From 337e488258671ba177c07de56f94aca930b8d8b5 Mon Sep 17 00:00:00 2001 From: Austin Wang <38676809+austinywang@users.noreply.github.com> Date: Fri, 9 Oct 2026 14:12:15 -0700 Subject: [PATCH 1/4] test: cover Cloud welcome for users who already turned Cloud on --- cmuxTests/CloudWelcomeTests.swift | 20 ++++++++++++++++++++ 1 file changed, 20 insertions(+) diff --git a/cmuxTests/CloudWelcomeTests.swift b/cmuxTests/CloudWelcomeTests.swift index ce6d54015413..b7ae8ac843ac 100644 --- a/cmuxTests/CloudWelcomeTests.swift +++ b/cmuxTests/CloudWelcomeTests.swift @@ -1,4 +1,6 @@ import AppKit +import CmuxCloud +import CmuxSettings import Testing #if canImport(cmux_DEV) @@ -9,6 +11,24 @@ import Testing @Suite("Cloud welcome") struct CloudWelcomeTests { + @Test("welcome includes Cloud on and off; only MDM blocks it", arguments: [false, true], [false, true]) + func welcomeIgnoresActivation(cloudIsOn: Bool, blockedByMDM: Bool) throws { + let suiteName = "CloudWelcomeTests.\(UUID().uuidString)" + let defaults = try #require(UserDefaults(suiteName: suiteName)) + defer { defaults.removePersistentDomain(forName: suiteName) } + defaults.set(cloudIsOn, forKey: BetaFeaturesCatalogSection().cloudMachines.userDefaultsKey) + let policy = ManagedDevicePolicy(defaults: defaults, releaseDomainDefaults: nil) { _, key in + key == ManagedDevicePolicyKey.disableCloud.rawValue ? blockedByMDM : nil + } + + #expect(CloudWelcomeWindowController.shouldPresentAutomatically( + seenVersion: defaults.string(forKey: CloudWelcomeWindowController.seenVersionDefaultsKey), + appVersion: "0.65.1", + cloudAvailable: CloudMachinesFeature.isAvailable(policy: policy), + cloudEnabled: CloudMachinesFeature.isEnabled(defaults: defaults, policy: policy) + ) == !blockedByMDM) + } + @Test("welcome owns close instead of the terminal behind it") @MainActor func welcomeOwnsCloseShortcut() { From d0e95d6b5fb9d7dbabc88d39afbb676051299df9 Mon Sep 17 00:00:00 2001 From: Austin Wang <38676809+austinywang@users.noreply.github.com> Date: Fri, 9 Oct 2026 14:14:19 -0700 Subject: [PATCH 2/4] fix: show the Cloud welcome regardless of first-use activation --- .../Cloud/CloudWelcomeWindowController.swift | 27 +++--- cmuxTests/CloudWelcomeTests.swift | 89 ++++++++++++------- 2 files changed, 69 insertions(+), 47 deletions(-) diff --git a/Sources/Cloud/CloudWelcomeWindowController.swift b/Sources/Cloud/CloudWelcomeWindowController.swift index 4e7f4ab4354c..2fb04c6eee22 100644 --- a/Sources/Cloud/CloudWelcomeWindowController.swift +++ b/Sources/Cloud/CloudWelcomeWindowController.swift @@ -1,9 +1,9 @@ import AppKit -import CmuxCloud +import CmuxSettings import SwiftUI -/// Shows the 0.65.1 Cloud welcome once for users who have Cloud available and -/// have not enabled it yet. Debug builds can reopen it from Help. +/// Shows the 0.65.1 Cloud welcome once, whether Cloud is on or off, unless +/// MDM blocks Cloud. Debug builds can reopen it from Help. @MainActor final class CloudWelcomeWindowController: NSObject, NSWindowDelegate { /// The welcome is a release announcement, rather than a permanent prompt. @@ -15,25 +15,23 @@ final class CloudWelcomeWindowController: NSObject, NSWindowDelegate { private var window: NSWindow? /// Launch presentation is considered once, at the first main window. A /// window opened later (Cmd+N an hour in) must not pop the welcome up just - /// because remote flags arrived since; an unseen welcome waits for next launch. + /// because MDM policy changed since; an unseen welcome waits for next launch. private var didConsiderLaunchPresentation = false - /// Cloud has to be offered on this Mac and still be off. The campaign only - /// runs in its target release, and its version marker makes it one-time. + /// Cloud's on/off setting does not affect the announcement. Only managed + /// DisableCloud policy excludes users from this one-time release campaign. nonisolated static func shouldPresentAutomatically( - seenVersion: String?, + defaults: UserDefaults, appVersion: String, - cloudAvailable: Bool, - cloudEnabled: Bool, + policy: ManagedDevicePolicy, isDebugBuild: Bool = false, isRunningUnderXCTest: Bool = false, isUITestMode: Bool = false ) -> Bool { guard !isDebugBuild, !isRunningUnderXCTest, !isUITestMode else { return false } return appVersion == campaignVersion - && seenVersion != campaignVersion - && cloudAvailable - && !cloudEnabled + && defaults.string(forKey: seenVersionDefaultsKey) != campaignVersion + && !policy.isEnforced(.disableCloud) } /// Records that this release's announcement has been considered. The @@ -49,10 +47,9 @@ final class CloudWelcomeWindowController: NSObject, NSWindowDelegate { didConsiderLaunchPresentation = true let appVersion = Bundle.main.object(forInfoDictionaryKey: "CFBundleShortVersionString") as? String ?? "" guard Self.shouldPresentAutomatically( - seenVersion: defaults.string(forKey: Self.seenVersionDefaultsKey), + defaults: defaults, appVersion: appVersion, - cloudAvailable: CloudMachinesFeature.isAvailable, - cloudEnabled: CloudMachinesFeature.isEnabled + policy: ManagedDevicePolicy() ) else { return } Self.markCampaignSeen(in: defaults) present(over: parent) diff --git a/cmuxTests/CloudWelcomeTests.swift b/cmuxTests/CloudWelcomeTests.swift index b7ae8ac843ac..296a74f5f29b 100644 --- a/cmuxTests/CloudWelcomeTests.swift +++ b/cmuxTests/CloudWelcomeTests.swift @@ -1,5 +1,4 @@ import AppKit -import CmuxCloud import CmuxSettings import Testing @@ -11,22 +10,24 @@ import Testing @Suite("Cloud welcome") struct CloudWelcomeTests { - @Test("welcome includes Cloud on and off; only MDM blocks it", arguments: [false, true], [false, true]) - func welcomeIgnoresActivation(cloudIsOn: Bool, blockedByMDM: Bool) throws { + @Test("welcome includes Cloud on and off; only MDM blocks it", arguments: [nil, false, true] as [Bool?], [false, true]) + func welcomeIgnoresActivation(cloudIsOn: Bool?, blockedByMDM: Bool) throws { let suiteName = "CloudWelcomeTests.\(UUID().uuidString)" let defaults = try #require(UserDefaults(suiteName: suiteName)) defer { defaults.removePersistentDomain(forName: suiteName) } - defaults.set(cloudIsOn, forKey: BetaFeaturesCatalogSection().cloudMachines.userDefaultsKey) + if let cloudIsOn { + defaults.set(cloudIsOn, forKey: BetaFeaturesCatalogSection().cloudMachines.userDefaultsKey) + } let policy = ManagedDevicePolicy(defaults: defaults, releaseDomainDefaults: nil) { _, key in - key == ManagedDevicePolicyKey.disableCloud.rawValue ? blockedByMDM : nil + key == ManagedDevicePolicyKey.disableCloud.rawValue && blockedByMDM ? true : nil } #expect(CloudWelcomeWindowController.shouldPresentAutomatically( - seenVersion: defaults.string(forKey: CloudWelcomeWindowController.seenVersionDefaultsKey), + defaults: defaults, appVersion: "0.65.1", - cloudAvailable: CloudMachinesFeature.isAvailable(policy: policy), - cloudEnabled: CloudMachinesFeature.isEnabled(defaults: defaults, policy: policy) + policy: policy ) == !blockedByMDM) + #expect(defaults.object(forKey: CloudWelcomeWindowController.seenVersionDefaultsKey) == nil) } @Test("welcome owns close instead of the terminal behind it") @@ -44,43 +45,68 @@ struct CloudWelcomeTests { #expect(cmuxWindowShouldOwnCloseShortcut(window)) } - @Test("shows once for the 0.65.1 campaign while Cloud is offered and still off") - func presentsOnlyWhenUnseenAvailableAndOff() { - #expect(CloudWelcomeWindowController.shouldPresentAutomatically(seenVersion: nil, appVersion: "0.65.1", cloudAvailable: true, cloudEnabled: false)) - #expect(!CloudWelcomeWindowController.shouldPresentAutomatically(seenVersion: "0.65.1", appVersion: "0.65.1", cloudAvailable: true, cloudEnabled: false)) - #expect(CloudWelcomeWindowController.shouldPresentAutomatically(seenVersion: "0.65.0", appVersion: "0.65.1", cloudAvailable: true, cloudEnabled: false)) - #expect(!CloudWelcomeWindowController.shouldPresentAutomatically(seenVersion: nil, appVersion: "0.65.0", cloudAvailable: true, cloudEnabled: false)) - #expect(!CloudWelcomeWindowController.shouldPresentAutomatically(seenVersion: nil, appVersion: "0.65.1", cloudAvailable: false, cloudEnabled: false)) - #expect(!CloudWelcomeWindowController.shouldPresentAutomatically(seenVersion: nil, appVersion: "0.65.1", cloudAvailable: true, cloudEnabled: true)) + @Test("automatic welcome targets only stable 0.65.1", arguments: ["0.64.25", "0.65.0", "0.65.1", "0.65.2", "0.65.1-nightly", ""]) + func presentsOnlyInCampaignRelease(appVersion: String) throws { + let suiteName = "CloudWelcomeTests.\(UUID().uuidString)" + let defaults = try #require(UserDefaults(suiteName: suiteName)) + defer { defaults.removePersistentDomain(forName: suiteName) } + let policy = ManagedDevicePolicy(defaults: defaults, releaseDomainDefaults: nil, forcedObject: { _, _ in nil }) + #expect(CloudWelcomeWindowController.shouldPresentAutomatically( + defaults: defaults, + appVersion: appVersion, + policy: policy + ) == (appVersion == "0.65.1")) } - @Test("an older marker upgrades to 0.65.1 and prevents a repeat") - func campaignMarkerUpgradeAndNoRepeat() { + @Test("an absent or older marker upgrades to 0.65.1 and prevents a repeat", arguments: [nil, "0.64.25", "0.65.0"] as [String?]) + func campaignMarkerUpgradeAndNoRepeat(previousMarker: String?) throws { let suiteName = "CloudWelcomeTests.\(UUID().uuidString)" - let defaults = UserDefaults(suiteName: suiteName)! + let defaults = try #require(UserDefaults(suiteName: suiteName)) defer { defaults.removePersistentDomain(forName: suiteName) } + let policy = ManagedDevicePolicy(defaults: defaults, releaseDomainDefaults: nil, forcedObject: { _, _ in nil }) - defaults.set("0.65.0", forKey: CloudWelcomeWindowController.seenVersionDefaultsKey) + if let previousMarker { + defaults.set(previousMarker, forKey: CloudWelcomeWindowController.seenVersionDefaultsKey) + } #expect(CloudWelcomeWindowController.shouldPresentAutomatically( - seenVersion: defaults.string(forKey: CloudWelcomeWindowController.seenVersionDefaultsKey), + defaults: defaults, appVersion: CloudWelcomeWindowController.campaignVersion, - cloudAvailable: true, - cloudEnabled: false + policy: policy )) CloudWelcomeWindowController.markCampaignSeen(in: defaults) #expect(defaults.string(forKey: CloudWelcomeWindowController.seenVersionDefaultsKey) == CloudWelcomeWindowController.campaignVersion) - #expect(!CloudWelcomeWindowController.shouldPresentAutomatically( - seenVersion: defaults.string(forKey: CloudWelcomeWindowController.seenVersionDefaultsKey), - appVersion: CloudWelcomeWindowController.campaignVersion, - cloudAvailable: true, - cloudEnabled: false + for cloudIsOn in [false, true] { + defaults.set(cloudIsOn, forKey: BetaFeaturesCatalogSection().cloudMachines.userDefaultsKey) + #expect(!CloudWelcomeWindowController.shouldPresentAutomatically( + defaults: defaults, + appVersion: CloudWelcomeWindowController.campaignVersion, + policy: policy + )) + } + } + + @Test("only a profile-enforced DisableCloud policy suppresses the welcome") + func unmanagedDisableCloudPreferenceDoesNotSuppressWelcome() throws { + let suiteName = "CloudWelcomeTests.\(UUID().uuidString)" + let defaults = try #require(UserDefaults(suiteName: suiteName)) + defer { defaults.removePersistentDomain(forName: suiteName) } + defaults.set(true, forKey: ManagedDevicePolicyKey.disableCloud.rawValue) + let policy = ManagedDevicePolicy(defaults: defaults, releaseDomainDefaults: nil, forcedObject: { _, _ in nil }) + #expect(CloudWelcomeWindowController.shouldPresentAutomatically( + defaults: defaults, + appVersion: "0.65.1", + policy: policy )) } @Test("automatic presentation is suppressed for development and test launches") - func suppressesDevelopmentAndTestLaunches() { + func suppressesDevelopmentAndTestLaunches() throws { + let suiteName = "CloudWelcomeTests.\(UUID().uuidString)" + let defaults = try #require(UserDefaults(suiteName: suiteName)) + defer { defaults.removePersistentDomain(forName: suiteName) } + let policy = ManagedDevicePolicy(defaults: defaults, releaseDomainDefaults: nil, forcedObject: { _, _ in nil }) let arguments: [(Bool, Bool, Bool)] = [ (true, false, false), (false, true, false), @@ -88,10 +114,9 @@ struct CloudWelcomeTests { ] for (isDebugBuild, isRunningUnderXCTest, isUITestMode) in arguments { #expect(!CloudWelcomeWindowController.shouldPresentAutomatically( - seenVersion: nil, + defaults: defaults, appVersion: "0.65.1", - cloudAvailable: true, - cloudEnabled: false, + policy: policy, isDebugBuild: isDebugBuild, isRunningUnderXCTest: isRunningUnderXCTest, isUITestMode: isUITestMode From 65cc5a59db361792d232d2479f8f45f846e20223 Mon Sep 17 00:00:00 2001 From: Austin Wang <38676809+austinywang@users.noreply.github.com> Date: Fri, 9 Oct 2026 14:23:35 -0700 Subject: [PATCH 3/4] ci: restore guard routing lost while merging main Restore the reviewed guard routing from 575ab74328c while retaining newer Testbox and protected-signing checks. The existing reusable-workflow permission and structure regressions fail before this repair and pass after it. Co-authored-by: Austin Wang <38676809+austinywang@users.noreply.github.com> --- .github/workflows/ci-guards.yml | 263 ++++++++++++++++---------------- 1 file changed, 134 insertions(+), 129 deletions(-) diff --git a/.github/workflows/ci-guards.yml b/.github/workflows/ci-guards.yml index 26d016c542a8..a35f83b8a2dd 100644 --- a/.github/workflows/ci-guards.yml +++ b/.github/workflows/ci-guards.yml @@ -64,37 +64,23 @@ jobs: fail-fast: false matrix: group: ${{ fromJSON(inputs.linux_guard_test_groups) }} + exclude: + - group: ci runs-on: ${{ github.repository_owner != 'manaflow-ai' && 'ubuntu-24.04' || github.event_name == 'pull_request' && github.event.pull_request.head.repo.full_name != github.repository && 'blacksmith-4vcpu-ubuntu-2404' || vars.LINUX_RUNNER || 'blacksmith-4vcpu-ubuntu-2404' }} # Its three sibling guard jobs are bounded at 15; 65 recent runs peaked at 0.8 min. timeout-minutes: 15 # This job executes scripts from the pull request. It needs only read # access for checkout, never workflow, issue, or repository write access. - # The ci matrix leg reads the existing CI fast-guards check through the - # Checks REST API; keep this read-only and scoped to this job. + # The always-on CI fast-guards job owns the `ci` group for pull requests; + # this routed matrix keeps the other groups that observe the diff. permissions: contents: read - checks: read steps: - name: Checkout uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 with: persist-credentials: false - - name: Check independent fast guard result - id: fast-guard - if: ${{ matrix.group == 'ci' }} - env: - GH_TOKEN: ${{ github.token }} - REPOSITORY: ${{ github.repository }} - HEAD_SHA: ${{ github.event_name == 'pull_request' && github.event.pull_request.head.sha || github.sha }} - run: python3 scripts/ci/fast_guard_status.py - - - name: Propagate failed independent fast guard - if: ${{ matrix.group == 'ci' && steps.fast-guard.outputs.state == 'failure' }} - run: | - echo "CI fast guards already reported failure for this revision; skipping duplicate guard execution." - exit 1 - - name: Validate macOS runner guards if: ${{ matrix.group == 'preflight' }} run: ./tests/test_ci_self_hosted_guard.sh @@ -108,121 +94,117 @@ jobs: run: python3 tests/test_build_graph_health.py - name: Validate CMUX workload profile contract - if: ${{ matrix.group == 'ci' && steps.fast-guard.outputs.skip != 'true' }} + if: ${{ matrix.group == 'ci' }} run: python3 tests/test_ci_workload_profiles.py - - name: Validate fast guard status selection - if: ${{ matrix.group == 'ci' && steps.fast-guard.outputs.skip != 'true' }} - run: python3 tests/test_ci_fast_guard_status.py - - name: Validate repository variable defaults - if: ${{ matrix.group == 'ci' && steps.fast-guard.outputs.skip != 'true' }} + if: ${{ matrix.group == 'ci' }} run: python3 tests/test_ci_repo_variable_defaults.py - name: Validate the local and fast guard runner - if: ${{ matrix.group == 'ci' && steps.fast-guard.outputs.skip != 'true' }} + if: ${{ matrix.group == 'ci' }} run: python3 tests/test_ci_run_guards.py - name: Validate machine-failure detection for focused reruns - if: ${{ matrix.group == 'ci' && steps.fast-guard.outputs.skip != 'true' }} + if: ${{ matrix.group == 'ci' }} run: python3 tests/test_ci_machine_failure.py - name: Validate the CI timing readout - if: ${{ matrix.group == 'ci' && steps.fast-guard.outputs.skip != 'true' }} + if: ${{ matrix.group == 'ci' }} run: python3 tests/test_ci_timing_readout.py - name: Validate the repository variable check - if: ${{ matrix.group == 'ci' && steps.fast-guard.outputs.skip != 'true' }} + if: ${{ matrix.group == 'ci' }} run: python3 tests/test_ci_check_repo_variables.py - name: Validate the cloud overflow switch - if: ${{ matrix.group == 'ci' && steps.fast-guard.outputs.skip != 'true' }} + if: ${{ matrix.group == 'ci' }} run: python3 tests/test_ci_cloud_overflow_switch.py - name: Validate guard failure attribution - if: ${{ matrix.group == 'ci' && steps.fast-guard.outputs.skip != 'true' }} + if: ${{ matrix.group == 'ci' }} run: python3 tests/test_ci_guard_attribution.py - name: Validate main-fix merge evidence - if: ${{ matrix.group == 'ci' && steps.fast-guard.outputs.skip != 'true' }} + if: ${{ matrix.group == 'ci' }} run: python3 tests/test_gh_merge_green.py - name: Validate gh-merge-green --revert - if: ${{ matrix.group == 'ci' && steps.fast-guard.outputs.skip != 'true' }} + if: ${{ matrix.group == 'ci' }} run: python3 tests/test_gh_merge_green_revert.py - name: Validate base-red excusal for gh-merge-green - if: ${{ matrix.group == 'ci' && steps.fast-guard.outputs.skip != 'true' }} + if: ${{ matrix.group == 'ci' }} run: python3 tests/test_base_red_excuse.py - name: Validate main compile attribution - if: ${{ matrix.group == 'ci' && steps.fast-guard.outputs.skip != 'true' }} + if: ${{ matrix.group == 'ci' }} run: python3 tests/test_main_compile_attribution.py - name: Validate CI failure attribution - if: ${{ matrix.group == 'ci' && steps.fast-guard.outputs.skip != 'true' }} + if: ${{ matrix.group == 'ci' }} run: python3 tests/test_ci_classify_failures.py - name: Validate the workflow_run handlers' API budget - if: ${{ matrix.group == 'ci' && steps.fast-guard.outputs.skip != 'true' }} + if: ${{ matrix.group == 'ci' }} run: python3 tests/test_ci_workflow_run_api_budget.py - name: Validate the report-only reverse test impact selector - if: ${{ matrix.group == 'ci' && steps.fast-guard.outputs.skip != 'true' }} + if: ${{ matrix.group == 'ci' }} run: | python3 tests/test_ci_reverse_test_impact.py python3 tests/test_reverse_test_impact_route.py - name: Require the R2 public URL wherever the R2 cache actions run - if: ${{ matrix.group == 'ci' && steps.fast-guard.outputs.skip != 'true' }} + if: ${{ matrix.group == 'ci' }} run: python3 tests/test_ci_r2_cache_public_url.py - name: Validate macOS jobs select a pinned Xcode - if: ${{ matrix.group == 'ci' && steps.fast-guard.outputs.skip != 'true' }} + if: ${{ matrix.group == 'ci' }} run: python3 tests/test_ci_macos_xcode_selection.py - name: Validate Xcode pin audit - if: ${{ matrix.group == 'ci' && steps.fast-guard.outputs.skip != 'true' }} + if: ${{ matrix.group == 'ci' }} run: python3 tests/test_ci_xcode_pin_audit.py - name: Validate v0.64.25 rpath repair workflow contract - if: ${{ matrix.group == 'ci' && steps.fast-guard.outputs.skip != 'true' }} + if: ${{ matrix.group == 'ci' }} run: bash tests/test_repair_v06425_workflow.sh - name: Validate Xcode build metrics receipt - if: ${{ matrix.group == 'ci' && steps.fast-guard.outputs.skip != 'true' }} + if: ${{ matrix.group == 'ci' }} run: python3 tests/test_build_metrics.py - name: Validate fleet compiler-cache wiring - if: ${{ matrix.group == 'ci' && steps.fast-guard.outputs.skip != 'true' }} + if: ${{ matrix.group == 'ci' }} run: bash tests/test_ci_fleet_compilation_cache.sh - name: Validate feature flag linter scope - if: ${{ matrix.group == 'ci' && steps.fast-guard.outputs.skip != 'true' }} + if: ${{ matrix.group == 'ci' }} run: python3 -m unittest tests/test_lint_feature_flags_scope.py tests/test_cloud_upgrade_rollout_retirement.py - name: Validate feature flag review lead-time report - if: ${{ matrix.group == 'ci' && steps.fast-guard.outputs.skip != 'true' }} + if: ${{ matrix.group == 'ci' }} run: python3 tests/test_feature_flag_review_lead_time.py - name: Validate feature flag review drift issue - if: ${{ matrix.group == 'ci' && steps.fast-guard.outputs.skip != 'true' }} + if: ${{ matrix.group == 'ci' }} run: python3 tests/test_feature_flag_review_drift_issue.py - name: Validate canonical compile cache build root - if: ${{ matrix.group == 'ci' && steps.fast-guard.outputs.skip != 'true' }} + if: ${{ matrix.group == 'ci' }} run: python3 tests/test_ci_canonical_build_root.py - name: Validate seeded macOS checkout - if: ${{ matrix.group == 'ci' && steps.fast-guard.outputs.skip != 'true' }} + if: ${{ matrix.group == 'ci' }} run: python3 tests/test_ci_git_seed.py - name: Validate the CLI lane runs in compile admission - if: ${{ matrix.group == 'ci' && steps.fast-guard.outputs.skip != 'true' }} + if: ${{ matrix.group == 'ci' }} run: python3 tests/test_ci_cli_lane_in_admission.py - name: Run canonical CMUX CI guard profile - if: ${{ matrix.group == 'ci' && steps.fast-guard.outputs.skip != 'true' }} + if: ${{ matrix.group == 'ci' }} run: | set -euo pipefail state_root="$RUNNER_TEMP/cmux-ci-guard-profile" @@ -438,7 +420,7 @@ jobs: run: python3 tests/test_cmux_config_schema_embed.py - name: Set up Bun for guard tests - if: ${{ matrix.group == 'preflight' || matrix.group == 'release-ios' }} + if: ${{ matrix.group == 'preflight-agent-chat' || matrix.group == 'release-ios' }} uses: oven-sh/setup-bun@0c5077e51419868618aeaa5fe8019c62421857d6 # v2 with: bun-version: "1.3.6" @@ -446,7 +428,7 @@ jobs: # TypeScript is pinned exactly in agent-chat's devDependencies, so this # check uses the locked local compiler instead of fetching one at runtime. - name: Type-check agent-chat - if: ${{ matrix.group == 'preflight' }} + if: ${{ matrix.group == 'preflight-agent-chat' }} working-directory: agent-chat run: | bun install --frozen-lockfile @@ -455,7 +437,7 @@ jobs: # Runs the agent-chat unit tests listed in its package.json, including # the Claude launch environment policy. - name: Run agent-chat unit tests - if: ${{ matrix.group == 'preflight' }} + if: ${{ matrix.group == 'preflight-agent-chat' }} working-directory: agent-chat run: bun run test @@ -464,13 +446,13 @@ jobs: # hand edit or schema change without regen. Needs bun (bunx quicktype), # set up above. - name: Validate control-plane generated types - if: ${{ matrix.group == 'preflight' }} + if: ${{ matrix.group == 'preflight-agent-chat' }} run: ./scripts/check-control-plane-types.sh # Runs web/scripts/check-complexity.mjs against scratch repositories, so # it needs the Bun set up above rather than the `ci` group's Python only. - name: Validate web complexity source enumeration - if: ${{ matrix.group == 'preflight' }} + if: ${{ matrix.group == 'preflight-agent-chat' }} run: python3 tests/test_web_complexity_source_enumeration.py - name: Set up Python 3.9 for nightly prune compatibility @@ -480,7 +462,7 @@ jobs: python-version: "3.9" - name: Prepare workflow guard Python dependencies - if: ${{ matrix.group == 'preflight' || (matrix.group == 'ci' && steps.fast-guard.outputs.skip != 'true') || matrix.group == 'app-host-execution' || matrix.group == 'app-host-process' || matrix.group == 'app-host-cache' || matrix.group == 'release-notary' || matrix.group == 'release-tooling' }} + if: ${{ matrix.group == 'preflight' || matrix.group == 'ci' || matrix.group == 'app-host-execution' || matrix.group == 'app-host-process' || matrix.group == 'app-host-cache' || matrix.group == 'release-notary' || matrix.group == 'release-tooling' }} run: | set -euo pipefail python3 -m venv "$RUNNER_TEMP/workflow-guard-venv" @@ -499,53 +481,53 @@ jobs: echo "$RUNNER_TEMP/workflow-guard-venv/bin" >> "$GITHUB_PATH" - name: Validate Blacksmith Testbox broker trust boundary - if: ${{ matrix.group == 'ci' && steps.fast-guard.outputs.skip != 'true' }} + if: ${{ matrix.group == 'ci' }} run: python3 tests/test_ci_testbox_broker_guard.py # Keep the Testbox trust checks in the routed CI guard matrix. This # replaces the former always-on testbox-broker-guard workflow, which # repeated this work on every pull request and main push. - name: Validate Testbox cleanup receipt ownership - if: ${{ matrix.group == 'ci' && steps.fast-guard.outputs.skip != 'true' }} + if: ${{ matrix.group == 'ci' }} run: ./tests/test_testbox_cleanup_receipt_ref.sh - name: Testbox keepalive counts a command in the checkout as use - if: ${{ matrix.group == 'ci' && steps.fast-guard.outputs.skip != 'true' }} + if: ${{ matrix.group == 'ci' }} run: ./tests/test_testbox_keepalive_busy.sh - name: Testbox source mtimes restore only unchanged files - if: ${{ matrix.group == 'ci' && steps.fast-guard.outputs.skip != 'true' }} + if: ${{ matrix.group == 'ci' }} run: python3 tests/test_testbox_source_mtimes.py - name: Testbox target prune keeps the warm disk bounded - if: ${{ matrix.group == 'ci' && steps.fast-guard.outputs.skip != 'true' }} + if: ${{ matrix.group == 'ci' }} run: ./tests/test_testbox_target_prune.sh - name: The retired Testbox approve helper approves nothing - if: ${{ matrix.group == 'ci' && steps.fast-guard.outputs.skip != 'true' }} + if: ${{ matrix.group == 'ci' }} run: ./tests/test_testbox_approve.sh - name: The Testbox demo stops its box and cancels its run on every failure - if: ${{ matrix.group == 'ci' && steps.fast-guard.outputs.skip != 'true' }} + if: ${{ matrix.group == 'ci' }} run: ./tests/test_testbox_demo_cleanup.sh - name: Lint the Testbox lane helpers - if: ${{ matrix.group == 'ci' && steps.fast-guard.outputs.skip != 'true' }} + if: ${{ matrix.group == 'ci' }} run: shellcheck scripts/blacksmith-bounded-command.sh scripts/blacksmith-cmux-tui-testbox-stage.sh scripts/blacksmith-testbox-cleanup.sh scripts/blacksmith-testbox-keepalive.sh scripts/blacksmith-testbox-busy.sh tests/test_testbox_keepalive_busy.sh scripts/blacksmith-testbox-target-prune.sh scripts/blacksmith-testbox-release.sh tests/test_testbox_target_prune.sh scripts/ci/install-actionlint.sh tests/test_ci_actionlint_download.sh scripts/blacksmith-testbox-demo.sh scripts/blacksmith-testbox-approve.sh tests/test_testbox_approve.sh tests/test_testbox_demo_cleanup.sh - name: Test the actionlint downloader without a network outage - if: ${{ matrix.group == 'ci' && steps.fast-guard.outputs.skip != 'true' }} + if: ${{ matrix.group == 'ci' }} run: ./tests/test_ci_actionlint_download.sh - name: Check that every workflow is linted - if: ${{ matrix.group == 'ci' && steps.fast-guard.outputs.skip != 'true' }} + if: ${{ matrix.group == 'ci' }} run: python3 tests/test_ci_actionlint_covers_every_workflow.py - name: Check that push and pull_request path filters agree - if: ${{ matrix.group == 'ci' && steps.fast-guard.outputs.skip != 'true' }} + if: ${{ matrix.group == 'ci' }} run: python3 tests/test_ci_workflow_path_filter_parity.py - name: Lint every workflow - if: ${{ matrix.group == 'ci' && steps.fast-guard.outputs.skip != 'true' }} + if: ${{ matrix.group == 'ci' }} env: ACTIONLINT_VERSION: "1.7.7" ACTIONLINT_SHA256: "023070a287cd8cccd71515fedc843f1985bf96c436b7effaecce67290e7e0757" @@ -558,37 +540,37 @@ jobs: "$RUNNER_TEMP/actionlint" - name: Validate contributor verification receipts and selection - if: ${{ matrix.group == 'ci' && steps.fast-guard.outputs.skip != 'true' }} + if: ${{ matrix.group == 'ci' }} run: | python3 tests/test_verification_receipt.py python3 tests/test_verify_local.py - name: Validate local hook trust boundary - if: ${{ matrix.group == 'ci' && steps.fast-guard.outputs.skip != 'true' }} + if: ${{ matrix.group == 'ci' }} run: python3 tests/test_preflight_trust.py - name: Validate hook installation leaves existing hooks alone - if: ${{ matrix.group == 'ci' && steps.fast-guard.outputs.skip != 'true' }} + if: ${{ matrix.group == 'ci' }} run: python3 tests/test_install_git_hooks.py - name: Validate required-check drift reconciliation - if: ${{ matrix.group == 'ci' && steps.fast-guard.outputs.skip != 'true' }} + if: ${{ matrix.group == 'ci' }} run: python3 tests/test_ci_required_checks_drift.py - name: Validate package test selection - if: ${{ matrix.group == 'ci' && steps.fast-guard.outputs.skip != 'true' }} + if: ${{ matrix.group == 'ci' }} run: python3 tests/test_ci_select_package_tests.py - name: Validate the package test lane's GhosttyKit revision on a fleet worktree - if: ${{ matrix.group == 'ci' && steps.fast-guard.outputs.skip != 'true' }} + if: ${{ matrix.group == 'ci' }} run: python3 tests/test_ci_package_lane_ghostty_sha.py - name: Validate workflow_run triggers name workflows that exist - if: ${{ matrix.group == 'ci' && steps.fast-guard.outputs.skip != 'true' }} + if: ${{ matrix.group == 'ci' }} run: python3 tests/test_ci_workflow_run_sources.py - name: Validate shallow complexity comparison fetching - if: ${{ matrix.group == 'ci' && steps.fast-guard.outputs.skip != 'true' }} + if: ${{ matrix.group == 'ci' }} run: python3 tests/test_ci_fetch_complexity_base.py - name: Validate Ghostty helper cache failure handling @@ -604,155 +586,155 @@ jobs: run: python3 tests/test_ci_release_helper_archs.py - name: Validate stale run cleanup eligibility - if: ${{ matrix.group == 'ci' && steps.fast-guard.outputs.skip != 'true' }} + if: ${{ matrix.group == 'ci' }} run: python3 tests/test_cleanup_stale_runs.py - name: Validate the scheduled main full-suite run - if: ${{ matrix.group == 'ci' && steps.fast-guard.outputs.skip != 'true' }} + if: ${{ matrix.group == 'ci' }} run: python3 tests/test_ci_main_full_suite.py - name: Validate main full-suite failure attribution - if: ${{ matrix.group == 'ci' && steps.fast-guard.outputs.skip != 'true' }} + if: ${{ matrix.group == 'ci' }} run: python3 tests/test_ci_main_regression_attribution.py - name: Validate merge receipts - if: ${{ matrix.group == 'ci' && steps.fast-guard.outputs.skip != 'true' }} + if: ${{ matrix.group == 'ci' }} run: python3 tests/test_ci_merge_receipt.py - name: Validate merge-main's green base and guard failure labels - if: ${{ matrix.group == 'ci' && steps.fast-guard.outputs.skip != 'true' }} + if: ${{ matrix.group == 'ci' }} run: python3 tests/test_ci_merge_main.py - name: Validate main full-suite failure reruns and bisects - if: ${{ matrix.group == 'ci' && steps.fast-guard.outputs.skip != 'true' }} + if: ${{ matrix.group == 'ci' }} run: python3 tests/test_ci_main_regression_bisect.py - name: Validate CI queue janitor policy - if: ${{ matrix.group == 'ci' && steps.fast-guard.outputs.skip != 'true' }} + if: ${{ matrix.group == 'ci' }} run: python3 tests/test_ci_queue_janitor.py - name: Validate pull request macOS pool choice - if: ${{ matrix.group == 'ci' && steps.fast-guard.outputs.skip != 'true' }} + if: ${{ matrix.group == 'ci' }} run: python3 tests/test_ci_pr_runner_pool.py - name: Validate simple live macOS pool choice - if: ${{ matrix.group == 'ci' && steps.fast-guard.outputs.skip != 'true' }} + if: ${{ matrix.group == 'ci' }} run: python3 tests/test_ci_simple_pool_picker.py - name: Validate agent pane frame pacing summary - if: ${{ matrix.group == 'ci' && steps.fast-guard.outputs.skip != 'true' }} + if: ${{ matrix.group == 'ci' }} run: python3 tests/test_ci_frame_pacing_summary.py - name: Validate manual dispatch routing guard - if: ${{ matrix.group == 'ci' && steps.fast-guard.outputs.skip != 'true' }} + if: ${{ matrix.group == 'ci' }} run: python3 tests/test_ci_manual_dispatch_guard_workflow.py - name: Validate manual dispatch guard decisions - if: ${{ matrix.group == 'ci' && steps.fast-guard.outputs.skip != 'true' }} + if: ${{ matrix.group == 'ci' }} run: python3 tests/test_ci_manual_dispatch_guard.py - name: Validate delta CI from the last green head - if: ${{ matrix.group == 'ci' && steps.fast-guard.outputs.skip != 'true' }} + if: ${{ matrix.group == 'ci' }} run: python3 tests/test_ci_delta_since_green.py - name: Validate the package interface fingerprint - if: ${{ matrix.group == 'ci' && steps.fast-guard.outputs.skip != 'true' }} + if: ${{ matrix.group == 'ci' }} run: python3 tests/test_ci_package_interface_fingerprint.py - name: Validate late placement onto idle root runners - if: ${{ matrix.group == 'ci' && steps.fast-guard.outputs.skip != 'true' }} + if: ${{ matrix.group == 'ci' }} run: python3 tests/test_ci_late_placement.py - name: Validate spread-first compile admission placement - if: ${{ matrix.group == 'ci' && steps.fast-guard.outputs.skip != 'true' }} + if: ${{ matrix.group == 'ci' }} run: python3 tests/test_ci_admission_placement.py - name: Validate owned Mac build state - if: ${{ matrix.group == 'ci' && steps.fast-guard.outputs.skip != 'true' }} + if: ${{ matrix.group == 'ci' }} run: python3 tests/test_ci_owned_build_state.py - name: Validate canonical root ownership boundary - if: ${{ matrix.group == 'ci' && steps.fast-guard.outputs.skip != 'true' }} + if: ${{ matrix.group == 'ci' }} run: python3 tests/test_ci_take_canonical_root.py - name: Validate warm-state distance recording and routing - if: ${{ matrix.group == 'ci' && steps.fast-guard.outputs.skip != 'true' }} + if: ${{ matrix.group == 'ci' }} run: python3 tests/test_ci_warm_distance.py - name: Validate owned SwiftPM build directories - if: ${{ matrix.group == 'ci' && steps.fast-guard.outputs.skip != 'true' }} + if: ${{ matrix.group == 'ci' }} run: python3 tests/test_ci_owned_spm_scratch.py - name: Validate the owned idle catch-up build - if: ${{ matrix.group == 'ci' && steps.fast-guard.outputs.skip != 'true' }} + if: ${{ matrix.group == 'ci' }} run: python3 tests/test_ci_owned_catch_up.py - name: Validate the persistent-pool rescue - if: ${{ matrix.group == 'ci' && steps.fast-guard.outputs.skip != 'true' }} + if: ${{ matrix.group == 'ci' }} run: python3 tests/test_ci_owned_pool_rescue.py - name: Validate the backend migrations plan - if: ${{ matrix.group == 'ci' && steps.fast-guard.outputs.skip != 'true' }} + if: ${{ matrix.group == 'ci' }} run: python3 tests/test_backend_migrations_plan.py - name: Validate the owned Mac warm state - if: ${{ matrix.group == 'ci' && steps.fast-guard.outputs.skip != 'true' }} + if: ${{ matrix.group == 'ci' }} run: python3 tests/test_ci_owned_warm_state.py - name: Validate CI health report - if: ${{ matrix.group == 'ci' && steps.fast-guard.outputs.skip != 'true' }} + if: ${{ matrix.group == 'ci' }} run: python3 tests/test_ci_health_report.py - name: Validate runner label policy - if: ${{ matrix.group == 'ci' && steps.fast-guard.outputs.skip != 'true' }} + if: ${{ matrix.group == 'ci' }} run: python3 tests/test_runner_label_policy.py - name: Validate the trusted web complexity workflow - if: ${{ matrix.group == 'ci' && steps.fast-guard.outputs.skip != 'true' }} + if: ${{ matrix.group == 'ci' }} run: python3 tests/test_web_complexity_trusted_workflow.py - name: Validate every workflow guard is wired - if: ${{ matrix.group == 'ci' && steps.fast-guard.outputs.skip != 'true' }} + if: ${{ matrix.group == 'ci' }} run: python3 tests/test_ci_workflow_guards_are_wired.py - name: Validate CLA metadata routing - if: ${{ matrix.group == 'ci' && steps.fast-guard.outputs.skip != 'true' }} + if: ${{ matrix.group == 'ci' }} run: python3 tests/test_cla_guard_metadata_routing.py - name: Validate required checks are bounded - if: ${{ matrix.group == 'ci' && steps.fast-guard.outputs.skip != 'true' }} + if: ${{ matrix.group == 'ci' }} run: python3 tests/test_ci_required_checks_are_bounded.py - name: Validate required checks have no paths filters - if: ${{ matrix.group == 'ci' && steps.fast-guard.outputs.skip != 'true' }} + if: ${{ matrix.group == 'ci' }} run: python3 tests/test_ci_required_checks_have_no_path_filters.py - name: Validate workflow write permissions are job-scoped - if: ${{ matrix.group == 'ci' && steps.fast-guard.outputs.skip != 'true' }} + if: ${{ matrix.group == 'ci' }} run: python3 tests/test_ci_workflow_permissions_are_job_scoped.py - name: Validate triage radar scoring - if: ${{ matrix.group == 'ci' && steps.fast-guard.outputs.skip != 'true' }} + if: ${{ matrix.group == 'ci' }} run: python3 tests/test_triage_radar.py - name: Validate triage severity and area rules - if: ${{ matrix.group == 'ci' && steps.fast-guard.outputs.skip != 'true' }} + if: ${{ matrix.group == 'ci' }} run: python3 tests/test_triage_rules.py - name: Validate cmux-tui focused filter routing - if: ${{ matrix.group == 'ci' && steps.fast-guard.outputs.skip != 'true' }} + if: ${{ matrix.group == 'ci' }} run: python3 tests/test_tui_focused_filter_guard.py - name: Validate the tui publish dispatch budget - if: ${{ matrix.group == 'ci' && steps.fast-guard.outputs.skip != 'true' }} + if: ${{ matrix.group == 'ci' }} run: python3 tests/test_tui_publish_dispatch_budget.py - name: Validate pull request caches are read-only - if: ${{ matrix.group == 'ci' && steps.fast-guard.outputs.skip != 'true' }} + if: ${{ matrix.group == 'ci' }} run: python3 tests/test_ci_pull_request_caches_are_read_only.py - name: Validate signing secrets are read only in protected environments - if: ${{ matrix.group == 'ci' && steps.fast-guard.outputs.skip != 'true' }} + if: ${{ matrix.group == 'ci' }} run: python3 tests/test_ci_signing_secrets_need_release_environment.py - name: Validate Release check architectures @@ -766,19 +748,19 @@ jobs: python3 tests/test_ci_release_product_reuse.py - name: Validate the R2 cache store script - if: ${{ matrix.group == 'ci' && steps.fast-guard.outputs.skip != 'true' }} + if: ${{ matrix.group == 'ci' }} run: bash tests/test_ci_r2_cache.sh - name: Validate the R2 cache census - if: ${{ matrix.group == 'ci' && steps.fast-guard.outputs.skip != 'true' }} + if: ${{ matrix.group == 'ci' }} run: python3 tests/test_ci_r2_cache_census.py - name: Validate the R2 cache pruner - if: ${{ matrix.group == 'ci' && steps.fast-guard.outputs.skip != 'true' }} + if: ${{ matrix.group == 'ci' }} run: python3 tests/test_r2_cache_prune.py - name: Validate the PR media pruner - if: ${{ matrix.group == 'ci' && steps.fast-guard.outputs.skip != 'true' }} + if: ${{ matrix.group == 'ci' }} run: python3 tests/test_ci_prune_pr_media.py - name: Validate nightly prune Python compatibility @@ -788,7 +770,7 @@ jobs: python3 tests/test_prune_nightly_release_assets.py - name: Validate activation benchmark scrollback sizing - if: ${{ matrix.group == 'ci' && steps.fast-guard.outputs.skip != 'true' }} + if: ${{ matrix.group == 'ci' }} run: python3 tests/test_perf_activation_scrollback_sizing.py - name: Validate create-dmg version pinning @@ -808,11 +790,11 @@ jobs: run: ./tests/test_ci_unit_test_spm_retry.sh - name: Validate checkout failure network diagnostics - if: ${{ matrix.group == 'ci' && steps.fast-guard.outputs.skip != 'true' }} + if: ${{ matrix.group == 'ci' }} run: python3 tests/test_ci_checkout_network_diagnostics.py - name: Validate production drift issue updates are sticky - if: ${{ matrix.group == 'ci' && steps.fast-guard.outputs.skip != 'true' }} + if: ${{ matrix.group == 'ci' }} run: python3 tests/test_iroh_drift_issue.py - name: Validate Swift Testing suite timeout guard @@ -880,11 +862,11 @@ jobs: run: python3 tests/test_ci_console_session_env_forwarding.py - name: Validate notification semantics gates - if: ${{ matrix.group == 'ci' && steps.fast-guard.outputs.skip != 'true' }} + if: ${{ matrix.group == 'ci' }} run: python3 tests/test_ci_notification_semantics.py - name: Validate package test bisect - if: ${{ matrix.group == 'ci' && steps.fast-guard.outputs.skip != 'true' }} + if: ${{ matrix.group == 'ci' }} run: python3 tests/test_ci_package_bisect.py - name: Validate app-host test failure classification @@ -1181,6 +1163,10 @@ jobs: if: ${{ matrix.group == 'release-notary' }} run: python3 tests/test_poll_notary_submission.py + - name: Validate notarization polling artifact reuse + if: ${{ matrix.group == 'release-notary' }} + run: python3 tests/test_nightly_notarization_poll_loop.py + - name: Validate accepted nightly DMG artifact aliases if: ${{ matrix.group == 'release-notary' }} run: python3 tests/test_nightly_artifact_alias.py @@ -1202,23 +1188,23 @@ jobs: run: node scripts/release_asset_guard.test.js - name: Validate fork runner routing - if: ${{ matrix.group == 'ci' && steps.fast-guard.outputs.skip != 'true' }} + if: ${{ matrix.group == 'ci' }} run: python3 tests/test_ci_fork_runner_routing.py - name: Validate runner capability resolution - if: ${{ matrix.group == 'ci' && steps.fast-guard.outputs.skip != 'true' }} + if: ${{ matrix.group == 'ci' }} run: python3 tests/test_ci_runner_capability_resolver.py - name: Validate evidence collection reporting - if: ${{ matrix.group == 'ci' && steps.fast-guard.outputs.skip != 'true' }} + if: ${{ matrix.group == 'ci' }} run: python3 tests/test_ci_evidence_outcomes.py - name: Validate reusable workflow job name lookups - if: ${{ matrix.group == 'ci' && steps.fast-guard.outputs.skip != 'true' }} + if: ${{ matrix.group == 'ci' }} run: python3 tests/test_ci_reusable_job_name_lookups.py - name: Validate reusable guard workflow structure - if: ${{ matrix.group == 'ci' && steps.fast-guard.outputs.skip != 'true' }} + if: ${{ matrix.group == 'ci' }} run: | python3 tests/test_ci_guard_workflow_structure.py python3 tests/test_app_host_test_products.py @@ -1231,7 +1217,7 @@ jobs: python3 tests/test_ci_cli_product_routing.py - name: Validate Iroh release gate timeouts - if: ${{ matrix.group == 'ci' && steps.fast-guard.outputs.skip != 'true' }} + if: ${{ matrix.group == 'ci' }} run: python3 tests/test_iroh_monitor_simulator_plan.py - name: Validate Python R2 appcast upload guard @@ -1515,6 +1501,25 @@ jobs: if value not in {"true", "false"}: bad[route] = f"invalid route {route}={value!r}" elif value == "true": + # Pull requests run the `ci` group in the first-class + # `CI fast guards` job in ci.yml. The reusable matrix + # excludes that group, so a route containing only `ci` + # legitimately has no matrix leg to report here. Every + # other requested group still needs a successful matrix + # aggregate; malformed or missing group metadata fails + # closed instead of silently accepting an empty route. + if route == "linux_guard_tests": + raw_groups = inputs.get("linux_guard_test_groups") + try: + groups = json.loads(raw_groups) if isinstance(raw_groups, str) else None + except (TypeError, ValueError): + groups = None + if not isinstance(groups, list) or not all(isinstance(group, str) for group in groups): + bad[route] = f"invalid linux_guard_test_groups={raw_groups!r}" + continue + if groups and set(groups) == {"ci"}: + print("linux_guard_tests=authoritative CI fast guards job") + continue if result != "success": bad[job] = f"{result} (route {route}=true)" elif result not in {"success", "skipped"}: From 571b8b76ca73ea187c9a576517a90100046f9596 Mon Sep 17 00:00:00 2001 From: Austin Wang <38676809+austinywang@users.noreply.github.com> Date: Fri, 9 Oct 2026 14:28:54 -0700 Subject: [PATCH 4/4] ci: repair inherited registry and runner-context failures Restore the deleted fast-guard test registration cleanup and nightly polling test registration. Resolve notarization receipt paths at runtime, where RUNNER_TEMP is defined, instead of using an invalid job-level runner context. --- .github/workflows/auto-resume-nightly-notarization.yml | 8 ++++++-- tests/test-execution.toml | 8 ++++---- 2 files changed, 10 insertions(+), 6 deletions(-) diff --git a/.github/workflows/auto-resume-nightly-notarization.yml b/.github/workflows/auto-resume-nightly-notarization.yml index 3cc5e3fd8ea3..7d4ba525caf2 100644 --- a/.github/workflows/auto-resume-nightly-notarization.yml +++ b/.github/workflows/auto-resume-nightly-notarization.yml @@ -298,9 +298,13 @@ jobs: ASC_API_ISSUER_ID: ${{ secrets.ASC_API_ISSUER_ID }} ASC_API_KEY_P8_BASE64: ${{ secrets.ASC_API_KEY_P8_BASE64 }} APPLE_SIGNING_IDENTITY: ${{ secrets.APPLE_SIGNING_IDENTITY }} - OUTER_STATE: ${{ runner.temp }}/cmux-outer-dmg-notarization.state - OUTER_LOG: ${{ runner.temp }}/cmux-outer-dmg-notarization.state.log steps: + - name: Set outer notarization receipt paths + run: | + printf '%s\n' \ + "OUTER_STATE=$RUNNER_TEMP/cmux-outer-dmg-notarization.state" \ + "OUTER_LOG=$RUNNER_TEMP/cmux-outer-dmg-notarization.state.log" >> "$GITHUB_ENV" + - name: Checkout trusted continuation tools uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 with: diff --git a/tests/test-execution.toml b/tests/test-execution.toml index 3d68d8fb67dd..3c6ea09993c8 100644 --- a/tests/test-execution.toml +++ b/tests/test-execution.toml @@ -1619,10 +1619,6 @@ lane = "linux-guard" path = "tests/test_ci_manual_dispatch_guard.py" lane = "linux-guard" -[[test]] -path = "tests/test_ci_fast_guard_status.py" -lane = "linux-guard" - [[test]] path = "tests/test_ci_homebrew_untrusted_input.py" lane = "linux-guard" @@ -1675,6 +1671,10 @@ lane = "linux-guard" path = "tests/test_nightly_resume_tracks.py" lane = "linux-guard" +[[test]] +path = "tests/test_nightly_notarization_poll_loop.py" +lane = "linux-guard" + [[test]] path = "tests/test_surface_task_local_reservations.py" lane = "manual"