Repository navigation
ci(release): sign and notarize on blacksmith-6vcpu-macos-26, not the stalled 12 vCPU label - #27440
lawrencecchen wants to merge 2 commits into
Conversation
blacksmith-12vcpu-macos-26 has started no job since 2026-10-28 20:32Z, so a release cut from main would queue forever. The guard now pins the literal 6 vCPU label (still literal: the job holds signing secrets). Fails until the next commit moves the job.
release.yml build-sign-notarize and the v0.64.25 repair job were hard-coded to blacksmith-12vcpu-macos-26 (d16b03c, #21024, which made secret-holding jobs use a literal label). That label has started no job since 2026-10-28 20:32Z. Both now take the literal 6 vCPU label, the size v0.65.2.2 signed on (run 40486284894). Still a literal, as guard rule 7 requires; only runs-on changes.
|
Review (independent subagent, correctness first): SHIP at 0bdae81
Not merged and no |
|
Found 1 test failure on Blacksmith runners: Failure
|
![Fix with [code]smith](https://pr-comments-assets.blacksmith.sh/codesmith/fix-with-codesmith-light-3x.png)
|
cmux status (one comment, edited in place; each line is updated by the job that owns it) Probably yours: CI failed on
Matched log linesNot re-run automatically: Written by
|
|
No actionable comments were generated in the recent review.
 |
| Layer / File(s) | Summary |
|---|---|
Workflow runner selection and test assertion .github/workflows/release.yml, .github/workflows/repair-v0-64-25-helper-rpaths.yml, tests/test_ci_release_sdk_lane.sh |
The release workflow selects blacksmith-6vcpu-macos-26 for manaflow-ai; the repair workflow selects it for other repository owners. The test assertion expects the updated label. |
Priority:
Estimated code review effort: 1 (Trivial) | ~4 minutes
Change: Bug fix
Possibly related PRs
- manaflow-ai/cmux#27129: Adds runner-pool handling for the same release and repair workflows.
- manaflow-ai/cmux#25371: Changes a signing job from the 12-vCPU label to the 6-vCPU label.
- manaflow-ai/cmux#26534: Changes runner handling for nightly signing, verification, and DMG jobs.
Suggested labels: risk:low
Suggested reviewers: teamleaderleo, austinywang
Merge Risk: 
0bdae
-
The runner-label updates and matching release assertion present no identified merge-blocking risk. Merge after normal checks pass.
Pre-merge checks: 
-
Check name Status Explanation Title check The title clearly and concisely describes the primary CI change: moving release signing and notarization to the 6-vCPU Blacksmith macOS runner. Docstring Coverage No eligible functions found in the changed files. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff with cyclomatic complexity of at least 2. Documentat… Linked Issues check Check skipped because no linked issues were found for this pull request. Out of Scope Changes check Check skipped because no linked issues were found for this pull request. Cmux Cloud Persistent Session And Early Input PASS. The pull request changes only GitHub Actions runner labels/comments and one matching regression-test string. It does not change Cloud terminal creation, cmux-tui transport, manual renderer admis… Cmux Swift Actor Isolation PASS: The pull request changes only two GitHub Actions YAML workflows and one shell test. It introduces no production Swift changes, so it cannot introduce or worsen the specified Swift 6 actor isolat… Cmux Swift Blocking Runtime PASS: The pull request changes only two GitHub workflow YAML files and one shell test. The reviewed diff contains no Swift files and introduces no blocking or timing-based Swift runtime synchronizatio… Cmux Browser Automation Off-Main PASS: The pull request does not change browser socket automation code. The authoritative diff contains only two workflow files and tests/test_ci_release_sdk_lane.sh; no changes touch `Sources/Termin…Cmux Expensive Synchronous Load PASS: The pull request changes only two GitHub Actions workflow files and one shell test. It introduces no production Swift changes and no agent-history, transcript, JSON/JSONL load, main-actor, or in… Cmux Cache Substitution Correctness PASS: The pull request changes only GitHub Actions YAML and a shell regression test. It does not change production Swift, TypeScript, or JavaScript code, and it does not introduce a cache substitution… Cmux No Hacky Sleeps PASS. The reviewed diff changes only GitHub Actions runner labels/comments and a test assertion. The policy explicitly excludes GitHub Actions YAML, and the shell change is test-only scaffolding. No s… Cmux Algorithmic Complexity The pull request changes only GitHub Actions runner labels/comments and a shell regression-test literal. It introduces no production collection processing, scans, sorting, joins, or runtime algorithm … Cmux Swift Concurrency PASS: The pull request changes only two GitHub Actions workflow files and one shell test. The diff contains no cmux-owned Swift code and introduces no Dispatch queues, Combine state, completion-handle… Cmux Swift @ConcurrentThe pull request changes only two GitHub workflow files and one shell test. The authoritative diff contains no Swift files or Swift declarations, so the @concurrentcriteria do not apply.Cmux Swift Package Boundaries PASS: The pull request changes only two GitHub Actions workflow files and one shell test. It introduces no production Swift changes, so the Swift package boundary check does not apply. Cmux Swiftpm Lockfiles PASS: The pull request changes only two workflow runner labels/comments and one regression test. It does not change a Package.swift dependency, an Xcode package reference, a cmux-owned .gitignore, or … Cmux Swift Logging The pull request changes only two GitHub workflow YAML files and one shell test. The diff adds no Swift production code and does not add or materially change any logging call or logger declaration. Th… Cmux User-Facing Error Privacy PASS. The pull request changes only GitHub Actions runner labels, related comments, and a regression-test expectation. It adds no user-facing errors, alerts, command output, API error bodies, or recov… Cmux Full Internationalization PASS: The PR changes only GitHub Actions runner configuration, developer comments, and a shell regression test. The added text is operational/developer-only, and the runner labels are literal CI confi… Cmux Swiftui State Layout The pull request changes only two GitHub Actions workflow files and one shell test. The diff contains no Swift or SwiftUI files and no SwiftUI state, layout measurement, lazy-row store reference, or r… Cmux Architecture Rethink PASS: The pull request changes only two GitHub workflow files and one shell test. The authoritative diff contains no Swift files or Swift architecture changes, so the Swift architectural-rethink failu… Cmux Swift Auxiliary Window Close Shortcuts PASS: The pull request changes only two GitHub Actions YAML workflows and one shell test. It adds no Swift code and does not add or modify any cmux-owned window, panel, controller, SwiftUI Window, or … Cmux Source Artifacts All three changed paths are intentional CI configuration or test source files. The diff changes runner labels, comments, and a matching regression assertion. It adds no logs, screenshots, recordings, … Cmux No Test Or Debug Seam In Production Source PASS: The pull request changes only two workflow YAML files and one shell test. The authoritative diff contains no Swift file under a production Sources/path, so it cannot introduce a test or debug…Description check The description includes a detailed Summary, Testing section, Observed / Not run details, and a Changelog entry. It clearly explains the capacity issue, changed runner labels, validation results, and … Full details: Docstring Coverage
-
Explanation
No eligible functions found in the changed files. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff with cyclomatic complexity of at least 2. Documentation-only edits and deletions within surviving functions are included; unchanged diff context and fully deleted functions are excluded. Analyzed 0 functions across 1 files. (2 skipped: 2 unsupported.)
Full details: Cmux Cloud Persistent Session And Early Input
-
Explanation
PASS. The pull request changes only GitHub Actions runner labels/comments and one matching regression-test string. It does not change Cloud terminal creation, cmux-tui transport, manual renderer admission, input ownership, authentication, idempotency, revision, or lease handling. No stated failure condition in the cloud persistent-session rule applies.
Full details: Cmux Swift Actor Isolation
-
Explanation
PASS: The pull request changes only two GitHub Actions YAML workflows and one shell test. It introduces no production Swift changes, so it cannot introduce or worsen the specified Swift 6 actor isolation mistakes.
Full details: Cmux Swift Blocking Runtime
-
Explanation
PASS: The pull request changes only two GitHub workflow YAML files and one shell test. The reviewed diff contains no Swift files and introduces no blocking or timing-based Swift runtime synchronization.
Full details: Cmux Browser Automation Off-Main
-
Explanation
PASS: The pull request does not change browser socket automation code. The authoritative diff contains only two workflow files and
tests/test_ci_release_sdk_lane.sh; no changes touchSources/TerminalController.swift,ControlCommandExecutionPolicy.swift, worker browser routing, WebKit/AppKit hops, or browser policy tests. The changed lines only update macOS runner labels, comments, and a CI assertion.
Full details: Cmux Expensive Synchronous Load
-
Explanation
PASS: The pull request changes only two GitHub Actions workflow files and one shell test. It introduces no production Swift changes and no agent-history, transcript, JSON/JSONL load, main-actor, or interactive-path code.
Full details: Cmux Cache Substitution Correctness
-
Explanation
PASS: The pull request changes only GitHub Actions YAML and a shell regression test. It does not change production Swift, TypeScript, or JavaScript code, and it does not introduce a cache substitution in a persistence, history, undo, or snapshot path.
Full details: Cmux No Hacky Sleeps
-
Explanation
PASS. The reviewed diff changes only GitHub Actions runner labels/comments and a test assertion. The policy explicitly excludes GitHub Actions YAML, and the shell change is test-only scaffolding. No sleep, timer, polling loop, fixed backoff, or wall-clock synchronization was introduced or worsened.
Full details: Cmux Algorithmic Complexity
-
Explanation
The pull request changes only GitHub Actions runner labels/comments and a shell regression-test literal. It introduces no production collection processing, scans, sorting, joins, or runtime algorithm changes covered by the algorithmic-complexity rule.
Full details: Cmux Swift Concurrency
-
Explanation
PASS: The pull request changes only two GitHub Actions workflow files and one shell test. The diff contains no cmux-owned Swift code and introduces no Dispatch queues, Combine state, completion-handler APIs, or fire-and-forget Tasks.
Full details: Cmux Swiftpm Lockfiles
-
Explanation
PASS: The pull request changes only two workflow runner labels/comments and one regression test. It does not change a Package.swift dependency, an Xcode package reference, a cmux-owned .gitignore, or any Package.resolved file. No SwiftPM lockfile rule violation is introduced.
Full details: Cmux Swift Logging
-
Explanation
The pull request changes only two GitHub workflow YAML files and one shell test. The diff adds no Swift production code and does not add or materially change any logging call or logger declaration. The Swift logging check is not applicable.
Full details: Cmux User-Facing Error Privacy
-
Explanation
PASS. The pull request changes only GitHub Actions runner labels, related comments, and a regression-test expectation. It adds no user-facing errors, alerts, command output, API error bodies, or recovery copy. The changed text is internal CI configuration and developer-facing test content, which is in scope for the stated pass conditions.
Full details: Cmux Full Internationalization
-
Explanation
PASS: The PR changes only GitHub Actions runner configuration, developer comments, and a shell regression test. The added text is operational/developer-only, and the runner labels are literal CI configuration tokens. No user-facing Swift, web UI, metadata, API response, markdown, changelog, or locale data changes are present.
Full details: Cmux Swiftui State Layout
-
Explanation
The pull request changes only two GitHub Actions workflow files and one shell test. The diff contains no Swift or SwiftUI files and no SwiftUI state, layout measurement, lazy-row store reference, or render-time mutation changes. The custom check is not applicable.
Full details: Cmux Architecture Rethink
-
Explanation
PASS: The pull request changes only two GitHub workflow files and one shell test. The authoritative diff contains no Swift files or Swift architecture changes, so the Swift architectural-rethink failure conditions do not apply.
Full details: Cmux Swift Auxiliary Window Close Shortcuts
-
Explanation
PASS: The pull request changes only two GitHub Actions YAML workflows and one shell test. It adds no Swift code and does not add or modify any cmux-owned window, panel, controller, SwiftUI Window, or WindowGroup. The auxiliary-window close-shortcut rule is therefore not applicable.
Full details: Cmux Source Artifacts
-
Explanation
All three changed paths are intentional CI configuration or test source files. The diff changes runner labels, comments, and a matching regression assertion. It adds no logs, screenshots, recordings, temp folders, caches, build output, dependency checkout, or broad artifact directory.
Full details: Cmux No Test Or Debug Seam In Production Source
-
Explanation
PASS: The pull request changes only two workflow YAML files and one shell test. The authoritative diff contains no Swift file under a production
Sources/path, so it cannot introduce a test or debug seam covered by this check.
Full details: Description check
-
Explanation
The description includes a detailed Summary, Testing section, Observed / Not run details, and a Changelog entry. It clearly explains the capacity issue, changed runner labels, validation results, and remaining limitations. The Proof section and repository Checklist are missing, but they are non-critical for this CI-only change.
-
Finishing Touches: 💡 1
-
🛠️ Fix failing CI checks: 💡
-
- Commit to this branch
- Create a new PR
📝 Generate docstrings
-
- Commit to this branch
- Create a new PR
🧪 Generate unit tests (beta)
-
- Commit to this branch
- Create a new PR
-
- Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.
Comment @coderabbitai help to get the list of available commands.
Summary
The next stable release cut from
mainwould wait forever for a Mac.release.yml'sbuild-sign-notarizejob is pinned toblacksmith-12vcpu-macos-26, and that label hasn't started a job since 2026-10-28 20:32Z. This PR moves it, and the one-offrepair-v0-64-25-helper-rpaths.ymlrepairjob, to the literalblacksmith-6vcpu-macos-26label. The 6 vCPU label is the one v0.65.2.2 signed on (run 40486284894, 35 min, timeout stays 355).The label stays a literal, not
vars.MACOS_RUNNER_26 || 'blacksmith-6vcpu-macos-26'. d16b03c (#21024) moved these jobs off that expression on purpose: rule 7 oftests/test_ci_signing_keychain_is_deleted_before_bundle_code.pysays a job that holds a signing secret may not take its runner from a repository variable. Using the variable again would fail that guard. The 12 vCPU size in #21024 was a size choice, not a requirement. I didn't copy feat-cmux-next'spick-sign-runnerpicker here. Its re-runalternatecan choose the 12 vCPU label (nightly run 40876675074's attempt 2 did), and the picker is a much larger change than this fix needs.Only
runs-onand a comment change in each job. The secrets, environment, permissions, steps and timeout are the same.Blacksmith's runner docs still list
blacksmith-12vcpu-macos-26as a valid on-demand label. That means this is a capacity stall, not a misspelled label.Evidence (GitHub API, 2026-10-29 ~14:05Z)
nightly.ymlruns, main and nightly-next), 0 of the 10 jobs that asked forblacksmith-12vcpu-macos-26got a runner. 44 jobs onblacksmith-6vcpu-macos-26started, with a median queue of 4.8 min and a newest start at 14:04:38Z.build-sign-notarize-nightly(arm64, x86_64 and universal) is queued on the 12 vCPU label. That came from the sign picker's re-run alternate, which ci(nightly): sign and verify picks stay on blacksmith-6vcpu-macos-26, never the stalled 12 vCPU label #27444 fixes.seed-derived-data.yml: every 12 vCPUseedjob since 2026-10-28 23:28Z was cancelled or is still queued with no runner. The last 12 vCPU start in its history was 2026-10-28T20:32:24Z, for a job that had been queued for 9 h.build-sign-notarizeon the 12 vCPU pin frommain.Testing
Regression:
bash tests/test_ci_release_sdk_lane.shnow pins the 6 vCPU literal. It fails on 874d570 (test only, workflow still on 12 vCPU) withFAIL: release must sign+notarize on the literal macOS 26 Blacksmith labeland passes on the head.Observed / Not run
Observed, run locally on the head:
bash tests/test_ci_release_sdk_lane.sh,bash tests/test_repair_v06425_workflow.sh: pass.python3ontests/test_ci_signing_keychain_is_deleted_before_bundle_code.py(rule 7 literal label),test_ci_production_secrets_protected_env.py,test_ci_runs_on_values.py,test_ci_no_github_hosted_macos.py,test_runner_label_policy.py,test_ci_fork_runner_routing.py: pass.SHELLCHECK_OPTS=-S warning) on both changed workflows: clean.Not run: a release or the repair workflow itself. Neither can run before merge (the
releaseenvironment only releases its secrets tomainandv*tags). Other 12 vCPU users onmainare not changed here: the nightly seed matrix, theci-compile-attribution.ymloverflow label,build-nightly-app's last fallback andpick-classic-sign-runner's re-run alternate. None of them is a hard-coded signing job.Changelog
none