ci(nightly-next): the legacy-identity sign skips a build the cmux NEXT feed is past
Summary
sign-nightly-identity-legacy signs a cmux NEXT build as cmux NIGHTLY for the old feed. Its first check, "Skip a build the old feed already has", now also skips a new submission (LEGACY_ACTION=new) of a build older than the cmux NEXT feed's newest Nightly build.
When this run's sign finally gets a Mac, a newer build is already on the cmux NEXT feed. The run that published that build signs it for the old feed, because legacy-identity-target takes the newest build, its own build included. So the older sign only held a macOS runner and a place in Apple's queue. On nightly-next today, runs 40935345693, 40936301031 and 40940370080 had their legacy signs queued 30-60 min for builds the NEXT feed was already past.
- A continuation (
LEGACY_ACTION=continue, a submission Apple already holds) is kept. - A Dev-ring item on the NEXT feed does not supersede a Nightly build (the same
nightly_next_ring.py select --channel cmux-nextrule the old-feed check uses). - A NEXT feed that cannot be read skips nothing.
- The check runs before any secret or Apple call. The skip output it sets is the one every later step already obeys, and
nightly-identity-legacy-publishedreads it as "nothing to publish".
No change to build-nightly-app, prepare, the cmux NEXT signer path or publish.
Performance
| metric | before | after | delta | harness or run link |
|---|---|---|---|---|
| legacy signs started for a build the NEXT feed was past (3 runs, 2026-10-29 19:48-20:03Z) | 3 queued 30-60 min each on Blacksmith macOS | 0 (skipped at the first step) | -3 macOS sign jobs and their Apple submissions | runs 40935345693, 40936301031, 40940370080 |
Testing
python3 tests/test_nightly_next_ring.py LegacySignSkipScriptTests runs the script with a stand-in curl that serves both feeds. It fails on the base script (test_a_new_submission_behind_the_next_feed_is_superseded) and passes on this head. Its six cases: a newer build signs; a build the old feed has skips; a new submission behind the NEXT feed skips; a Dev item does not supersede; a continuation is kept; an unreadable NEXT feed skips nothing. The full tests/test_nightly_next_ring.py, tests/test_nightly_step_coverage.py, tests/test_nightly_next_post_publish.py and tests/test_nightly_next_identity.py pass. tests/test_nightly_universal_build.sh fails the same way on base in this environment.
Observed / Not run
Observed: the tests above on Linux. Not run: a real nightly-next run with a superseded legacy sign. The next one that happens shows "build N is superseded, not submitted" in that job's summary.
Changelog
none
š¤ Generated with Claude Code
Agent session: agent session