fix(images): clear platform pull before validation

[jyaunches]

Summary

Managed-image promotion now removes each locally pulled platform image before it validates the next architecture. This prevents Docker from rejecting the second platform pull for the same multi-platform digest.

Changes

• Remove the local cohort image after each anonymous architecture-specific pull.
• Verify that local image removal follows the anonymous pull in the managed-image workflow.

Type of Change

• Code change (feature, bug fix, or refactor)
• Code change with doc updates
• Doc only (prose changes, no code sample modifications)
• Doc only (includes code sample changes)

Quality Gates

• Tests added or updated for changed behavior
• Existing tests cover changed behavior — justification:
• Tests not applicable — justification:
• Docs updated for user-facing behavior changes
• Docs not applicable — justification: The change affects only the local Docker cache used by CI validation. It does not change a managed-image tag, publication contract, interface, or operator procedure.
• Sensitive paths changed (security, policy, credentials, preflight, onboarding, inference, runner, sandbox, or messaging)
• Sensitive-path review completed or maintainer-approved waiver recorded — reviewer/approval link/justification:
• Non-success, skipped, or missing CI check accepted by maintainer — check name, approval link, and follow-up issue:

Documentation Writer Review

• Documentation writer subagent reviewed the completed changes
• Result: no-docs-needed
• Evidence: Reviewed .github/workflows/managed-images.yaml and test/managed-image-publication-workflow.test.ts. The change has no user-facing interface, publication-contract, or operator-procedure effect.
• Agent: Codex Desktop

DGX Station Hardware Evidence

• Tested on DGX Station
• Tested commit:
• Station profile/scenario:
• Result:
• Supporting evidence:

Verification

• PR description includes a Signed-off-by: line and every commit appears as Verified in GitHub
• Normal pre-commit, commit-msg, and pre-push hooks passed, or npm run validate:pr passed after refreshing origin/main when hooks were skipped or unavailable
• Targeted behavior tests pass for the current change set, or tests are marked not applicable above — command/result or justification: npx vitest run --project integration test/managed-image-publication-workflow.test.ts passed 11 tests.
• Applicable broad gate passed — npm test for broad runtime/test-harness changes; npm run check for repo-wide validation/coverage changes — command/result:
• Quality Gates section completed with required justifications or waivers
• No secrets, API keys, or credentials committed
• npm run docs builds without warnings (doc changes only)
• Doc pages follow the style guide (doc changes only)
• New doc pages include SPDX header and frontmatter (new pages only)

---

Signed-off-by: Julie Yaunches jyaunches@nvidia.com

Summary by CodeRabbit

• Chores

  • Improved image publication workflow cleanup by automatically removing temporarily pulled images after processing.
  • Helps reduce leftover image data and local storage usage during staged image promotion.

• Tests

  • Updated validation to confirm platform-specific images are pulled and removed as expected.

[coderabbitai]

📝 Walkthrough

Walkthrough

The managed-image promotion workflow removes each cohort image locally after anonymous platform pulls. The aggregate promotion test verifies expected platform-specific pulls and immediate removal of each pulled image reference.

Changes

Managed image promotion cleanup

Layer / File(s)	Summary
Post-pull image cleanup and verification .github/workflows/managed-images.yaml, test/managed-image-publication-workflow.test.ts	The workflow removes each pulled cohort image, and the aggregate promotion test validates expected platform-specific pulls, cleanup ordering, and matching removal references.

Estimated code review effort: 2 (Simple) | ~10 minutes

Possibly related PRs

• NVIDIA/NemoClaw#7756: Directly modifies the managed-image publication workflow and aggregate promotion test covered by this cleanup change.
• NVIDIA/NemoClaw#7772: Introduces managed-image cohort digest references exercised by the updated workflow and tests.

Suggested labels: area: ci, area: packaging, bug-fix, platform: container

Suggested reviewers: prekshivyas

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly summarizes the main workflow fix: clearing platform-specific image pulls before validation.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

✨ Finishing Touches

📝 Generate docstrings

• Create stacked PR
• Commit on current branch

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch codex/fix-multiarch-pull-validation

---

_{Comment @coderabbitai help to get the list of available commands.}

[github-code-quality]

Code Coverage Overview

Languages: TypeScript

TypeScript / code-coverage/plugin

The overall coverage in commit f4ab974 in the codex/fix-multiarch-... branch remains at 96%, unchanged from commit 4f74ea7 in the main branch.

TypeScript / code-coverage/cli

The overall coverage in commit f4ab974 in the codex/fix-multiarch-... branch remains at 81%, unchanged from commit 4f74ea7 in the main branch.

---

_{Updated July 31, 2026 00:05 UTC}

[coderabbitai]

Actionable comments posted: 1

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In `@test/managed-image-publication-workflow.test.ts`:
- Around line 488-492: Update the assertions around runManagedImagePromotion to
execute the promotion script and inspect its recorded Docker calls rather than
checking script text ordering. Assert that all six platform pull calls are each
followed by removal of the corresponding cohort reference, covering every
pull/removal pair.

🪄 Autofix (Beta)

Fix all unresolved CodeRabbit comments on this PR:

• Push a commit to this branch (recommended)
• Create a new PR with the fixes

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Enterprise

Run ID: ed9f8c21-1903-4efb-a219-e64b95a8a6bb

📥 Commits

Reviewing files that changed from the base of the PR and between 4767f58 and 8974e93.

📒 Files selected for processing (2)

• .github/workflows/managed-images.yaml
• test/managed-image-publication-workflow.test.ts

[github-actions]

PR Review Advisor — No blocking findings reported

Advisor assessment: No blocking advisor findings reported
Next action: No advisor follow-up needed.
Findings: 0 blockers · 0 warnings · 0 suggestions

Model lanes

• GPT-5.6 Terra (primary): Completed · high confidence · 0 blockers · 0 warnings · 0 suggestions
• Nemotron 3 Ultra (second opinion): Completed · high confidence · 0 blockers · 0 warnings · 0 suggestions
• Model comparison: normalized findings match; normalized E2E selections match; severity counts match.

Nemotron output stays in workflow artifacts and does not change the assessment above.

E2E guidance

Advisory only. E2E / PR Gate selects and runs jobs independently.

Recommended E2E: None

Workflow run details

This automated review informs maintainers. Warnings and suggestions do not require a response. A maintainer decides whether to merge.

[coderabbitai]

Actionable comments posted: 1

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In `@test/managed-image-publication-workflow.test.ts`:
- Around line 596-598: Update the cleanup assertions around the pull workflow to
inspect the original accepted.calls array rather than a filtered sequence. For
each expected platform pull, locate its raw index and assert that the
immediately following call is image rm for the same reference, preserving the
requirement that cleanup directly follows every pull.

🪄 Autofix (Beta)

Fix all unresolved CodeRabbit comments on this PR:

• Push a commit to this branch (recommended)
• Create a new PR with the fixes

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Enterprise

Run ID: ca8f012f-1c7a-4180-941c-061cba17ea7f

📥 Commits

Reviewing files that changed from the base of the PR and between 8974e93 and 4061983.

📒 Files selected for processing (1)

• test/managed-image-publication-workflow.test.ts

[coderabbitai]

Caution

Some comments are outside the diff and can’t be posted inline due to platform limitations.

⚠️ Outside diff range comments (1)

test/managed-image-publication-workflow.test.ts (1)

486-487: 🎯 Functional Correctness | 🟠 Major | ⚡ Quick win

Retain coverage for anonymous pulls.

The replacement assertions verify platform pulls and cleanup order, but no longer verify that pulls use DOCKER_CONFIG="$anonymous_config". A regression to the default Docker config could therefore validate a non-public image using credentials while the test still passes. Assert the runtime pull environment through the recorder, rather than restoring a brittle script-text assertion.

As per path instructions, this test should verify observable runtime behavior rather than implementation-shaped script text.

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@test/managed-image-publication-workflow.test.ts` around lines 486 - 487,
Update the assertions in the promotion workflow test around promotion.run to
verify through the recorder that image pulls execute with DOCKER_CONFIG set to
anonymous_config. Remove or avoid brittle script-text matching for this
behavior, while preserving the existing platform and cleanup-order coverage.

Source: Path instructions

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Outside diff comments:
In `@test/managed-image-publication-workflow.test.ts`:
- Around line 486-487: Update the assertions in the promotion workflow test
around promotion.run to verify through the recorder that image pulls execute
with DOCKER_CONFIG set to anonymous_config. Remove or avoid brittle script-text
matching for this behavior, while preserving the existing platform and
cleanup-order coverage.

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Enterprise

Run ID: f5b5bc4e-5fbf-4c3f-af22-af6f11782b22

📥 Commits

Reviewing files that changed from the base of the PR and between 4061983 and f4ab974.

📒 Files selected for processing (1)

• test/managed-image-publication-workflow.test.ts

[cjagwani]

Lgtm