PR #35202 - manaflow-ai/cmux

Summary

Base red: classic API guard / classic-api-guard fails on every PR into feat-cmux-next since about 09:10Z (#34711, #35173, #35174, #35175, #35178). The guard (added by #35126) lists the PR's files over REST, and that call fails with gh: API rate limit exceeded for installation (HTTP 403), so the step exits 1 before the guard runs.

When the REST listing fails, the step now reads the changed paths from refs/pull/N/merge instead: a depth-2 blobless fetch, then git diff --name-only --no-renames merge^1 merge. Its first parent is the base, so the diff is what the PR changes, and --no-renames lists a rename as both its old and new path, as the REST listing did. If that fails too (no merge ref, e.g. a conflicting PR), it warns and passes into feat-cmux-next, where the guard only warns anyway, and still fails into main.

Testing

Fallback by hand: the fetch plus diff against refs/pull/35174/merge listed 6 paths. #35174 changes 6 files.
python3 tests/test_classic_api_guard.py (13 OK), tests/test_ci_guard_workflow_structure.py, tests/test_ci_runs_on_values.py, actionlint on the workflow: all pass.

Observed / Not run

Observed: the commands above. Not run: a live run where REST fails. The workflow runs from the PR's own copy, so this PR's own check runs the new step.

Changelog

none

Agent session: agent session

🤖 Generated with Claude Code

^{Open in [code]smith · Need help on this PR? Tag @codesmith-bot with what you need.}

Summary by cubic

Fixes the classic API guard so it no longer fails on every PR into feat-cmux-next when the REST file listing hits the installation rate limit (HTTP 403).

Adds a fallback that reads changed paths from refs/pull/N/merge using a depth-2 blobless fetch and git diff --name-only --no-renames.
The merge ref is used only when its parents match the event's base and head SHAs, so a stale ref is ignored.
If both listings fail, the check warns and passes into feat-cmux-next (where the guard only warns) but still fails into main.