update tests

[susanhooks]

Description

Validation

• Standard CI passes.
• Kind integration passes, or this PR explains why it was not run.

The kind integration test is manual due to taking ~30 min to complete. When the PR is ready for
review, approve the current commit and start the suite with these PR comments:

/ok to test <sha>
/kind test

As a fallback, run Actions -> Kind Integration -> Run workflow against the copy-pr-bot generated
pull-request/<PR_NUMBER> branch. Use the default test_path for the full suite, or narrow it
only while debugging.

The completed workflow updates this PR description with its conclusion and exact run URL.

Passing Kind Integration run, if not automatically reported:

Kind integration completed with success for a488dfc3c0e2.

Checklist

• I am familiar with the contributing guidelines in CONTRIBUTING.md.
• Commits are signed off for DCO compliance.
• New or existing tests cover these changes, or the PR explains why tests are not needed.
• Documentation is updated for user-facing behavior changes.
• Generated artifacts are updated when applicable, such as OpenAPI specs,
  docs screenshots, or Helm/rendered outputs.

Summary by CodeRabbit

• Tests

  • Improved test isolation for Redis-backed locking by using per-run unique lock keys to prevent cross-run interference.
  • Expanded Redis lock serialization coverage to better exercise renewal/loss and concurrent distinct-key scenarios.
  • Added coverage ensuring host spelling variations (name vs. IP) collapse to a single deterministic workflow lock key, with workflow-level canonicalization enforced.

• Chores

  • Updated continuous integration to provision a Redis service for the test environment and configure Redis connection settings accordingly.

[copy-pr-bot]

This pull request requires additional validation before any workflows can run on NVIDIA's runners.

Pull request vetters can view their responsibilities here.

Contributors can view more details about this message here.

[coderabbitai]

📝 Walkthrough

Walkthrough

The Python CI job now provisions Redis. Redis lock tests use per-run unique keys, and IB PKey workflow tests validate canonical host lock keys and enforce canonicalization for host-keyed workflows.

Changes

Lock test validation

Layer / File(s)	Summary
Redis service setup .github/workflows/public-ci.yml	The python-tests job provisions a Redis 7 Alpine service with a health check and sets Redis connection environment variables.
Redis lock key isolation src/tests/common/test_lock_redis.py	The Redis fixture distinguishes CI-configured Redis from local opt-in usage, while serialization and renewal tests generate unique Redis lock keys for each run.
Workflow host canonicalization src/tests/temporal/ngc/workflows/test_ib_pkey_lock.py	Tests verify equivalent host spellings produce the same workflow lock key and require host-keyed workflows to override input canonicalization.

Estimated code review effort: 2 (Simple) | ~10 minutes

🚥 Pre-merge checks | ✅ 4 | ❌ 1

❌ Failed checks (1 inconclusive)

Check name	Status	Explanation	Resolution
Title check	❓ Inconclusive	The title is too generic and does not describe the specific Redis lock test hardening and workflow changes in this PR.	Use a specific title such as 'Harden Redis lock tests and workflow host canonicalization'.

✅ Passed checks (4 passed)

Check name	Status	Explanation
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.

✨ Finishing Touches

📝 Generate docstrings

• Create stacked PR
• Commit on current branch

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch sh/workflow-lock-test-hardening

---

_{Comment @coderabbitai help to get the list of available commands.}

[coderabbitai]

Actionable comments posted: 2

🧹 Nitpick comments (1)

.github/workflows/public-ci.yml (1)

149-149: 🔒 Security & Privacy | 🔵 Trivial | ⚡ Quick win

Pin the Redis image to an immutable reference.

redis:7-alpine is mutable, so future CI runs can silently consume a different image. Pin a reviewed digest (or repository-approved immutable reference) for reproducible lock-test infrastructure.

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In @.github/workflows/public-ci.yml at line 149, Update the Redis service image
configuration in the CI workflow from the mutable redis:7-alpine tag to a
reviewed immutable digest or repository-approved immutable reference, preserving
the existing Redis service setup.

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In @.github/workflows/public-ci.yml:
- Around line 157-159: Update the Redis fixture’s client.ping() failure handling
so explicitly configured CI Redis connections raise the failure instead of
calling pytest.skip(...). Preserve pytest.skip(...) only for the intentional
local opt-in path, and use the existing REDIS_HOST/REDIS_PORT configuration
symbols to distinguish these modes.

In `@src/tests/temporal/ngc/workflows/test_ib_pkey_lock.py`:
- Around line 82-97: The test test_host_keyed_lock_requires_canonicalization
currently checks only that canonicalize_input is overridden, allowing no-op
implementations. Add a behavior-level assertion using equivalent hostname and IP
inputs to verify workflow_class.canonicalize_input produces the same canonical
host value, or strengthen the registration validation to enforce this contract
for every workflow returned by _host_keyed_locked_workflows.

---

Nitpick comments:
In @.github/workflows/public-ci.yml:
- Line 149: Update the Redis service image configuration in the CI workflow from
the mutable redis:7-alpine tag to a reviewed immutable digest or
repository-approved immutable reference, preserving the existing Redis service
setup.

🪄 Autofix (Beta)

Fix all unresolved CodeRabbit comments on this PR:

• Push a commit to this branch (recommended)
• Create a new PR with the fixes

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Enterprise

Run ID: ab3f53b4-c9f2-469d-abfa-4ce4f7d96aab

📥 Commits

Reviewing files that changed from the base of the PR and between b9a429a and 632e43d.

📒 Files selected for processing (3)

• .github/workflows/public-ci.yml
• src/tests/common/test_lock_redis.py
• src/tests/temporal/ngc/workflows/test_ib_pkey_lock.py

[susanhooks]

/ok to test a488dfc

[susanhooks]

/kind test

[susanhooks]

/kind test

[github-actions]

Queued Kind integration for a488dfc: https://github.com/NVIDIA/nv-config-manager/actions/workflows/kind-integration.yml