ci: the devbox rebake publishes its manifest branch in two pushes

Merged
TE
8d ago
+13-4

Every devbox image rebake since 10-28 baked, verified and smoke-tested its image, then failed at "Publish the manifest pull request": ! [remote rejected] HEAD -> devbox-rebake/4e7d84ee3095 (Unable to determine if workflow can be created or updated due to timeout; workflows scope may be required.) (runs 40640977877 and 40851484187). Nothing could be promoted, so staging Cloud machines still boot the 10-15 image. Its cmux-tui predates agent session tabs (agent-session-tabs-v1), so no agent chat opens on a new staging machine.

A single push of a new branch makes GitHub work out which commits are new against the whole repository, and here that times out. Since the push token has no workflows permission, GitHub refuses the push. The step now pushes twice: first the branch at the baked commit, which is already on the base and adds no commit, then the one manifest commit on top, which touches only web/services/vms/images/*.json. No token, permission or other step changes.

Changelog

none

Observed / Not run

  • The two failing publish logs are quoted above. The bake in run 40851484187 pinned cmux-tui 6a202d045fd6, which includes agent session tabs, and its verify and smoke steps passed.
  • actionlint on the file, tests/test_ci_runs_on_values.py, test_ci_workflow_permissions_are_job_scoped.py and test_ci_actionlint_covers_every_workflow.py pass.
  • Not run yet: the publish itself. I'll dispatch the rebake once this merges.

šŸ¤– Generated with Claude Code

Agent session: agent session

Summary by cubic

Fixes the devbox image rebake workflow so its manifest branch publish no longer times out and gets refused by GitHub.

Every publish since 10-28 failed because a single push of a new devbox-rebake/* branch makes GitHub compute new commits against the whole repository, which times out on this repository. The step now pushes twice: first the branch at the baked commit (already on the base, adds no commit), then the one manifest commit on top. No token, permission, or other step changes.