ci: run the release-notary guards on feat-cmux-next

[teamleaderleo]

Summary

ci.yml skips its guards for feat-cmux-next PRs (cmux-next.yml is that branch's CI, #16206) and has no push trigger. So the nightly, notarization and nightly-next guard tests in ci-guards.yml ran nowhere on the branch nightly-next ships from. tests/test_nightly_cmux_tui_resolve.py stayed red there unseen (#18716).

New .github/workflows/cmux-next-guards.yml calls ci-guards.yml for feat-cmux-next pull requests and pushes:

• Only the release-notary group runs, plus ci-guards' always-on submodule forward-only guard and its Guard status rollup. Main's other groups are not enabled on the diverged branch.
• There is no path filter, so a base red shows on the push that caused it. The group takes under a minute on Linux.
• Read-only permissions (contents and checks read).

The first run of the new workflow (job 113627139893) surfaced two more base reds in the group, both fixed here:

• The license compliance test needs ghostty-next/build.zig.zon (toolchain_notices.py fails on a missing one by design), but the guard checkout has no submodules. A release-notary-only step now shallow-initializes ghostty-next when .gitmodules lists it. It's a no-op on main.
• That test's "mapped Mach-O passes" fixture used bin/cmux, which since the bundle-map update also requires the Rust and Zig std notices that a fixture Mach-O cannot name. It now uses the first-party-only libexec/cmux-server-helper.

Stacked on #18716 (its two commits are here so this PR's own run is green). Once #18716 merges, the diff is the last two commits.

Testing

• Red commit f1326d5 adds tests/test_cmux_next_guards_route.py, which fails without the workflow ("no workflow runs the release-notary guards for feat-cmux-next pull requests and pushes"). It passes with it. The test runs in the release-notary group itself.
• actionlint is clean. The workflow-wide tests pass: test_ci_reusable_workflow_permissions, test_ci_reusable_job_name_lookups, test_ci_pull_request_caches_are_read_only, test_ci_merge_queue_required_checks. test_ci_fork_runner_routing and test_ci_change_areas fail identically on base without this file (cmux-next.yml:992 runner fallback, an unrelated busy-worker case).
• CI: this PR's own run of the new workflow is green on head 0115151 (run 37870821025, job 113628262868). It executed the resolver, license compliance, universal nightly, notarization and route tests, with ghostty-next initialized. The earlier red run (job 113627139893) is the license-step red above.

Changelog

none

🤖 Generated with Claude Code

---

^{Need help on this PR? Tag @codesmith-bot with what you need. Autofix is disabled.}

---

Summary by cubic

Runs the release-notary guard tests on feat-cmux-next pull requests and pushes, and fixes the nightly delta jobs to compare against the resolved build commit instead of the branch tip.

ci.yml skips its guards for feat-cmux-next and never runs on push, so the nightly and nightly-next guard tests ran nowhere on that branch. A new cmux-next-guards.yml workflow calls ci-guards.yml with only the release-notary group for feat-cmux-next PRs and pushes, with no path filter so a base red shows on the push that caused it.

• Fixes nightly delta jobs that incorrectly skipped every delta result as stale whenever the build was behind the tip, since publication moves the release tag to the resolved build commit.
• Release notes, the recovery manifest, and artifact names also now use the resolved build commit.
• Initializes the ghostty-next submodule in the release-notary group, since the license compliance test reads ghostty-next/build.zig.zon and fails when it is missing.
• Switches the license compliance fixture to a first-party-only Mach-O, because bin/cmux also requires the Rust and Zig standard library notices.
• Adds a regression test in the release-notary group that fails if no workflow routes those guards to feat-cmux-next or initializes ghostty-next before the compliance check.

This stacks on #18716; once that merges, the diff here is the remaining commits.

^{Written for commit 0115151. Summary will update on new commits.}

---

Note

Medium Risk
Touches nightly publication/delta republish tagging and adds branch-specific CI routing; mistakes could skip deltas or mis-attribute release metadata, but changes are guard-tested and read-only on the new workflow.

Overview
Adds cmux-next-guards.yml so feat-cmux-next pull requests and pushes run the reusable ci-guards workflow with only the release-notary Linux guard group (nightly/notarization/nightly-next contract tests that main CI skipped on that branch).

ci-guards.yml now shallow-inits the ghostty-next submodule before release-notary license checks when present, wires tests/test_cmux_next_guards_route.py into that group, and the license compliance shell test uses a libexec/cmux-server-helper fixture instead of bin/cmux so toolchain notices are not required for the positive Mach-O case.

nightly.yml delta generation, republish stale-tag guard, release notes head SHA, and notarization recovery artifact naming now use resolve-nightly-cmux-tui-client.outputs.build_sha (and short SHA) instead of decide.outputs.head_sha, with matching updates in test_nightly_universal_build.sh.

^{Reviewed by Cursor Bugbot for commit 0115151. Bugbot is set up for automated code reviews on this repo. Configure here.}

[coderabbitai]

Important

Review skipped

Auto reviews are disabled on base/target branches other than the default branch.

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

• Configuration used: Repository: manaflow-ai/cmux/.coderabbit.yaml
• Review profile: ASSERTIVE
• Plan: Advanced
• Run ID: 2a6d09f4-10c5-4c51-9533-6f3f50754fc2

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

• Autopilot · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[github-actions]

The feat-cmux-next push run https://github.com/manaflow-ai/cmux/actions/runs/37871997540 at 9e3a1a2 failed: cmux-next swift test.
Those jobs last passed at cfe3a43. This pull request is one of 4 merged since: #18716, #18718, #18124, #18170.
If the failure is in your change, fix forward on feat-cmux-next. Pull requests run only the tiers their paths reach (docs/ci/cmux-next-tiers.md); label a batch PR full-ci to run them all before merging.