[teamleaderleo]

Makes the app FFI re-pin land itself, through review, within about the release build time. #32305, #31927 and #32436 each left feat-cmux-next red on "Check the app FFI pin" for about an hour on 2026-11-02, while the re-pin PR (#32121) waited for someone to review and land it.

A PR can't re-pin itself: cmux-app-ffi-<sha> releases publish only from a feat-cmux-next push (the ffi-release environment and the tag ruleset). So the fix is to shorten the wait after the push:

• The repin job runs check-app-ffi-pin.sh --verify-release before it pushes app-ffi-repin. The pinned checksum has to be the published one, and the FFI sources have to match the release's SOURCE_SHA tree. A base that has since gained newer FFI sources fails here and waits for the newer publish.
• The pin commit goes through GitHub's contents API, so it is authored by the release App and signed by GitHub. A force-pushed git commit can't be told apart from a push by anyone else with write access to the branch. The review reconciler now reviews app-ffi-repin on first sight, but only when it changes Package.swift alone in such commits. The lander then lands it on that receipt.
• The JSON body goes in a file (--input), because Package.swift's base64 (about 131 KB) is past Linux's 128 KiB limit for one argument.

No permission changes: the job already mints contents: write for this App.

Changelog

none

Observed / Not run

• python3 tests/test_app_ffi_release_workflow.py: 10 tests OK on the head. The new assertions fail on base (verify before push, a contents API PUT with --input, no git commit).
• Locally, the jq payload round-trips Package.swift's base64 exactly.
• Not run: the job itself. It runs only on a feat-cmux-next push that changes FFI sources; the next one exercises it.

Agent session: agent session

🤖 Generated with Claude Code

---

^{Open in [code]smith · Need help on this PR? Tag @codesmith-bot with what you need.}

---

Summary by cubic

Makes the app FFI re-pin land itself automatically within about the release build time, instead of leaving feat-cmux-next red on "Check the app FFI pin" for about an hour while waiting for a reviewer.

• The repin job runs check-app-ffi-pin.sh --verify-release before pushing, so the pinned checksum must be the published one and the FFI sources must match the release's SOURCE_SHA tree.
• The pin commit now goes through GitHub's contents API, so it's authored by the release App and signed by GitHub; the review reconciler and lander process it on first sight without manual review.
• The JSON payload is passed via a file (--input) because Package.swift's base64 exceeds Linux's 128 KiB argument limit.

Changelog

none

^{Written for commit 838226a. Summary will update on new commits.}

[github-actions]

cmux status _{(one comment, edited in place; each line is updated by the job that owns it)}

Review 838226a: HQ feed card · gallery before/after runs · checks

App of this head (app.zip, kept 1 day)

gh workflow run reload-build.yml -R manaflow-ai/cmux --ref feat-cmux-next -f tag=pr32477 -f ref=lane/ffi-pin-pr-gate -f platform=macos -f backend_mode=local

Shipped in:

• cmux NEXT nightly 1.0.0-nightly.4149439773601 (6ad4953200)
• cmux NEXT nightly 1.0.0-nightly.4149622662301 (72e65a53e0)
• cmux NEXT nightly 1.0.0-nightly.4149719270001 (ccb777fdde)
• cmux NEXT nightly 1.0.0-nightly.4149824422001 (f6b340f97a)
• cmux NEXT nightly 1.0.0-nightly.4150011005501 (fbf9260854)
• cmux NEXT nightly 1.0.0-nightly.4150109776501 (ae802cfe75)
• cmux NEXT nightly 1.0.0-nightly.4150231832001 (9b07402606)

The feat-cmux-next push run https://github.com/manaflow-ai/cmux/actions/runs/41493651131 at f561b65 failed: cmux-next checks (god files, concurrency, crash safety, l10n).
Those jobs last passed at bf3fbd9. This pull request is one of 3 merged since: #31921, #32476, #32477.
If the failure is in your change, fix forward on feat-cmux-next. Pull requests run only the tiers their paths reach (docs/ci/cmux-next-tiers.md); label a batch PR full-ci to run them all before merging.

[teamleaderleo]

Review (codex gpt-6.1-sol high, sweep, via the review router; full diff from merge base d614f40 to this head): SHIP at 838226a

[P2] [follow-up] .github/workflows/app-ffi-release.yml:563 - The job force-pushes app-ffi-repin to the unmodified base before the Contents API commit. If the API call fails, any existing repin PR is left reset to base and its prior pin commit is discarded; no later workflow run is guaranteed to restore it, leaving the published release unpinned. Create the commit on a temporary ref and update app-ffi-repin only after it succeeds.