base red: runs-on tests follow the owned-only nightly rule (a7b6a611)

Draft
AZ
5d ago
+29-2

What

This fixes a base red, which is priority zero. nightly-guards / workflow-guard-tests / release-notary has failed on every feat-cmux-next push since about 02:45Z (for example 41167470866) and on every PR. It is holding #25915 and #28660, among others. Two tests in tests/test_ci_runs_on_fallback.py fail:

  • test_a_picked_signing_label_has_a_rerun_alternative: sign-nightly-identity-legacy no longer reads a picked label.
  • test_no_runs_on_chain_ends_on_the_reserved_side_label: sign-nightly-identity-legacy, verify-nightly-identity-legacy and generate-nightly-deltas now end on vars.CI_SIDE_LANE_RUNNER.

Both follow from a7b6a61175c8 (Lawrence, 2026-10-30: "Nightlies never use Blacksmith, ever"). That commit moved those three jobs to owned Macs only: the owned nightly slot, then the owned side lane, never a Blacksmith label. It also removed the Blacksmith re-run alternate. The tests still encoded the old routing, owned Macs then Blacksmith.

This PR changes tests only, so the workflow is unchanged:

  • OWNED_ONLY_NIGHTLY_JOBS names the three jobs. Only for those jobs, and only for vars.CI_SIDE_LANE_RUNNER, a chain that ends on the owned side lane is allowed.
  • The re-run alternative test now requires only build-sign-notarize-nightly, which still picks one.
  • A new test pins the exemption to the route a7b6a611 chose. Each of the three jobs exists, names no Blacksmith label and no vars.MACOS_RUNNER*, and ends vars.CI_NIGHTLY_NEXT_BUILD_RUNNER || vars.CI_SIDE_LANE_RUNNER. If a job's route changes, the exemption stops covering it.

Command: python3 tests/test_ci_runs_on_fallback.py

  • On the base (443dfacf^): FAILED (failures=2).
  • On the head: 20 tests OK.

Lawrence's commit says "the other nightly jobs move in the next commit, with a guard test over every nightly". When that lands, it can replace this exemption with its own guard.

Observed / Not run

  • Ran: the command above, on the base and on the head.
  • Not run: the full release-notary job. CI runs it here.

šŸ¤– Generated with Claude Code