Walkthrough

Adds optional Docker Hub credentials to the reusable E2E workflow, inserts a conditional "Authenticate to Docker Hub" login step, propagates credentials into nightly E2E jobs (blanking for untrusted dispatches), updates checkout settings, and extends tests and types for the new fields.

Changes

Docker Hub authentication for nightly E2E

Sequence Diagram(s)

sequenceDiagram
  participant NightlyWorkflow
  participant E2EReusableWorkflow
  participant DockerHub
  NightlyWorkflow->>E2EReusableWorkflow: call e2e-script with conditional DOCKERHUB_USERNAME/DOCKERHUB_TOKEN
  E2EReusableWorkflow->>DockerHub: docker login docker.io (token-stdin) [if credentials present]
  E2EReusableWorkflow-->>NightlyWorkflow: continue (anonymous pulls) [if credentials missing]

Estimated code review effort

🎯 4 (Complex) | ⏱️ ~45 minutes

Suggested labels

nightly-e2e

Poem

🐰 I hop in CI with a tiny shrug,
Credentials snug beneath my rug,
I whisper to Docker, "please let us through,"
Sandbox builds fetch without a queue,
Nightly runs hum—no rate-limit tug.

_{✏️ Tip: You can configure your own custom pre-merge checks in the settings.}

E2E Recommendation Advisor

Failed: Could not parse JSON from advisor output; see /home/runner/work/NemoClaw/NemoClaw/artifacts/e2e-advisor/e2e-advisor-raw-output.txt

E2E Scenario Advisor

Failed: Could not parse JSON from advisor output; see /home/runner/work/NemoClaw/NemoClaw/artifacts/e2e-advisor/e2e-scenario-advisor-raw-output.txt

🛠️ Needs attention

• None.

🔎 Worth checking

• Reusable Docker Hub auth relies on caller event shape (.github/workflows/e2e-script.yaml:167): The current nightly caller withholds Docker Hub secrets for workflow_dispatch runs with a non-empty target_ref, so the known PR-head auto-dispatch path is protected. However, the reusable workflow itself decides whether to run docker login by reading github.event.inputs.target_ref, which is a nightly workflow_dispatch convention rather than an explicit workflow_call trust contract. A future or different caller could pass Docker Hub secrets and an arbitrary ref without that event input, causing the reusable runner to authenticate before executing checked-out code.
  • Recommendation: Make the reusable workflow boundary self-contained: add an explicit workflow_call input such as dockerhub_auth_allowed/trusted_ref and require callers to set it, or rely only on blank/non-blank passed secrets from the caller while documenting that callers must not pass these secrets for untrusted refs.
  • Evidence: e2e-script.yaml runs `Authenticate to Docker Hub` when `${{ github.event_name != 'workflow_dispatch' || github.event.inputs.target_ref == '' }}`; nightly-e2e.yaml currently blanks DOCKERHUB_* for `${{ github.event_name == 'workflow_dispatch' && inputs.target_ref != '' }}`, but that protection lives in the caller.
• Workflow auth change needs runtime validation evidence (.github/workflows/nightly-e2e.yaml:256): The added tests are useful structural workflow-contract checks, but this change depends on GitHub Actions expression evaluation, reusable-workflow secret propagation, Docker CLI login behavior, and the position of login before sandbox image builds. Those paths cannot be fully proven by string assertions alone.
  • Recommendation: Add or record targeted runtime validation for the changed behavior, for example a selective nightly dispatch that exercises docs-validation-e2e and at least one sandbox-build-heavy job with configured Docker Hub credentials, plus a target_ref dispatch confirming credentials are withheld.
  • Evidence: test/e2e-script-workflow.test.ts asserts workflow YAML strings and job lists; issue ci: authenticate Docker Hub pulls in nightly E2E #3629 proposed approach explicitly asks to validate with a targeted nightly dispatch including docs-validation-e2e and another sandbox-build-heavy job.

🌱 Nice ideas

• None.

Current findings:

• Reusable Docker Hub auth relies on caller event shape (.github/workflows/e2e-script.yaml:167): The current nightly caller withholds Docker Hub secrets for workflow_dispatch runs with a non-empty target_ref, so the known PR-head auto-dispatch path is protected. However, the reusable workflow itself decides whether to run docker login by reading github.event.inputs.target_ref, which is a nightly workflow_dispatch convention rather than an explicit workflow_call trust contract. A future or different caller could pass Docker Hub secrets and an arbitrary ref without that event input, causing the reusable runner to authenticate before executing checked-out code.
  • Recommendation: Make the reusable workflow boundary self-contained: add an explicit workflow_call input such as dockerhub_auth_allowed/trusted_ref and require callers to set it, or rely only on blank/non-blank passed secrets from the caller while documenting that callers must not pass these secrets for untrusted refs.
  • Evidence: e2e-script.yaml runs `Authenticate to Docker Hub` when `${{ github.event_name != 'workflow_dispatch' || github.event.inputs.target_ref == '' }}`; nightly-e2e.yaml currently blanks DOCKERHUB_* for `${{ github.event_name == 'workflow_dispatch' && inputs.target_ref != '' }}`, but that protection lives in the caller.
• Workflow auth change needs runtime validation evidence (.github/workflows/nightly-e2e.yaml:256): The added tests are useful structural workflow-contract checks, but this change depends on GitHub Actions expression evaluation, reusable-workflow secret propagation, Docker CLI login behavior, and the position of login before sandbox image builds. Those paths cannot be fully proven by string assertions alone.
  • Recommendation: Add or record targeted runtime validation for the changed behavior, for example a selective nightly dispatch that exercises docs-validation-e2e and at least one sandbox-build-heavy job with configured Docker Hub credentials, plus a target_ref dispatch confirming credentials are withheld.
  • Evidence: test/e2e-script-workflow.test.ts asserts workflow YAML strings and job lists; issue ci: authenticate Docker Hub pulls in nightly E2E #3629 proposed approach explicitly asks to validate with a targeted nightly dispatch including docs-validation-e2e and another sandbox-build-heavy job.