fix(ci): retry same-source nightly incident closure

Merged
TE
1mo ago
+51-3

Changelog

  • Fixed retry handling for deferred nightly failure incidents when the exact source SHA is already published.

What changed

The asynchronous notarization continuation now distinguishes an exact source match from a newer published build. An exact match skips duplicate publication but reruns the source-SHA-matched incident closure; a newer build continues to leave the older incident open.

Validation

  • bash tests/test_nightly_universal_build.sh
  • python3 tests/test_notarization_recovery_manifest.py
  • python3 tests/test_nightly_promotion_admission.py
  • python3 tests/test_nightly_publication_marker.py
  • actionlint .github/workflows/auto-resume-nightly-notarization.yml .github/workflows/resume-nightly-notarization.yml .github/workflows/nightly.yml
  • python3 scripts/verify-local.py
  • git diff --check

View with [code]smith Autofix with [code]smith
Need help on this PR? Tag @codesmith-bot with what you need. Autofix is disabled.

Summary by cubic

Fixes the retry handling for deferred nightly failure incidents when the same source SHA is already published. Previously, any existing publication skipped closing the incident; now an exact source match still retries closure, while a newer build leaves the older incident open.

[!NOTE]
Low Risk
CI workflow guard and incident-close conditions only; no app runtime or release artifact logic changes.

Overview
Fixes deferred nightly failure incident closure on notarization continuation retries when the release is already published for the same source SHA.

The publication guard in auto-resume-nightly-notarization.yml now treats an exact cmux-published-sha match as already published but sets ALREADY_PUBLISHED_SAME_SOURCE; a newer cmux-published-build alone still blocks republication without that flag. Close deferred nightly failure incident runs when publication was skipped for a different reason or when the skip was a same-source idempotent hit, so closure can retry without republishing. A newer build from another commit still skips closure.

Adds a regression in test_nightly_publication_marker.py that exercises the embedded guard script and closure if across SHA/build fixture cases.

Reviewed by Cursor Bugbot for commit fa6bef3a025a278165cafb96753ca7e1ce6855b5. Bugbot is set up for automated code reviews on this repo. Configure here.

Summary by CodeRabbit

  • Bug Fixes
    • Improved nightly release publication checks so releases already published from the same source are recognized correctly.
    • Deferred publication failures are now closed when a release is newly published or the existing release matches the source.
    • Checks continue to distinguish releases from different sources and builds that are at or ahead of the current build.