ci: let the pre-merge Release check compile arm64 only

[teamleaderleo]

Summary

The pre-merge release-build job compiles the app target as one whole module per architecture. Any change to app code recompiles both slices, so the compilation cache saves little there: measured on Warp today, 27.9 min cold, 21.7 min warm with app code changed, 4 min warm with it unchanged. Of the 21.7, the x86_64 whole-module compile is about 10.5 min.

This adds an opt-in to compile arm64 only in that check:

• scripts/ci/release-build-archs.sh resolves universal (default, also when unset) or arm64, and rejects anything else.
• release-build reads vars.CI_RELEASE_BUILD_ARCHS, or the new release_archs dispatch input, and passes the result to ARCHS and to the slice checks. The prebuilt Ghostty helper and TUI client are still verified universal in both modes.
• Nothing changes until a maintainer sets the variable. nightly.yml and release.yml never read it, and tests/test_ci_release_build_archs.sh fails if nightly ever does.

Trade-off for maintainers

With arm64, a compile error that only exists in the x86_64 slice passes the merge queue and is caught by the nightly build on that main revision instead. Swift code here is not architecture specific and GhosttyKit is prebuilt, so this should be rare, but it moves that one failure class from before merge to after it. To turn it on:

gh variable set CI_RELEASE_BUILD_ARCHS --repo manaflow-ai/cmux --body arm64

Testing

• tests/test_ci_release_build_archs.sh (new, wired into workflow-guard-tests)
• actionlint, tests/test_ci_self_hosted_guard.sh, tests/test_nightly_universal_build.sh, tests/test_ci_change_areas.py, tests/test_ci_pull_request_caches_are_read_only.py pass locally
• A workflow_dispatch run of this branch with release_archs=arm64 measures the real job; result will be added as a comment.

Issues

• Related: Merge queue and CI cost: admin-only settings to finish the rollout #13182

🤖 Generated with Claude Code

---

Summary by cubic

Adds an opt-in that lets the pre-merge Release check compile arm64 only, dropping the Intel slice that dominates the job's build time. Unset or universal keeps today's universal build; with arm64, an Intel-only compile break is caught by the nightly build after merge instead of before. Slice verification now checks built binaries for exactly the resolved architectures, so a universal binary can't pass an arm64-only check.

Migration

• Set CI_RELEASE_BUILD_ARCHS=arm64, or pass release_archs=arm64 to a workflow_dispatch run, to enable it.
• The prebuilt helper is still verified universal in both modes.

Related to #13182.

^{Written for commit c04551a. Summary will update on new commits.}

[coderabbitai]

Warning

Review limit reached

Next included review available in 3 minutes.

Check out review usage here.

View limit details

Limit details: You’ve used all 10 included reviews currently available.

You've used all free OSS reviews for now. Wait for the free limit to reset to keep reviewing this public repository.

Learn how review limits work.

Review configuration:

⚙️ Run configuration

Configuration used: Repository: manaflow-ai/cmux/.coderabbit.yaml

Review profile: ASSERTIVE

Plan: Advanced

Run ID: 31ab2d4d-dab1-4b03-837e-2bc38b5798ad

📥 Commits

Reviewing files that changed from the base of the PR and between f48ef36 and c04551a.

📒 Files selected for processing (5)

• .github/workflows/ci.yml
• scripts/ci/release-build-archs.sh
• scripts/ci/verify-binary-archs.sh
• tests/test_ci_release_build_archs.sh
• tests/test_ci_self_hosted_guard.sh

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[github-actions]

All contributors have signed the CLA ✍️ ✅
_{Posted by the CLA Assistant Lite bot.}

[greptile-apps]

Confidence Score: 5/5

The PR appears safe to merge; the prior slice-validation concern is fixed and no new actionable issue remains.

Summary

The PR adds an opt-in arm64-only mode for the pre-merge Release build while retaining universal builds by default and in nightly workflows.

• Resolves the requested architecture through a fail-closed allowlist.
• Passes the resolved architecture to Xcode and architecture-sensitive artifact checks.
• Keeps downloaded helper artifacts universal.
• Verifies exact slice sets so universal artifacts cannot accidentally satisfy arm64-only checks.
• Adds workflow guard coverage for defaults, rejected values, exact verification, and nightly isolation.

Diagram

%%{init: {'theme': 'neutral'}}%%
flowchart TD
  A[workflow_dispatch input or repository variable] --> B[release-build-archs.sh]
  B -->|unset, default, universal| C[arm64 and x86_64]
  B -->|arm64| D[arm64 only]
  B -->|unsupported value| E[Fail Release check]
  C --> F[Xcode Release build]
  D --> F
  F --> G[verify-binary-archs.sh]
  G --> H[Require exact app, CLI, and cmux-cua slices]
  F --> I[Keep prebuilt helper and TUI client universal]
  J[Nightly workflow] --> K[Always build universal artifact]

Loading

_{Reviews (3) · Last reviewed commit: "Merge main into ci-pr-release-arm64"}

[cursor]

Bugbot is paused — on-demand spend limit reached

Bugbot uses usage-based billing for this team and has hit its on-demand spend limit.

A team admin can raise the spend limit in the Cursor dashboard, or wait for the next billing cycle to continue.