Repository navigation
ci(signing): trust glaeda runner hook df0e90b4 - #29029
Closed
cmux-bot[bot] wants to merge 0 commit into
Closed
cmux-bot[bot] wants to merge 0 commit into
cmux-bot[bot] wants to merge 0 commit into
Conversation
Contributor
|
cmux status (one comment, edited in place; each line is updated by the job that owns it) Review App of this head (app.zip, kept 1 day)
|
|
Found 2 test failures on Blacksmith runners: Failures
|
![Fix with [code]smith](https://pr-comments-assets.blacksmith.sh/codesmith/fix-with-codesmith-light-3x.png)
cmux-bot Bot
pushed a commit
that referenced
this pull request
Oct 31, 2026
… hook 49b5d9f5 (#29154) nightly-guards / workflow-guard-tests / release-notary is red on every feat-cmux-next push and PR. Three causes, all in this one job: 1. RunsOnFallbackTests (first red a7b6a61, "legacy sign and deltas run on owned Macs only"). That commit ended sign-nightly-identity-legacy, verify-nightly-identity-legacy and generate-nightly-deltas on vars.CI_SIDE_LANE_RUNNER, a reserved lane (#28249 forbids a terminal reserved variable: an unset or offline lane is one dead queue), and dropped the legacy sign's Blacksmith picked label. Fix in the workflow: each chain now ends on the owned std pool literal 'glaeda-std-xcode-26.6' after the side lane, so it stays on owned Macs (no Blacksmith, Lawrence 2026-10-30) and never ends on a reserved variable. The re-run test keeps build-sign-notarize-nightly's Blacksmith alternate rule; the legacy sign and verify now get the owned form of the same rule (an owned pick holds only on the attempt that picked it). The exact-string pins a7b6a61 added (test_nightly_sign_runner, test_ci_nightly_off_blacksmith, test_nightly_universal_build.sh) pin the new ending. 2. test_ci_warm_sources (hidden behind 1 in the same step): 13 jobs drifted from .github/warm-sources.json (stable-next.yml, chromium staleness, acpmux tests, test-compile plan, cmux-tui cargo caches, the removed Blacksmith twin). The four cmux-tui lines are the same as #28818. 3. SigningHooksInStepWithGlaedaTests: glaeda 1cd373c3 (#1768) released runner hook 49b5d9f5 at 06:22Z. Its sha256 matches scripts/glaeda-cmux-runner-hook on glaeda main and glaeda-disk pins it as newest; the change lengthens the signing drain wait and keeps the claim and leftover checks. Same line as the sync PR #29029. Ran on this VM, every release-notary step of ci-guards.yml: all pass except license compliance (no ghostty-next submodule here) and the arm64-only track (no lipo on Linux), which pass in CI on the base.
cmux-bot
Bot
force-pushed
the
auto/glaeda-signing-hooks
branch
from
October 31, 2026 11:41
340cb0e to
845f03b
Compare
cmux-bot
Bot
changed the title
github-actions
Bot
added
risk:low
teamleaderleo
temporarily deployed
to
ci-routing-agent
October 31, 2026 11:43 — with 
GitHub Actions
Inactive
GitHub Actions
Inactive
teamleaderleo
temporarily deployed
to
artifacts
October 31, 2026 11:45 — with
GitHub Actions
Inactive
GitHub Actions
Inactive
teamleaderleo
temporarily deployed
to
artifacts
October 31, 2026 11:45 — with
GitHub Actions
Inactive
GitHub Actions
Inactive
lawrencecchen
added a commit
that referenced
this pull request
Oct 31, 2026
…kle key; stable-next jobs in runners.json (#29261) * base red: release-notary RunsOnFallbackTests, warm sources and glaeda hook 49b5d9f5 nightly-guards / workflow-guard-tests / release-notary is red on every feat-cmux-next push and PR. Three causes, all in this one job: 1. RunsOnFallbackTests (first red a7b6a61, "legacy sign and deltas run on owned Macs only"). That commit ended sign-nightly-identity-legacy, verify-nightly-identity-legacy and generate-nightly-deltas on vars.CI_SIDE_LANE_RUNNER, a reserved lane (#28249 forbids a terminal reserved variable: an unset or offline lane is one dead queue), and dropped the legacy sign's Blacksmith picked label. Fix in the workflow: each chain now ends on the owned std pool literal 'glaeda-std-xcode-26.6' after the side lane, so it stays on owned Macs (no Blacksmith, Lawrence 2026-10-30) and never ends on a reserved variable. The re-run test keeps build-sign-notarize-nightly's Blacksmith alternate rule; the legacy sign and verify now get the owned form of the same rule (an owned pick holds only on the attempt that picked it). The exact-string pins a7b6a61 added (test_nightly_sign_runner, test_ci_nightly_off_blacksmith, test_nightly_universal_build.sh) pin the new ending. 2. test_ci_warm_sources (hidden behind 1 in the same step): 13 jobs drifted from .github/warm-sources.json (stable-next.yml, chromium staleness, acpmux tests, test-compile plan, cmux-tui cargo caches, the removed Blacksmith twin). The four cmux-tui lines are the same as #28818. 3. SigningHooksInStepWithGlaedaTests: glaeda 1cd373c3 (#1768) released runner hook 49b5d9f5 at 06:22Z. Its sha256 matches scripts/glaeda-cmux-runner-hook on glaeda main and glaeda-disk pins it as newest; the change lengthens the signing drain wait and keeps the claim and leftover checks. Same line as the sync PR #29029. Ran on this VM, every release-notary step of ci-guards.yml: all pass except license compliance (no ghostty-next submodule here) and the arm64-only track (no lipo on Linux), which pass in CI on the base. * test(ci): a Sparkle-key job on an owned Mac must hold the whole mini (red: generate-nightly-deltas) tests/test_ci_signing_owned_mac.py now treats a job that holds a Sparkle private key as a signing job, and checks a signing job whose runs-on has no ephemeral route (owned only) even when it reads no owned pick. Rule 4 (the keychain delete) stays for jobs that make a keychain. Red on 340f771 (PR #29154 head, base 7bda8ef): test_workflows fails with four findings for nightly.yml generate-nightly-deltas: not in SIGNING_JOBS, no claim gate first, no signing-runner-claim.sh step, and the Sparkle keys in job-level env. Run 41180899369 ran it on cmux14-glaeda-2 beside other jobs (glaeda class isolated). * fix(ci): generate-nightly-deltas holds the whole Mac before the Sparkle key; stable-next jobs in runners.json generate-nightly-deltas held the Sparkle private keys (job-level env) on an owned mini beside other jobs, with no claim (glaeda class isolated; run 41180899369 on cmux14-glaeda-2). It now does what sign-nightly-identity-legacy does: - runs-on: the signing picker's drained mini on this attempt (sign_owned, under the same attempt guard), then the owned nightly slot, the side lane and the owned std pool. This is a placement output, so the routing table no longer reports a bypass. - its first step is the same claim gate (a YAML alias of the legacy sign's), and signing-runner-claim.sh runs from the workflow commit before any secret. - the three Sparkle keys move from the job env into the one step that signs. - it is in SIGNING_JOBS (tests/test_ci_signing_owned_mac.py and scripts/ci/signing_runner.py). glaeda must list it in its SIGNING_JOBS too (the exclusive class); until then the gate refuses it on an owned Mac and the run publishes no deltas (they are optional; the full DMG and appcast are not affected). runners.json: the five stable-next.yml macOS jobs get their classes, with a picker_followup each (fixed labels, as the routing table now reports). Tests (Linux VM): test_ci_signing_owned_mac, test_runner_routing_table, test_nightly_step_coverage, test_workflow_file_size (489988 < 490000 bytes), test_nightly_sign_runner, test_nightly_trusted_routing, test_ci_runs_on_fallback, test_ci_warm_sources, test_nightly_universal_build, test_nightly_sparkle_key, test_generate_nightly_deltas: all pass. --------- Co-authored-by: cmux-bot[bot] <348531757+cmux-bot[bot]@users.noreply.github.com>
This branch was previously deployed
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
glaeda pins these runner hooks (glaeda-disk's
CMUX_NEXT_DRAIN_HOOK_SHA256), andscripts/ci/glaeda-signing-hooks.txtdoes not list them yet. Until it does, owned-Mac signing jobs on minis that run them fail their claim gate, and each run's Blacksmith twin signs.df0e90b42c73838e01855a51636b7ed5c47fd918faf76ab815b5ce78aec54e57: glaeda 548d71ae: runner hook: a borrower whose repack finds its store damaged is reset and borrows again once (fix(keyboard): support CJK input methods for custom shortcuts #1770)Check before landing: each sha is the sha256 of
scripts/glaeda-cmux-runner-hookat a reviewed glaeda main commit, and that hook still waits out an earlier job's leftover processes and gives signing jobs the exclusive claim.tests/test_ci_signing_owned_mac.pychecks that every listed sha is a glaeda pin.Written by cmuxterm-hq
.github/workflows/fleet-reconciler-glaeda-signing-hooks.yml(tools/fleet-reconcilers/glaeda_signing_hooks_sync.py). It updates this branch when glaeda pins another hook, and never merges.