#23545 cmux-next checks: the App size cap on a push compares with the commit before it

Summary

The "CmuxNextApp size cap" step in cmux-next.yml passes --base only on pull requests. So while the App is over the cap, every push to feat-cmux-next is red, including pushes that add no App lines. This step runs only on pushes (FULL_CI).

On a push, the step now passes --base ${{ github.event.before }}, matching the script's documented usage ("--base REF (pull requests/pushes)"). The checkout has depth 2, so the step first fetches that commit when it's missing. Any push that adds App source lines still fails, under or over the cap. A push with no before commit (a new branch, all zeros) keeps the plain cap. If the before commit can't be fetched, the script can't resolve it and falls back to the plain cap, so the check fails closed.

This PR is separate from the cap raise #23540, which is held for a sign-off.

Testing

tests/test_cmux_next_checks_workflow.py has a new AppSizeCapOnPush class. It runs the step's own run script, read from the workflow, in a scratch git repo as a push. Its three cases:

• no App source growth passes over the cap;
• source growth fails with "real source growth is not allowed";
• a zero before keeps the plain cap.

The test commit comes before the fix. The cmux-next checks job runs this file in CI; this PR's red and green results will be added as a comment.

Observed / Not run

• Ran: the new step script by hand in a scratch repo. A comment-only push over the cap exited 0 ("no source-line growth"), and a push adding let d = 4 failed ("real source growth is not allowed"). The workflow parses with PyYAML, actionlint flags nothing in the step, and bash -n passes.
• Not run locally: the unittest itself, which a hook blocks on cosmic-gray; CI runs it.

Changelog

none

🤖 Generated with Claude Code

Agent session: cosmic-gray

---

^{Need help on this PR? Tag @codesmith-bot with what you need.}

---

Summary by cubic

Fixes the CmuxNext App size cap check on pushes so it compares against the commit before the push, instead of always failing while the App is over the cap.

• On a push the step now passes --base ${{ github.event.before }}, fetching the commit when missing; pushes that add App source lines still fail, and pushes with no new source lines pass.
• A push with a zero before (new branch) and pushes where the before commit can't be fetched fall back to the plain cap and fail closed.
• Adds an AppSizeCapOnPush test class covering all three cases.