ci: install web dependencies before the Cloud VM image lock tests

[teamleaderleo]

Summary

"Cloud VM image lock" has failed on every feat-cmux-next push run since db3743e (6 runs, the latest 37590398962 on 07b0a81) with error: Cannot find package 'freestyle' from web/scripts/cmux-vm-image/guest.ts. The lock test imports smoke.ts, which now reaches guest.ts and its freestyle import. The job skipped bun install on the assumption that the tests use no web dependency.

The fix runs bun install --frozen-lockfile in web/ before the tests and updates the workflow comment. It changes no test or web/ code.

Verification

• Red: base push run 37590398962, step "Run bun test ..." (1 fail, missing freestyle).
• Green: this PR's "Cloud VM image lock" run (the workflow file change triggers it).
• actionlint passes on the workflow.

Changelog

none

🤖 Generated with Claude Code

---

^{Need help on this PR? Tag @codesmith-bot with what you need. Autofix is disabled.}

---

Summary by cubic

Fixes the Cloud VM image lock workflow, which has failed on every feat-cmux-next push since the lock test started importing guest.ts and its freestyle dependency. The job previously skipped bun install on the assumption that the tests use no web dependencies.

• Runs bun install --frozen-lockfile in web/ before the lock tests and updates the workflow comment.
• No test or web/ code changes.

^{Written for commit ee0952f. Summary will update on new commits.}

---

Note

Low Risk
CI-only workflow change; no application or test logic modified.

Overview
Fixes the Cloud VM image lock CI job by installing web dependencies before running VM image tests.

The workflow previously skipped bun install because the tests were assumed to have no web deps. The lock test now pulls in smoke.ts → guest.ts, which requires the freestyle package, so the job runs bun install --frozen-lockfile in web/ before bun test. The header comment is updated to document that dependency chain.

^{Reviewed by Cursor Bugbot for commit ee0952f. Bugbot is set up for automated code reviews on this repo. Configure here.}

[coderabbitai]

Important

Review skipped

Auto reviews are disabled on base/target branches other than the default branch.

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

• Configuration used: Repository: manaflow-ai/cmux/.coderabbit.yaml
• Review profile: ASSERTIVE
• Plan: Advanced
• Run ID: bfea7a8e-6304-4182-985a-efe216138255

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

• Autopilot · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[github-actions]

The feat-cmux-next push run https://github.com/manaflow-ai/cmux/actions/runs/37597620459 at e39f213 failed: cmux-next checks (god files, concurrency, crash safety, l10n).
Those jobs last passed at 1aa7972. This pull request is one of 3 merged since: #18311, #18301, #18317.
If the failure is in your change, fix forward on feat-cmux-next. Pull requests run only the tiers their paths reach (docs/ci/cmux-next-tiers.md); label a batch PR full-ci to run them all before merging.