ci(release): link dispatched Brev image run

[jyaunches]

Summary

This follow-up to #6774 captures the downstream Brev image workflow run returned by GitHub and links it from the LKG trigger summary. The maintainer release skill now explains how to hand that link to the maintainer and treats downstream runtime validation and production-family promotion as the success gate.

Related Issue

Follow-up to #6772 and #6774.

Changes

• Request return_run_details when dispatching brevdev/nemoclaw-image and validate the returned numeric run ID and exact repository Actions URL.
• Include the downstream run ID, clickable URL, and follow-through instruction in the source workflow summary and log output.
• Fail safely when GitHub accepts a dispatch without valid run details, while preserving the existing secret and lkg immutability boundaries.
• Teach nemoclaw-maintainer-cut-release-tag how to locate the source run, extract the downstream link, and require runtime E2E plus nemoclaw-brev-cpu family promotion.
• Add a five-minute timeout to the short source dispatch job and expand its contract tests.

Type of Change

• Code change (feature, bug fix, or refactor)
• Code change with doc updates
• Doc only (prose changes, no code sample modifications)
• Doc only (includes code sample changes)

Quality Gates

• Tests added or updated for changed behavior
• Existing tests cover changed behavior — justification:
• Tests not applicable — justification:
• Docs updated for user-facing behavior changes
• Docs not applicable — justification: This is internal maintainer release automation; the required documentation-writer review confirmed the maintainer skill is the canonical guidance and no published user behavior changes.
• Sensitive paths changed (security, policy, credentials, preflight, onboarding, inference, runner, sandbox, or messaging)
• Sensitive-path review completed or maintainer-approved waiver recorded — reviewer/approval link/justification: The response is validated as a numeric run ID plus the exact expected repository Actions URL; the PAT remains environment-only, the summary remains secret-free, and the security contract plus gitleaks passed.
• Non-success, skipped, or missing CI check accepted by maintainer — check name, approval link, and follow-up issue:

Verification

• PR description includes the DCO sign-off declaration and every commit appears as Verified in GitHub
• Normal pre-commit, commit-msg, and pre-push hooks passed, or npm run check:diff passed when hooks were skipped or unavailable
• Targeted behavior tests pass for the current change set, or tests are marked not applicable above — command/result or justification: npx vitest run test/release-lkg-brev-image.test.ts test/skills-frontmatter.test.ts test/changelog-docs.test.ts (41/41 after merging current main).
• Applicable broad gate passed — npm test for broad runtime/test-harness changes; npm run check for repo-wide validation/coverage changes — command/result:
• Quality Gates section completed with required justifications or waivers
• No secrets, API keys, or credentials committed
• npm run docs builds without warnings (doc changes only)
• Doc pages follow the style guide (doc changes only)
• New doc pages include SPDX header and frontmatter (new pages only)

---

Signed-off-by: Julie Yaunches jyaunches@nvidia.com

Summary by CodeRabbit

• Release Process
  • Release automation now includes downstream production image workflow run details in the job summary, with a direct run link when available.
  • Production image dispatches are rejected when returned downstream run details are missing or inconsistent.
  • Updated production image promotion guidance with clearer trigger steps and success validation.
• Reliability
  • The production image dispatch job now auto-terminates after five minutes.
• Tests
  • Extended workflow contract checks for optional timeouts and added negative coverage for invalid downstream run details.

[copy-pr-bot]

Auto-sync is disabled for draft pull requests in this repository. Workflows must be run manually.

Contributors can view more details about this message here.

[coderabbitai]

📝 Walkthrough

Walkthrough

The release script requests and validates downstream workflow run details, reports the resulting run URL, and rejects incomplete responses. Tests cover these behaviors, the dispatch job has a five-minute timeout, and maintainer instructions require downstream success and E2E validation.

Changes

Production image dispatch

Layer / File(s)	Summary
Dispatch tracking and validation scripts/release-lkg-brev-image.sh, .github/workflows/release-lkg-brev-image.yaml, test/release-lkg-brev-image.test.ts	The dispatch requests downstream run details, validates the returned ID and URL, records linked or unavailable run information in the summary, and enforces a five-minute job timeout with corresponding tests.
Maintainer verification procedure .agents/skills/nemoclaw-maintainer-cut-release-tag/SKILL.md	The release procedure now records and shares the downstream run link, follows the relevant workflow, and requires successful downstream execution and runtime E2E validation.

Estimated code review effort: 3 (Moderate) | ~20 minutes

Sequence Diagram(s)

sequenceDiagram
  participant Maintainer
  participant ReleaseScript
  participant GitHubAPI
  participant ProductionImageWorkflow
  Maintainer->>ReleaseScript: Promote selected release tag
  ReleaseScript->>GitHubAPI: Dispatch with return_run_details=true
  GitHubAPI-->>ReleaseScript: Return workflow_run_id and html_url
  ReleaseScript->>ReleaseScript: Validate downstream run details
  ReleaseScript-->>Maintainer: Write run ID and direct run URL
  Maintainer->>ProductionImageWorkflow: Watch downstream run
  ProductionImageWorkflow-->>Maintainer: Report success and E2E validation

Loading

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title is concise and accurately reflects the main change of linking the dispatched Brev image workflow run.

✨ Finishing Touches

📝 Generate docstrings

• Create stacked PR
• Commit on current branch

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch codex/issue-6772-downstream-run-link

---

_{Comment @coderabbitai help to get the list of available commands.}

[github-code-quality]

Code Coverage Overview

Languages: TypeScript

TypeScript / code-coverage/plugin

The overall coverage in commit 5e2dbcd in the codex/issue-6772-dow... branch remains at 96%, unchanged from commit 70d7d28 in the main branch.

TypeScript / code-coverage/cli

The overall coverage in commit 5e2dbcd in the codex/issue-6772-dow... branch remains at 80%, unchanged from commit 70d7d28 in the main branch.

Show a code coverage summary of the most impacted files.

File	main 70d7d28	codex/issue-6772-dow... 5e2dbcd	+/-
src/lib/domain/.../connect-env.ts	97%	89%	-8%
src/lib/platform.ts	89%	84%	-5%
src/lib/messagi...nnels/policy.ts	100%	100%	0%
src/lib/sandbox...rce-identity.ts	91%	91%	0%
src/lib/securit...ntial-filter.ts	93%	93%	0%
src/lib/state/m...lock-storage.ts	97%	97%	0%
src/lib/trace.ts	94%	94%	0%

---

_{Updated July 20, 2026 18:45 UTC}

[github-actions]

PR Review Advisor — Informational

Advisor assessment: Informational / high confidence
Next action: No advisor follow-up needed.
Findings: 0 blockers · 0 warnings · 0 suggestions
Status: No actionable findings remain in the canonical review ledger.

Model lanes

• GPT-5.6 Terra (primary): Completed · high confidence · 0 blockers · 0 warnings · 0 suggestions
• Nemotron 3 Ultra (second opinion): Completed · high confidence · 0 blockers · 1 warning · 0 suggestions
• Model comparison: normalized findings differ; normalized E2E selections match; Nemotron reported the same number of blockers, 1 more warning, the same number of suggestions.

Nemotron output stays in workflow artifacts and does not change the assessment above.

Since last review: 0 prior items resolved · 0 still apply · 0 new items found

E2E guidance

Advisory only. E2E / PR Gate selects and runs jobs independently.

Recommended E2E: None

Workflow run details

This automated review informs maintainers. Warnings and suggestions do not require a response. A maintainer decides whether to merge.

[wscurran]

✨
Related open PRs:

• #6774 ci(release): dispatch Brev image on lkg promotion

Related open issues:

• #6772 Trigger the Brev production image build when lkg is promoted

---

Related open PRs:

• #6774 ci(release): dispatch Brev image on lkg promotion

---

Related open issues:

• #6772 Trigger the Brev production image build when lkg is promoted

[coderabbitai]

Actionable comments posted: 1

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In `@test/release-lkg-brev-image.test.ts`:
- Around line 254-269: Update the release dispatch test around runDispatch to
use a valid numeric downstream run ID paired with a mismatched GitHub Actions
run URL, such as ID 123456789 and URL run 987654321. Keep the existing nonzero
status, rejection error, unavailable downstream run, and absence of
actions/runs/ assertions so the exact-URL validation is covered.

🪄 Autofix (Beta)

Fix all unresolved CodeRabbit comments on this PR:

• Push a commit to this branch (recommended)
• Create a new PR with the fixes

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Enterprise

Run ID: f0ef78ca-15c5-4a33-9004-69cd8f1a10d8

📥 Commits

Reviewing files that changed from the base of the PR and between e0fe1d3 and 68d8e96.

📒 Files selected for processing (4)

• .agents/skills/nemoclaw-maintainer-cut-release-tag/SKILL.md
• .github/workflows/release-lkg-brev-image.yaml
• scripts/release-lkg-brev-image.sh
• test/release-lkg-brev-image.test.ts