Separate macOS admission reruns from product skips

[teamleaderleo]

Summary

Use the compiled-product identity from #13462 for the earlier-run admission shortcut, while keeping admission/orchestration changes fail-open.

The key distinction is:

• product identity answers whether an already-admitted compiled product is still equivalent;
• admission identity answers whether the current macOS admission logic itself needs to execute.

This changes the changes job so:

• product fingerprints come from product_input_identity.py --key, including the selected Xcode repository variable;
• source/product changes naturally miss when product inputs differ;
• edits to .github/workflows/ci.yml, .github/actions/**, or scripts/ci/** always execute macOS admission even when the product identity is unchanged;
• those admission-only runs can then use Reuse macOS products across admission-only commits #13462's product reuse inside the macOS job and avoid Xcode compilation;
• non-PR events and ambiguous/empty routing state remain fail-closed.

So an admission implementation change exercises current admission code without paying a full compile solely because orchestration bytes changed.

Stacked on #13462.

Related: #13095, #13325, #13411, #13431, #13462.

---

Summary by cubic

Separates the macOS compile-admission skip from admission/orchestration changes. A compile-only PR skips the Mac only when the compiled-product identity is unchanged and no CI/admission implementation files changed; admission code changes still run the current macOS admission logic, which can reuse a compatible product.

• The changes job fingerprints product identity with product_input_identity.py --key, including the selected Xcode variable; recipe and job-level control extraction are fail-closed, so new or unknown steps, env keys, or job keys invalidate reuse until reviewed.
• Ghostty selection is classified as a product input.
• Edits to .github/workflows/ci.yml, .github/actions/**, or scripts/ci/** always execute admission; source/product changes miss when product inputs differ.
• Non-PR events and ambiguous or empty routing state remain fail-closed.

^{Written for commit cab1ff9. Summary will update on new commits.}

Summary by CodeRabbit

• Bug Fixes

  • Improved CI change detection so relevant workflow and build-control updates are recognized reliably.
  • Prevented reuse of previous build admissions when admission-related configuration changes.
  • Improved build identity tracking when external Xcode selectors change.

• Tests

  • Added coverage for CI change detection across workflow, tooling, product, source, test, and documentation updates.
  • Added regression coverage confirming stable identities for unchanged build selections.

[coderabbitai]

Important

Review skipped

Auto reviews are disabled on base/target branches other than the default branch.

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Repository: manaflow-ai/cmux/.coderabbit.yaml

Review profile: ASSERTIVE

Plan: Advanced

Run ID: 8970ca68-7df3-40e1-ba6d-fda866abb30c

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

✨ Finishing Touches

📝 Generate docstrings

• Commit to this branch
• Create a new PR

🧪 Generate unit tests (beta)

• Commit to this branch
• Create a new PR

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[teamleaderleo]

@coderabbitai review

[coderabbitai]

⚠️ Action not completed

Pull request base or head changed.

Note: CodeRabbit is an incremental review system and does not re-review already reviewed commits. This command is applicable only when automatic reviews are paused.

[cursor]

Bugbot is paused — on-demand spend limit reached

Bugbot uses usage-based billing for this team and has hit its on-demand spend limit.

A team admin can raise the spend limit in the Cursor dashboard, or wait for the next billing cycle to continue.

[cursor]

Bugbot is paused — on-demand spend limit reached

Bugbot uses usage-based billing for this team and has hit its on-demand spend limit.

A team admin can raise the spend limit in the Cursor dashboard, or wait for the next billing cycle to continue.