fix(ci): show fork E2E gate in PR rollup

.github/workflows/pr-e2e-gate.yaml

@@ -58,6 +58,7 @@ jobs:
       checks: write
       contents: read
       pull-requests: read
+      statuses: write
     concurrency:
       group: pr-e2e-gate-${{ github.repository }}-${{ github.event.pull_request.number }}-${{ github.event.pull_request.head.sha }}-${{ github.event.pull_request.base.sha }}
       queue: max
@@ -99,6 +100,7 @@ jobs:
       checks: write
       contents: read
       pull-requests: read
+      statuses: write
     steps:
       - name: Checkout controller
         uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
@@ -136,6 +138,7 @@ jobs:
       checks: write
       contents: read
       pull-requests: read
+      statuses: write
     concurrency:
       group: pr-e2e-gate-${{ github.repository }}-${{ github.event_name == 'workflow_run' && github.event.workflow_run.pull_requests[0].number || inputs.pr_number }}-${{ github.event_name == 'workflow_run' && github.event.workflow_run.head_sha || inputs.expected_head_sha }}-${{ github.event_name == 'workflow_run' && github.event.workflow_run.pull_requests[0].base.sha || inputs.expected_base_sha }}
       queue: max

test/pr-e2e-gate-fork-approval.test.ts

@@ -73,6 +73,10 @@ function prGateMutationResponse(request: RecordedGitHubRequest, id = 17): Respon
   return githubResponse(exactPrGateCheck({ id, ...body }));
 }
 
+function commitStatusMutationResponse(request: RecordedGitHubRequest): Response {
+  return githubResponse(request.body);
+}
+
 function mainWorkflowRefRoute(sha = WORKFLOW_SHA) {
   return githubFetchRoute(
     ({ url }) => url.endsWith("/git/ref/heads/main"),
@@ -273,6 +277,8 @@ describe("PR E2E controller fork credentialed E2E approval safety", () => {
     vi.stubEnv("GITHUB_TOKEN", "token");
     vi.stubEnv("GITHUB_REPOSITORY", "NVIDIA/NemoClaw");
     vi.stubEnv("GITHUB_OUTPUT", outputPath);
+    vi.stubEnv("GITHUB_ACTIONS", "true");
+    vi.stubEnv("GITHUB_WORKFLOW", "E2E / PR Gate Controller");
     const requests: RecordedGitHubRequest[] = [];
     vi.spyOn(globalThis, "fetch").mockImplementation(
       createGitHubFetchRouter(
@@ -298,6 +304,10 @@ describe("PR E2E controller fork credentialed E2E approval safety", () => {
             ({ url, method }) => url.endsWith("/check-runs/17") && method === "PATCH",
             (request) => prGateMutationResponse(request),
           ),
+          githubFetchRoute(
+            ({ url, method }) => url.endsWith(`/statuses/${HEAD_SHA}`) && method === "POST",
+            commitStatusMutationResponse,
+          ),
         ],
         requests,
       ),
@@ -338,6 +348,14 @@ describe("PR E2E controller fork credentialed E2E approval safety", () => {
       expect(JSON.stringify(pending?.body)).toContain(
         "This gate passes only if the dispatched evidence references both SHAs and verifies successfully.",
       );
+      const visibleStatus = requests
+        .filter((request) => request.url.endsWith(`/statuses/${HEAD_SHA}`))
+        .at(-1);
+      expect(visibleStatus?.body).toMatchObject({
+        state: "pending",
+        context: "E2E / PR Gate / Rollup",
+        description: "Maintainer approval required to run fork E2E",
+      });
       const outputs = fs.readFileSync(outputPath, "utf8");
       expect(outputs).not.toContain("approval_");
       expect(outputs).toContain("finalized=true");

test/pr-e2e-gate-lifecycle.test.ts

@@ -324,6 +324,8 @@ describe("PR E2E controller lifecycle", () => {
     vi.stubEnv("GITHUB_TOKEN", "token");
     vi.stubEnv("GITHUB_REPOSITORY", "NVIDIA/NemoClaw");
     vi.stubEnv("GITHUB_OUTPUT", outputPath);
+    vi.stubEnv("GITHUB_ACTIONS", "true");
+    vi.stubEnv("GITHUB_WORKFLOW", "E2E / PR Gate Controller");
     const requests: RecordedGitHubRequest[] = [];
     const prior = exactPrGateCheck({
       id: 16,
@@ -355,6 +357,10 @@ describe("PR E2E controller lifecycle", () => {
             ({ url, method }) => url.endsWith("/check-runs/17") && method === "PATCH",
             (request) => prGateMutationResponse(request),
           ),
+          githubFetchRoute(
+            ({ url, method }) => url.endsWith(`/statuses/${HEAD_SHA}`) && method === "POST",
+            (request) => githubResponse(request.body),
+          ),
         ],
         requests,
       ),
@@ -383,6 +389,15 @@ describe("PR E2E controller lifecycle", () => {
           ),
         },
       });
+      const rollupStatus = requests.find((request) =>
+        request.url.endsWith(`/statuses/${HEAD_SHA}`),
+      );
+      expect(rollupStatus?.body).toEqual({
+        state: "success",
+        context: "E2E / PR Gate / Rollup",
+        description: "All selected E2E checks passed",
+        target_url: "https://github.com/NVIDIA/NemoClaw/runs/17",
+      });
     } finally {
       fs.rmSync(workDir, { recursive: true, force: true });
     }
@@ -1370,6 +1385,8 @@ describe("PR E2E controller lifecycle", () => {
     vi.stubEnv("GITHUB_TOKEN", "token");
     vi.stubEnv("GITHUB_REPOSITORY", "NVIDIA/NemoClaw");
     vi.stubEnv("GITHUB_OUTPUT", outputPath);
+    vi.stubEnv("GITHUB_ACTIONS", "true");
+    vi.stubEnv("GITHUB_WORKFLOW", "E2E / PR Gate Controller");
     const requests: RecordedGitHubRequest[] = [];
     vi.spyOn(globalThis, "fetch").mockImplementation(
       createGitHubFetchRouter(
@@ -1386,6 +1403,10 @@ describe("PR E2E controller lifecycle", () => {
             ({ url, method }) => url.endsWith("/check-runs/17") && method === "PATCH",
             (request) => prGateMutationResponse(request),
           ),
+          githubFetchRoute(
+            ({ url, method }) => url.endsWith(`/statuses/${HEAD_SHA}`) && method === "POST",
+            (request) => githubResponse(request.body),
+          ),
         ],
         requests,
       ),
@@ -1397,6 +1418,7 @@ describe("PR E2E controller lifecycle", () => {
         "https://api.github.com/repos/NVIDIA/NemoClaw/check-runs/17",
         "https://api.github.com/repos/NVIDIA/NemoClaw/actions/runs/23/cancel",
         "https://api.github.com/repos/NVIDIA/NemoClaw/check-runs/17",
+        `https://api.github.com/repos/NVIDIA/NemoClaw/statuses/${HEAD_SHA}`,
       ]);
       expect(requests[2]?.body).toMatchObject({
         status: "completed",
@@ -1406,6 +1428,12 @@ describe("PR E2E controller lifecycle", () => {
           summary: "The controller stopped before it could complete the check.",
         },
       });
+      expect(requests[3]?.body).toEqual({
+        state: "failure",
+        context: "E2E / PR Gate / Rollup",
+        description: "Controller stopped early",
+        target_url: "https://github.com/NVIDIA/NemoClaw/runs/17",
+      });
       expect(fs.readFileSync(outputPath, "utf8")).toContain("finalized=true");
     } finally {
       fs.rmSync(directory, { recursive: true, force: true });

test/pr-e2e-gate-rollup-status.test.ts

@@ -0,0 +1,130 @@
+// SPDX-FileCopyrightText: Copyright (c) 2026 NVIDIA CORPORATION & AFFILIATES. All rights reserved.
+// SPDX-License-Identifier: Apache-2.0
+
+import { afterEach, describe, expect, it, vi } from "vitest";
+import { type PullRequest, prGateExternalId, seedPrGate } from "../tools/e2e/pr-e2e-gate.mts";
+import {
+  createGitHubFetchRouter,
+  githubFetchRoute,
+  type RecordedGitHubRequest,
+} from "./support/github-fetch-router.ts";
+
+const HEAD_SHA = "a".repeat(40);
+const BASE_SHA = "b".repeat(40);
+
+afterEach(() => {
+  vi.restoreAllMocks();
+  vi.unstubAllEnvs();
+});
+
+function githubResponse(value?: unknown, status = 200): Response {
+  return {
+    ok: status >= 200 && status < 300,
+    status,
+    json: async () => value,
+    text: async () => (value === undefined ? "" : JSON.stringify(value)),
+  } as Response;
+}
+
+function forkPullRequest(): PullRequest {
+  return {
+    number: 42,
+    state: "open",
+    changed_files: 1,
+    head: {
+      ref: "feature/pr-e2e-gate",
+      sha: HEAD_SHA,
+      repo: { full_name: "contributor/NemoClaw" },
+    },
+    base: {
+      sha: BASE_SHA,
+      repo: { full_name: "NVIDIA/NemoClaw" },
+    },
+  };
+}
+
+function exactPrGateCheck(overrides: Record<string, unknown> = {}) {
+  return {
+    id: 17,
+    name: "E2E / PR Gate",
+    head_sha: HEAD_SHA,
+    external_id: prGateExternalId(42, HEAD_SHA, BASE_SHA),
+    status: "in_progress",
+    conclusion: null,
+    output: {
+      title: "Maintainer approval required to run fork E2E",
+      summary: "A maintainer must approve this fork E2E run.",
+    },
+    app: { id: 15368 },
+    ...overrides,
+  };
+}
+
+function controllerRoutes(statusResponse: (request: RecordedGitHubRequest) => Response) {
+  return [
+    githubFetchRoute(
+      ({ url, method }) => url.endsWith("/pulls/42") && method === "GET",
+      () => githubResponse(forkPullRequest()),
+    ),
+    githubFetchRoute(
+      ({ url, method }) => url.includes(`/commits/${HEAD_SHA}/check-runs?`) && method === "GET",
+      () => githubResponse({ total_count: 1, check_runs: [exactPrGateCheck()] }),
+    ),
+    githubFetchRoute(
+      ({ url, method }) => url.endsWith(`/statuses/${HEAD_SHA}`) && method === "POST",
+      statusResponse,
+    ),
+  ];
+}
+
+describe("PR E2E gate rollup status", () => {
+  it("publishes a pending PR rollup status for a fork gate", async () => {
+    vi.stubEnv("GITHUB_ACTIONS", "true");
+    vi.stubEnv("GITHUB_WORKFLOW", "E2E / PR Gate Controller");
+    vi.stubEnv("GITHUB_TOKEN", "token");
+    vi.stubEnv("GITHUB_REPOSITORY", "NVIDIA/NemoClaw");
+    const requests: RecordedGitHubRequest[] = [];
+    vi.spyOn(globalThis, "fetch").mockImplementation(
+      createGitHubFetchRouter(
+        controllerRoutes((request) => githubResponse(request.body)),
+        requests,
+      ),
+    );
+
+    await expect(seedPrGate(42, HEAD_SHA, BASE_SHA)).resolves.toBe(17);
+    expect(requests.at(-1)).toMatchObject({
+      method: "POST",
+      body: {
+        state: "pending",
+        context: "E2E / PR Gate / Rollup",
+        description: "Maintainer approval required to run fork E2E",
+        target_url: "https://github.com/NVIDIA/NemoClaw/runs/17",
+      },
+    });
+  });
+
+  it("keeps the authoritative gate usable when rollup publication fails", async () => {
+    vi.stubEnv("GITHUB_ACTIONS", "true");
+    vi.stubEnv("GITHUB_WORKFLOW", "E2E / PR Gate Controller");
+    vi.stubEnv("GITHUB_TOKEN", "token");
+    vi.stubEnv("GITHUB_REPOSITORY", "NVIDIA/NemoClaw");
+    const warning = vi.spyOn(console, "warn").mockImplementation(() => undefined);
+    const requests: RecordedGitHubRequest[] = [];
+    vi.spyOn(globalThis, "fetch").mockImplementation(
+      createGitHubFetchRouter(
+        controllerRoutes(() => githubResponse({ message: "temporary failure" }, 503)),
+        requests,
+      ),
+    );
+
+    await expect(seedPrGate(42, HEAD_SHA, BASE_SHA)).resolves.toBe(17);
+    expect(
+      requests.filter(
+        (request) => request.url.endsWith(`/statuses/${HEAD_SHA}`) && request.method === "POST",
+      ),
+    ).toHaveLength(2);
+    expect(warning).toHaveBeenCalledWith(
+      expect.stringContaining("Could not publish E2E / PR Gate / Rollup"),
+    );
+  });
+});

test/pr-e2e-gate-workflow.test.ts

@@ -348,6 +348,7 @@ describe("PR E2E gate workflow", () => {
       checks: "write",
       contents: "read",
       "pull-requests": "read",
+      statuses: "write",
     });
     expect(initialize.concurrency?.group).toBe(
       "pr-e2e-gate-${{ github.repository }}-${{ github.event.pull_request.number }}-${{ github.event.pull_request.head.sha }}-${{ github.event.pull_request.base.sha }}",
@@ -367,6 +368,7 @@ describe("PR E2E gate workflow", () => {
       checks: "write",
       contents: "read",
       "pull-requests": "read",
+      statuses: "write",
     });
     expect(coordinate.if).toContain("github.event_name == 'workflow_run'");
     expect(coordinate.if).toContain("github.event.workflow_run.event == 'pull_request'");
@@ -385,6 +387,7 @@ describe("PR E2E gate workflow", () => {
       checks: "write",
       contents: "read",
       "pull-requests": "read",
+      statuses: "write",
     });
     expect(coordinate.concurrency?.group).toBe(
       "pr-e2e-gate-${{ github.repository }}-${{ github.event_name == 'workflow_run' && github.event.workflow_run.pull_requests[0].number || inputs.pr_number }}-${{ github.event_name == 'workflow_run' && github.event.workflow_run.head_sha || inputs.expected_head_sha }}-${{ github.event_name == 'workflow_run' && github.event.workflow_run.pull_requests[0].base.sha || inputs.expected_base_sha }}",

test/pr-e2e-gate.test.ts

@@ -134,6 +134,7 @@ function prGateMutationResponse(request: RecordedGitHubRequest, id = 17): Respon
   const body = (request.body ?? {}) as Record<string, unknown>;
   return githubResponse(exactPrGateCheck({ id, ...body }));
 }
+
 function sha256(value: string): string {
   return createHash("sha256").update(value).digest("hex");
 }