ci: identify the merge-group fail-fast watcher's source workflow by file, not display name

[teamleaderleo]

.github/workflows/merge-group-fail-fast.yml decides which workflow may start it by matching a human-readable display name: on.workflow_run.workflows: [Merge-group policy checks]. That string is the name: of merge-group-policy-checks.yml. Anyone who renames that workflow for clarity disables the watcher, and nothing reports it — the watcher simply never triggers again, so a merge group whose first macOS job fails runs the rest of its shards to the end and every queue entry behind it waits. The merge queue is disabled on this repository right now (flaky and cancelled runs clogged it), so the watcher is dormant and this can rot unnoticed until the queue is turned back on. Three more workflows depend on another workflow's display name the same way: persistent-macos-router.yml (CI), update-homebrew.yml (Release macOS app) and cmux-tui-release-delivery.yml (cmux-tui release binaries).

Resulting behavior

on.workflow_run.workflows: accepts only a workflow's display name, so the name stays in the trigger. It is no longer the only copy of the pairing:

• Each of the four consumers declares env.SOURCE_WORKFLOW_PATHS, the file that must carry the name it waits for. tests/test_ci_workflow_run_sources.py reads that file's own name: and fails when the two disagree, so a rename fails the pull request that renames it instead of silently switching a guard off.
• merge-group-fail-fast.yml confirms the identity at run time as well. The workflow_run payload carries path and workflow_id next to the presentation name, and display names are not unique, so the watcher now refuses to cancel anything unless it was started by .github/workflows/merge-group-policy-checks.yml. The CI run it then watches was already located by file (actions/workflows/ci.yml/runs), and the test asserts every such lookup names a workflow that exists.

API evidence for the fields used, from a real merge-group run of the source workflow:

$ gh api "repos/manaflow-ai/cmux/actions/workflows/merge-group-policy-checks.yml/runs?per_page=1" \
    --jq '.workflow_runs[0] | {id, name, path, workflow_id, event}'
{"event":"merge_group","id":35503457744,"name":"Merge-group policy checks",
 "path":".github/workflows/merge-group-policy-checks.yml","workflow_id":362434528}

Sweep for the same shape

Every other place in .github/ and scripts/ci/ that matches a job, check or workflow by display text:

Where	Matches	Status
merge-group-fail-fast.yml, persistent-macos-router.yml, update-homebrew.yml, cmux-tui-release-delivery.yml	another workflow's name:	fixed here
update-homebrew.yml:58 select(.name == "build-sign-notarize")	a job in release.yml	already pinned by tests/test_release_homebrew_gate.py, which also asserts the job carries no name: override
ios-testflight.yml:159,377 job.name === 'Upload to TestFlight'	its own upload job's name:	pinned here, derived from that job
tests/test_ci_merge_queue_required_checks.py REQUIRED_CHECKS	branch-protection check names	unchanged. The source of truth is the GitHub API, not the tree; reconciling needs administration: read, which PR CI must not hold
tests/test_tui_publish_workflow_security.py:1604	cmux-tui release binaries, written out again	left as is; the new test now derives the same name from the file, so a rename fails there first
ci.yml:458 release_only_jobs	ci-macos.yml job ids	not this class. Job ids are identity, and the step parses them out of the file

The jobs API has no stable alternative for the job matches: its objects expose name and workflow_name, never the YAML job id (gh api .../jobs --jq '.jobs[0] | keys' on release run 35225939389). That is why those stay name matches with a test pinning them.

Validation and remaining gap

• python3 tests/test_ci_workflow_run_sources.py fails on the first commit and passes on the second.
• Four negative controls, each applied to the tree and reverted: renaming merge-group-policy-checks.yml, renaming the TestFlight upload job, replacing the run-time path check with name, and pointing the CI lookup at a file that does not exist. Each is reported as a distinct failure.
• actionlint clean on all five changed workflows. test_ci_change_areas.py (which asserts this watcher's shape), test_release_homebrew_gate.py, test_tui_publish_workflow_security.py, test_ci_persistent_mac_compile.py, test_ci_merge_queue_required_checks.py, test_ci_guard_workflow_structure.py, test_ci_linux_guard_routing.py, test_ci_reusable_workflow_permissions.py and the execution-registry validator all pass. Two test_ci_change_areas.py failures (test_workflow_self_change_guard_runs_before_detector_imports, test_router_change_with_app_source_uses_trusted_base_product_routing) reproduce unchanged on a clean checkout of the base commit 95e843a and are unrelated to this branch.
• Remaining gap: the merge queue is off, so the run-time identity check has not executed against a live merge group. Nothing here runs until the queue is re-enabled; the static test is what holds in the meantime. REQUIRED_CHECKS still duplicates branch protection with no way to derive it.

Part of #13095. Row 2 of docs/ci/derived-not-declared.md.

🤖 Generated with Claude Code

---

Summary by cubic

Pins four workflow_run consumers to the workflow files they expect, while retaining GitHub's display-name trigger filter. Renames now fail CI instead of silently disabling consumers, and the merge-group watcher verifies the triggering file before cancelling runs.

• Adds SOURCE_WORKFLOW_PATHS validation and runs it in CI guards, covering missing workflows, mismatched names, and file-based run lookups.
• Makes the fail-fast watcher locate CI runs by workflow file and reject unexpected source workflows or events.
• Updates the review-fabric test to validate router behavior and explicit ownership instead of grepping stale path literals.
• Bounds the suite-coverage job with a 5-minute timeout.
• Part of [RFC] CI structure: thin router, reusable platform workflows, merge queue, failure ratchet #13095.

^{Written for commit c1865e5. Summary will update on new commits.}

[coderabbitai]

Warning

Review limit reached

Next included review available in 5 minutes.

Check out review usage here.

View limit details

Limit details: You’ve used all 10 included reviews currently available.

You've used all free OSS reviews for now. Wait for the free limit to reset to keep reviewing this public repository.

Learn how review limits work.

Review configuration:

⚙️ Run configuration

Configuration used: Repository: manaflow-ai/cmux/.coderabbit.yaml

Review profile: ASSERTIVE

Plan: Advanced

Run ID: 46d94241-9040-4613-90c8-df30ca4bf9f5

📥 Commits

Reviewing files that changed from the base of the PR and between 83a6294 and c1865e5.

📒 Files selected for processing (8)

• .github/workflows/ci-guards.yml
• .github/workflows/ci.yml
• .github/workflows/cmux-tui-release-delivery.yml
• .github/workflows/merge-group-fail-fast.yml
• .github/workflows/persistent-macos-router.yml
• .github/workflows/update-homebrew.yml
• tests/test-execution.toml
• tests/test_ci_workflow_run_sources.py

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[github-actions]

All contributors have signed the CLA ✍️ ✅
_{Posted by the CLA Assistant Lite bot.}

[cursor]

Bugbot is paused — on-demand spend limit reached

Bugbot uses usage-based billing for this team and has hit its on-demand spend limit.

A team admin can raise the spend limit in the Cursor dashboard, or wait for the next billing cycle to continue.