[teamleaderleo]

Changelog

• Fixed retry handling for deferred nightly failure incidents when the exact source SHA is already published.

What changed

The asynchronous notarization continuation now distinguishes an exact source match from a newer published build. An exact match skips duplicate publication but reruns the source-SHA-matched incident closure; a newer build continues to leave the older incident open.

Validation

• bash tests/test_nightly_universal_build.sh
• python3 tests/test_notarization_recovery_manifest.py
• python3 tests/test_nightly_promotion_admission.py
• python3 tests/test_nightly_publication_marker.py
• actionlint .github/workflows/auto-resume-nightly-notarization.yml .github/workflows/resume-nightly-notarization.yml .github/workflows/nightly.yml
• python3 scripts/verify-local.py
• git diff --check

---

^{Need help on this PR? Tag @codesmith-bot with what you need. Autofix is disabled.}

---

Summary by cubic

Fixes the retry handling for deferred nightly failure incidents when the same source SHA is already published. Previously, any existing publication skipped closing the incident; now an exact source match still retries closure, while a newer build leaves the older incident open.

^{Written for commit fa6bef3. Summary will update on new commits.}

---

Note

Low Risk
CI workflow guard and incident-close conditions only; no app runtime or release artifact logic changes.

Overview
Fixes deferred nightly failure incident closure on notarization continuation retries when the release is already published for the same source SHA.

The publication guard in auto-resume-nightly-notarization.yml now treats an exact cmux-published-sha match as already published but sets ALREADY_PUBLISHED_SAME_SOURCE; a newer cmux-published-build alone still blocks republication without that flag. Close deferred nightly failure incident runs when publication was skipped for a different reason or when the skip was a same-source idempotent hit, so closure can retry without republishing. A newer build from another commit still skips closure.

Adds a regression in test_nightly_publication_marker.py that exercises the embedded guard script and closure if across SHA/build fixture cases.

^{Reviewed by Cursor Bugbot for commit fa6bef3. Bugbot is set up for automated code reviews on this repo. Configure here.}

Summary by CodeRabbit

• Bug Fixes
  • Improved nightly release publication checks so releases already published from the same source are recognized correctly.
  • Deferred publication failures are now closed when a release is newly published or the existing release matches the source.
  • Checks continue to distinguish releases from different sources and builds that are at or ahead of the current build.

[github-actions]

All contributors have signed the CLA ✍️ ✅
_{Posted by the CLA Assistant Lite bot.}

[coderabbitai]

Note

Currently processing new changes in this PR. This may take a few minutes, please wait...

⚙️ Run configuration

• Configuration used: Repository: manaflow-ai/cmux/.coderabbit.yaml
• Review profile: ASSERTIVE
• Plan: Advanced
• Run ID: 10e55d53-98e4-4f2c-ab25-2d1cbea1bc0d

📥 Commits

Reviewing files that changed from the base of the PR and between 19acbfe and fa6bef3.

📒 Files selected for processing (2)

• .github/workflows/auto-resume-nightly-notarization.yml
• tests/test_nightly_publication_marker.py

 ______________________________________________________________________________________________________________________________________________________
< Why do you need code reviews? dB/dt = ∇ × Bv: The proliferation rate of bugs (dB/dt) equals the curl of the bug vector field (Bv). It's simple math. >
 ------------------------------------------------------------------------------------------------------------------------------------------------------
  \
   \   \
        \ /\
        ( )
      .( o ).

✨ Finishing Touches

📝 Generate docstrings

• Commit to this branch
• Create a new PR

🧪 Generate unit tests (beta)

• Commit to this branch
• Create a new PR

• Autopilot · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[github-actions]

Merge receipt for fa6bef3a02: every check was green at merge (9 verified; 15 skipped by policy). Full suite runs on main after merge.