test(guardrails): consolidate growth checks in Vitest (NVIDIA#9354)

<!-- markdownlint-disable MD041 -->
## Summary

Run the codebase growth policies as ordinary Vitest tests instead of
separate scanners, evaluators, wrappers, and npm targets. The same tests
now serve local changes and the trusted pull request workflow, reducing
the implementation by 2,532 lines while preserving the five existing
policies.

## Changes

- Add one Vitest suite for new JavaScript files, `src/lib/onboard.ts`
growth, test size budgets, test conditionals, and test loops.
- Use one shared diff reader for local Git changes and pull request
blobs.
- Replace the seven-step growth workflow and the standalone pre-commit
entry point with the same focused Vitest command.
- Delete the superseded scanners, evaluators, wrapper tests, and two
obsolete npm targets. Keep one bridge target for the base-trusted static
action that executes against this PR, while the updated action uses the
consolidated hook directly after merge.
- Make the TypeScript requirement for new test files explicit in the
contributor guide.

## Type of Change

- [x] Code change (feature, bug fix, or refactor)
- [ ] Code change with doc updates
- [ ] Doc only (prose changes, no code sample modifications)
- [ ] Doc only (includes code sample changes)

## Quality Gates

- [x] Tests added or updated for changed behavior
- [ ] Existing tests cover changed behavior — justification:
- [ ] Tests not applicable — justification:
- [x] Sensitive paths changed (security, policy, credentials, preflight,
onboarding, inference, runner, sandbox, or messaging)
- [ ] Sensitive-path review completed or maintainer-approved waiver
recorded — reviewer/approval link/justification:
- [ ] Non-success, skipped, or missing CI check accepted by maintainer —
check name, approval link, and follow-up issue:

## Verification

- [x] PR description includes a `Signed-off-by:` line and every commit
appears as `Verified` in GitHub
- [x] Normal `pre-commit`, `commit-msg`, and `pre-push` hooks passed, or
`npm run validate:pr` passed after refreshing `origin/main` when hooks
were skipped or unavailable
- [x] Targeted behavior tests pass for the current change set, or tests
are marked not applicable above — `npx vitest run --project integration
test/growth-guardrails.test.ts
test/growth-guardrails-workflow-boundary.test.ts
test/growth-guardrails-pr-blob-client.test.ts` (33 passed)
- [ ] Applicable broad gate passed — `npm run check` completed with
29,085 passing tests and 40 unrelated host-sensitive failures caused by
a foreign user systemd service, local platform facts, and a
group-writable parent directory; the codebase growth hook and plugin
coverage passed
- [x] Quality Gates section completed with required justifications or
waivers
- [x] No secrets, API keys, or credentials committed
- [ ] `npm run docs` builds without warnings (doc changes only)
- [ ] Doc pages follow the [style
guide](https://github.com/NVIDIA/NemoClaw/blob/main/docs/CONTRIBUTING.md)
(doc changes only)
- [ ] New doc pages include SPDX header and frontmatter (new pages only)

---
Signed-off-by: Carlos Villela <cvillela@nvidia.com>


<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit

* **Refactor**
  * Consolidated code-growth checks into a unified validation suite.
  * Simplified validation for changed files and pull requests.
  * Updated pre-commit and changed-test workflows to use unified checks.
  * Removed redundant standalone scans and budget checks.

* **Documentation**
* Updated contribution guidance to require TypeScript for new test
files.

* **Tests**
* Added coverage for growth limits, syntax patterns, renamed files, and
pull-request changes.
  * Added direct validation of workflow configuration.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->

---------

Signed-off-by: Carlos Villela <cvillela@nvidia.com>

Author: cv

.github/actions/ci-static-checks/action.yaml

@@ -55,17 +55,12 @@ runs:
       run: |
         npx prek run --all-files --stage pre-commit \
           --skip source-shape-test-budget \
-          --skip test-file-size-budget \
           --skip test-skills-yaml
 
     - name: Run source-shape budget
       shell: bash
       run: npm run source-shape:check
 
-    - name: Run test file size budget
-      shell: bash
-      run: npm run test-size:check
-
     - name: Verify platform matrix is in sync
       shell: bash
       run: python3 scripts/generate-platform-docs.py --check

.github/workflows/codebase-growth-guardrails.yaml

@@ -21,92 +21,6 @@ jobs:
     runs-on: ubuntu-latest
     timeout-minutes: 5
     steps:
-      - name: Block newly added JavaScript files
-        env:
-          GH_TOKEN: ${{ github.token }}
-          PR_NUMBER: ${{ github.event.pull_request.number }}
-          REPO: ${{ github.repository }}
-        run: |
-          set -euo pipefail
-
-          rows="$(gh api --paginate "/repos/${REPO}/pulls/${PR_NUMBER}/files" \
-            --jq '.[] | select((.filename | test("\\.(js|cjs|mjs)$")) and (.status == "added" or (.status == "renamed" and ((.previous_filename // "") | test("\\.(js|cjs|mjs)$") | not)))) | [.status, .filename, (.previous_filename // "")] | @tsv')"
-
-          if [ -z "$rows" ]; then
-            echo "PASS: no newly added .js, .cjs, or .mjs files."
-            exit 0
-          fi
-
-          cat <<'EOF'
-          FAIL: this PR adds JavaScript source files.
-
-          NemoClaw is standardizing on TypeScript for new Node.js code. Please
-          use .ts for new source, test, and script files instead of .js, .cjs,
-          or .mjs. Existing JavaScript files may still be modified or deleted.
-
-          Blocked files:
-          EOF
-          while IFS=$'\t' read -r file_status file_path previous_path; do
-            if [ -n "$previous_path" ]; then
-              echo "          - ${file_path} (${file_status} from ${previous_path})"
-            else
-              echo "          - ${file_path} (${file_status})"
-            fi
-          done <<< "$rows"
-          exit 1
-
-      - name: Require src/lib/onboard.ts to be net-neutral or smaller
-        env:
-          GH_TOKEN: ${{ github.token }}
-          PR_NUMBER: ${{ github.event.pull_request.number }}
-          REPO: ${{ github.repository }}
-          TARGET_FILE: src/lib/onboard.ts
-          EXTRACTION_DIR: src/lib/onboard/
-        run: |
-          set -euo pipefail
-
-          # Intentionally hard-code TARGET_FILE in the jq expression. gh's jq
-          # filter does not accept shell variables directly, and missing
-          # previous_filename values must not match every file.
-          rows="$(gh api --paginate "/repos/${REPO}/pulls/${PR_NUMBER}/files" \
-            --jq '.[] | select(.filename == "src/lib/onboard.ts" or .previous_filename == "src/lib/onboard.ts") | [.additions, .deletions, .filename] | @tsv')"
-
-          if [ -z "$rows" ]; then
-            echo "${TARGET_FILE} was not changed. New modules under ${EXTRACTION_DIR} are allowed."
-            exit 0
-          fi
-
-          additions=0
-          deletions=0
-          while IFS=$'\t' read -r file_additions file_deletions _file_path; do
-            if [ -z "${file_additions:-}" ]; then
-              continue
-            fi
-            additions=$((additions + file_additions))
-            deletions=$((deletions + file_deletions))
-          done <<< "$rows"
-
-          net=$((additions - deletions))
-          echo "${TARGET_FILE}: +${additions}/-${deletions} (net ${net})"
-          echo "Growth under ${EXTRACTION_DIR} is allowed; this budget applies only to ${TARGET_FILE}."
-
-          if [ "$additions" -le "$deletions" ]; then
-            echo "PASS: ${TARGET_FILE} is net-neutral or smaller."
-            exit 0
-          fi
-
-          cat <<EOF
-          FAIL: ${TARGET_FILE} grew by ${net} line(s).
-
-          ${TARGET_FILE} is already about 12k lines. Please move new logic into
-          focused modules under ${EXTRACTION_DIR}, or reduce ${TARGET_FILE} by at
-          least as many lines as this PR adds there.
-
-          This check allows src/lib/onboard/** to grow. It only blocks net growth
-          in the top-level onboard entrypoint.
-          EOF
-          exit 1
-
       - name: Check out the trusted base revision
         uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
@@ -116,32 +30,9 @@ jobs:
       - name: Install trusted dependencies
         run: npm ci --ignore-scripts --no-audit --no-fund
 
-      - name: Require changed test files to stay within size budget
-        env:
-          GH_TOKEN: ${{ github.token }}
-          PR_NUMBER: ${{ github.event.pull_request.number }}
-          REPO: ${{ github.repository }}
-          BASE_SHA: ${{ github.event.pull_request.base.sha }}
-          HEAD_REPO: ${{ github.event.pull_request.head.repo.full_name }}
-          HEAD_SHA: ${{ github.event.pull_request.head.sha }}
-        run: |
-          set -euo pipefail
-          node --experimental-strip-types tools/growth-guardrails/test-size-budget.mts
-
-      - name: Require changed test files not to add if statements
-        env:
-          GH_TOKEN: ${{ github.token }}
-          PR_NUMBER: ${{ github.event.pull_request.number }}
-          REPO: ${{ github.repository }}
-          BASE_SHA: ${{ github.event.pull_request.base.sha }}
-          HEAD_REPO: ${{ github.event.pull_request.head.repo.full_name }}
-          HEAD_SHA: ${{ github.event.pull_request.head.sha }}
-        run: |
-          set -euo pipefail
-          node --experimental-strip-types tools/growth-guardrails/test-conditionals.mts
-
-      - name: Require changed test files not to increase test-loop counts
+      - name: Test codebase growth guardrails
         env:
+          NEMOCLAW_GROWTH_PR: "1"
           GH_TOKEN: ${{ github.token }}
           PR_NUMBER: ${{ github.event.pull_request.number }}
           REPO: ${{ github.repository }}
@@ -150,4 +41,4 @@ jobs:
           HEAD_SHA: ${{ github.event.pull_request.head.sha }}
         run: |
           set -euo pipefail
-          node --experimental-strip-types tools/growth-guardrails/test-loops.mts
+          npx vitest run --project integration test/growth-guardrails.test.ts

.pre-commit-config.yaml

@@ -333,12 +333,12 @@ repos:
         files: ^(.+\.(test|spec)\.(js|ts|mjs|mts|cjs|cts)|scripts/find-source-shape-tests\.mts|ci/source-shape-test-budget\.json)$
         priority: 20
 
-      - id: test-file-size-budget
-        name: Test file size budget
-        entry: npm run test-size:check
+      - id: codebase-growth-guardrails
+        name: Codebase growth guardrails
+        entry: npx vitest run --project integration test/growth-guardrails.test.ts
         language: system
+        always_run: true
         pass_filenames: false
-        files: ^(test/|src/.*\.(test|spec)\.(ts|js|mts|mjs|cts|cjs)$|nemoclaw/src/.*\.(test|spec)\.(ts|js|mts|mjs|cts|cjs)$|scripts/check-test-file-size-budget\.mts$|ci/test-file-size-budget\.json$)
         priority: 20
 
       - id: test-skills-yaml

CONTRIBUTING.md

@@ -490,7 +490,7 @@ The repository is organized as follows.
 
 All new source files must be TypeScript. Do not add new `.js` files to the project. When modifying an existing JavaScript file, prefer migrating it to TypeScript in the same PR.
 
-Only a small CommonJS launcher/compatibility layer remains in `bin/`, while the main CLI implementation now lives in `src/lib/` and compiles to `dist/`. Tests in `test/` may remain ESM JavaScript for now but new test files should use TypeScript where practical.
+Only a small CommonJS launcher/compatibility layer remains in `bin/`, while the main CLI implementation now lives in `src/lib/` and compiles to `dist/`. Existing tests in `test/` may remain ESM JavaScript, but new test files must use TypeScript.
 
 Shell scripts (`scripts/*.sh`) must pass ShellCheck and use `shfmt` formatting.
 

ci/source-architecture-budget.json

@@ -62,6 +62,6 @@
     "src/lib/actions/sandbox": 183,
     "src/lib/state": 39,
     "src/lib/inference": 63,
-    "scripts": 46
+    "scripts": 44
   }
 }

ci/source-shape-test-budget.json

@@ -63,7 +63,7 @@
     },
     {
       "file": "test/growth-guardrails-workflow-boundary.test.ts",
-      "test": "flags %s",
+      "test": "runs the trusted Vitest guardrails against pull request data",
       "category": "security"
     },
     {

package.json

@@ -26,7 +26,7 @@
     "test": "npm run clean:cli && npm --prefix nemoclaw run clean && npm run build:cli && npm --prefix nemoclaw run build && vitest run --project cli --project integration --project installer-integration --project package-contract --project plugin --project e2e-support",
     "test:spec": "npm test -- --reporter=tree",
     "test:fast": "npm run clean:cli && npm run catalog:compile && vitest run --project cli --project plugin --project e2e-support",
-    "test:changed": "npm run catalog:compile && vitest run --changed --project cli --project plugin --project e2e-support",
+    "test:changed": "npm run catalog:compile && vitest run --project integration test/growth-guardrails.test.ts && vitest run --changed --project cli --project plugin --project e2e-support",
     "test:watch": "npm run catalog:compile && vitest watch --project cli --project plugin --project e2e-support",
     "test:shuffle": "npm run catalog:compile && vitest run --project cli --project plugin --project e2e-support --sequence.shuffle.tests --coverage=false",
     "test:diagnose:leaks": "npm run catalog:compile && vitest run --project cli --project plugin --project e2e-support --detectAsyncLeaks --coverage=false --reporter=default --reporter=hanging-process",
@@ -66,9 +66,7 @@
     "type-safety:hotspots": "tsx scripts/type-safety-hotspots.mts",
     "source-shape:scan": "tsx scripts/find-source-shape-tests.mts --metrics",
     "source-shape:check": "tsx scripts/find-source-shape-tests.mts --check",
-    "test-size:check": "tsx scripts/check-test-file-size-budget.mts",
-    "test-conditionals:scan": "tsx scripts/find-test-conditionals.mts",
-    "test-loops:scan": "tsx scripts/growth-guardrails/find-test-loops.mts",
+    "test-size:check": "vitest run --project integration test/growth-guardrails.test.ts",
     "bump:version": "tsx scripts/bump-version.mts",
     "release:plan": "tsx scripts/release-plan.mts",
     "release:cut": "bash scripts/release-cut-tag.sh",