ci: publish org-member dogfood app artifacts

[teamleaderleo]

Org-member PRs with the dev-build label currently receive a tailnet-only controller link, so contributors outside the tailnet cannot download the app. This adds a trusted two-stage handoff:

• same-repository MEMBER and OWNER PRs build the exact head on the existing macOS CI route and upload a content-addressed ZIP as a short-lived GitHub artifact
• a default-branch workflow_run publisher revalidates the open PR, exact head, repository, author association, and label before uploading the ZIP to the private cmux-fleet-artifacts R2 bucket
• the publisher HEAD-verifies a 15-minute SigV4 URL and updates one sticky PR comment with the download link and SHA-256 digest

The publisher uses the protected artifacts environment and CMUX_CEF_R2_* credentials. The direct R2 URL remains the transport until the controller CDN origin is available.

Validation: test_r2_presign.py, test_r2_upload_requests.py, test_ci_production_secrets_protected_env.py, test_ci_pull_request_caches_are_read_only.py, test_ci_workflow_run_sources.py, YAML parsing, and git diff --check pass. actionlint reports only the existing SC2129 warning at ci.yml:476.

---

^{Need help on this PR? Tag @codesmith-bot with what you need. Autofix is disabled.}

---

Summary by cubic

Changes how org-member dev-build PRs get dogfood builds: instead of a tailnet-only controller link, the PR's CI run builds the exact head on a macOS runner, uploads a ZIP as a GitHub artifact, and a default-branch publisher revalidates the PR, uploads the ZIP to the private cmux-fleet-artifacts R2 bucket, and posts a sticky comment with a 15-minute signed download URL and SHA-256 digest.

The publisher runs only for open, same-repository PRs from MEMBER/OWNER authors with the dev-build label, uses the protected artifacts environment with CMUX_CEF_R2_* credentials, and HEAD-verifies the signed URL before posting the link. Direct R2 URLs remain the transport until the controller CDN origin is available. The dogfood build is now a real macOS build outside ci-status, so failures are visible but never block merges; the 15-minute link expires between pushes. Tests added cover the presigner, protected-environment secrets, and workflow source rules; actionlint reports only the pre-existing SC2129 warning.

^{Written for commit 7e7fce6. Summary will update on new commits.}

[coderabbitai]

Important

Review skipped

Auto reviews are disabled on base/target branches other than the default branch.

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

• Configuration used: Repository: manaflow-ai/cmux/.coderabbit.yaml
• Review profile: ASSERTIVE
• Plan: Advanced
• Run ID: febd21b8-9714-43bc-8194-0a38366828eb

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

• Autopilot · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}