ci: match manual dispatch coverage before cancellation

[teamleaderleo]

Follow-up to #16111. A manual dispatch is cancelled only when an open PR run at the same source has equivalent effective coverage and configuration.

The fingerprint includes a version, source SHA and ref, cache backend, Release architectures, and coverage policy. Active equivalent PR runs may suppress a duplicate. Failed, missing, unknown, compile-only, or fuller manual coverage stays eligible.

Validation: python3 tests/test_ci_manual_dispatch_guard.py, python3 tests/test_ci_manual_dispatch_guard_workflow.py, git diff --check.

— Copperleaf pending
Run: run_16111_coverage_20260930
Intention: repair manual dispatch cancellation coverage matching

---

^{Need help on this PR? Tag @codesmith-bot with what you need. Autofix is disabled.}

---

Summary by cubic

Manual CI dispatches are now only cancelled as duplicates when an open PR run at the same head has equivalent effective coverage and configuration.

• The CI workflow's run title carries a versioned fingerprint (source SHA/ref, cache backend, release architectures, coverage policy) that the guard reads from the run metadata.
• The guard cancels a dispatch only when the PR run's fingerprint matches; failed, compile-only, unknown, or missing coverage, or a fuller manual configuration, keeps the dispatch eligible.

^{Written for commit 101e5ea. Summary will update on new commits.}

[coderabbitai]

Warning

Review limit reached

You've used all free OSS reviews for now. Wait for the free limit to reset to keep reviewing this public repository.

Next included review available in 9 minutes.

Check out review usage here.

View limit details

Limit details: You’ve used all 10 included reviews currently available.

Learn how review limits work.

Review configuration:

⚙️ Run configuration

Configuration used: Repository: manaflow-ai/cmux/.coderabbit.yaml

Review profile: ASSERTIVE

Plan: Advanced

Run ID: e8361941-b333-476c-88ea-4c45f60e663d

📥 Commits

Reviewing files that changed from the base of the PR and between 152174b and 101e5ea.

📒 Files selected for processing (5)

• .github/workflows/ci-manual-dispatch-guard.yml
• .github/workflows/ci.yml
• scripts/ci/manual_dispatch_guard.py
• tests/test_ci_manual_dispatch_guard.py
• tests/test_ci_manual_dispatch_guard_workflow.py

• Autopilot · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Autopilot is currently an internal CodeRabbit preview.

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[teamleaderleo]

Review at 7e89151: READY. Fixed: cancellation now requires matching source SHA and ref, cache backend, Release architectures, and effective coverage policy, with active or successful full-suite coverage only. Fuller, failed, missing, unknown, or compile-only coverage remains eligible. Left: none.

— Copperleaf pending
Run: run_16111_coverage_20260930
Intention: independent exact-head review

[teamleaderleo]

The first CI attempt did not find a defect in this change. Fast static checks failed on two pre-existing French localization parity entries from #13232; #16175 documents those invariants. CLA Assistant and CLA policy guard failed because the GitHub API installation rate limit was exceeded. The routing checks only propagated the static-preflight failure. No rerun was requested.

— Copperleaf pending
Run: run_16111_coverage_20260930
Intention: record the external CI blockers while auto-merge remains armed

[github-actions]

All contributors have signed the CLA ✍️ ✅
_{Posted by the CLA Assistant Lite bot.}

[github-actions]

Merge receipt for 101e5ea77a, merged 2026-09-30 20:02:29 UTC

• Not verified at merge: ci-status (not reported), CI fast guards (in progress), Fast static checks (in progress), receipt-contract (in progress), Testbox broker trust boundary (in progress), transport (in progress), Web complexity (in progress)
• Verified: web-validation
• Skipped by policy: web-build, web-database-tests, web-tests
• Full suite: runs on main after merge.

Labeled merged-unverified: if main breaks near this merge, look here first.

[teamleaderleo]

Review at 101e5ea: READY. Fixed: the coverage marker job now keeps the stable full-suite-coverage name, while the guard reads the evaluated fingerprint from the run display title. This avoids relying on an unevaluated job-name expression. Left: none.

— Copperleaf pending
Run: run_16111_coverage_20260930
Intention: independent exact-head review after repair