Add /claude fix workflow for on-demand PR fixes by Phlip79 · Pull Request #4862 · NVIDIA/Megatron-LM

Phlip79 · 2026-05-19T03:55:17Z

Summary

Adds a maintainer-only /claude fix [optional steer] PR-comment command for:

ordinary text merge conflicts;
terminal lint failures; and
ordinary, non-GB200 unit-test failures.

A bare /claude fix uses the current conflict or latest supported CI failure. The workflow makes up to three attempts, leaves at most one svcnvidia-nemo-ci commit per session, and posts a service-account comment explaining each published revision.

Flow

authorize and pin PR/base
  -> prepare a read-only Claude proposal
  -> independently validate and publish
  -> run and monitor exact-SHA CI
  -> retry only for supported failures

The first publication is a normal fast-forward push. Later attempts may amend only the exact service-account commit created earlier in the same session, using an exact --force-with-lease with no fallback. Every revision is rechecked by DCO and CI.

Safety

Both workflows default to permissions: {} and grant permissions per job. Claude receives no PAT, OIDC token, or GitHub write access.
Only forks of NVIDIA/Megatron-LM are accepted. Maintainer edits must be enabled, and the target cannot be the fork's default or protected branch.
Head, base, requester, fork, and branch state are pinned and rechecked before publication and CI authorization.
.github/**, CODEOWNERS, and SECURITY.md changes are rejected. Generated changes cannot create, delete, rename, change modes, add binary content, or touch files outside the PR/conflict scope.
Merge repair accepts only ordinary three-stage text conflicts with matching regular-file modes. Modify/delete, add/add, symlink, mode-mismatch, and binary conflicts fail closed.
Each attempt is limited to 25 files, 1,000 changed lines, a 10 MiB patch, 100 Claude turns, and 90 minutes of preparation.
CI iteration is limited to lint and ordinary unit tests. Functional, integration, GB200, infrastructure, DCO, policy, cancelled, and unknown failures stop for manual handling.
Service commits use svcnvidia-nemo-ci <svcnvidia-nemo-ci@nvidia.com> with the matching Signed-off-by trailer. The trusted DCO app must pass before CI is authorized.
NVIDIA inference configuration follows Use NVIDIA inference credentials for Claude actions #5589.

/claude fix is explicit maintainer authorization for a model-generated commit to enter internal CI. Structural validation cannot prove semantic correctness, so it should be used only on PRs whose existing content is trusted.

Validation

Actionlint, YAML parsing, bash -n for all 14 shell blocks, and git diff --check.
Mock histories covering one to three attempts, merge commits, delayed first changes, parent/message/DCO preservation, and stale-lease rejection.
Fixtures for exact-SHA CI selection, supported-failure classification, patch reconstruction, path/size limits, report sanitization, and idempotent comments.
Conflict-gate tests covering ordinary/executable text, modify/delete, delete/modify, add/add, mode mismatch, symlink, binary content, and unusual paths.

Live API-dispatched canaries:

#3005 / run 28405228308: resolved a text conflict and normally fast-forwarded the fork branch.
#3370 / run 28536954502: rejected a modify/delete conflict before Claude ran and left the branch unchanged.
#5262 / run 28540314675: published signed-off commit a2b79903, posted the required service explanation, passed DCO, and entered exact-SHA CI. This test also exposed and verified the fix for staging Claude's local conflict resolution before checking Git's unmerged index.

All temporary canary wiring was removed additively and copied out of NVIDIA's pull-request/4862 ref. No development or target branch was force-pushed.

The normal issue_comment entry point becomes active after this workflow is merged to the default branch.

copy-pr-bot · 2026-05-19T03:55:21Z

This pull request requires additional validation before any workflows can run on NVIDIA's runners.

Pull request vetters can view their responsibilities here.

Contributors can view more details about this message here.

Add a maintainer-triggered, bounded workflow for resolving ordinary merge conflicts and terminal lint or unit-test failures. Separate authorization, read-only Claude preparation, clean-room validation, and deterministic publication. Keep credentials out of the model, validate the exact result tree and paths, create DCO-signed-off bot commits, and require human CI authorization. Signed-off-by: Philip Petrakian <ppetrakian@nvidia.com>

copy-pr-bot · 2026-06-29T20:55:20Z

Auto-sync is disabled for draft pull requests in this repository. Workflows must be run manually.

Contributors can view more details about this message here.