[teamleaderleo]

Every devbox image rebake since 10-28 baked, verified and smoke-tested its image, then failed at "Publish the manifest pull request": ! [remote rejected] HEAD -> devbox-rebake/4e7d84ee3095 (Unable to determine if workflow can be created or updated due to timeout; workflows scope may be required.) (runs 40640977877 and 40851484187). Nothing could be promoted, so staging Cloud machines still boot the 10-15 image. Its cmux-tui predates agent session tabs (agent-session-tabs-v1), so no agent chat opens on a new staging machine.

A single push of a new branch makes GitHub work out which commits are new against the whole repository, and here that times out. Since the push token has no workflows permission, GitHub refuses the push. The step now pushes twice: first the branch at the baked commit, which is already on the base and adds no commit, then the one manifest commit on top, which touches only web/services/vms/images/*.json. No token, permission or other step changes.

Changelog

none

Observed / Not run

• The two failing publish logs are quoted above. The bake in run 40851484187 pinned cmux-tui 6a202d045fd6, which includes agent session tabs, and its verify and smoke steps passed.
• actionlint on the file, tests/test_ci_runs_on_values.py, test_ci_workflow_permissions_are_job_scoped.py and test_ci_actionlint_covers_every_workflow.py pass.
• Not run yet: the publish itself. I'll dispatch the rebake once this merges.

🤖 Generated with Claude Code

Agent session: agent session

---

Summary by cubic

Fixes the devbox image rebake workflow so its manifest branch publish no longer times out and gets refused by GitHub.

Every publish since 10-28 failed because a single push of a new devbox-rebake/* branch makes GitHub compute new commits against the whole repository, which times out on this repository. The step now pushes twice: first the branch at the baked commit (already on the base, adds no commit), then the one manifest commit on top. No token, permission, or other step changes.

^{Written for commit c9f0df8. Summary will update on new commits.}

[github-actions]

cmux status _{(one comment, edited in place; each line is updated by the job that owns it)}

Review c9f0df8: HQ feed card · gallery before/after runs · checks

App of this head (app.zip, kept 1 day)

gh workflow run reload-build.yml -R manaflow-ai/cmux --ref feat-cmux-next -f tag=pr27367 -f ref=dep-fleet/devbox-rebake-publish-ref -f platform=macos -f backend_mode=local

red: cmux-next checks (god files, concurrency, crash safety, l10n); base red: the same failure on the base 82ebef2; does not block

[blacksmith-sh]

Found 6 test failures on Blacksmith runners:

Failures

Test	View Logs
/tmp/tmp3esbq0ho/summary-fail.json (live):/summary-fail.json (live):	View Logs
/tmp/tmphfxgjtsh/summary-missing.json (live):/summary-missing.json (live):	View Logs
[new_workspaces] debug.new_workspace timed 0 of 50 new workspace rows/ [new_workspaces] debug.new_workspace timed 0 of 50 new workspace rows	View Logs
[new_workspaces] the window draws no frames/[new_workspaces] the window draws no frames	View Logs
[tabs] debug.tab_switch timed 0 of 40 switches/ [tabs] debug.tab_switch timed 0 of 40 switches	View Logs
[tabs] the window draws no frames/[tabs] the window draws no frames	View Logs

^{Need help on this PR? Tag @codesmith-bot with what you need.}

[teamleaderleo]

Bead cx-mxeylz created for this PR by the cmux coordinator.

[teamleaderleo]

Review (Codex gpt-6-astra, high, fast; independent): SHIP at c9f0df8

$COMMIT is the parent of the manifest commit. Both forced pushes go to the job's own branch. Tokens, masking and the PR-open steps are unchanged, and set -euo pipefail stops on either failed push. The red cmux-next checks step ("No new SwiftUI") is red the same way at the merge base 7e93d81; this PR changes no Swift.

[github-actions]

The feat-cmux-next push run https://github.com/manaflow-ai/cmux/actions/runs/40908190707 at e9f957f failed: cmux-next checks (god files, concurrency, crash safety, l10n).
Those jobs last passed at 13f725e. This pull request is one of 4 merged since: #27455, #27370, #27367, #25891.
If the failure is in your change, fix forward on feat-cmux-next. Pull requests run only the tiers their paths reach (docs/ci/cmux-next-tiers.md); label a batch PR full-ci to run them all before merging.

[github-actions]

Shipped in:

• cmux NEXT nightly 1.0.0-nightly.4091190102101 (54dc209439)
• cmux NEXT nightly 1.0.0-nightly.4091361851901 (b0f1261733)