ci(nightly): defer legacy identity publication after lookup errors

AU
20d ago
+2229-247

Summary

Fixes #20668. The cmux NIGHTLY-identity publication job now treats pending-submission artifact lookup as a safety boundary. A successful lookup with no candidate allows a new submission; a GitHub Actions API or artifact download error defers the run without starting another Apple notarization submission. This preserves the signed submission while Apple is still processing it and avoids duplicate publication attempts.

Testing

  • bash tests/test_nightly_universal_build.sh — passed on 39bbec06db.
  • bash tests/test_notarize_nightly_dmg.sh — passed on 39bbec06db.
  • bash -n scripts/ci/nightly-next-legacy-pending.sh and git diff --check — passed.
  • Regression proof: tests/test_nightly_universal_build.sh failed on 7330333a67 before the helper/workflow repair because the pending lookup path did not exist; it passes on 39bbec06db.
  • python3 scripts/verify-local.py reached 10/11 checks; localization, localization-defaults, and package-groups reported existing repository drift unrelated to this change. Project normalization and test wiring passed.

Changelog

none

Proof

CI-only change; the focused shell regression and notarization harness provide the proof.

View with [code]smith Autofix with [code]smith
Need help on this PR? Tag @codesmith-bot with what you need.

Summary by cubic

Fixes #20668: the nightly-next legacy identity publication now defers a new Apple notarization submission when it cannot verify that no submission is already pending. A new submission starts only after a successful artifact lookup finds no pending candidate, and recovered DMGs are verified before publication.

  • Adds a secret-free nightly signing admission job that verifies source runs and prepared-app digests without signing or publishing.
  • Builds and submits the DMG around the stapled app with a 6-hour fallback to the accepted first DMG when Apple never answers.
  • Routes high-volume CI bot jobs through the cmux-bot installation token, consolidates manual nightly dispatch into a build_mode choice, and moves unsigned-resume restore jobs onto Blacksmith runners.
  • Hardens tag-permission probing, workflow guards, changed-only localization checks, and determinism baselines for the new signing paths, and repairs guard drift from the latest main/nightly-next merges.
  • Accepts reviewed fork heads in guarded merge validation via gh-merge-green --trust-fork-head, which pins the exact reviewed commit for merged-tree checks.
  • Keeps gallery link and advisory workflows fork-safe by scoping permissions to the job and routing fork PRs to Blacksmith runners.
  • Syncs workspace package groups, guard coverage, and the devbox source-drift baseline after those merges.
  • Unrelated work merged in from main/nightly-next — Cloud Run API (authenticated adapter, migration retry, redacted cause detail, cross-realm errors, structured fields, variant column repair and defaulting), WebAuthn, billing, Bonsplit rendering, and devbox — is not part of this fix.