ci(nightly): authenticate controller admission check receipts
NEXT control jobs cannot authenticate the private controller from a runner outside its network. Consume its authenticated GitHub Check Run instead: require the existing publishing App, exact run, attempt, source, jobs and canonical lease identity, plus the controller's terminal decision and clocks. Missing or invalid publication fails placement; it never becomes a no-start receipt or a paid runner choice.
Leo: “FOR OUR NIGHTLIES ARE THEY END TO END ON OUR FLEET? WE CAN'T BE RELYING ON BLACKSMITH THAT CUTS OUT”.
CI_NIGHTLY_ADMISSION_CHECKS=1 opts ordinary NEXT builds in through a run/source-bound workflow title. The controller uses that marker and the actual current-attempt bootstrap job to admit demand before a runner starts. Dedicated-fleet jobs retain first priority and skip this reader. Unsigned-resume titles and routing remain compatible with the existing retry tracker. Downstream controls require a verified receipt from their own attempt, so a failed-jobs rerun cannot reuse stale placement and fall through to paid capacity.
The only permission addition is checks: read on the existing metadata job, needed to authenticate the Check Run's App identity. No App permission, credential, runner trust or release-environment change is made. Read-only permissions from #30248 are retained. Existing routes remain when the opt-in is disabled. Activation stays off until the controller demand and publisher changes are deployed.
The reader makes at most two authenticated GitHub requests, with one delayed retry only when publication is absent. Its 210-second publication allowance covers the controller's 180-second lease and delivery margin; the job timeout also bounds the operation. API calls have a 15-second timeout and 1 MiB response limit, and reject redirects. There is no polling loop, background timer, dispatch or cancellation. Existing warm sources and compile caches are unchanged; this adds no build.
Validation: the same focused missing-receipt regression fails on base f818cf72352 (it selects a fallback despite opt-in) and passes at this head. New receipt/workflow tests (18), legacy admission (26), trusted routing (37), dedicated routing (7), routing policy (33), nightly routing (20), fork routing (23) and promotion-queue cases (9) pass. The live routing-table check, diff validation and pre-push checks pass. Job-scoped permissions (5), reusable permissions, workflow-size (2) and source-archive policy checks also pass. Two identical license steps now use YAML anchors to retain workflow-size headroom; the parsed workflow is unchanged by that deduplication. Coverage includes wrong App, identity/attempt/source mismatch, ambiguous or truncated publication, malformed JSON, nanosecond clock boundaries, missing/stale downstream outputs, dedicated priority, and anchored unsigned-resume titles.
Observed / Not run
Observed: 173 focused tests and cases pass; the missing-receipt policy has a base/head regression. Not run: an enabled production nightly consuming the new publication. That proof follows controller deployment and explicit opt-in activation. Prior art: preserves #30085's identity-bound leases, #30173's disabled-mode fallback, #30249's dedicated priority and #30248's read-only metadata permissions.
| Performance | Before | After | Delta | Evidence |
|---|---|---|---|---|
| GitHub admission reads per opted-in placement | No public receipt reader | At most two | Bounded authenticated reads | Reader tests |
| Blacksmith minutes/day | Not measured | Not measured | Paid overflow requires controller no-start proof when enabled | Routing tests; live activation pending |
Changelog
- Authenticate fleet admission receipts before routing opted-in NEXT nightly controls.
Agent session: agent session
🤖 Generated with Claude Code