ci: rebuild the nightly when majestic-webui's dist asset changes

[widgetii]

Problem

The preflight gate skips a scheduled build when this repo's HEAD already matches the published nightly:

if [ "$event_name" = "schedule" ] && [ "$PREV" = "$HEAD" ]; then should_build=false

That assumes firmware HEAD alone determines what an image contains. It doesn't for majestic-webui, which is consumed as a rolling dist release asset — a WebUI fix changes the image without moving HEAD here.

The result is a silent hole: on a quiet firmware tree the nightly skips night after night and the WebUI fix never reaches a build. This is live right now — OpenIPC/majestic-webui#129 fixed two bugs from #2235, the dist asset refreshed 26s after merge, and tonight's nightly would still have skipped because HEAD hasn't moved since 0010f73.

Change

Compare the dist asset's content digest alongside HEAD, and record it in the nightly notes as webui= for the next run to diff against.

The digest is content-addressed (sha256:…), so re-uploading identical bytes doesn't force a pointless rebuild — only a genuine content change does.

Both unknown-value paths fall through to building rather than skipping blind:

• a failed lookup leaves the digest empty, and the -n "$WEBUI" guard means an empty value never matches;
• publish omits the webui= line entirely rather than writing an empty one that a later empty lookup would spuriously match.

The first run after this merges will build once (no webui= in the current notes), then settle.

Testing

The gate body was extracted from the workflow and executed under bash -e against the real GitHub API for the digest:

case	result
schedule, same sha, same digest	should_build=false
schedule, same sha, stale digest	should_build=true
schedule, same sha, no webui= (first run)	should_build=true
schedule, different sha	should_build=true
workflow_dispatch, everything same	should_build=true
digest lookup fails (API down)	should_build=true, step survives set -e

Publish-side NOTES construction was also run under bash -e with and without a digest: the webui= line appears when set and is omitted when empty, with no set -e failure. YAML parses and preflight.outputs gains webui_digest.

Scope

This covers majestic-webui only. Around twenty other packages track a moving ref (majestic itself, mspod, motors, yaml-cli, rubyfpv, …) and remain invisible to the gate — the same staleness the "Refresh moving-ref package downloads" step was added to fight, one layer up. Worth a follow-up; deliberately not bundled here.

🤖 Generated with Claude Code