ci: skip compile admission when an earlier run compiled the same build inputs

[teamleaderleo]

Stacked on #13117 (it needs that pull request's full_suite switch). Replaces #13128.

Summary

• Under the compile-only pull request policy from 13117, compile admission is the only Mac job a push pays for. This skips it when the push changed nothing the Xcode build reads: a guard test, another workflow, docs, or a merge of main that only moved web.
• scripts/ci/build_input_fingerprint.py hashes the git tree entries (mode, object id, path) of every path that can reach the build, plus the selected Xcode. It starts from the router's own macOS classification and additionally ignores tests/, tests_v2/, .github/ other than ci.yml, and Markdown. Unknown paths count as inputs.
• Every pull request run publishes that fingerprint as an artifact name (build-inputs-<hash>, a few bytes, 7 days). scripts/ci/find_admitted_build.py checks the last six CI runs of the same branch for that artifact together with a successful macOS compile admission job.
• Trust: only runs whose head repository is this repository count, since a fork's run can rewrite its workflow and report anything. Any API error means compile. The tests gate accepts a skipped admission only when the run is compile-only and the lookup said yes.
• Full-suite runs always compile, because the shards need this revision's product. Merge groups are full-suite, so what lands is always compiled.
• Nothing changes until CI_PULL_REQUEST_SUITE=compile-only is set.

Why this and not 13128

13128 keeps the compiler's CAS on the runner's disk. Every macOS runner here exists for one job (two consecutive admissions tonight ran on warp-6x-arm64-w6xi4lr7… and …wv2ennr1…), so the next run never sees that disk. Saving the CAS per pull request instead would push the main seed out of the cache budget with multi-GB snapshots, for little gain: Swift recompiles a whole module when any file in it changes.

Expected effect

Sample of 44 recent pull requests with 687 later commits: 15% of later commits touched no build input, and another 18% were merges of main, some of which qualify too. Each hit saves one 16 to 21 minute Mac job; on the paid runners that is the whole per-push Mac cost under the compile-only policy.

Testing

• tests/test_ci_change_areas.py on Python 3.9 and 3.12: PASS. New tests run the real tests gate for every combination (skipped admission passes only when compile-only and admitted; a failed admission never passes; full-suite never reuses a verdict), check the fingerprint ignores exactly the non-inputs and reacts to each input class and to the Xcode pin, and check the lookup against a fake API: current run excluded, different inputs, failed or skipped admission, fork run, API failure.
• The lookup script was run against the live API (no match, exit 0). actionlint clean; runner and permission guards pass.
• Not yet exercised end to end, because the compile-only policy is off.

Issues

• Related: [RFC] CI structure: thin router, reusable platform workflows, merge queue, failure ratchet #13095

🤖 Generated with Claude Code

---

Summary by cubic

Skips macOS compile admission when an earlier run of the same branch already compiled identical build inputs, so pushes that touch only tests, docs, other workflows, or web-only merges of main no longer pay for a 16–21 minute Mac compile. Nothing changes until CI_PULL_REQUEST_SUITE=compile-only is set.

How it works

• Each PR run attempt publishes a build-inputs-<fingerprint>-<attempt> artifact; the fingerprint covers every git tree path the Xcode build reads plus the selected Xcode pin.
• A compile-only run skips admission when one of the last six branch runs has the matching artifact and a successful macOS compile admission job in that artifact's attempt; the tests gate accepts that skip only when the admission result is skipped.
• Only runs whose head repository is this repository count, since a fork can rewrite its workflow; any API error falls back to compiling.
• The fingerprint, publish, and lookup steps continue on error, so a broken optimization compiles instead of failing routing.
• Full-suite runs always compile, because the shards need this revision's product.

Related to #13095.

^{Written for commit 6a81a25. Summary will update on new commits.}

[coderabbitai]

Warning

Review limit reached

Next included review available in 14 minutes.

Check out review usage here.

View limit details

Limit details: You’ve used all 10 included reviews currently available.

You've used all free OSS reviews for now. Wait for the free limit to reset to keep reviewing this public repository.

Learn how review limits work.

Review configuration:

⚙️ Run configuration

Configuration used: Repository: manaflow-ai/cmux/.coderabbit.yaml

Review profile: ASSERTIVE

Plan: Advanced

Run ID: ee169568-0e69-4845-9dd6-9b8f3b7c5241

📥 Commits

Reviewing files that changed from the base of the PR and between bd65a8a and 6a81a25.

📒 Files selected for processing (4)

• .github/workflows/ci.yml
• scripts/ci/build_input_fingerprint.py
• scripts/ci/find_admitted_build.py
• tests/test_ci_change_areas.py

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[greptile-apps]

Confidence Score: 5/5

The PR appears safe to merge, with the previous findings addressed and no new blocking issue identified.

Summary

Adds reuse of successful macOS compile admission for compile-only pull requests with identical build inputs, while retaining compilation for full-suite runs.

• Fingerprints tracked build inputs and the selected Xcode configuration.
• Matches fingerprint artifacts to successful admission jobs from the same run attempt.
• Makes reuse steps best-effort and URL-encodes branch queries.
• Adds regression coverage for attempt isolation, fallback behavior, and artifact naming.
• No new actionable findings were identified.

Diagram

%%{init: {'theme': 'neutral'}}%%
flowchart TD
  A[Route CI suite] --> B{Full suite?}
  B -->|Yes| C[Compile admission]
  B -->|No| D[Fingerprint build inputs]
  D --> E{Trusted earlier run has matching receipt and successful admission in the same attempt?}
  E -->|Yes| F[Skip compile admission]
  E -->|No or lookup failure| C
  C --> G[Tests gate checks required results]
  F --> G

Loading

_{Reviews (3) · Last reviewed commit: "ci: bind compile admission evidence to o..."}

[github-actions]

All contributors have signed the CLA ✍️ ✅
_{Posted by the CLA Assistant Lite bot.}