ci: auto-update release notes on push to main by ericksoa · Pull Request #1 · NVIDIA/NemoClaw

ericksoa · 2026-03-16T18:25:53Z

Migrated from NVIDIA/openshell-openclaw-plugin#31

Summary

Adds a GitHub Actions workflow that auto-updates docs/about/release-notes.md on every push to main
Categorizes commits into Features / Fixes / Other based on commit message prefixes (case-insensitive)
Filters out noise: reverts, chores, docs-only, test-only, style, and low-signal commits
Scopes to only new commits since last run (uses [release-notes] marker in commit message)
Self-loop prevention: skips if the triggering commit is from this workflow
Commits back with -s (DCO signed-off)

How it works

On push to main, collects non-merge commits since last tag or last [release-notes] commit
Categorizes by prefix: add/feat → Features, fix → Fixes, everything else → Other
Inserts a dated block under the ## 0.1.0 Unreleased heading
Commits and pushes the updated file

Test plan

Merge a commit to main and verify the workflow runs
Check that docs/about/release-notes.md gets a new dated section
Verify the workflow doesn't trigger itself (no infinite loop)
Verify commit messages are correctly categorized

…to main Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com> Signed-off-by: Aaron Erickson <aerickson@nvidia.com>

Add a preflight check that catches the #1 onboarding blocker on Ubuntu 24.04, DGX Spark, and WSL2. When cgroup v2 is active but Docker's daemon.json lacks "default-cgroupns-mode": "host", onboarding now fails fast with a clear error and fix instructions instead of failing late at gateway startup with a cryptic kubelet error. Closes #16

wscurran · 2026-03-20T23:17:23Z

Thanks for setting up a GitHub Actions workflow that automatically updates the release notes on pushes to the main branch, which could help keep the documentation up to date and reduce manual effort.

cv · 2026-03-21T19:27:31Z

Hi @ericksoa! Thanks for putting this together — auto-updating release notes is something we've been wanting. Since this was opened, the repo has seen a lot of activity: we've added CI checks, new features, and restructured a few things. Would you mind rebasing onto the latest main when you get a chance? That way we can give it a proper review with everything up to date. Appreciate it!

ericksoa · 2026-03-22T16:30:51Z

Superseded — release notes page now points to GitHub native releases/commits/PRs.

- Default model: nvidia/nemotron-3-super-120b-a12b (March 2026 release, 12B active / 120B total MoE, 5x throughput) - Replace meta/llama-3.3-70b-instruct with Nemotron 3 Super in the nvidia provider catalog (Dockerfile sed patch at build time) - All NVIDIA models in provider: Nemotron 70B, Mistral NeMo Minitron, Nemotron 3 Super — no Meta/Llama - Blueprint default profile updated to nemotron-3-super-120b-a12b - Tracked as tech debt: NVIDIA#1 Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

…IA#62) Add a preflight check that catches the NVIDIA#1 onboarding blocker on Ubuntu 24.04, DGX Spark, and WSL2. When cgroup v2 is active but Docker's daemon.json lacks "default-cgroupns-mode": "host", onboarding now fails fast with a clear error and fix instructions instead of failing late at gateway startup with a cryptic kubelet error. Closes NVIDIA#16

Nightly agent that monitors upstream NVIDIA/NemoClaw and NVIDIA/OpenShell for breaking changes, updates project docs/config, and sends a daily Telegram summary. Uses qwen3-coder:30b (local Ollama) via cron inside the sandbox. - Add agent skill: .agents/skills/compass/platform-update-reviewer/SKILL.md - Add nvidia_docs network policy (docs.nvidia.com, developer.nvidia.com) - Add openclaw/node binaries to github policy for API access - Add .state/ to .gitignore for deployment-specific state - Update AGENT-SPECS.md with implementation details - Reorder PLAN.md build order (Platform Update Reviewer is now #1) Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

…docs Add two behavioral tests that directly validate cv's blocker NVIDIA#1 fix: - Healthy gateway is preserved (no destroy/forward-stop) on rerun - Stale vs healthy vs active-unnamed states trigger correct cleanup Also add setup-jetson entry to docs/reference/commands.md. Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

… (#1305) ## Summary Fixes the four issues reported in #1114 — EACCES permission errors and missing gateway token when running inside the NemoClaw sandbox. ### Issue mapping | # | Reported error | Fix | |---|----------------|-----| | 1 | `EACCES: open '/sandbox/.openclaw/openclaw.json.*.tmp'` | `install_configure_guard` — intercepts `openclaw configure` with a clear error and directs users to `nemoclaw onboard --resume` on the host | | 2 | Same as #1 (different PID) | Same fix | | 3 | `EACCES: mkdir '/sandbox/.openclaw/credentials'` | Already resolved on main via #1519 (credentials symlink to `.openclaw-data/`) | | 4 | No WhatsApp QR code | Consequence of #3, also resolved by #1519 | ### Root cause (issues 1 & 2) OpenClaw's `configure` command performs atomic writes — it creates a temp file (`openclaw.json.PID.UUID.tmp`) in the same directory as the config. Since `/sandbox/.openclaw/` is Landlock read-only at the kernel level, file creation is rejected with EACCES. This is by design: the sandbox config is intentionally immutable at runtime. Rather than weakening Landlock (security regression), we intercept the command in the sandbox shell and guide users to the correct host-side workflow. ### Changes **1. `install_configure_guard()`** — Writes a shell function wrapper to `.bashrc`/`.profile` that intercepts `openclaw configure` and prints: ``` Error: 'openclaw configure' cannot modify config inside the sandbox. The sandbox config is read-only (Landlock enforced) for security. To change your configuration, exit the sandbox and run: nemoclaw onboard --resume This rebuilds the sandbox with your updated settings. ``` All other `openclaw` subcommands pass through to the real binary. **2. `export_gateway_token()`** — Reads `gateway.auth.token` from `openclaw.json` and exports it as `OPENCLAW_GATEWAY_TOKEN`, so interactive sessions (`openshell sandbox connect`) can authenticate with the gateway. Persists to `.bashrc`/`.profile` using idempotent marker blocks and cleans stale tokens on revocation. **3. `_read_gateway_token()` helper** — Shared Python snippet used by both `export_gateway_token` and `print_dashboard_urls` (deduplication, uses `with open()` context manager). All three are called in both root and non-root startup paths. ## Security properties preserved - `/sandbox/.openclaw` remains root-owned, Landlock read-only - `openclaw.json` remains chmod 444 (immutable) - No new attack surface — token is read-only from existing config - `command openclaw` bypass preserves all non-configure functionality Fixes #1114 Signed-off-by: Dongni Yang <dongniy@nvidia.com> Co-authored-by: Claude Sonnet 4.6 <noreply@anthropic.com> Co-authored-by: Claude Opus 4.6 (1M context) <noreply@anthropic.com> --------- Signed-off-by: Dongni Yang <dongniy@nvidia.com> Co-authored-by: Claude Sonnet 4.6 <noreply@anthropic.com>

…IA#1114) (NVIDIA#1305) ## Summary Fixes the four issues reported in NVIDIA#1114 — EACCES permission errors and missing gateway token when running inside the NemoClaw sandbox. ### Issue mapping | # | Reported error | Fix | |---|----------------|-----| | 1 | `EACCES: open '/sandbox/.openclaw/openclaw.json.*.tmp'` | `install_configure_guard` — intercepts `openclaw configure` with a clear error and directs users to `nemoclaw onboard --resume` on the host | | 2 | Same as NVIDIA#1 (different PID) | Same fix | | 3 | `EACCES: mkdir '/sandbox/.openclaw/credentials'` | Already resolved on main via NVIDIA#1519 (credentials symlink to `.openclaw-data/`) | | 4 | No WhatsApp QR code | Consequence of NVIDIA#3, also resolved by NVIDIA#1519 | ### Root cause (issues 1 & 2) OpenClaw's `configure` command performs atomic writes — it creates a temp file (`openclaw.json.PID.UUID.tmp`) in the same directory as the config. Since `/sandbox/.openclaw/` is Landlock read-only at the kernel level, file creation is rejected with EACCES. This is by design: the sandbox config is intentionally immutable at runtime. Rather than weakening Landlock (security regression), we intercept the command in the sandbox shell and guide users to the correct host-side workflow. ### Changes **1. `install_configure_guard()`** — Writes a shell function wrapper to `.bashrc`/`.profile` that intercepts `openclaw configure` and prints: ``` Error: 'openclaw configure' cannot modify config inside the sandbox. The sandbox config is read-only (Landlock enforced) for security. To change your configuration, exit the sandbox and run: nemoclaw onboard --resume This rebuilds the sandbox with your updated settings. ``` All other `openclaw` subcommands pass through to the real binary. **2. `export_gateway_token()`** — Reads `gateway.auth.token` from `openclaw.json` and exports it as `OPENCLAW_GATEWAY_TOKEN`, so interactive sessions (`openshell sandbox connect`) can authenticate with the gateway. Persists to `.bashrc`/`.profile` using idempotent marker blocks and cleans stale tokens on revocation. **3. `_read_gateway_token()` helper** — Shared Python snippet used by both `export_gateway_token` and `print_dashboard_urls` (deduplication, uses `with open()` context manager). All three are called in both root and non-root startup paths. ## Security properties preserved - `/sandbox/.openclaw` remains root-owned, Landlock read-only - `openclaw.json` remains chmod 444 (immutable) - No new attack surface — token is read-only from existing config - `command openclaw` bypass preserves all non-configure functionality Fixes NVIDIA#1114 Signed-off-by: Dongni Yang <dongniy@nvidia.com> Co-authored-by: Claude Sonnet 4.6 <noreply@anthropic.com> Co-authored-by: Claude Opus 4.6 (1M context) <noreply@anthropic.com> --------- Signed-off-by: Dongni Yang <dongniy@nvidia.com> Co-authored-by: Claude Sonnet 4.6 <noreply@anthropic.com>

- Guard runArgv/runArgvCapture against shell:true to prevent security bypass (finding NVIDIA#1) — throws if a caller attempts to re-enable shell interpretation. Added 2 tests. - Document the intentional bash -c exception in getOllamaWarmupCommand explaining why it's safe (finding NVIDIA#2). - Remove dead getOpenshellCommand() from policies.ts (finding NVIDIA#3). - Remove unused shellQuote import from nim.ts (finding NVIDIA#4). - Fix brittle indexOf assertion in onboard-readiness test (finding NVIDIA#5).

ci: add GitHub Actions workflow to auto-update release notes on push …

c620af8

…to main Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com> Signed-off-by: Aaron Erickson <aerickson@nvidia.com>

cluster2600 mentioned this pull request Mar 18, 2026

Mission Control cannot connect to OpenClaw gateway inside NemoClaw sandbox #328

Closed

wscurran added the CI/CD Use this label to identify issues with NemoClaw CI/CD pipeline or GitHub Actions. label Mar 20, 2026

wscurran added the Integration: GitHub Use this label to identify GitHub integration issues with NemoClaw. label Mar 20, 2026

ericksoa closed this Mar 22, 2026

This was referenced Mar 22, 2026

nemoclaw fails to detect GPU on NVIDIA Jetson Thor and Orin #300

Closed

Install issues #360

Closed

zNeill mentioned this pull request Mar 26, 2026

[NeMoClaw][Linux] nemoclaw deploy fails: Brev CLI does not support --gpu flag #998

Closed

ACCGAGTT mentioned this pull request Mar 27, 2026

Web search tools fail in sandbox: DNS resolution blocked (getaddrinfo EAI_AGAIN) #626

Closed

drmarcopapa mentioned this pull request Mar 31, 2026

npm install inside sandbox extremely slow — 310s timeouts on FETCH_ERROR retries #1043

Closed

2 tasks

prekshivyas mentioned this pull request Apr 6, 2026

fix(preflight): warn when installed OpenShell version differs from tested version #1314

Closed

Dongni-Yang mentioned this pull request Apr 7, 2026

fix(sandbox): guard openclaw configure and export gateway token (#1114) #1305

Merged

ColinM-sys mentioned this pull request Apr 9, 2026

docs(k8s): document evaluation-only patterns and production alternatives (#1442) #1676

Open

3 tasks

ericksoa mentioned this pull request Apr 12, 2026

feat(vm): openshell-vm microVM gateway backend (full lifecycle, E2E 30/30) #1791

Draft

10 tasks

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

ci: auto-update release notes on push to main#1

ci: auto-update release notes on push to main#1
ericksoa wants to merge 1 commit intomainfrom
ci/auto-release-notes

ericksoa commented Mar 16, 2026

Uh oh!

wscurran commented Mar 20, 2026

Uh oh!

cv commented Mar 21, 2026

Uh oh!

ericksoa commented Mar 22, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

Conversation

ericksoa commented Mar 16, 2026

Summary

How it works

Test plan

Uh oh!

wscurran commented Mar 20, 2026

Uh oh!

cv commented Mar 21, 2026

Uh oh!

ericksoa commented Mar 22, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants