From 09471006cf68d2fc916e2c8eac7138c6d097b7e3 Mon Sep 17 00:00:00 2001 From: Leo Li Date: Wed, 4 Nov 2026 17:30:29 +0000 Subject: [PATCH 1/2] ci: the backend secret-route guard covers the three Cloud journey jobs journey-preview, journey-staging and journey-production (#35103) read secrets and the cmux-next-cloud-journey environment, so they belong in BACKEND_SECRET_JOBS; without them the guard's credentialed-set check fails and their routes go unchecked. Their routes already have the bounded pool-read shape. cloud-journey-prod.yml's job holds the production account, so it names blacksmith-4vcpu-ubuntu-2404 literally, as on main (#35303). Co-Authored-By: Claude Opus 5.5 Agent-Session: https://cmux.com/deeplink/agent?id=aid-8b9c8964a6aea0b7e2bd --- .github/workflows/cloud-journey-prod.yml | 2 +- tests/test_ci_runner_pool_reconcile.py | 1 + 2 files changed, 2 insertions(+), 1 deletion(-) diff --git a/.github/workflows/cloud-journey-prod.yml b/.github/workflows/cloud-journey-prod.yml index 0bfac5235fde..70d2fee3d246 100644 --- a/.github/workflows/cloud-journey-prod.yml +++ b/.github/workflows/cloud-journey-prod.yml @@ -50,7 +50,7 @@ jobs: fail-fast: false matrix: model: [stub, real] - runs-on: ${{ contains(fromJSON('["blacksmith-8vcpu-ubuntu-2404","blacksmith-16vcpu-ubuntu-2404","blacksmith-4vcpu-ubuntu-2404"]'), vars.LINUX_RUNNER) && vars.LINUX_RUNNER || fromJSON(vars.RUNNER_POOLS).linux_2 }} + runs-on: ${{ github.repository_owner != 'manaflow-ai' && 'ubuntu-24.04' || 'blacksmith-4vcpu-ubuntu-2404' }} timeout-minutes: 30 environment: cmux-next-cloud-journey permissions: diff --git a/tests/test_ci_runner_pool_reconcile.py b/tests/test_ci_runner_pool_reconcile.py index d9a149dd4447..1c3edc641636 100644 --- a/tests/test_ci_runner_pool_reconcile.py +++ b/tests/test_ci_runner_pool_reconcile.py @@ -25,6 +25,7 @@ "vitess-development", "migrations-development", "preview", "deploy-staging", "deploy-development", "promote-gates", "promote-production", "rollback-production", "chief-off-production", "deploy-production", "preview-cleanup", + "journey-preview", "journey-staging", "journey-production", ) From 33e2ad73441fa1cbc12a0229e6abf053545aa0fb Mon Sep 17 00:00:00 2001 From: Leo Li Date: Wed, 4 Nov 2026 18:04:22 +0000 Subject: [PATCH 2/2] ci: the production journey reads the Blacksmith pools, not a literal size feat-cmux-next's runner guards refuse a literal single-size label (#32457) and one with no overflow failover (#26439), and the old linux_2 route was reachable outside manaflow-ai. The job now takes the owner fork branch, then the overflow pool linux_16 or linux_8, the same pools backend.yml's credentialed jobs end in. It no longer reads vars.LINUX_RUNNER, so that variable cannot move it. Co-Authored-By: Claude Opus 5.5 Agent-Session: https://cmux.com/deeplink/agent?id=aid-8b9c8964a6aea0b7e2bd --- .github/workflows/cloud-journey-prod.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.github/workflows/cloud-journey-prod.yml b/.github/workflows/cloud-journey-prod.yml index 70d2fee3d246..79ad30700f4b 100644 --- a/.github/workflows/cloud-journey-prod.yml +++ b/.github/workflows/cloud-journey-prod.yml @@ -50,7 +50,7 @@ jobs: fail-fast: false matrix: model: [stub, real] - runs-on: ${{ github.repository_owner != 'manaflow-ai' && 'ubuntu-24.04' || 'blacksmith-4vcpu-ubuntu-2404' }} + runs-on: ${{ github.repository_owner != 'manaflow-ai' && 'ubuntu-24.04' || vars.CI_CLOUD_OVERFLOW_SAVED && fromJSON(vars.RUNNER_POOLS).linux_16 || fromJSON(vars.RUNNER_POOLS).linux_8 }} timeout-minutes: 30 environment: cmux-next-cloud-journey permissions: