ci: app-host rerun holds the product's canonical root

[teamleaderleo]

Summary

glaeda's review found that app-host-test-rerun.yml's rerun job hard-codes /private/tmp/cmux-ci, rm -rfs that root's derived-data-compile-admission, and never calls glaeda-canonical-root take. On an owned Mac with two roots it could replace a tree another job is using. It also rebuilt a product compiled in /private/tmp/cmux-ci-2 at root-1 paths, which its swiftmodules do not match.

• scripts/ci/take-product-canonical-root.sh (new) reads the producer's root from the product receipt's derived, the same way restore-app-host-test-product.sh does. If the receipt has no canonical root, it uses CMUX_CI_CANONICAL_ROOT, then /private/tmp/cmux-ci. It rejects anything that is not /private/tmp/cmux-ci or /private/tmp/cmux-ci-<n>, holds the root with glaeda-canonical-root take <root> --wait 1800 when the helper exists, and prints the root.
• In the rerun job, "Unpack products at the path CI compiled them" now extracts to $RUNNER_TEMP/rerun-products first. It takes the root, and only after that replaces <root>/derived-data-compile-admission (with a mv). It exports CMUX_CI_CANONICAL_ROOT, CANONICAL_ROOT and COMPILE_DERIVED_DATA to $GITHUB_ENV. The job-level hard-coded CANONICAL_ROOT / COMPILE_DERIVED_DATA env is gone. Exporting CMUX_CI_CANONICAL_ROOT also fixes a latent mismatch: canonical-resolve read that variable while the rest of the job used the hard-coded root.
• The tests still run from $RUNNER_TEMP/cmux-derived-data-rerun, a DerivedData of the job's own, the same way the shard jobs do.
• Blacksmith is unchanged: a receipt from a Blacksmith producer names /private/tmp/cmux-ci, and there is no helper to call.

Why the rebuild stays in <root>/derived-data-compile-admission and not a fresh directory: the cmuxTests bundle is compiled against the producer's swiftmodules, which carry absolute paths into that DerivedData and into <root>/src. In a different directory, those paths would point at whatever the root holds, possibly another revision's build. Taking the root first makes that directory this job's own until the job ends. test-e2e.yml owns the same path the same way.

glaeda follow-up (not in this PR): the hook still classifies rerun as an unknown job, which means compile, pinned to root 1. It holds root 1 from job start, so the take is a no-op for root-1 products and exits 2 ("one root per job") for a root-2 product. The rerun fails loudly in that case and no longer builds at the wrong paths. Adding ("app-host-test-rerun.yml", "rerun"): "gui" to WORKFLOW_JOB_CLASSES lets it take the producer's root like other consumers. It runs the app-host tests in the console session, so it needs the gui token.

Tests

• python3 tests/test_app_host_test_rerun.py: 47 tests OK. The new CanonicalRootTests check that:
  • the workflow's code lines never name /private/tmp/cmux-ci; the fallback lives only in the helper
  • the take call is present, and it runs before the only rm -rf "$COMPILE_DERIVED_DATA"
  • products are staged outside the root
  • the three env vars are exported
  • the helper picks the producer's root over the one glaeda handed the job, keeps this job's root for receipts without one, rejects bad roots, fails when the take fails, and skips the take with no helper
• ./tests/test_ci_self_hosted_guard.sh: 38 checks pass.
• python3 tests/test_ci_canonical_build_root.py: OK.
• tests/test_ci_change_areas.py::test_app_host_rerun_runs_on_the_products_pool: OK.
• actionlint .github/workflows/app-host-test-rerun.yml: clean.

The existing test file is already wired into ci-guards.yml (app-host-execution group) and tests/test-execution.toml (linux-guard), so no new wiring is needed.

release-build audit

Scope: the release-build job in ci-macos.yml and the scripts it runs.

Paths it writes or deletes

• Workspace:
  • build-universal/ is the Release DerivedData, plus CompilationCache.noindex. It is deleted at job start by "Reclaim release runner disk" and never cleaned at job end.
  • .spm-cache/ holds the SwiftPM checkouts and .package-cache. It is also deleted at start.
  • GhosttyKit.xcframework is deleted and re-extracted by download-prebuilt-ghosttykit.sh.
  • ghostty-cli-helper/ is a downloaded artifact.
  • .git/index.lock and .git/modules/**/*.lock are cleared by the first step.
  • All of these are per-runner-instance paths.
• $RUNNER_TEMP: the cmux-tui manifests, cmux-release-product.tar.gz, and the reuse receipt.
• $TMPDIR / mktemp: scratch dirs from test_thin_app_bundle.sh, test_install_cmux_tui_client.sh, download-prebuilt-ghosttykit.sh and build-cmux-cua.sh, all removed by traps.
• $HOME, shared by every job on the mini:
  • ~/.cargo and ~/.rustup: install-rust-ci.sh may run rustup-init, rustup default stable, rustup target add, and install the DiffSidecar toolchain.
  • ~/Library/Caches/cmux/cmux-tui-client: install-cmux-tui-client.sh.
  • ~/Library/Caches/cmux/cmux-cua: build-cmux-cua.sh, which runs as an Xcode build phase.
  • Default Go caches, ~/Library/Caches/go-build and ~/go/pkg/mod, from the wireguard-go/tunnel build phase.
  • $RUNNER_TOOL_CACHE, from actions/setup-go.
• Host-global: select-ci-xcode.sh runs xcode-select -s (sudo -n fallback) unless CMUX_CI_SKIP_XCODE_SELECT=1. It only reads /Applications to choose an Xcode.
• Not touched: /private/tmp/cmux-ci* (no canonical root), /Users/Shared/cmux-build-fleet (owned build state), /Applications writes, launchd, defaults.

Signing and secrets

• CODE_SIGNING_ALLOWED=NO. The only signatures are ad hoc (codesign --sign -) on cmux-cua and its helper app, plus codesign --verify. These do not use the keychain.
• The only credential is github.token with read scopes (actions, attestations, contents). It is used for gh attestation verify, artifact download, and product restore.
• The cache-restore action is restore-only.
• No repository secrets, no keychain, no notarization.

GUI session: not needed. No app launch, no XCTest, and no run-in-console-session.sh.

Safe on a persistent owned mini that runs other jobs? Yes, with these caveats:

1. xcode-select -s is host-global. It is harmless while every job on the mini selects the same Xcode. Otherwise, set CMUX_CI_SKIP_XCODE_SELECT=1 for this job; it already pins DEVELOPER_DIR.
2. The rustup and ~/Library/Caches/cmux writes are shared $HOME state. Every other job writes it the same way, but two concurrent rustup installs can race on first use.
3. Disk: a universal Release build-universal/ (several GB) stays in each runner instance's workspace until that instance's next release-build.
4. runs-on is vars.MACOS_RUNNER_26, not the owned-pool picker, so it needs a routing change to reach a mini at all.

Recommended glaeda class: isolated (2 units, no root, no gui):

• It compiles into its own workspace DerivedData, never a canonical root, so compile would take a root and the persistent-dd token for nothing.
• It consumes no admission product, so it is not product.
• It needs no console session, so it is not gui.
• The 2-unit weight matches a universal Release compile.

The hook would treat it as an unknown job today (compile, pinned to root 1), so it needs an explicit "release-build": "isolated" entry in JOB_CLASSES before it is routed to minis.

🤖 Generated with Claude Code

---

^{Need help on this PR? Tag @codesmith-bot with what you need. Autofix is disabled.}

---

Summary by cubic

The rerun job now holds the product's canonical build root before rebuilding against it, so it no longer replaces trees another job is using and rebuilds at the paths the product was compiled at.

Bug Fixes

• New scripts/ci/take-product-canonical-root.sh reads the producer's root from the product receipt's derived, falls back to CMUX_CI_CANONICAL_ROOT then /private/tmp/cmux-ci, and takes the root with glaeda-canonical-root take when the helper exists.
• Products are staged in $RUNNER_TEMP/rerun-products and moved into the root only after the take succeeds.
• CMUX_CI_CANONICAL_ROOT, CANONICAL_ROOT, and COMPILE_DERIVED_DATA are exported, fixing the mismatch where canonical-resolve read CMUX_CI_CANONICAL_ROOT while the job used a hard-coded root.
• Blacksmith is unchanged: receipts there name /private/tmp/cmux-ci and there is no helper to call.

^{Written for commit 723aced. Summary will update on new commits.}

Summary by CodeRabbit

• Chores
  • App-host test reruns now validate the build location recorded with their artifacts and prepare that location before installing staged products. This makes reruns use the producer’s build area and helps prevent conflicts when multiple CI jobs run at the same time. Invalid locations are rejected, and reruns report an error if the build area cannot be acquired.

[github-actions]

All contributors have signed the CLA ✍️ ✅
_{Posted by the CLA Assistant Lite bot.}

[coderabbitai]

Navigate logical layers of code changes, visualize relationships, and explore their blast radius.

Note

Currently processing new changes in this PR. This may take a few minutes, please wait...

⚙️ Run configuration

Configuration used: Repository: manaflow-ai/cmux/.coderabbit.yaml

Review profile: ASSERTIVE

Plan: Advanced

Run ID: f8240dc9-ed30-4635-a644-29ba139e1eff

📥 Commits

Reviewing files that changed from the base of the PR and between a855dbf and 723aced.

📒 Files selected for processing (3)

• .github/workflows/app-host-test-rerun.yml
• scripts/ci/take-product-canonical-root.sh
• tests/test_app_host_test_rerun.py

 ____________________________
< Try...catch me if you can. >
 ----------------------------
  \
   \   \
        \ /\
        ( )
      .( o ).

✨ Finishing Touches

📝 Generate docstrings

• Commit to this branch
• Create a new PR

🧪 Generate unit tests (beta)

• Commit to this branch
• Create a new PR

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}