[Pedro Henrique Penna (ppenna)]

Removes NFV (neuro-formal verification) support: the NFV PR reviewer that
#1249 installed and #1266 and #1287 maintained, the source-context workflow
that it called, and gh-aw's records of both. Required status check never
depended on the reviewer, so no merge requirement changes.

Changes

• ci: remove the NFV PR reviewer deletes .github/workflows/nfv-pr-review.md
  and its compiled nfv-pr-review.lock.yml. gh-aw compiled the reviewer's
  comment and failure reports into safe_outputs and conclusion jobs that
  could write issues, so doc/ci.md and a test named them beside the nightly
  CI report's job; both again allow that job alone. doc/ci.md also drops its
  Advisory NFV review section.
• ci: remove the NFV source-context workflow deletes nfv-source-context.md
  and nfv-source-context.lock.yml, a reusable workflow that only the
  reviewer called, as its repository_context job.
• ci: drop gh-aw's records of the NFV workflows deletes
  .github/aw/packages/microsoft-neuro-formal-verification-workflow-f129a0ff0f1c.json,
  gh-aw's record of the package installation, and
  .github/aw/actions-lock.json, which pinned the github/gh-aw-actions/setup
  action that both lock files ran. No other workflow is compiled with gh-aw, so
  .github/aw goes too.

Before the rebase onto dev, the branch's tree was byte-identical to
git revert of the five commits that brought NFV in and maintained it:
9b8c619, be760f5, 15c74e6, 9db0e43, and a9ce4f1. git range-diff
shows that the rebase changed no patch.

Two things stay on purpose:

• .gitattributes still marks .github/workflows/*.lock.yml as generated. The
  rule predates NFV (f85e984), and any change to .gitattributes selects the
  microVM tests and the benchmarks.
• 25c595b, an nvx-rs fix that an NFV report suggested, is an ordinary code
  change.

Test changes

python scripts/check_test_changes.py --base origin/dev reports 1 change to an
existing test, hence tests-modified:

• WorkflowTests.test_only_the_report_job_writes_and_only_issues in
  scripts/test_nightly_ci.py again expects nightly-ci-report.yml:report to
  be the only job that can write issues, without
  nfv-pr-review.lock.yml:conclusion and nfv-pr-review.lock.yml:safe_outputs,
  which this pull request deletes. The file is back to its version from before
  be760f5, byte for byte.

After merging

No remaining workflow reads these repository settings, which a maintainer can
delete once this lands: the Actions variables NFV_MODEL and
NFV_RELEASE_SHA, and the Actions secrets NFV_RELEASE_TOKEN,
COPILOT_GITHUB_TOKEN, and GH_AW_GITHUB_TOKEN.

Validation

• Windows 11 (local), with Python 3.14, Ruff 0.15.22, and Pyright 1.1.411, at
  0ccedd7:
  • ruff check and ruff format --check of scripts and .github/specula;
    pyright --pythonplatform Linux and --pythonplatform Windows, with 0
    errors; check_markdown_links.py; check_test_layout.py;
    nvx.py check-kernel-config; and the PowerShell syntax check.
  • The Windows steps of validate-nvx, with Git's usr\bin on PATH:
    compileall, test_adversarial.py, test_hosts.py, and every
    nvx.py --help pass. The unittest list ran 1814 tests, with 73 skipped,
    3 of them because this checkout has no OpenVMM submodule, and 7 errors:
    subtests of test_host_loopback_allow_script_checks_publication_and_traffic
    and test_private_network_ingress_script_checks_policy_and_traffic whose
    stubbed scripts exceed their 10-second timeout under Git's MSYS sh on
    this host. Unchanged dev at ab97477 fails the same 7 subtests the same
    way, and which of them time out varies from run to run.
  • nvx.py classify-ci-changes --event-name pull_request over this diff
    selects no guest artifacts, OpenVMM binaries, OpenVMM CI check, microVM
    tests, or benchmarks.
• Each commit on its own: test_nightly_ci.py, test_markdown_links.py, the
  two test_nvx_tools.py tests that scan every workflow, and
  check_markdown_links.py pass at the first and second commits.
• Left to CI: this pull request's run once it is marked ready, including the
  Linux NVX CLI job, the tests that need the OpenVMM submodule, and
  Lint, typing, and formatting on Ubuntu, whose ShellCheck, shfmt, and
  Specula steps did not run here.

[github-actions]

This pull request changes existing tests

It modifies or removes 1 existing test asset(s), listed below. Review each with care: a change to a test can hide a regression that the test caught. See doc/contribute.md#changes-to-existing-tests.

Test code

Change	What	Before	After
modified test	def WorkflowTests.test_only_the_report_job_writes_and_only_issues in scripts/test_nightly_ci.py	scripts/test_nightly_ci.py:2024	scripts/test_nightly_ci.py:2024

Relocated unchanged: 0; added: 0. Compared the merge base ab97477a9c7e with 0ccedd7b3cbd.

[Copilot]

🟢 Approval recommended

No active review issues were identified for the removal of the advisory NFV integration.

No open issues 🎉

What changed in this PR

Removes NVX’s advisory NFV PR-review integration and its gh-aw installation records, leaving required CI checks and merge requirements unchanged.

Changes:

• Deletes the NFV reviewer and reusable source-context workflows.
• Removes gh-aw package metadata and action pins used by NFV.
• Updates CI documentation and the permissions test so only the nightly report job is allowed to write issues.

File	Description
scripts/​test_nightly_ci.py	Removes NFV jobs from the issue-write allowlist.
doc/​ci.md	Removes NFV guidance and updates documented issue-write permissions.
.github/​workflows/​nfv-source-context.md	Deletes the source-context workflow definition.
.github/​workflows/​nfv-source-context.lock.yml	Deletes the compiled source-context workflow.
.github/​workflows/​nfv-pr-review.md	Deletes the NFV reviewer definition.
.github/​aw/​packages/​microsoft-neuro-formal-verification-workflow-f129a0ff0f1c.json	Deletes the NFV package installation record.
.github/​aw/​actions-lock.json	Deletes the gh-aw setup action pin.

_{Review effort: Balanced}