#25879 ci(nightly): move seven run blocks into scripts so nightly.yml keeps room under GitHub's size limit

Restores base: every nightly.yml run on feat-cmux-next pushes has been failing at startup with zero jobs ("This run likely failed because of a workflow file issue"), for example runs 40439968068 and 40439776806.

Why: GitHub refuses a workflow file over about 512,000 bytes. nightly.yml reached 512,052 bytes with #25807, and 520,608 bytes at 045a410f. #25849's YAML anchors brought it back to 507,029 bytes, which is still only a few changes from breaking again.

What changes:

• Seven run: | blocks in nightly.yml move word for word into scripts/ci/nightly-steps/*.sh. None of them uses a ${{ }} expression. Their steps keep their env:, if: and id: and now run bash scripts/ci/nightly-steps/<step>.sh:

  • legacy-identity-target: Compare the cmux NEXT feed with the old feed
  • recover-nightly-next-notarization: Continue the newest accepted pending notarization
  • publish-nightly-identity-legacy: Publish the cmux NIGHTLY DMG, release notes and the old feed
  • publish-nightly: Prepare nightly release notes and appcast summaries
  • publish-nightly: Final publication gate
  • publish-nightly-identity-legacy: Generate the old feed's appcast
  • sign-nightly-identity-legacy: Prepare current NEXT DMG for the parallel identity

  The two publish-nightly steps call the copy under .publish-tooling/. That copy is the job's existing sparse checkout of scripts/ at the workflow commit, made before both steps. The always() marker step stays inline, because it can run when that checkout did not.

• nightly.yml goes from 507,029 to 469,734 bytes.

• tests/nightly_workflow_text.py puts the scripts back inline for the tests that read nightly.yml's text or YAML. The result is byte-identical to the old nightly.yml. Before the move, I checked that the YAML parse of the old and new files is identical except for those seven run: values.

• tests/test_workflow_file_size.py (preflight group in ci-guards.yml) fails when nightly.yml is at or above 490,000 bytes, and when any workflow reaches GitHub's 512,000-byte limit.

Size: 1,219 changed lines, of which about 1,090 are the verbatim move, counted once as removed and once as added. Splitting it would leave base close to the limit for longer.

Risk: the moved steps run in the nightly and publish path. Their commands are unchanged; only where the text lives has changed. Local runs: every Python and shell test that reads nightly.yml passes, or fails the same way on base (runner label policy, signing-keychain, path-filter parity, and others).

Agent session: agent session

🤖 Generated with Claude Code