[narduk-lane-automation]

This PR makes nuxt-cloudflare.yml reuse a PR's Required or E2E result on the default-branch push without the R2 store. GitHub's own record is enough.

Why this, not "run the taskgraph engine inside nuxt-cloudflare.yml"

nuxt-cloudflare.yml already has two of taskgraph's three wins: parallel fast lanes, and whole-run main-push reuse (required-reuse-pr-results). Taskgraph's per-task keys only beat whole-run reuse once a repo narrows its inputs, and that is per-repo config.

The count across the 67 callers: 24 reuse today and 43 don't. Of those 43, 36 pass no CI_ARTIFACTS_R2_* secrets, including the narduk-enterprises-clients repos that call this callable, and they can never receive them. So the gap is the store, and this closes it for every caller on its next pin bump.

Change

• What already ran. The PR's Publish Required proof <key> / Publish full E2E proof <key> step already runs, and succeeds, without credentials. It only skips writing a pointer. workflows#227 bound that step's job to the callable's own runner header, so the step itself is the proof.
• New lookup: findProofOnGitHub. It runs when findProof finds no pointer, for no credentials or no pointer stored. A store error still throws and runs the full gate.
  • On a push, it finds the merged pull request's run from the push's subject. A merge commit names its branch. A squash subject is the PR title, which is the run's display_title. A PR head that already held the pushed tree also counts.
  • Every candidate passes the same rules as a pointer's run (attestedRun): a successful same-repository pull_request run of the caller workflow, a green <job> / Required that this callable wrote, and the step with this key.
  • A Dependabot run (actor or triggering actor) never vouches, because it gets no NVAULT_TOKEN or store secrets.
• Behaviour change. e2e-reuse-pr-results defaults to true, so after a repin a store-less caller also reuses E2E on its push when the PR ran the full E2E. Its description now says so. required-reuse-pr-results stays opt-in.
• Copy. taskgraph.yml's byte-equal store-client copy follows.

Proof

• Tests:
  • test_e2e_reuse.py covers store-free reuse through a squash title, a merge branch, a matching head tree, and attempt 2. It refuses:
    • another PR;
    • a fork;
    • another workflow;
    • a failed run;
    • another callable SHA;
    • no attesting step;
    • a tree the run did not test;
    • a subject naming no PR;
    • a Dependabot actor or triggering actor.
  • test_fast_path.py covers the Required path the same way.
• Live, on the pointer path (nuxt-cloudflare: a reuse proof counts only from a Required job the callable wrote #227): familystat-us's main push 41140766946 reused PR run 41140093408's Required result in 27 s, bound through the callable header.
• Not yet measured live: the store-free path. The next step is a canary on favicon-checker, which has no R2 secrets and a green main: repin, turn on required-reuse-pr-results, merge, and read the push.

Review

• Opus verify found no blockers. It found that the key covers the tested tree, and every job checks out that tree, so the candidate search only affects speed.
• Its findings are fixed here: Dependabot runs can no longer vouch, the stale texts and log messages are corrected, the store-error comment is fixed, and the test gaps are closed.
• Not fixed, speed only:
  • a single-commit squash subject is the commit title, not the PR title, so that case misses;
  • an older-pin run can cost 7 s per candidate.

Gates

• scripts/precheck on 3532e88: exit 0, 40/40 commands passed. Its timed lines:

  PASS 15.05s bash scripts/install-actionlint-native-alerts.sh actionlint
  PASS 0.94s actionlint -no-color -oneline .github/workflows/*.yml
  PASS 0.30s python3 scripts/lint_callables.py
  PASS 0.71s python3 scripts/test_actionlint_native_permissions.py
  PASS 20.62s python3 scripts/test_apple_gate.py
  PASS 1.35s python3 scripts/test_artifact_budget.py
  PASS 0.90s python3 scripts/test_cache_paths.py
  PASS 6.11s python3 scripts/test_ci_admission.py
  PASS 7.13s python3 scripts/test_ci_artifact_store.py
  PASS 6.62s python3 scripts/test_dependency_audit.py
  PASS 1.40s python3 scripts/test_design_ledger.py
  PASS 0.26s python3 scripts/test_design_publish.py
  PASS 2.36s python3 scripts/test_e2e_build_artifact.py
  PASS 5.40s python3 scripts/test_e2e_mode.py
  PASS 7.66s python3 scripts/test_e2e_pr_subset.py
  PASS 1.12s python3 scripts/test_e2e_quarantine.py
  PASS 27.00s python3 scripts/test_e2e_reuse.py
  PASS 40.85s python3 scripts/test_e2e_skip_paths.py
  PASS 1.82s python3 scripts/test_eslint_cache.py
  PASS 1.11s python3 scripts/test_exact_candidate.py
  PASS 0.80s python3 scripts/test_extra_env.py
  PASS 54.75s python3 scripts/test_fast_path.py
  PASS 1.30s python3 scripts/test_flake_digest.py
  PASS 6.73s python3 scripts/test_foundation_check.py
  PASS 9.64s python3 scripts/test_package_auth_cleanup.py
  PASS 1.74s python3 scripts/test_package_batch_metadata.py
  PASS 1.72s python3 scripts/test_permission_ceiling.py
  PASS 3.05s python3 scripts/test_playwright_toolchain.py
  PASS 13.50s python3 scripts/test_preview_gate.py
  PASS 1.57s python3 scripts/test_production_upload.py
  PASS 0.09s python3 scripts/test_python_static_gate.py
  PASS 1.32s python3 scripts/test_quality_gates.py
  PASS 2.70s python3 scripts/test_red_main_listener.py
  PASS 0.09s python3 scripts/test_required_gate.py
  PASS 0.72s python3 scripts/test_reusable_browser_tests.py
  PASS 8.57s python3 scripts/test_runner_default.py
  PASS 17.48s python3 scripts/test_script_gates.py
  PASS 1.36s python3 scripts/test_store_placement.py
  PASS 24.88s python3 scripts/test_taskgraph.py
  PASS 0.22s python3 scripts/test_tee_pipefail.py

Refs fleet#1180

🤖 Generated with Claude Code