chore: address Sonar scan findings by willkill07 · Pull Request #137 · NVIDIA/NeMo-Relay

willkill07 · 2026-05-21T14:23:38Z

Overview

Address the current Sonar scan findings by tightening the reported test and Guardrails validation code, and include the small CLI coverage-test API update needed to keep Rust validation green.

I confirm this contribution is my own work, or I have the right to submit it under this project's license.
I searched existing issues and open pull requests, and this does not duplicate existing work.

Details

Replaced the Node subscriber-event deep clone test with structuredClone.
Deduplicated the repeated Go EmitEvent failed: %v test literal.
Split NeMo Guardrails config-shape validation into focused mode-specific helpers backed by shared shape flags and diagnostic creation.
Updated the CLI coverage test conditional guardrail callback from Box to Arc to match the current registry API and unblock Rust validation.

Validation:

cargo test -p nemo-flow nemo_guardrails
just test-go
just test-node
just test-rust
commit hooks: cargo fmt, cargo clippy, cargo check, go fmt/vet, node prettier check

Where should the reviewer start?

Start with crates/core/src/plugins/nemo_guardrails/plugin_component.rs, where the Sonar cognitive-complexity issue is resolved without changing diagnostic messages.

Related Issues: (use one of the action keywords Closes / Fixes / Resolves / Relates to)

Relates to: none

Summary by CodeRabbit

Tests
- Updated test implementations across multiple components for consistency and clarity.
Refactor
- Improved internal configuration validation logic with a cleaner, flag-driven approach for better maintainability.
Chores
- Internal code improvements and standardization of error handling patterns.

Signed-off-by: Will Killian <wkillian@nvidia.com>

coderabbitai · 2026-05-21T14:23:57Z

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: ASSERTIVE

Plan: Enterprise

Run ID: bd7b1f1f-611e-46ba-802f-03da12339184

📥 Commits

Reviewing files that changed from the base of the PR and between 78e83c0 and a32a627.

📒 Files selected for processing (4)

crates/cli/tests/coverage/server_tests.rs
crates/core/src/plugins/nemo_guardrails/plugin_component.rs
crates/node/tests/scope_tests.mjs
go/nemo_flow/scope_test.go

📜 Recent review details

⏰ Context from checks skipped due to timeout of 90000ms. You can increase the timeout in your CodeRabbit configuration to a maximum of 15 minutes (900000ms). (1)

GitHub Check: Check / Run

🧰 Additional context used

📓 Path-based instructions (23)

crates/node/**

📄 CodeRabbit inference engine (.agents/skills/test-node-binding/SKILL.md)

Run just test-node for the normal dev/test loop when working on Node binding changes

Files:

crates/node/tests/scope_tests.mjs

crates/{python,ffi,node,wasm}/**/*

⚙️ CodeRabbit configuration file

crates/{python,ffi,node,wasm}/**/*: Treat binding changes as public API changes. Check for parity with the other language bindings, FFI ownership/lifetime safety,
callback error propagation, stable type conversion, and consistent async/stream semantics.
Flag changes that update one binding without corresponding tests or documentation for the same surface elsewhere.

Files:

crates/node/tests/scope_tests.mjs

{crates/**/tests/**,python/tests/**,go/nemo_flow/**/*_test.go}

⚙️ CodeRabbit configuration file

{crates/**/tests/**,python/tests/**,go/nemo_flow/**/*_test.go}: Tests should cover the behavior promised by the changed API surface, including error paths and cross-request isolation where relevant.
Prefer assertions on lifecycle events, scope stacks, middleware ordering, and binding parity over shallow smoke tests.

Files:

crates/node/tests/scope_tests.mjs
crates/cli/tests/coverage/server_tests.rs
go/nemo_flow/scope_test.go

**/*.rs

📄 CodeRabbit inference engine (.agents/skills/test-ffi-surface/SKILL.md)

**/*.rs: Run cargo fmt --all for FFI work as it is Rust work
Run just test-rust for FFI validation
Run cargo clippy --workspace --all-targets -- -D warnings to enforce warnings-as-errors linting

**/*.rs: Run cargo fmt --all for Rust code formatting
Run cargo clippy --workspace --all-targets -- -D warnings to enforce Rust linting with no warnings
Run just test-rust as the shared-runtime build/test wrapper for Rust changes

Use Rust snake_case naming convention for Rust code

**/*.rs: Any Rust change must run just test-rust
Any Rust change must run cargo fmt --all
Any Rust change must run cargo clippy --workspace --all-targets -- -D warnings

**/*.rs: Run cargo fmt --all for Rust code formatting when Node changes touch Rust files
Run cargo clippy --workspace --all-targets -- -D warnings to enforce strict linting when Rust files changed as part of Node work

**/*.rs: Always run just test-rust when any Rust code changes
Always run cargo fmt --all when any Rust code changes
Always run cargo clippy --workspace --all-targets -- -D warnings when any Rust code changes

If any Rust files changed as part of the Python work, also run cargo fmt --all, just test-rust, and cargo clippy --workspace --all-targets -- -D warnings

Files:

crates/cli/tests/coverage/server_tests.rs
crates/core/src/plugins/nemo_guardrails/plugin_component.rs

**/*.{rs,go,js,ts,tsx}

📄 CodeRabbit inference engine (CONTRIBUTING.md)

Include SPDX license headers in all Rust, Go, JavaScript, and TypeScript source files using C-style comment syntax

Files:

crates/cli/tests/coverage/server_tests.rs
go/nemo_flow/scope_test.go
crates/core/src/plugins/nemo_guardrails/plugin_component.rs

**/*.{rs,py,go,js,ts,tsx}

📄 CodeRabbit inference engine (CONTRIBUTING.md)

Use SONAR_IGNORE_START / SONAR_IGNORE_END markers only for documented false positives that cannot be resolved in code; keep ignored blocks small, add explanatory comments, and require reviewer sign-off

Files:

crates/cli/tests/coverage/server_tests.rs
go/nemo_flow/scope_test.go
crates/core/src/plugins/nemo_guardrails/plugin_component.rs

**/*.{js,ts,tsx,jsx,py,rs,go,java,c,cpp,h,cc,cxx,cs,rb,php,swift,kt}

📄 CodeRabbit inference engine (.agents/skills/prepare-pr/SKILL.md)

Changed files must be formatted with the language-native formatter

Files:

crates/cli/tests/coverage/server_tests.rs
go/nemo_flow/scope_test.go
crates/core/src/plugins/nemo_guardrails/plugin_component.rs

**/*.{py,js,ts,tsx,go,rs,md}

📄 CodeRabbit inference engine (.agents/skills/validate-change/SKILL.md)

Format changed files with the language-native formatter before the final lint/test pass

Files:

crates/cli/tests/coverage/server_tests.rs
go/nemo_flow/scope_test.go
crates/core/src/plugins/nemo_guardrails/plugin_component.rs

**/*.{rs,py,js,ts,tsx,go}

📄 CodeRabbit inference engine (.agents/skills/validate-change/SKILL.md)

During iteration, prefer uv run pre-commit run --files <changed files...> for targeted validation

Files:

crates/cli/tests/coverage/server_tests.rs
go/nemo_flow/scope_test.go
crates/core/src/plugins/nemo_guardrails/plugin_component.rs

go/nemo_flow/**/*.go

📄 CodeRabbit inference engine (.agents/skills/test-go-binding/SKILL.md)

Format changed Go packages with cd go/nemo_flow && go fmt ./...

Use PascalCase naming convention for Go API implementations

For Go binding changes, run go fmt ./... within the Go module to format all Go files

Files:

go/nemo_flow/scope_test.go

**/*.go

📄 CodeRabbit inference engine (CONTRIBUTING.md)

**/*.go: Use gofmt for Go code formatting
Use go vet ./... for Go static analysis
Use PascalCase naming convention for Go code

Files:

go/nemo_flow/scope_test.go

**/*.{md,markdown,py,sh,bash,js,ts,java,cpp,go,rust}

📄 CodeRabbit inference engine (.agents/skills/contribute-docs/SKILL.md)

Keep package names, repo references, and build commands current in documentation

Files:

go/nemo_flow/scope_test.go

{crates/adaptive/**,python/nemo_flow/{adaptive,plugin}.py,go/nemo_flow/{adaptive,**}/*.go,**/*.{ts,js,wasm}}