Skip to content

fix(e2e): support compatible credential migration#5380

Merged
cv merged 3 commits into
mainfrom
codex/fix-compatible-inference-e2e-key
Jun 13, 2026
Merged

fix(e2e): support compatible credential migration#5380
cv merged 3 commits into
mainfrom
codex/fix-compatible-inference-e2e-key

Conversation

@cv

@cv cv commented Jun 13, 2026

Copy link
Copy Markdown
Collaborator

Summary

Teach the migrated credential-migration Vitest E2E to treat the repository NVIDIA_INFERENCE_API_KEY secret as the hosted OpenAI-compatible service credential for https://inference-api.nvidia.com/v1. The test now migrates that source secret into the custom provider's COMPATIBLE_API_KEY credential instead of asserting an nvapi-/Build NVIDIA provider contract.

Changes

  • Add a hosted-inference E2E fixture that reads NVIDIA_INFERENCE_API_KEY as the source secret and configures the custom compatible-endpoint route.
  • Update the live credential-migration test to stage the migrated credential as COMPATIBLE_API_KEY and assert the compatible-endpoint gateway provider.
  • Wire the nightly and Vitest scenario credential-migration jobs to pass the hosted service endpoint/model while keeping COMPATIBLE_API_KEY out of workflow secrets/env.

Type of Change

  • Code change (feature, bug fix, or refactor)
  • Code change with doc updates
  • Doc only (prose changes, no code sample modifications)
  • Doc only (includes code sample changes)

Verification

  • npx prek run --all-files passes
  • npm test passes
  • Tests added or updated for new or changed behavior
  • No secrets, API keys, or credentials committed
  • Docs updated for user-facing behavior changes
  • npm run docs builds without warnings (doc changes only)
  • Doc pages follow the style guide (doc changes only)
  • New doc pages include SPDX header and frontmatter (new pages only)

Signed-off-by: Carlos Villela cvillela@nvidia.com

Summary by CodeRabbit

  • Tests

    • Added hosted-inference tests validating credential-to-environment mapping, compatibility mode, and model routing
    • Updated credential-migration E2E to compute provider/credential settings at runtime and record dynamic provider/model outcomes
  • Chores

    • CI workflows updated to exercise an alternate compatible-provider routing and pass compatible endpoint, model, and credential variables for testing

Signed-off-by: Carlos Villela <cvillela@nvidia.com>
@cv cv self-assigned this Jun 13, 2026
@coderabbitai

coderabbitai Bot commented Jun 13, 2026

Copy link
Copy Markdown
Contributor

Review Change Stack

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info
⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Enterprise

Run ID: 40194b43-1aa1-4354-9bb4-56b852063e3b

📥 Commits

Reviewing files that changed from the base of the PR and between d7f39ba and 39b9d6f.

📒 Files selected for processing (5)
  • .github/workflows/e2e-vitest-scenarios.yaml
  • .github/workflows/nightly-e2e.yaml
  • test/e2e-scenario/fixtures/hosted-inference.ts
  • test/e2e-scenario/live/credential-migration.test.ts
  • test/e2e-scenario/support-tests/hosted-inference.test.ts
🚧 Files skipped from review as they are similar to previous changes (2)
  • .github/workflows/e2e-vitest-scenarios.yaml
  • test/e2e-scenario/live/credential-migration.test.ts

📝 Walkthrough

Walkthrough

Adds a hosted-inference fixture and Vitest support tests, updates the live credential-migration E2E to use the fixture for credential/provider/model resolution, and adjusts CI workflows to set env vars that exercise the compatible-provider migration path.

Changes

Hosted Inference Configuration and Integration

Layer / File(s) Summary
Hosted inference fixtures and types
test/e2e-scenario/fixtures/hosted-inference.ts
Exports fixture types and implements requireHostedInferenceConfig to resolve API key, provider/providerName, credential env name, model, endpointUrl, and an env map for compatible-provider routing.
Vitest support tests
test/e2e-scenario/support-tests/hosted-inference.test.ts
Adds tests asserting the hosted-inference mapping: NVIDIA_INFERENCE_API_KEY is used as the source secret, mapped into COMPATIBLE_API_KEY, accepts non-nvapi- values in compatibility mode, and populates NEMOCLAW_* fields when a model is provided.
Credential migration test integration
test/e2e-scenario/live/credential-migration.test.ts
Replaces hardcoded legacy credential handling with requireHostedInferenceConfig(...) outputs; updates redaction, staged credentials key, onboarding child env, provider assertions, and scenario-result recording to use computed values.
Workflow environment configuration
.github/workflows/e2e-vitest-scenarios.yaml, .github/workflows/nightly-e2e.yaml
Expand credential-migration job env with NEMOCLAW_PROVIDER, NEMOCLAW_ENDPOINT_URL, NEMOCLAW_MODEL, and NEMOCLAW_COMPAT_MODEL (retaining NVIDIA_INFERENCE_API_KEY) to force the compatible-provider inference route during CI runs.

Sequence Diagram

sequenceDiagram
  participant Workflow as CI Workflow
  participant TestSetup as Test Setup
  participant HostedInference as requireHostedInferenceConfig
  participant MigrationTest as Credential Migration Test
  participant Secrets as Environment/Secrets

  Workflow->>TestSetup: set NVIDIA_INFERENCE_API_KEY and NEMOCLAW_* env
  TestSetup->>HostedInference: call requireHostedInferenceConfig(secrets, env, options)
  HostedInference->>Secrets: read required secrets and NEMOCLAW_* env
  HostedInference-->>TestSetup: return HostedInferenceConfig
  TestSetup->>MigrationTest: stage credential and set child env
  MigrationTest->>MigrationTest: run migration and assert results
Loading

Estimated code review effort

🎯 4 (Complex) | ⏱️ ~45 minutes

Possibly related PRs

  • NVIDIA/NemoClaw#5228: Earlier changes to the credential-migration Vitest flow that introduced the migration test this change extends.

Suggested labels

area: e2e, v0.0.65

Poem

🐰 I hopped through CI and env with care,

mapped keys and models in the air,
compatible paths now found and paired,
tests record the provider shared,
a small hop — migrations repaired.

🚥 Pre-merge checks | ✅ 4 | ❌ 1

❌ Failed checks (1 warning)

Check name Status Explanation Resolution
Docstring Coverage ⚠️ Warning Docstring coverage is 0.00% which is insufficient. The required threshold is 80.00%. Write docstrings for the functions missing them to satisfy the coverage threshold.
✅ Passed checks (4 passed)
Check name Status Explanation
Description Check ✅ Passed Check skipped - CodeRabbit’s high-level summary is enabled.
Title check ✅ Passed The title accurately summarizes the main change: enabling compatible credential migration for the E2E tests through a shared fixture and provider configuration.
Linked Issues check ✅ Passed Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check ✅ Passed Check skipped because no linked issues were found for this pull request.

✏️ Tip: You can configure your own custom pre-merge checks in the settings.

✨ Finishing Touches
📝 Generate docstrings
  • Create stacked PR
  • Commit on current branch
🧪 Generate unit tests (beta)
  • Create PR with unit tests
  • Commit unit tests in branch codex/fix-compatible-inference-e2e-key

Comment @coderabbitai help to get the list of available commands and usage tips.

@github-actions

github-actions Bot commented Jun 13, 2026

Copy link
Copy Markdown
Contributor

E2E Advisor Recommendation

Required E2E: None
Optional E2E: None

Workflow run

Full advisor summary

E2E Recommendation Advisor

Failed: Could not parse JSON from advisor output; see /home/runner/work/NemoClaw/NemoClaw/artifacts/e2e-advisor/e2e-advisor-raw-output.txt

@github-actions

github-actions Bot commented Jun 13, 2026

Copy link
Copy Markdown
Contributor

Vitest E2E Scenario Recommendation

Required Vitest E2E scenarios: None
Optional Vitest E2E scenarios: None

Workflow run

Full Vitest E2E advisor summary

Vitest E2E Scenario Advisor

Failed: Could not parse JSON from advisor output; see /home/runner/work/NemoClaw/NemoClaw/artifacts/e2e-advisor/e2e-scenario-advisor-raw-output.txt

@github-actions

github-actions Bot commented Jun 13, 2026

Copy link
Copy Markdown
Contributor

PR Review Advisor

Findings: 0 needs attention, 1 worth checking, 0 nice ideas
Top item: PR review advisor unavailable

Review findings

🛠️ Needs attention

  • None.

🔎 Worth checking

  • PR review advisor unavailable: The automated advisor could not complete: Could not parse JSON from PR review advisor output; see /home/runner/work/NemoClaw/NemoClaw/artifacts/pr-review-advisor/pr-review-advisor-raw-output.txt
    • Recommendation: Re-run the PR Review Advisor or perform a manual review.
    • Evidence: Could not parse JSON from PR review advisor output; see /home/runner/work/NemoClaw/NemoClaw/artifacts/pr-review-advisor/pr-review-advisor-raw-output.txt

🌱 Nice ideas

  • None.
Consider writing more tests for
  • **Runtime validation** — Add or identify targeted runtime/integration validation for the changed behavior; do not report external E2E job pass/fail here.. Runtime/sandbox/infrastructure paths need behavioral runtime validation: .github/workflows/e2e-vitest-scenarios.yaml, .github/workflows/nightly-e2e.yaml.

Workflow run details

This is an automated advisory review. A human maintainer must make the final merge decision.

@coderabbitai coderabbitai Bot left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Actionable comments posted: 1

🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In `@test/e2e-scenario/fixtures/hosted-inference.ts`:
- Around line 41-44: The apiKey resolution in the apiKey const currently checks
secrets.optional("NVIDIA_INFERENCE_API_KEY") before honoring the configured
nvidiaSecretName, which breaks precedence; change the fallback order so it first
attempts secrets.optional(nvidiaSecretName), then
secrets.optional("NVIDIA_INFERENCE_API_KEY"), and finally
secrets.required(nvidiaSecretName) (i.e., use secrets.optional(nvidiaSecretName)
?? secrets.optional("NVIDIA_INFERENCE_API_KEY") ??
secrets.required(nvidiaSecretName)) so that nvidiaSecretName takes precedence;
update the apiKey assignment that uses secrets.optional and secrets.required
accordingly.
🪄 Autofix (Beta)

Fix all unresolved CodeRabbit comments on this PR:

  • Push a commit to this branch (recommended)
  • Create a new PR with the fixes

ℹ️ Review info
⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Enterprise

Run ID: 521d0520-e195-4b12-8c4e-f25fe904bd85

📥 Commits

Reviewing files that changed from the base of the PR and between 1467e84 and b636c00.

📒 Files selected for processing (5)
  • .github/workflows/e2e-vitest-scenarios.yaml
  • .github/workflows/nightly-e2e.yaml
  • test/e2e-scenario/fixtures/hosted-inference.ts
  • test/e2e-scenario/live/credential-migration.test.ts
  • test/e2e-scenario/support-tests/hosted-inference.test.ts

Comment thread test/e2e-scenario/fixtures/hosted-inference.ts Outdated
Signed-off-by: Carlos Villela <cvillela@nvidia.com>

@coderabbitai coderabbitai Bot left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

🧹 Nitpick comments (1)
test/e2e-scenario/support-tests/hosted-inference.test.ts (1)

36-52: 💤 Low value

Consider asserting NEMOCLAW_COMPAT_MODEL in env map.

The fixture sets NEMOCLAW_COMPAT_MODEL: model at line 51, but this test doesn't verify it. For completeness and to catch regressions if that field is accidentally removed:

Suggested addition
     expect(cfg.env).toMatchObject({
       NEMOCLAW_PROVIDER: "custom",
       NEMOCLAW_ENDPOINT_URL: "https://inference-api.nvidia.com/v1",
       NEMOCLAW_MODEL: "nvidia/nvidia/nemotron-3-super-v3",
+      NEMOCLAW_COMPAT_MODEL: "nvidia/nvidia/nemotron-3-super-v3",
       COMPATIBLE_API_KEY: "sk-compatible-key",
     });
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@test/e2e-scenario/support-tests/hosted-inference.test.ts` around lines 36 -
52, Add an assertion that the compatibility model env var is present: inside the
"accepts a compatible-provider credential when CI enables the compatibility
flag" test (the it block using requireHostedInferenceConfig and cfg), extend the
existing env assertions to include NEMOCLAW_COMPAT_MODEL with the expected model
value from the test fixture (e.g., add
expect(cfg.env).toHaveProperty("NEMOCLAW_COMPAT_MODEL", model) or include
"NEMOCLAW_COMPAT_MODEL": <expected-model> in the toMatchObject call) so the test
verifies the compat model is set.
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Nitpick comments:
In `@test/e2e-scenario/support-tests/hosted-inference.test.ts`:
- Around line 36-52: Add an assertion that the compatibility model env var is
present: inside the "accepts a compatible-provider credential when CI enables
the compatibility flag" test (the it block using requireHostedInferenceConfig
and cfg), extend the existing env assertions to include NEMOCLAW_COMPAT_MODEL
with the expected model value from the test fixture (e.g., add
expect(cfg.env).toHaveProperty("NEMOCLAW_COMPAT_MODEL", model) or include
"NEMOCLAW_COMPAT_MODEL": <expected-model> in the toMatchObject call) so the test
verifies the compat model is set.

ℹ️ Review info
⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Enterprise

Run ID: 0ad086aa-be86-43f7-9c47-b1f092b1a84c

📥 Commits

Reviewing files that changed from the base of the PR and between b636c00 and d7f39ba.

📒 Files selected for processing (2)
  • test/e2e-scenario/fixtures/hosted-inference.ts
  • test/e2e-scenario/support-tests/hosted-inference.test.ts

Signed-off-by: Carlos Villela <cvillela@nvidia.com>
@cv cv merged commit 9e9efd6 into main Jun 13, 2026
46 checks passed
@cv cv deleted the codex/fix-compatible-inference-e2e-key branch June 13, 2026 08:08
@cv cv added the v0.0.65 Release target label Jun 13, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

v0.0.65 Release target

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant