ci: read the owned-pool rescue's Actions API through the route App

[teamleaderleo]

Stacked on #14460. GitHub retargets it to main when that merges.

What

The owned-pool rescue polls the Actions API (jobs, artifacts, the run, the PR head) on GITHUB_TOKEN. That token has about 1000 requests an hour for the whole repository, which is what kept #14460 from watching more runs. The org's manaflow-glaeda-route App already has Actions access (cmuxterm-hq#639) and its own budget of 5000 an hour.

• ci-owned-pool-rescue.yml mints an App installation token with actions, contents and pull-requests read. The step is continue-on-error and only runs when GLAEDA_ROUTE_APP_ID is set.
• owned_pool_rescue.GitHub sends every GET with that token (READ_TOKEN).
• Cancels and re-runs stay on GITHUB_TOKEN. ci-macos.yml routes a rescued attempt 2 back to the fleet only when github.triggering_actor == 'github-actions[bot]'. A re-run started by the App would silently skip that.
• An installation token lasts an hour and a watch can run longer. A 401 on a read switches reads to GITHUB_TOKEN for the rest of the watch. If the token can't be minted, everything stays on GITHUB_TOKEN, as it is today.

Tests

tests/test_ci_owned_pool_rescue.py adds a Tokens class. It checks that reads use the App token while writes keep the repo token, that an expired App token falls back, that everything uses the repo token when there is no App token, and how the workflow mints and passes the token. All 80 rescue tests pass, and actionlint is clean on every workflow.

🤖 Generated with Claude Code

---

Summary by cubic

Switches the owned-pool rescue's Actions API reads (jobs, artifacts, the run, the PR head) from the repository's GITHUB_TOKEN to the manaflow-glaeda-route App installation token, which has its own 5000 requests an hour instead of the repository's shared 1000.

• The workflow mints the App token with actions, contents, and pull-requests read access; a failed or skipped mint leaves all requests on GITHUB_TOKEN.
• Cancels and re-runs keep GITHUB_TOKEN so attempt-2 re-runs stay attributed to github-actions[bot] for fleet routing.
• A 401 on a read (the App token expires after an hour) falls back to GITHUB_TOKEN for the rest of the watch.

^{Written for commit 4796d7e. Summary will update on new commits.}

[coderabbitai]

Warning

Review limit reached

Next included review available in 18 minutes.

Check out review usage here.

View limit details

Limit details: You’ve used all 10 included reviews currently available.

You've used all free OSS reviews for now. Wait for the free limit to reset to keep reviewing this public repository.

Learn how review limits work.

Review configuration:

⚙️ Run configuration

Configuration used: Repository: manaflow-ai/cmux/.coderabbit.yaml

Review profile: ASSERTIVE

Plan: Advanced

Run ID: d92a1539-7f71-4419-9a08-8edbc84229b8

📥 Commits

Reviewing files that changed from the base of the PR and between 115588f and 4796d7e.

📒 Files selected for processing (3)

• .github/workflows/ci-owned-pool-rescue.yml
• scripts/ci/owned_pool_rescue.py
• tests/test_ci_owned_pool_rescue.py

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[github-actions]

All contributors have signed the CLA ✍️ ✅
_{Posted by the CLA Assistant Lite bot.}

[github-actions]

Merge receipt for 4796d7ed7e: every check was green at merge (8 verified; 11 skipped by policy). Full suite runs on main after merge.