fix(ci): a fork pull request never reads CI_SESSION_LANE_RUNNER by lawrencecchen · Pull Request #27548 · manaflow-ai/cmux

lawrencecchen · 2026-10-29T20:15:40Z

Summary

#27201 (dd027bc) gave the macOS placement step SESSION_LANE: ${{ vars.CI_SESSION_LANE_RUNNER }}. That runner variable names an owned glaeda-session-* label, and the line has no fork branch. tests/test_ci_fork_runner_routing.py (ci-guards.yml "Validate fork runner routing") fails on it: cmux-next.yml:1249 checks vars.CI_SESSION_LANE_RUNNER before the fork pull-request branch.

The expression now starts with the owner branch and the fork pull-request branch, in the same form as every other runner line. A fork pull request never reads the variable. There is no exemption entry in the test, so there is no second list to keep correct.

Thanks @teamleaderleo for #27201. This only gates the new input; the session-lane routing is unchanged for same-repository runs.

Values before and after

Evaluated with GitHub's && / || rules, using the test's own expression parser. "placement lane" is what scripts/ci/side_lane_placement.py takes from it: it uses SESSION_LANE only when the value starts with glaeda-.

vars.CI_SESSION_LANE_RUNNER = 'glaeda-session-light-xcode-26.6'
  push to feat-cmux-next          old='glaeda-session-light-xcode-26.6'    new='glaeda-session-light-xcode-26.6' same    placement lane: old='glaeda-session-light-xcode-26.6' new='glaeda-session-light-xcode-26.6'
  same-repo pull request          old='glaeda-session-light-xcode-26.6'    new='glaeda-session-light-xcode-26.6' same    placement lane: old='glaeda-session-light-xcode-26.6' new='glaeda-session-light-xcode-26.6'
  workflow_dispatch               old='glaeda-session-light-xcode-26.6'    new='glaeda-session-light-xcode-26.6' same    placement lane: old='glaeda-session-light-xcode-26.6' new='glaeda-session-light-xcode-26.6'
  fork pull request (into ours)   old='glaeda-session-light-xcode-26.6'    new='blacksmith-6vcpu-macos-26'    CHANGED placement lane: old='glaeda-session-light-xcode-26.6' new=''
  a fork's own CI (no vars)       old=''                                   new='macos-26'                     CHANGED placement lane: old='' new=''
vars.CI_SESSION_LANE_RUNNER = ''
  push to feat-cmux-next          old=''                                   new=''                             same    placement lane: old='' new=''
  same-repo pull request          old=''                                   new=''                             same    placement lane: old='' new=''
  workflow_dispatch               old=''                                   new=''                             same    placement lane: old='' new=''
  fork pull request (into ours)   old=''                                   new='blacksmith-6vcpu-macos-26'    CHANGED placement lane: old='' new=''
  a fork's own CI (no vars)       old=''                                   new='macos-26'                     CHANGED placement lane: old='' new=''

Same-repository pushes, pull requests and dispatches get the same value as before.
In both fork cases, the placement's session lane is ''. That is its safe default: the job keeps the route it had without the lane.
The step also runs only on a glaeda- side route, which a fork never gets. This change makes the input safe without depending on that.

Changelog

none

Testing

Command: python3 tests/test_ci_fork_runner_routing.py

Base 7b53cd4: FAILED (failures=1) (the line above).
Head: Ran 20 tests ... OK.

Also OK at the head: test_ci_side_lane_placement.py, test_ci_next_macos_cascade.py, test_ci_owned_pool_rescue.py, test_ci_pr_runner_pool.py, test_runner_label_policy.py, test_cmux_next_checks_workflow.py.

Observed / Not run

Observed: the commands above on Linux (cmux-orchestrator-1, Python 3.12), at the base and the head. The value table comes from a script that evaluates both expressions. scripts/cmux-next/prepush-gate.py: no new violations.
Not run: a real fork pull request through Actions, and actionlint (it is not installed on this VM).

The same class of fix for perf/chrome-parity is on cp/fix-tip-checks-base-red-4.

^{Need help on this PR? Tag @codesmith-bot with what you need.}

Summary by cubic

Fixes the macOS placement step in cmux-next.yml so a fork pull request never reads the CI_SESSION_LANE_RUNNER variable, which resolves the failing "Validate fork runner routing" test.

The SESSION_LANE expression now checks the owner and fork pull-request branches before falling back to the variable, matching the pattern used by other runner lines.
Same-repository pushes, pull requests, and dispatches get the same values as before; fork paths use their safe defaults (macos-26 or blacksmith-6vcpu-macos-26), which place no session lane.
Session-lane routing is unchanged for same-repository runs.

^{Written for commit 83df9a3. Summary will update on new commits.}

dd027bc (#27201) gave the macOS placement step SESSION_LANE: ${{ vars.CI_SESSION_LANE_RUNNER }}, a runner variable that names an owned glaeda-session-* label, with no fork branch. tests/test_ci_fork_runner_routing.py (ci-guards.yml "Validate fork runner routing") fails on it: "cmux-next.yml:1249 checks vars.CI_SESSION_LANE_RUNNER before the fork pull-request branch". The expression now starts with the owner branch and the fork pull-request branch, as every other runner line does. Values, by GitHub's && / || rules (evaluated with the test's own parser): - push, same-repo pull request, workflow_dispatch in manaflow-ai: unchanged (the variable, or ''). - fork pull request into manaflow-ai: 'blacksmith-6vcpu-macos-26' (was the variable). - a fork's own CI: 'macos-26' (was ''). side_lane_placement.py uses SESSION_LANE only when it starts with "glaeda-", so for both fork cases the placement's session lane is '', its safe default (the job keeps the route it had without it). The step itself runs only on a glaeda- side route, which a fork never gets; this makes the input safe on its own, with no exemption list to keep right. Red (base 7b53cd4): python3 tests/test_ci_fork_runner_routing.py -> FAILED (failures=1). Green (head): OK (20). test_ci_side_lane_placement, test_ci_next_macos_cascade, test_ci_owned_pool_rescue, test_ci_pr_runner_pool, test_runner_label_policy, test_cmux_next_checks_workflow: OK.

github-actions · 2026-10-29T20:15:53Z

cmux status _{(one comment, edited in place; each line is updated by the job that owns it)}

Review 83df9a3: HQ feed card · gallery before/after runs · checks

App of this head (app.zip, kept 1 day)

gh workflow run reload-build.yml -R manaflow-ai/cmux --ref feat-cmux-next -f tag=pr27548 -f ref=fix/session-lane-fork-gate -f platform=macos -f backend_mode=local

red: cmux-next checks (god files, concurrency, crash safety, l10n); no finished base run on 34e31e4 to compare; do not merge until green; see lane-rules

Shipped in:

cmux NEXT nightly 1.0.0-nightly.4115488208801 (dd66817742)
cmux NEXT nightly 1.0.0-nightly.4115755828101 (7c0adaf184)

lawrencecchen · 2026-10-29T20:20:12Z

Independent review subagent, security lens: SHIP. A fork PR into manaflow-ai stops at the fork branch before vars.CI_SESSION_LANE_RUNNER (also when its head repo is deleted: a null full_name is != the repository). side_lane_placement.py:649-652 is the only reader of SESSION_LANE and takes it only when it starts with glaeda-, so the fork values give an empty session lane. The macos-placement job's if: already skips fork PRs; this gate makes the input safe on its own. Push, same-repo PR and workflow_dispatch (the workflow's only triggers) get the same value as before, with the variable set and unset. Base 7b53cd4: test_ci_fork_runner_routing.py failures=1; head OK (20); placement, rescue, cascade, label-policy, pool and checks-workflow tests OK.

Review (Claude Opus 5.5, security lens): SHIP at 83df9a3

blacksmith-sh · 2026-10-29T20:22:00Z

Found 6 test failures on Blacksmith runners:

Failures

Test	View Logs
`/tmp/tmp1ualvyls/summary-fail.json (live):/summary-fail.json (live):`	View Logs
`/tmp/tmphggg9iox/summary-missing.json (live):/summary-missing.json (live):`	View Logs
`[new_workspaces] debug.new_workspace timed 0 of 50 new workspace rows/` `[new_workspaces] debug.new_workspace timed 0 of 50 new workspace rows`	View Logs
`[new_workspaces] the window draws no frames/[new_workspaces] the window draws no frames`	View Logs
`[tabs] debug.tab_switch timed 0 of 40 switches/` `[tabs] debug.tab_switch timed 0 of 40 switches`	View Logs
`[tabs] the window draws no frames/[tabs] the window draws no frames`	View Logs

^{Need help on this PR? Tag @codesmith-bot with what you need.}

teamleaderleo · 2026-10-29T20:24:25Z

Bead cx-69p3aj created for this PR by the cmux coordinator.

teamleaderleo · 2026-10-30T06:46:58Z

Review (codex gpt-6-astra high fast, drain lane): SHIP at 83df9a3

No blocking findings. The expression preserves same-repository behavior and short-circuits fork cases before accessing the runner variable.

Review limited to the supplied diff; the files/ directory was absent.

lawrencecchen added the risk:normal Risk tier (docs/ci/risk-tiers.md) label Oct 29, 2026

lawrencecchen temporarily deployed to ci-routing-agent October 29, 2026 20:16 — with GitHub Actions Inactive

lawrencecchen added the ready-to-land Reviewed at this head; next-autoland merges it into feat-cmux-next when its only reds are base reds label Oct 29, 2026

teamleaderleo mentioned this pull request Oct 30, 2026

ci(cmux-next): the session label comes only from a placement that judged its queue #27853

Merged

lawrencecchen merged commit 914c8ce into feat-cmux-next Oct 31, 2026
187 of 211 checks passed

lawrencecchen deleted the fix/session-lane-fork-gate branch October 31, 2026 00:33

Navigation Menu

Repository navigation

fix(ci): a fork pull request never reads CI_SESSION_LANE_RUNNER - #27548

fix(ci): a fork pull request never reads CI_SESSION_LANE_RUNNER#27548
lawrencecchen merged 1 commit into
feat-cmux-nextfrom
fix/session-lane-fork-gate

lawrencecchen commented Oct 29, 2026 •

edited by cubic-dev-ai Bot

Loading

Uh oh!

github-actions Bot commented Oct 29, 2026 •

edited

Loading

Uh oh!

lawrencecchen commented Oct 29, 2026

Uh oh!

blacksmith-sh Bot commented Oct 29, 2026

Uh oh!

teamleaderleo commented Oct 29, 2026

Uh oh!

teamleaderleo commented Oct 30, 2026

Uh oh!

Uh oh!

This branch was previously deployed

Reviewers

Uh oh!

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

Conversation

lawrencecchen commented Oct 29, 2026 • edited by cubic-dev-ai Bot Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Summary

Values before and after

Changelog

Testing

Observed / Not run

Summary by cubic

Uh oh!

github-actions Bot commented Oct 29, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

lawrencecchen commented Oct 29, 2026

Uh oh!

blacksmith-sh Bot commented Oct 29, 2026

Failures

Uh oh!

teamleaderleo commented Oct 29, 2026

Uh oh!

teamleaderleo commented Oct 30, 2026

Uh oh!

Uh oh!

This branch was previously deployed

Reviewers

Uh oh!

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

lawrencecchen commented Oct 29, 2026 •

edited by cubic-dev-ai Bot

Loading

github-actions Bot commented Oct 29, 2026 •

edited

Loading