base red: CI guard profile fails on base content

TE
4d ago
+571-181

The cmux-next CI guard group job (the workflow guard profile) fails on the content of base. Every PR that touches .github/workflows runs that profile, so each one inherits these reds. Base pushes never run the profile, so the red-on-base classifier can't excuse them. Each fix also routes the profile, so a separate PR for each group would fail on the other groups' reds. This is why they land together.

Each group is its own commit set, and each names the PR that regressed it:

  • Runner guard (tests/test_ci_self_hosted_guard.sh)
    • The guard now accepts an owned macOS pool label when it is chosen through a picker output or a repository variable. This is the current routing order: Linux, then owned Macs, then hosted overflow last.
    • It still refuses a bare self-hosted, a single-host label, an owned label named directly, and any pull-request workflow whose fork branch does not come first. Runner trust is unchanged.
    • The sentry-cli check now also reads the nightly step script that #31013 moved the upload into.
  • Runner pools
    • The base-tier kick, dev kick and iOS nightly trigger now read the Linux pool after their fork branches (#30837).
    • The owned-pool rescue lists the Linux-only workflows (#29844, #31138).
  • Small maps
    • Shallow fetches happen only on checkouts that are already shallow (#30495, #30501).
    • The design-surfaces map points at TurnRows.tsx, replacing the file #29800 deleted.
    • The errno lint scans cmux-next-ios/verify/.
    • Four manual-lane tests are listed in UNWIRED with reasons.
  • Fleet rule lints
    • No product code or test names a personal machine.
    • The verify scripts and tool-eval harness stop only the processes they started, by recorded PID or group.
    • The linker stub Security.tbd is allowlisted with its reason.
  • Nightly hygiene
    • The Xcode-pin guard follows YAML step aliases (#30471). nightly.yml needed no change for this.
    • Five unused signing anchors are removed; behaviour is the same.
    • The retention allowlist entry follows the daemon upload to its new job (#25935).
  • Determinism
    • Three Python tests no longer assert on wall time (#30822, #31266, #28553).
    • The remaining Swift and web findings are allowlisted with reasons, as follow-ups.
  • Media
    • The visual-gate state uses an example.invalid host.
    • Tours drop the record key and other keys the schema doesn't know.
    • pane-polish is split into two tours of at most 30 steps.
  • Signing and retry labels (security-sensitive)
    • swift-test, daemon-test and generated-files apply the bot run_attempt <= 3 gate to their owned fallback, like the other fleet fallbacks (#29814).
    • The keychain guard's rule 7 now admits two cases. (a) Jobs in the exclusive signing class whose first step is the claim gate, which are already checked for the temporary keychain and its always() delete. (b) stable-next sign, whose secrets and hosted runner share one developer-id condition.
    • The retry guard flags attempts of 3 or more, as its own comment says. The owned-only nightly signing jobs are exempt only while their runs-on keeps exactly the owned route.

Done when the cmux-next CI guard group check on this PR is green.

Agent session: agent session

🤖 Generated with Claude Code

View with [code]smith Autofix with [code]smith
Need help on this PR? Tag @codesmith-bot with what you need.

Summary by cubic

Fixes the cmux-next CI guard group job so the workflow guard profile passes on base content. The profile runs on every PR that touches .github/workflows, so each PR currently inherits these reds; base pushes never run the profile, so the red-on-base classifier can't excuse them. All groups land together because each fix also routes the profile, and separate PRs would fail on the other groups' reds.

Runner trust and pools

  • The runner guard accepts an owned macOS pool label when it is chosen through a picker output or a repository variable, keeping the routing order Linux, owned Macs, then hosted overflow; it still refuses a bare self-hosted, single-host labels, an owned label named directly, and any pull-request workflow whose fork branch does not come first.
  • The sentry-cli check also reads the nightly step script that #31013 moved the upload into.
  • The base-tier kick, dev kick, and iOS nightly trigger read the Linux pool after their fork branches (#30837); the owned-pool rescue lists the Linux-only workflows (#29844, #31138).
  • swift-test, daemon-test, and generated-files apply the bot run_attempt <= 3 gate to their owned fallback, like the other fleet fallbacks (#29814); the keychain guard's rule 7 admits the claim-gated exclusive signing job and stable-next sign.

Maps, media, determinism, and hygiene

  • Shallow fetches happen only on checkouts that are already shallow (#30495, #30501); the design-surfaces map points at TurnRows.tsx (#29800); the errno lint scans cmux-next-ios/verify/; four manual-lane tests are listed in UNWIRED with reasons.
  • No product code or test names a personal machine; the verify scripts and tool-eval harness stop only the processes they started, by recorded PID or group.
  • Three Python tests no longer assert on wall time; remaining Swift and web findings are allowlisted with reasons.
  • The visual-gate state uses an example.invalid host; tours drop unknown keys; pane-polish is split into two tours of at most 30 steps.
  • The Xcode-pin guard follows YAML step aliases (#30471); five unused signing anchors are removed; the retention allowlist entry follows the daemon upload to its new job (#25935).