ci: reuse the resolve's manifests on the first scheme build

[teamleaderleo]

Summary

Part of hq#661 workstream 5 (compile speed on the owned minis).

The first of the admission's scheme builds spent 18 to 44 s in Resolve Package Graph re-evaluating all 91 Package.swift files. SwiftPM keys each evaluated manifest on xcodebuild's whole environment. The resolve runs under swiftpm-manifest-cache.sh run (fixed env), and so does the seeded cache, but the builds ran under the step's environment, so they never hit.

This PR:

• runs every scheme build through the same run wrapper, with FileSystemMode kept on both the resolve and the builds, so they share one environment;
• hands the caller's HOME, CI, TMPDIR, CMUX_*, CARGO_*, RUSTUP_* and Go variables to the script phases as command-line build settings. Build settings reach every script phase's environment but not SwiftPM's key;
• passes PATH as CMUX_CALLER_PATH, since Swift Build builds a script's PATH from its own process PATH and ignores a PATH build setting. scripts/build-phase-caller-path.sh puts it back behind Xcode's tool directories, where Xcode would have put it. It is sourced by the Nucleo FFI, diff sidecar, wireguard-go and bundled-resources phases, and does nothing outside CI.

Evidence (toy project, Xcode 27, local package)

Manifest cache entries after each step, starting from a fresh manifest:

• resolve under run: +1 (evaluated)
• build under run with HOME, CI, CMUX_CALLER_PATH, CMUX_SKIP_ZIG_BUILD settings: +0 (hit)
• build the old way: +1 (miss)

The same toy confirmed that script phases see the forwarded settings, that the restored PATH finds ~/.cargo/bin/cargo, and that a PATH= build setting is ignored for script phases.

After merge

Changing swiftpm-manifest-cache.sh changes the manifest cache key, so dispatch seed-derived-data.yml and seed-swiftpm-manifests.yml on main. Until then readers fall back to the old prefix entries, which miss.

Tests

• tests/test_ci_canonical_build_root.py: builds share the resolve's exact environment, per-step noise (GITHUB_RUN_ID) stays out, forwarded settings and CMUX_CALLER_PATH reach every build, and the PATH helper restores the caller PATH behind Xcode's directories.
• tests/test_build_app_bundled_resources.sh, tests/test_ci_test_compilation_cache_seed.sh, tests/test_ci_swiftpm_manifest_cache.sh pass.

🤖 Generated with Claude Code

---

^{Need help on this PR? Tag @codesmith-bot with what you need. Autofix is disabled.}

---

Summary by cubic

Runs every scheme build through the same swiftpm-manifest-cache.sh environment as the resolve, so the first build reuses its evaluated Package.swift manifests instead of re-evaluating all 91 (18–44 s per admission). Script phases still receive the caller's PATH, HOME, CI, and toolchain settings via command-line build settings, which SwiftPM excludes from its cache key; a new build-phase-caller-path.sh helper restores the caller's PATH in the Nucleo FFI, diff sidecar, wireguard-go, and bundled-resources phases. Secret-looking variable names (*TOKEN*, *SECRET*, *PASSWORD*, *_KEY) are dropped from the forwarded settings because they land in the build log a DerivedData seed carries.

After merge

• Changing swiftpm-manifest-cache.sh changes the manifest cache key; dispatch seed-derived-data.yml and seed-swiftpm-manifests.yml on main.

^{Written for commit ccb209d. Summary will update on new commits.}

[coderabbitai]

Warning

Review limit reached

Next included review available in 10 minutes.

Check out review usage here.

View limit details

Limit details: You’ve used all 10 included reviews currently available.

You've used all free OSS reviews for now. Wait for the free limit to reset to keep reviewing this public repository.

Learn how review limits work.

Review configuration:

⚙️ Run configuration

Configuration used: Repository: manaflow-ai/cmux/.coderabbit.yaml

Review profile: ASSERTIVE

Plan: Advanced

Run ID: cf9680c8-1092-4523-8f25-9c9e7888c7f5

📥 Commits

Reviewing files that changed from the base of the PR and between f8857c5 and ccb209d.

📒 Files selected for processing (8)

• scripts/build-app-bundled-resources.sh
• scripts/build-command-palette-nucleo-ffi.sh
• scripts/build-diff-sidecar.sh
• scripts/build-phase-caller-path.sh
• scripts/build-wireguard-go.sh
• scripts/ci/compile-app-host-test-product.sh
• scripts/ci/swiftpm-manifest-cache.sh
• tests/test_ci_canonical_build_root.py

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[github-actions]

All contributors have signed the CLA ✍️ ✅
_{Posted by the CLA Assistant Lite bot.}

[blacksmith-sh]

Found 1 test failure on Blacksmith runners:

Failure

Test	View Logs
test_paid_and_downstream_jobs_checkout_only_the_resolved_sha (main.IOSWorkflowDispa tchRefTests.test_paid_and_downstream_jobs_checkout_only_the_resolved_sha)/ test_paid_and_downstream_jobs_checkout_only_the_resolved_sha (main.IOSWorkflowDispa tchRefTests.test_paid_and_downstream_jobs_checkout_only_the_resolved_sha)	View Logs

^{Need help on this PR? Tag @codesmith-bot with what you need.}

[github-actions]

Merge receipt for ccb209d5ec, merged 2026-09-25 18:47:11 UTC

• Not verified at merge: ci-status (failure), guards (18) (failure), linux-preflight (failure), tests (failure), CLA policy guard (failure)
• Verified: macOS compile admission, Web complexity, web-validation, diff-sidecar-check, Fast static checks, GhosttyKit release check, macOS admission gate, macOS status, Testbox broker trust boundary, Web status, web-subarea-scope
• Skipped by policy: app-host unit tests, agent-session-web-resources, browser, Claude wrapper regressions, CLI product tests, late-placement, react-apps-check, release-admission, release-build, remote-daemon, suite-coverage, swift-package-tests, and 9 more
• Full suite: runs on main after merge.

Labeled merged-unverified: if main breaks near this merge, look here first.