fix(nightly): use the resolved build commit after publication

[teamleaderleo]

Summary

Base repair: tests/test_nightly_cmux_tui_resolve.py is red on feat-cmux-next. Nothing showed it, because ci-guards does not run for feat-cmux-next (a follow-up PR fixes that).

The nightly builds at the resolved cmux-tui commit (build_sha), and publication moves the release tag there. Several later uses still took the tip (decide.head_sha):

• generate-nightly-deltas and republish-nightly-deltas checked out the tip. The republish stale check compared the release tag with the tip, so whenever the build was behind the tip, every delta result was skipped as stale. Both jobs now need the resolver and use build_sha.
• publish-nightly release notes now use build_sha as their head, so the notes cover the commits actually built.
• The nightly-next recovery manifest and artifact name now record the built commit (build_sha, build_short_sha). The main auto-resume no longer continues nightly-next (Nightly continuation: never resume nightly-next on main's channel #18711), so no other consumer reads them.

Main's NIGHTLY and RC run the same jobs, so the delta fix applies to them too. When the build is at the tip, build_sha equals the tip and nothing changes.

Testing

• Red: tests/test_nightly_cmux_tui_resolve.py fails on origin/feat-cmux-next with 11 tip uses ("republish-nightly-deltas checks out ... not the resolved build commit", etc.). The red commit 6efe7fd extends tests/test_nightly_universal_build.sh to require the resolver in both delta jobs and the stale check against build_sha. It fails on base's nightly.yml ("post-publication delta generation must be matrixed, stale-guarded ...").
• Green on aca51aa: both pass. actionlint is clean on nightly.yml. The whole ci-guards release-notary group passes locally, except the license compliance step, which needs the ghostty-next submodule checkout.
• CI coverage: ci-guards does not run on feat-cmux-next, so no CI job executes these tests on this PR.

Changelog

none

🤖 Generated with Claude Code

---

^{Need help on this PR? Tag @codesmith-bot with what you need. Autofix is disabled.}

---

Summary by cubic

Fixes nightly delta generation and release notes to use the resolved build commit instead of the tip after publication.

The delta jobs checked out the tip and compared the release tag with it, but publication moves the tag to the resolved build commit. Whenever the build was behind the tip, every delta result was skipped as stale. Release notes heads and the nightly-next recovery manifest and artifact name also used the tip instead of the commit that was built.

• The delta and republish jobs now depend on the resolver and use build_sha; when the build is at the tip, behavior is unchanged.
• tests/test_nightly_universal_build.sh requires the resolver in both delta jobs and checks the stale guard against build_sha.

^{Written for commit aca51aa. Summary will update on new commits.}

---

Note

Medium Risk
Changes nightly/RC Sparkle delta republish and release-note commit ranges; wrong SHA wiring could skip deltas or mis-attribute notes, but behavior matches when build_sha equals the tip.

Overview
Nightly publication can build at a resolved cmux-tui commit (build_sha) while the branch tip moves ahead. This PR aligns downstream jobs that still used decide.head_sha with resolve-nightly-cmux-tui-client.outputs.build_sha (and build_short_sha).

generate-nightly-deltas and republish-nightly-deltas now depend on the resolver, check out build_sha, and compare the channel release tag to build_sha in the stale guard (so deltas are not skipped when the tag points at the built commit but the tip has moved). publish-nightly release notes use build_sha as NOTES_HEAD. Notarization recovery JSON and artifact names record the built commit instead of the tip.

tests/test_nightly_universal_build.sh is updated to require the resolver in both delta jobs and the stale check against build_sha.

^{Reviewed by Cursor Bugbot for commit aca51aa. Bugbot is set up for automated code reviews on this repo. Configure here.}

[coderabbitai]

Important

Review skipped

Auto reviews are disabled on base/target branches other than the default branch.

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

• Configuration used: Repository: manaflow-ai/cmux/.coderabbit.yaml
• Review profile: ASSERTIVE
• Plan: Advanced
• Run ID: 22390968-7f65-4370-a5ac-fbcc00cd91cb

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

• Autopilot · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[github-actions]

The feat-cmux-next push run https://github.com/manaflow-ai/cmux/actions/runs/37871997540 at 9e3a1a2 failed: cmux-next swift test.
Those jobs last passed at cfe3a43. This pull request is one of 4 merged since: #18716, #18718, #18124, #18170.
If the failure is in your change, fix forward on feat-cmux-next. Pull requests run only the tiers their paths reach (docs/ci/cmux-next-tiers.md); label a batch PR full-ci to run them all before merging.