ci: skip a main seed build only when the nearest seed has the same inputs

[teamleaderleo]

Problem

seed-derived-data.yml's decide job skips the Mac when a push's build fingerprint equals its parent's. That assumes the parent has a seed, and it often has none.

The workflow never cancels a running seed. A newer push replaces the one pending run, so the replaced commit is never built. The next docs-only push then compares against that unseeded parent, sees equal inputs, and skips. From then on, main's newest seed stays on an older build for as long as such pushes keep coming.

Measured over the last 100 seeder runs (2026-09-23 17:00Z to 2026-09-24 17:10Z), using each commit's own fingerprint script: 8 of 22 skips left main 2 to 6 commits past its newest seed with different build inputs. The last case: #14241 merged at 15:46Z, and 80 minutes passed with no seed built after it (1493cdf and three later pushes were replaced while pending; fb895a9 and 7cf4e10 then skipped). PR admissions during such windows adopt a seed with different inputs and compile more.

Cancellation itself costs nothing: none of the 54 cancelled seeder runs in the same window had started a Mac job.

Change

scripts/ci/seed_decide.py walks main's first-parent history, up to 30 commits, to the nearest commit whose seeder run saved a seed (seed job succeeded and Save seed ran) or is saving one now (seed in progress, never cancelled). It skips only if HEAD's build inputs equal that commit's. A pending run does not count, since a newer push can still replace it. A skipped ancestor is walked past, and the comparison is made against the seed behind it. API errors, no seeded ancestor in the window, or a fingerprint failure all build.

The decide job now checks out 32 commits and reads Actions (actions: read).

Proof

A replay of the new logic against all 22 historical skips, with real seeder run data and each commit's own build_input_fingerprint.py:

• It builds on exactly the 8 stale skips: 7cf4e10, fb895a9, 623e5bc, 7dc0415, 4e35c3e, 1c1d27b, f4ff9af, 0b9b318.
• It keeps the 13 correct skips.
• It builds on one more, a05c7e6, whose seeded ancestor predates the 100-run window. That errs in the conservative direction.

python3 tests/test_seed_decide.py: 8 OK. tests/test_seed_derived_data.py: 26 OK. tests/test_ci_guard_workflow_structure.py and validate_test_execution_registry.py pass. actionlint is clean.

🤖 Generated with Claude Code

---

^{Need help on this PR? Tag @codesmith-bot with what you need. Autofix is disabled.}

---

Summary by cubic

Fixes the seed build skip so a docs-only push no longer leaves main's newest seed on an older build with different inputs. The decide job compared build inputs with the parent commit, assuming it had a seed; a newer push replaces a pending seed run, so the parent often had none.

scripts/ci/seed_decide.py now walks main's first-parent history (up to 30 commits) to the nearest ancestor with a completed seed (seed job succeeded and "Save seed" ran) and skips only when the build inputs match that commit's. A pending run does not count. The step names it reads are pinned in one place so a rename can't silently change behavior. Anything unknown — API errors, no seeded ancestor, fingerprint failures — builds. The decide job now checks out 32 commits and requires actions: read.

A replay against real run data and the historical skips builds on exactly the 8 stale-skip commits and keeps all 13 correct skips.

^{Written for commit 20e09ba. Summary will update on new commits.}

Known gaps, unchanged by this PR

Both existed with the parent-only check:

• A green Save seed step does not prove the upload happened: r2-cache.sh returns 0 on a missing credential or an HTTP upload error. A silent save failure lets later docs pushes skip against a seed that does not exist.
• The fingerprint ignores the runner pool and the Xcode behind the key prefix, so a change to MACOS_RUNNER_PR or the Xcode variable lets docs pushes skip while the new prefix has no seed.

🤖 Generated with Claude Code

Summary by CodeRabbit

• CI Improvements
  • Derived data seed builds are now skipped when a recent successful seed has matching build inputs. Builds still run when inputs differ, no usable seed is found, checks fail, or the workflow is manually triggered.
  • Added automated checks for the seed-build decision process and its workflow configuration.

[coderabbitai]

Navigate logical layers of code changes, visualize relationships, and explore their blast radius.

Note

Currently processing new changes in this PR. This may take a few minutes, please wait...

⚙️ Run configuration

Configuration used: Repository: manaflow-ai/cmux/.coderabbit.yaml

Review profile: ASSERTIVE

Plan: Advanced

Run ID: be4bc4d3-f423-440a-acca-82a257a45b9c

📥 Commits

Reviewing files that changed from the base of the PR and between 55d9b75 and 20e09ba.

📒 Files selected for processing (6)

• .github/workflows/ci-guards.yml
• .github/workflows/seed-derived-data.yml
• scripts/ci/seed_decide.py
• tests/test-execution.toml
• tests/test_ci_guard_workflow_structure.py
• tests/test_seed_decide.py

 ___________________________________________
< That's not a fallback, that's a trapdoor. >
 -------------------------------------------
  \
   \   (\__/)
       (•ㅅ•)
       / 　 づ

✨ Finishing Touches

📝 Generate docstrings

• Commit to this branch
• Create a new PR

🧪 Generate unit tests (beta)

• Commit to this branch
• Create a new PR

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[github-actions]

All contributors have signed the CLA ✍️ ✅
_{Posted by the CLA Assistant Lite bot.}