test(e2e): freeze legacy nightly bash wiring

[jyaunches]

Summary

• freeze the current top-level test/e2e/test-*.sh legacy bash suite with an explicit allowlist
• freeze the current scheduled nightly-e2e.yaml legacy script wiring with a separate allowlist
• assert every scheduled nightly legacy script reference still points at an existing file

Rationale

This keeps the legacy bash E2E surface from growing while migration work moves toward Vitest/regression coverage. When a nightly-wired legacy script is intentionally retired, the retiring PR should remove it from nightly-e2e.yaml and update this allowlist in the same change.

Validation

• npx vitest run test/e2e-script-workflow.test.ts --reporter=default ✅
• npm run test-size:check -- test/e2e-script-workflow.test.ts ✅

Note: pre-push full test hook was not used for upload because this local worktree lacks full generated/dist artifacts and Docker; targeted validation above passed.

Summary by CodeRabbit

• Tests
  • Enhanced end-to-end testing infrastructure with new validation checks to ensure shell script configurations remain consistent and all referenced test scripts are properly available.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Enterprise

Run ID: 82fc93d2-4847-484d-8f81-ee2c9b76a2da

📥 Commits

Reviewing files that changed from the base of the PR and between 5f60ed6 and 4e9b496.

📒 Files selected for processing (1)

• test/e2e-script-workflow.test.ts

---

📝 Walkthrough

Walkthrough

This PR adds a test-level validation layer to lock down legacy E2E shell scripts. It introduces file-backed allowlists for top-level and nightly-wired legacy scripts, helper functions to enumerate and extract script references from workflows, and assertions to ensure both inventories remain frozen to their allowlists with file existence verification.

Changes

E2E Legacy Script Freeze Coverage

Layer / File(s)	Summary
Allowlists and helper functions test/e2e-script-workflow.test.ts (lines 4–181)	Imports existsSync and defines LEGACY_E2E_SHELL_ALLOWLIST and NIGHTLY_E2E_SCRIPT_ALLOWLIST. Helper listLocalE2eScripts() enumerates present test/e2e/test-*.sh scripts, and extractE2eScriptReferences() traverses nested workflow objects via regex to collect referenced script paths.
Freeze assertions test/e2e-script-workflow.test.ts (lines 207–219)	Two Vitest tests verify that discovered top-level legacy scripts match the top-level allowlist and that scripts referenced from nightly workflow jobs match the nightly allowlist while confirming each referenced script file exists.

Estimated code review effort

🎯 2 (Simple) | ⏱️ ~12 minutes

Possibly related PRs

• NVIDIA/NemoClaw#5109: Both PRs center on retiring and validating legacy E2E shell-script wiring; the main PR freezes allowlists of referenced test/e2e/test-*.sh scripts while the related PR adjusts coverage for specific legacy scripts that affect the frozen inventory.
• NVIDIA/NemoClaw#5107: Both PRs focus on legacy E2E bash script stability; the main PR hardens allowlist/freeze assertions for legacy test-*.sh references while the related PR migrates a specific script into live Vitest coverage.

Poem

A frozen list of shells so old,
Now locked in place, their paths controlled.
Helper functions test each line,
Legacy scripts held in time—all fine! 🐰✨

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly and specifically describes the main change: freezing the legacy nightly bash wiring in the E2E test suite.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

_{✏️ Tip: You can configure your own custom pre-merge checks in the settings.}

✨ Finishing Touches

📝 Generate docstrings

• Create stacked PR
• Commit on current branch

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch test/freeze-nightly-legacy-e2e

---

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

[github-actions]

PR Review Advisor

Findings: 0 needs attention, 0 worth checking, 0 nice ideas
Top item: No actionable code findings

Workflow run details

This is an automated advisory review. A human maintainer must make the final merge decision.

[cv]

Coordination update: #5126 has now folded in this deterministic guardrail shape and is green on 69ad9666b.

The current #5126 foundation includes:

• the frozen top-level test/e2e/test-*.sh allowlist
• the frozen nightly-e2e.yaml legacy script allowlist
• the scheduled-script existence check
• removal of the repo-local legacy-inventory.json / generated inventory ledgers
• no PR-body deletion evidence contract

So I think this PR is best treated as superseded by #5126 once that re-review completes. Thank you for pushing the simpler shape; it is the one we adopted.

[prekshivyas]

Reviewed (code + 9-cat security). Test-only guardrail: freezes the legacy test/e2e/test-*.sh set (72-entry allowlist) and the nightly-wired subset (59-entry allowlist, each file-backed) to stop the bash E2E surface growing during the Vitest migration.

✅ Approve — I reproduced both allowlists byte-exact against the head SHA (empty diffs), and the path/URL resolution + the nightly-ref regex are correct with no blind spots (all refs live under jobs:). Security: all 9 pass — and it actually helps posture by pinning the existence of the security E2Es (test-network-policy.sh, test-credential-sanitization.sh, test-hermes-sandbox-secret-boundary.sh, …) in the nightly wiring, so silently dropping one would fail this test.

The deliberate maintenance friction (any add/remove of a legacy script now requires editing this file) is the stated, intended purpose.

[cv]

Thanks for putting this guardrail together. This shape ended up being useful, but it has already been folded into #5126, which is now merged on main.

At this point the remaining #5156 branch is superseded rather than separately mergeable: main has moved forward with later updates to , including follow-on allowlist changes and additional coverage/wiring assertions. Merging this PR now would risk dropping those newer updates.

Closing as superseded by #5126.

[cv]

Small correction to the previous note: the omitted file path was test/e2e-script-workflow.test.ts.