fix(ci): omit null conclusion from running checks

[cv]

Summary

Restore the trusted PR E2E controller after #7054 by omitting the invalid conclusion: null field when updating an active GitHub check. GitHub currently rejects that request with HTTP 422 before control-plane authorization or E2E dispatch can occur.

Changes

• Omit conclusion from in-progress check-run PATCH requests while retaining strict validation that GitHub returns conclusion === null for the persisted active check.
• Assert the outbound field is absent across initial authorization, restored authorization, and authorized dispatch transitions.
• Preserve exact PR/head/base identity, trusted-app validation, maintainer authorization, immutable history, and final stale-revision checks unchanged.

The escaped defect was caused by treating GitHub's response representation as a valid request representation. Existing mocks spread the request into a successful response, toMatchObject allowed the extra request key, and one test explicitly required the invalid null field. Live controller run https://github.com/NVIDIA/NemoClaw/actions/runs/29549179465 reproduced the API rejection after all ordinary CI passed.

This prerequisite cannot satisfy its own required E2E / PR Gate Coordination check: trusted workflow-run evaluation checks out the current main controller, which contains the defect being repaired. After ordinary CI and automated review pass, an independent maintainer must review this exact commit and explicitly accept that one check as a manual merge exception. Subsequent release PRs will then refresh on the repaired base and produce normal exact-head E2E evidence.

Type of Change

• Code change (feature, bug fix, or refactor)
• Code change with doc updates
• Doc only (prose changes, no code sample modifications)
• Doc only (includes code sample changes)

Quality Gates

• Tests added or updated for changed behavior
• Existing tests cover changed behavior — justification:
• Tests not applicable — justification:
• Docs updated for user-facing behavior changes
• Docs not applicable — justification: This only corrects an internal GitHub check-run request body; observable maintainer guidance, CLI/configuration, product behavior, and release notes do not change. Independent docs-writer review found no update necessary.
• Sensitive paths changed (security, policy, credentials, preflight, onboarding, inference, runner, sandbox, or messaging)
• Sensitive-path review completed or maintainer-approved waiver recorded — reviewer/approval link/justification: Independent nine-category security review of exact commit a76af0b9c2d15486c0f5b6f869a802e3bb9ed631 returned PASS/GO with no findings; outbound null removal does not alter strict inbound identity, authorization, TOCTOU, or fail-closed validation.
• Non-success, skipped, or missing CI check accepted by maintainer — check name, approval link, and follow-up issue: Pending independent maintainer review of the expected E2E / PR Gate Coordination self-bootstrap failure described above. Do not merge before ordinary CI and automated review are otherwise green.

Verification

• PR description includes a Signed-off-by: line and every commit appears as Verified in GitHub
• Normal pre-commit, commit-msg, and pre-push hooks passed, or npm run check:diff passed when hooks were skipped or unavailable
• Targeted behavior tests pass for the current change set, or tests are marked not applicable above — npx vitest run test/pr-e2e-gate*.test.ts test/pr-e2e-required.test.ts passed 149/149 tests across 9 files; the focused regression failed before the fix with received conclusion: null and passed afterward. Source-shape, test-size, Biome, CLI build, and CLI typecheck also passed.
• Applicable broad gate passed — npm test for broad runtime/test-harness changes; npm run check for repo-wide validation/coverage changes — command/result: Not run; the focused controller suite and normal hooks cover this three-file request-shape fix.
• Quality Gates section completed with required justifications or waivers
• No secrets, API keys, or credentials committed
• npm run docs builds without warnings (doc changes only)
• Doc pages follow the style guide (doc changes only)
• New doc pages include SPDX header and frontmatter (new pages only)

---

Signed-off-by: Carlos Villela cvillela@nvidia.com

Summary by CodeRabbit

• Bug Fixes

  • Updated E2E check-run progress updates to omit an unnecessary conclusion value while checks are in progress.
  • Improved handling of retryable authorization states after incompatible changes.

• Tests

  • Expanded coverage to verify check-run updates use the correct in-progress payload.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Enterprise

Run ID: aeb8c1d2-e202-4fb0-9307-a2ffd13787fd

📥 Commits

Reviewing files that changed from the base of the PR and between 94b5e46 and a76af0b.

📒 Files selected for processing (3)

• test/pr-e2e-gate-fork-skip.test.ts
• test/pr-e2e-gate-retry-history.test.ts
• tools/e2e/pr-e2e-gate.mts

---

📝 Walkthrough

Walkthrough

The PR E2E gate no longer sends conclusion: null when updating a check run to in_progress. Fork/skip and retry-history tests now assert that the PATCH payload omits conclusion.

Changes

E2E check-run update

Layer / File(s)	Summary
In-progress check update payload tools/e2e/pr-e2e-gate.mts, test/pr-e2e-gate-fork-skip.test.ts, test/pr-e2e-gate-retry-history.test.ts	markCheckInProgress omits conclusion: null, and related tests verify that the PATCH payload contains no conclusion property.

Estimated code review effort: 1 (Trivial) | ~5 minutes

Possibly related issues

• Trusted PR E2E gate cannot retry a completed exact-diff check #7052 — Both changes update PR E2E gate check-run handling and related retry behavior around conclusion.

Possibly related PRs

• NVIDIA/NemoClaw#6914 — Updates the same controller and related tests for in-progress authorization checks.
• NVIDIA/NemoClaw#7054 — Covers opposing expectations around including conclusion: null in restored check-run updates.
• NVIDIA/NemoClaw#7064 — Updates the same PATCH payload and test assertions to omit conclusion.

Suggested labels: area: ci, area: e2e, bug

Suggested reviewers: apurvvkumaria

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly summarizes the main fix: removing null conclusion from in-progress check updates.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

✨ Finishing Touches

📝 Generate docstrings

• Create stacked PR
• Commit on current branch

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch codex/fix-pr-e2e-null-conclusion

---

_{Comment @coderabbitai help to get the list of available commands.}

[github-code-quality]

Code Coverage Overview

Languages: TypeScript

TypeScript / code-coverage/plugin

The overall coverage remains at 96%, unchanged from the main branch.

TypeScript / code-coverage/cli

The overall coverage in the codex/fix-pr-e2e-nul... branch remains at 80%, unchanged from the main branch.

Show a code coverage summary of the most impacted files.

File	main 94b5e46	codex/fix-pr-e2e-nul... a76af0b	+/-
src/lib/domain/.../connect-env.ts	97%	89%	-8%

---

_{Updated July 17, 2026 02:32 UTC
Code Coverage is in Public Preview. Learn more and provide us with your feedback.}

[github-actions]

PR Review Advisor — Informational

Advisor assessment: Informational / high confidence
Next action: No advisor follow-up needed.
Findings: 0 blockers · 0 warnings · 0 suggestions
Status: No actionable findings remain in the canonical review ledger.

Model lanes

• GPT-5.6 Terra (primary): Completed · high confidence · 0 blockers · 0 warnings · 0 suggestions
• Nemotron 3 Ultra (second opinion): Completed · high confidence · 0 blockers · 0 warnings · 0 suggestions
• Model comparison: normalized findings match; normalized E2E selections differ; severity counts match.

Nemotron output stays in workflow artifacts and does not change the assessment above.

E2E guidance

Advisory only. E2E / PR Gate selects and runs jobs independently.

Recommended E2E: cloud-onboard, credential-sanitization, security-posture

Workflow run details

This automated review informs maintainers. Warnings and suggestions do not require a response. A maintainer decides whether to merge.

[cv]

@jyaunches @ericksoa — urgent v0.0.85 prerequisite review requested for exact commit a76af0b9c2d15486c0f5b6f869a802e3bb9ed631 on base 94b5e46e14d8d425948ba75693bb86c466996869.

Everything except the controller's self-bootstrap check is green: full ordinary CI, all self-hosted tests, CodeQL, macOS/WSL, DCO, Verified signature, Advisor 0/0/0, CodeRabbit clean, no review threads, and an independent nine-category security review with no findings. The only failures are E2E / PR Gate Coordination and its observer; both derive solely from workflow run 29550188358 reproducing the current-main HTTP 422 that this one-line production fix removes. No live E2E child was dispatched.

Please independently review the exact diff. If it is acceptable, approve and use the documented manual merge exception for those two self-referential checks. After this lands, #7055 will be refreshed on repaired main and must pass the normal exact-head gate before merge.

[apurvvkumaria]

Reviewed exact head a76af0b against current base 94b5e46. No blocking findings. The patch correctly omits the final-only conclusion field from in-progress PATCH requests while preserving strict validation that GitHub persists the response as conclusion === null; identity, authorization, TOCTOU, and fail-closed behavior remain unchanged. The focused controller suite passes 149/149, automated advisors are clean, and all ordinary CI is green. I accept the two non-success E2E checks as a narrow self-bootstrap exception for this exact revision: the trusted evaluator checked out the buggy base controller, received the reproduced 422 before any child dispatch, and the observer failure is derivative. Approved.