From 40ffdbdf04b78d3a94eea3e03607ff31740a9258 Mon Sep 17 00:00:00 2001 From: Leo Date: Mon, 21 Sep 2026 17:09:06 -0700 Subject: [PATCH 1/6] ci: rebase selective Bun guard setup onto current main --- .github/workflows/ci-guards.yml | 1 + tests/test_ci_change_areas.py | 9 +++++++++ 2 files changed, 10 insertions(+) diff --git a/.github/workflows/ci-guards.yml b/.github/workflows/ci-guards.yml index e2e37fc3f8f2..bca54a24318d 100644 --- a/.github/workflows/ci-guards.yml +++ b/.github/workflows/ci-guards.yml @@ -134,6 +134,7 @@ jobs: run: python3 scripts/generate-cmux-config-schema.py --check - name: Set up Bun for guard tests + if: ${{ matrix.group == 'preflight' || matrix.group == 'release' }} uses: oven-sh/setup-bun@0c5077e51419868618aeaa5fe8019c62421857d6 # v2 with: bun-version: "1.3.6" diff --git a/tests/test_ci_change_areas.py b/tests/test_ci_change_areas.py index 383e31e53466..890c03cbb4c3 100644 --- a/tests/test_ci_change_areas.py +++ b/tests/test_ci_change_areas.py @@ -1993,6 +1993,15 @@ def test_linux_preflight_allows_skipped_guard_call_when_all_guard_routes_are_fal assert result.returncode == 0, result.stderr +def test_guard_bun_setup_runs_only_for_groups_that_execute_bun() -> None: + block = workflow_job_block("workflow-guard-tests", GUARD_WORKFLOW) + setup = block.index(" - name: Set up Bun for guard tests") + next_step = block.index(" - name: Validate Claude launch environment policy behavior", setup) + setup_block = block[setup:next_step] + assert "if: ${{ matrix.group == 'preflight' || matrix.group == 'release' }}" in setup_block + assert block.count("setup-bun@") == 1 + + def test_history_guard_uses_shallow_synthetic_merge_parent() -> None: block = workflow_job_block("workflow-guard-history", GUARD_WORKFLOW) assert "github.event_name == 'workflow_dispatch' && '0' || '2'" in block From 25807304bae20c4ddbe22ef433fa0ede631931ab Mon Sep 17 00:00:00 2001 From: Leo Date: Mon, 21 Sep 2026 17:46:27 -0700 Subject: [PATCH 2/6] ci: read compile admission from macOS workflow --- tests/test_ci_change_areas.py | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/tests/test_ci_change_areas.py b/tests/test_ci_change_areas.py index 890c03cbb4c3..d80c01034191 100644 --- a/tests/test_ci_change_areas.py +++ b/tests/test_ci_change_areas.py @@ -1417,7 +1417,7 @@ def test_build_input_fingerprint_tracks_product_identity_not_ci_orchestration() from build_input_fingerprint import fingerprint import product_input_identity as product_inputs - workflow = CI_WORKFLOW.read_text(encoding="utf-8") + workflow = MACOS_WORKFLOW.read_text(encoding="utf-8") admission = product_inputs._job_block( workflow, product_inputs.MACOS_ADMISSION_JOB, From c19d1b267c0ce01ad5c16a344979095d388c3868 Mon Sep 17 00:00:00 2001 From: Leo Date: Mon, 21 Sep 2026 17:48:42 -0700 Subject: [PATCH 3/6] ci: restrict Bun setup to preflight guards --- .github/workflows/ci-guards.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.github/workflows/ci-guards.yml b/.github/workflows/ci-guards.yml index bca54a24318d..31e1b1d65547 100644 --- a/.github/workflows/ci-guards.yml +++ b/.github/workflows/ci-guards.yml @@ -134,7 +134,7 @@ jobs: run: python3 scripts/generate-cmux-config-schema.py --check - name: Set up Bun for guard tests - if: ${{ matrix.group == 'preflight' || matrix.group == 'release' }} + if: ${{ matrix.group == 'preflight' }} uses: oven-sh/setup-bun@0c5077e51419868618aeaa5fe8019c62421857d6 # v2 with: bun-version: "1.3.6" From 61f4c4dca847ba1f97adde3c1a805a30f52014d9 Mon Sep 17 00:00:00 2001 From: Leo Date: Mon, 21 Sep 2026 17:48:45 -0700 Subject: [PATCH 4/6] test: pin Bun setup to preflight guards --- tests/test_ci_change_areas.py | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/tests/test_ci_change_areas.py b/tests/test_ci_change_areas.py index d80c01034191..13e3c7213d3c 100644 --- a/tests/test_ci_change_areas.py +++ b/tests/test_ci_change_areas.py @@ -1998,7 +1998,7 @@ def test_guard_bun_setup_runs_only_for_groups_that_execute_bun() -> None: setup = block.index(" - name: Set up Bun for guard tests") next_step = block.index(" - name: Validate Claude launch environment policy behavior", setup) setup_block = block[setup:next_step] - assert "if: ${{ matrix.group == 'preflight' || matrix.group == 'release' }}" in setup_block + assert "if: ${{ matrix.group == 'preflight' }}" in setup_block assert block.count("setup-bun@") == 1 From 8d900b714ebf97f9d5cd6996b1bdd63cd62f5757 Mon Sep 17 00:00:00 2001 From: Leo Date: Mon, 21 Sep 2026 18:25:34 -0700 Subject: [PATCH 5/6] fix(ci): keep Bun for release guard harnesses --- .github/workflows/ci-guards.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.github/workflows/ci-guards.yml b/.github/workflows/ci-guards.yml index 31e1b1d65547..bca54a24318d 100644 --- a/.github/workflows/ci-guards.yml +++ b/.github/workflows/ci-guards.yml @@ -134,7 +134,7 @@ jobs: run: python3 scripts/generate-cmux-config-schema.py --check - name: Set up Bun for guard tests - if: ${{ matrix.group == 'preflight' }} + if: ${{ matrix.group == 'preflight' || matrix.group == 'release' }} uses: oven-sh/setup-bun@0c5077e51419868618aeaa5fe8019c62421857d6 # v2 with: bun-version: "1.3.6" From 2912c658c022601cfdfd501988ee82556b05905c Mon Sep 17 00:00:00 2001 From: Leo Date: Mon, 21 Sep 2026 18:25:39 -0700 Subject: [PATCH 6/6] test(ci): retain Bun for release decision harness --- tests/test_ci_change_areas.py | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-) diff --git a/tests/test_ci_change_areas.py b/tests/test_ci_change_areas.py index 13e3c7213d3c..162a82653141 100644 --- a/tests/test_ci_change_areas.py +++ b/tests/test_ci_change_areas.py @@ -1998,8 +1998,12 @@ def test_guard_bun_setup_runs_only_for_groups_that_execute_bun() -> None: setup = block.index(" - name: Set up Bun for guard tests") next_step = block.index(" - name: Validate Claude launch environment policy behavior", setup) setup_block = block[setup:next_step] - assert "if: ${{ matrix.group == 'preflight' }}" in setup_block + assert "if: ${{ matrix.group == 'preflight' || matrix.group == 'release' }}" in setup_block assert block.count("setup-bun@") == 1 + # The release group executes test_ios_testflight_main_push_filter.py, whose + # decision harness launches Bun. Do not remove release from this condition + # just because the direct command is Python. + assert "test_ios_testflight_main_push_filter.py" in block def test_history_guard_uses_shallow_synthetic_merge_parent() -> None: