Commit 2619274
ci(docs): move documentation review after merge (#9234)
<!-- markdownlint-disable MD041 -->
## Summary
Documentation catch-up now runs after merges to `main` instead of
blocking ordinary code PR creation. The production workflow batches
accumulated changes behind at most one managed documentation PR,
independently authors and reviews a docs-only patch, and uses a separate
model-credential-free publisher job to open a draft PR from an immutable
SHA-specific branch when work remains.
## Production Decision
This PR is the accepted maintainer design record for the post-merge
documentation workflow.
- **Owner:** `Docs / Post-Merge Catch-Up` owns routine
public-documentation impact analysis, authoring, independent review, and
draft-PR creation after merges to `main`. `nemoclaw-maintainer-evening`
owns the dated release entry and merging the documentation PR before
tagging. Owning guidance outside `docs/**`, `fern/docs.yml`, and
`fern/assets/**` remains in the code PR.
- **Lifecycle:** If a managed documentation PR is open, later `main`
runs stop before model work while code merges continue. After that PR
merges, the next cumulative run covers the latest reachable semver tag
through its exact `main` commit. The cycle repeats until a later
exact-SHA run approves an empty patch. Each published branch is
immutable and SHA-specific; the workflow never force-pushes, updates,
closes, or deletes it.
- **Compatibility:** Ordinary code PRs may include public documentation,
but they no longer require it or the old documentation-review receipt.
Direct documentation-only PRs keep their writing and validation
requirements.
- **Security:** Only the inference-configuration step receives
`POST_MERGE_DOCS_API_KEY`. The author job has read-only GitHub contents
permission; its author sandbox edits only a local checkout, and the
separate offline reviewer receives a read-only repository checkout. The
publisher job has scoped GitHub write permission but receives no model
credential and reconstructs the exact reviewed docs-only tree before
writing.
- **Validation:** An approved empty patch completes successfully without
GitHub writes. An approved nonempty patch creates one draft PR from an
immutable branch and leaves the publisher job non-successful to record
pending documentation. The generated PR's required CI runs `npm run
docs` after opening. Artifact validation and initial live-state checks
happen before GitHub writes. Later failures can leave unreferenced Git
objects or the immutable automation branch, but repeated checkpoints
prevent a stale PR from being treated as current.
- **Release:** Tagging requires a successful exact-SHA `Docs /
Post-Merge Catch-Up` run whose `Publish documentation catch-up` job
succeeded, no open managed documentation PR, and no candidate-specific
automation branch. Because nonempty publication is non-successful, only
an independently approved empty result is release-ready.
- **Rollback:** A maintainer closes any unexpected draft and reverts
this workflow and its policy changes. Immutable automation branches may
remain as evidence; no automated force-push or deletion is required.
Deployment prerequisite: provision the repository Actions secret
`POST_MERGE_DOCS_API_KEY` before merge and retain it until rotation or
removal. GitHub exposes it only to the author job's `Configure isolated
inference` step; hosted-runner teardown removes the gateway runtime
copy, and the sandboxes, artifacts, and publisher never receive it. The
first push to `main` exercises hosted OpenShell authoring, review, and
artifact transfer. The first approved nonempty patch additionally
exercises GitHub writes, draft-PR creation, and approval-required PR
checks; maintainers must verify that path on its first production run.
## Changes
- Add a three-job workflow: active-PR gate, credential-isolated author
and reviewer, and separate trusted publisher.
- Create at most one draft documentation PR from an immutable
SHA-specific branch. Later merged changes remain pending for cumulative
documentation catch-up while that PR is open.
- Run `npm run docs` in required generated-PR CI instead of executing
the candidate in the credential-bearing author job.
- Remove the old same-PR documentation receipt workflow, its 1,051-line
script and test pair, and the receipt plumbing from PR creation and
follow-up.
- Reduce release-tag documentation work to exact workflow-job, open-PR,
and candidate-branch state checks.
- Keep the complete PR net-neutral against its recorded base: 1,475
additions and 1,475 deletions.
## Type of Change
- [ ] Code change (feature, bug fix, or refactor)
- [x] Code change with doc updates
- [ ] Doc only (prose changes, no code sample modifications)
- [ ] Doc only (includes code sample changes)
## Quality Gates
- [x] Tests added or updated for changed behavior
- [ ] Existing tests cover changed behavior — justification:
- [ ] Tests not applicable — justification:
- [x] Docs updated for user-facing behavior changes
- [ ] Docs not applicable — justification:
- [x] Sensitive paths changed (security, policy, credentials, preflight,
onboarding, inference, runner, sandbox, or messaging)
- [x] Sensitive-path review completed or maintainer-approved waiver
recorded — reviewer/approval link/justification: Independent security
review evaluated the complete 36-file diff at latest PR commit
`5859b5a65` against base SHA `8b9a28aab`. All nine security categories
passed with no findings. The final two-file delta changes only release
guidance and its contract test; it changes no workflow, credential,
permission, policy, dependency, or publication code. The review
confirmed that the prior credential-separation, artifact-binding,
authorization, cleanup, and fail-closed conclusions remain valid.
- [ ] Non-success, skipped, or missing CI check accepted by maintainer —
check name, approval link, and follow-up issue:
## Documentation Writer Review
- [x] Documentation writer subagent reviewed the completed changes
- Result: `docs-updated`
- Evidence: Independent Pi CLI review passed for the complete 36-file
diff at latest PR commit `5859b5a65`. The final guidance names the
`Publish documentation catch-up` job and requires an independently
approved empty patch at the recorded `origin/main` commit. Changed
public documentation includes `docs/CONTRIBUTING.md` and
`docs/resources/engineer-agentic-documentation.mdx`. `npx vitest run
test/changelog-docs.test.ts` passed 7 tests, `npm run docs` passed with
0 errors and 2 existing Fern warnings, and normal hooks passed.
- Agent: Pi CLI
<!-- docs-review-head-sha: 5859b5a -->
<!-- docs-review-agents-blob-sha: 993bdd8 -->
## DGX Station Hardware Evidence
- [ ] Tested on DGX Station
- Tested commit: Not applicable
- Station profile/scenario: Not applicable
- Result: Not applicable
- Supporting evidence: Not applicable
## Verification
- [x] PR description includes a `Signed-off-by:` line and every commit
appears as `Verified` in GitHub
- [x] Normal `pre-commit`, `commit-msg`, and `pre-push` hooks passed, or
`npm run validate:pr` passed after refreshing `origin/main` when hooks
were skipped or unavailable
- [x] Targeted behavior tests pass for the current change set, or tests
are marked not applicable above — The original focused suite passed 86
tests at commit `be0378778`. For latest PR commit `5859b5a65`, `npx
vitest run test/changelog-docs.test.ts` passed 7 tests, `npm run docs`
passed, and the independent security review recorded 4 focused files and
84 passing tests.
- [x] Applicable broad gate passed — all 54 current checks pass at
latest PR commit `5859b5a65`.
- [x] Quality Gates section completed with required justifications or
waivers
- [x] No secrets, API keys, or credentials committed
- [ ] `npm run docs` builds without warnings (doc changes only) — passed
with 0 errors and 2 existing Fern warnings.
- [x] Doc pages follow the [style
guide](https://github.com/NVIDIA/NemoClaw/blob/main/docs/CONTRIBUTING.md)
(doc changes only)
- [ ] New doc pages include SPDX header and frontmatter (new pages only)
---
Signed-off-by: Julie Yaunches <jyaunches@nvidia.com>
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **New Features**
* Added automated post-merge documentation updates with sandboxed
authoring, validation, independent review, and draft pull request
creation.
* Added release readiness checks requiring successful documentation
publication before tagging.
* Expanded documentation-only validation for supported documentation
paths.
* **Documentation**
* Updated contributor, maintainer, and release guidance for post-merge
documentation and changelog workflows.
* **Removed**
* Removed pull-request documentation receipt checks and related
validation commands.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
---------
Signed-off-by: Julie Yaunches <jyaunches@nvidia.com>
Signed-off-by: Prekshi Vyas <prekshiv@nvidia.com>
Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>
Co-authored-by: Prekshi Vyas <prekshiv@nvidia.com>
Co-authored-by: Carlos Villela <cvillela@nvidia.com>1 parent eaa274d commit 2619274
36 files changed
Lines changed: 1475 additions & 1475 deletions
File tree
- .agents/skills
- nemoclaw-contributor-create-pr
- nemoclaw-contributor-implement-issue
- nemoclaw-contributor-update-docs
- nemoclaw-maintainer-cut-release-tag
- nemoclaw-maintainer-evening
- nemoclaw-maintainer-policies/references
- nemoclaw-maintainer-refactor-docs
- nemoclaw-maintainer-release-notes
- nemoclaw-skills-guide
- .github
- workflows
- ci
- docs
- resources
- scripts
- src/lib/security
- test
- helpers
- tools
- openshell-agent
- post-merge-docs
| Original file line number | Diff line number | Diff line change | |
|---|---|---|---|
| |||
341 | 341 | | |
342 | 342 | | |
343 | 343 | | |
344 | | - | |
| 344 | + | |
345 | 345 | | |
346 | 346 | | |
347 | 347 | | |
| |||
| Original file line number | Diff line number | Diff line change | |
|---|---|---|---|
| |||
118 | 118 | | |
119 | 119 | | |
120 | 120 | | |
121 | | - | |
122 | | - | |
123 | | - | |
124 | | - | |
125 | | - | |
126 | | - | |
127 | | - | |
128 | | - | |
| 121 | + | |
| 122 | + | |
| 123 | + | |
| 124 | + | |
| 125 | + | |
129 | 126 | | |
130 | 127 | | |
131 | 128 | | |
132 | | - | |
133 | 129 | | |
134 | | - | |
135 | | - | |
| 130 | + | |
| 131 | + | |
136 | 132 | | |
137 | 133 | | |
138 | 134 | | |
| |||
| Original file line number | Diff line number | Diff line change | |
|---|---|---|---|
| |||
62 | 62 | | |
63 | 63 | | |
64 | 64 | | |
65 | | - | |
| 65 | + | |
| 66 | + | |
| 67 | + | |
| 68 | + | |
66 | 69 | | |
67 | 70 | | |
68 | 71 | | |
| |||
193 | 196 | | |
194 | 197 | | |
195 | 198 | | |
196 | | - | |
197 | | - | |
198 | | - | |
199 | 199 | | |
200 | 200 | | |
201 | 201 | | |
| |||
230 | 230 | | |
231 | 231 | | |
232 | 232 | | |
233 | | - | |
234 | | - | |
235 | | - | |
236 | | - | |
| 233 | + | |
| 234 | + | |
| 235 | + | |
| 236 | + | |
| 237 | + | |
237 | 238 | | |
238 | 239 | | |
239 | 240 | | |
| |||
Lines changed: 3 additions & 2 deletions
| Original file line number | Diff line number | Diff line change | |
|---|---|---|---|
| |||
92 | 92 | | |
93 | 93 | | |
94 | 94 | | |
95 | | - | |
96 | | - | |
| 95 | + | |
| 96 | + | |
| 97 | + | |
97 | 98 | | |
98 | 99 | | |
99 | 100 | | |
| |||
Lines changed: 16 additions & 38 deletions
| Original file line number | Diff line number | Diff line change | |
|---|---|---|---|
| |||
1 | 1 | | |
2 | 2 | | |
3 | | - | |
| 3 | + | |
4 | 4 | | |
5 | 5 | | |
6 | 6 | | |
7 | 7 | | |
8 | 8 | | |
9 | 9 | | |
10 | 10 | | |
11 | | - | |
12 | | - | |
| 11 | + | |
| 12 | + | |
13 | 13 | | |
14 | | - | |
| 14 | + | |
15 | 15 | | |
16 | | - | |
| 16 | + | |
| 17 | + | |
| 18 | + | |
17 | 19 | | |
18 | | - | |
19 | | - | |
20 | | - | |
21 | | - | |
22 | | - | |
23 | | - | |
24 | | - | |
25 | | - | |
| 20 | + | |
26 | 21 | | |
27 | 22 | | |
28 | 23 | | |
| |||
39 | 34 | | |
40 | 35 | | |
41 | 36 | | |
42 | | - | |
43 | | - | |
44 | | - | |
45 | 37 | | |
46 | 38 | | |
47 | 39 | | |
| |||
65 | 57 | | |
66 | 58 | | |
67 | 59 | | |
68 | | - | |
69 | | - | |
70 | | - | |
71 | | - | |
72 | | - | |
73 | | - | |
74 | | - | |
75 | | - | |
76 | | - | |
77 | | - | |
78 | | - | |
79 | | - | |
80 | | - | |
81 | | - | |
82 | | - | |
83 | | - | |
84 | | - | |
85 | 60 | | |
86 | 61 | | |
87 | | - | |
88 | | - | |
89 | | - | |
| 62 | + | |
| 63 | + | |
| 64 | + | |
| 65 | + | |
| 66 | + | |
| 67 | + | |
90 | 68 | | |
91 | 69 | | |
92 | | - | |
93 | | - | |
| 70 | + | |
| 71 | + | |
Lines changed: 19 additions & 18 deletions
| Original file line number | Diff line number | Diff line change | |
|---|---|---|---|
| |||
1 | 1 | | |
2 | 2 | | |
3 | | - | |
| 3 | + | |
4 | 4 | | |
5 | 5 | | |
6 | 6 | | |
| |||
36 | 36 | | |
37 | 37 | | |
38 | 38 | | |
39 | | - | |
40 | | - | |
| 39 | + | |
41 | 40 | | |
42 | 41 | | |
43 | 42 | | |
| |||
73 | 72 | | |
74 | 73 | | |
75 | 74 | | |
76 | | - | |
| 75 | + | |
77 | 76 | | |
78 | 77 | | |
79 | 78 | | |
80 | 79 | | |
81 | 80 | | |
82 | | - | |
83 | | - | |
84 | | - | |
85 | | - | |
| 81 | + | |
86 | 82 | | |
87 | 83 | | |
88 | | - | |
| 84 | + | |
| 85 | + | |
| 86 | + | |
| 87 | + | |
| 88 | + | |
| 89 | + | |
| 90 | + | |
89 | 91 | | |
90 | 92 | | |
91 | | - | |
92 | | - | |
93 | | - | |
94 | | - | |
| 93 | + | |
| 94 | + | |
| 95 | + | |
95 | 96 | | |
96 | 97 | | |
97 | 98 | | |
| |||
116 | 117 | | |
117 | 118 | | |
118 | 119 | | |
| 120 | + | |
119 | 121 | | |
120 | 122 | | |
121 | 123 | | |
122 | 124 | | |
123 | 125 | | |
124 | | - | |
125 | | - | |
126 | | - | |
127 | 126 | | |
128 | 127 | | |
129 | 128 | | |
| |||
212 | 211 | | |
213 | 212 | | |
214 | 213 | | |
| 214 | + | |
| 215 | + | |
215 | 216 | | |
216 | 217 | | |
217 | 218 | | |
| |||
305 | 306 | | |
306 | 307 | | |
307 | 308 | | |
308 | | - | |
309 | 309 | | |
310 | 310 | | |
311 | 311 | | |
| |||
335 | 335 | | |
336 | 336 | | |
337 | 337 | | |
338 | | - | |
| 338 | + | |
| 339 | + | |
339 | 340 | | |
340 | 341 | | |
341 | 342 | | |
| |||
0 commit comments