary for installer code and any subprocesses it invokes.
    • Recommendation: Install OpenShell before Docker login, or run the installer with Docker/token-related variables removed, for example: env -u DOCKER_CONFIG -u DOCKERHUB_USERNAME -u DOCKERHUB_TOKEN -u NVIDIA_INFERENCE_API_KEY -u GITHUB_TOKEN bash scripts/install-openshell.sh.
    • Evidence: The job writes DOCKER_CONFIG at line 3482, authenticates with DOCKERHUB_TOKEN in the following step, and then runs plain `bash scripts/install-openshell.sh` at line 3525. Nearby secret-bearing jobs use `env -u DOCKER_CONFIG -u DOCKERHUB_USERNAME -u DOCKERHUB_TOKEN ... bash scripts/install-openshell.sh`.
  • Validate the dashboard port before sandbox shell interpolation (test/e2e-scenario/live/device-auth-health-helpers.ts:21): NEMOCLAW_DASHBOARD_PORT is read as a raw string and later interpolated into a command executed via `openshell sandbox exec ... sh -lc`. The workflow sets a numeric value, but local or self-hosted overrides could include malformed values or shell metacharacters that alter the command run inside the sandbox.
    • Recommendation: Parse and validate NEMOCLAW_DASHBOARD_PORT as an integer TCP port in range 1-65535 before use, or avoid shell interpolation by passing validated arguments through a non-shell helper.
    • Evidence: `DASHBOARD_PORT` is assigned from `process.env.NEMOCLAW_DASHBOARD_PORT ?? "18789"` at line 21 and interpolated into `trustedSandboxShellScript(`curl ... http://localhost:${DASHBOARD\_PORT}${urlPath}\`\)\` at lines 67-68. `trustedSandboxShellScript` only brands non-empty strings; it does not escape embedded values.
  • Do not pass the 401 regression path when the dashboard root returns 200 (test/e2e-scenario/live/device-auth-health.test.ts:88): The migrated test is named and documented as protecting the device-auth 401 health contract, but it accepts both 200 and 401 from `/` and then continues with the same status assertions. If the environment returns 200, the test can pass without exercising the 401 behavior it is meant to protect.
    • Recommendation: When `/` returns 200, record the device-auth premise as not exercised and skip or mark the 401-specific assertion inconclusive. Keep a path that requires a 401 response for the device-auth regression contract.
    • Evidence: The legacy shell test treated root 401 as a premise-confirming pass and root 200 as skip-like compatibility evidence: `/ returns 200 — device auth not active on this image`. The new Vitest scenario uses `expect(["200", "401"], ...).toContain(root.stdout.trim())` under the 401-specific test name.
  • Preserve actual dashboard port detection from the legacy test (test/e2e-scenario/live/device-auth-health-helpers.ts:21): The legacy shell test updated DASHBOARD_PORT from `openshell forward list` after install because the forwarded host port may differ from the requested default if the port was already taken. The Vitest migration always uses the configured/default port, which can fail or probe the wrong endpoint in reused or self-hosted environments.
    • Recommendation: After install/onboard, detect the actual forwarded dashboard port for the sandbox and use that value for subsequent sandbox and host HTTP probes, or explicitly assert that this free-standing job requires the configured port to be honored.
    • Evidence: Legacy `test/e2e/test-device-auth-health.sh` assigned `ACTUAL_PORT=$(openshell forward list ...); DASHBOARD_PORT="$ACTUAL_PORT"` when present. The new scenario sets `DASHBOARD_PORT` once from env/default at line 21 and uses it for sandbox curl and host curl without updating it.
  • Add targeted boundary coverage for the new secret-bearing free-standing job (test/e2e-scenario/support-tests/e2e-scenarios-workflow.test.ts:487): The workflow inventory tests validate free-standing metadata generically, but this PR does not add behavior-specific assertions for the new device-auth-health selector or for the installer secret-boundary expectation. Because the added job is secret-bearing and dispatch-selectable, targeted regression coverage would improve confidence.
    • Recommendation: Add explicit tests showing `scenarios=device-auth-health` selects only `device-auth-health-vitest` and `jobs=device-auth-health-vitest` selects only that job. Also add or identify coverage that the OpenShell installer step runs without Docker/NVIDIA/GitHub token environment in scope.
    • Evidence: The diff adds workflow metadata `FREE_STANDING_SCENARIO_ID: "device-auth-health"` and a Docker/NVIDIA-secret-bearing job, but `test/e2e-scenario/support-tests/e2e-scenarios-workflow.test.ts` only changes import ordering and an inventory test timeout.

Workflow run details

This is an automated advisory review. A human maintainer must make the final merge decision.

@cv cv added the v0.0.66 label Jun 18, 2026
cv added 7 commits June 19, 2026 11:18
Signed-off-by: Carlos Villela <cvillela@nvidia.com>
…lth' into e2e-migrate/test-device-auth-health
Signed-off-by: Carlos Villela <cvillela@nvidia.com>
Signed-off-by: Carlos Villela <cvillela@nvidia.com>
…lth' into e2e-migrate/test-device-auth-health

Signed-off-by: Carlos Villela <cvillela@nvidia.com>

@coderabbitai coderabbitai Bot left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Actionable comments posted: 1

🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In `@test/e2e-scenario/live/device-auth-health.scenario.ts`:
- Around line 222-230: The current pkill command with the || true fallback can
silently fail without actually killing the gateway process, while still passing
the test and allowing the recovery phase to succeed without exercising the
intended disruption path. Remove the || true fallback from the pkill command in
the trustedSandboxShellScript call and add explicit validation to verify that
the gateway process was actually killed before proceeding with recovery polling.
This ensures the test truly exercises the kill and recovery contract rather than
allowing false positives where no actual disruption occurred.
🪄 Autofix (Beta)

Fix all unresolved CodeRabbit comments on this PR:

  • Push a commit to this branch (recommended)
  • Create a new PR with the fixes

ℹ️ Review info
⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Enterprise

Run ID: 9e4cf8f8-36be-433f-be56-512626cb773b

📥 Commits

Reviewing files that changed from the base of the PR and between 78439d2 and 06e2591.

📒 Files selected for processing (2)
  • test/e2e-scenario/live/device-auth-health.scenario.ts
  • test/e2e-scenario/live/device-auth-health.test.ts
✅ Files skipped from review due to trivial changes (1)
  • test/e2e-scenario/live/device-auth-health.test.ts

Comment on lines +222 to +230
await sandbox.execShell(
SANDBOX_NAME,
trustedSandboxShellScript("pkill -f 'openclaw.*gateway' 2>/dev/null || true"),
{
artifactName: "phase-5-kill-gateway-process",
env: commandEnv(),
timeoutMs: 30_000,
},
);

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

⚠️ Potential issue | 🟠 Major | ⚡ Quick win

Validate that gateway kill actually happened before recovery polling

The current kill command (pkill ... || true) can no-op and still pass, so the recovery phase can succeed without exercising the disruption path. That makes this scenario capable of false positives for the kill/recovery contract.

Suggested fix
-    await sandbox.execShell(
-      SANDBOX_NAME,
-      trustedSandboxShellScript("pkill -f 'openclaw.*gateway' 2>/dev/null || true"),
-      {
-        artifactName: "phase-5-kill-gateway-process",
-        env: commandEnv(),
-        timeoutMs: 30_000,
-      },
-    );
+    // Uses fixture helper that verifies the process tree is actually gone.
+    await sandbox.killGatewayTree(SANDBOX_NAME, {
+      artifactName: "phase-5-kill-gateway-process",
+      timeoutMs: 30_000,
+    });
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@test/e2e-scenario/live/device-auth-health.scenario.ts` around lines 222 -
230, The current pkill command with the || true fallback can silently fail
without actually killing the gateway process, while still passing the test and
allowing the recovery phase to succeed without exercising the intended
disruption path. Remove the || true fallback from the pkill command in the
trustedSandboxShellScript call and add explicit validation to verify that the
gateway process was actually killed before proceeding with recovery polling.
This ensures the test truly exercises the kill and recovery contract rather than
allowing false positives where no actual disruption occurred.

cv added 2 commits June 20, 2026 09:28
Signed-off-by: Carlos Villela <cvillela@nvidia.com>
Signed-off-by: Carlos Villela <cvillela@nvidia.com>
@cv
cv merged commit 5b12568 into main Jun 20, 2026
40 checks passed
@cv
cv deleted the e2e-migrate/test-device-auth-health branch June 20, 2026 18:39
@wscurran wscurran added area: ci CI workflows, checks, release automation, or GitHub Actions area: e2e End-to-end tests, nightly failures, or validation infrastructure labels Aug 1, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

area: ci CI workflows, checks, release automation, or GitHub Actions area: e2e End-to-end tests, nightly failures, or validation infrastructure

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants