fix(ci): make GitHub-hosted fallback actually build and test

[TheodoreSpeaks]

Summary

Follow-up to #5808. The first live CI_PROVIDER=github flip surfaced two real gaps — GitHub mode wasn't just slower, it couldn't finish.

• Missing rg — cloud-review-tools.test.ts runs the real helper script, which shells out to rg. Blacksmith's runner image ships ripgrep; GitHub's does not, so the test died with FileNotFoundError: 'rg'. Now installed explicitly in test-build.yml, guarded by command -v rg so it costs nothing where it's already present. Production was never affected: that script runs inside the E2B sandbox, whose template already aptInstalls ripgrep.
• App image OOM — next build was SIGKILLed (exit 137) building app.Dockerfile. The heap was already capped at 8192; the overflow is Turbopack's native allocation, which --max-old-space-size doesn't bound, plus Docker/BuildKit on a 16 GB runner. NEXT_BUILD_HEAP_MB now makes the ceiling configurable (default 8192, so Blacksmith is byte-for-byte unchanged) and the GitHub path trims it to 4096 to leave native headroom.

Also corrects the ci.yml header, which claimed GitHub mode meant "slower runs, not different results." That was wrong and is now documented with what actually failed.

Testing

• Verified the rg fix end-to-end: reproduced the exact CI failure locally (no real ripgrep binary on this machine — rg was only a shell function), then re-ran with a real rg on PATH → 9/9 passed.
• Verified the ${NEXT_BUILD_HEAP_MB:-8192} expansion under bun run: unset → 8192, set → 4096.
• actionlint clean; bun run lint:check 19/19.

The OOM fix is not verified. Confirming it needs a real CI_PROVIDER=github run that builds the app image, which only happens on a push to dev/staging/main — not on a PR. If 4096 turns out to be too tight, it fails loudly as "JavaScript heap out of memory" rather than a confusing SIGKILL, which is at least better diagnostics.

Type of Change

• Bug fix

Checklist

• Code follows project style guidelines
• Self-reviewed my changes
• Tests added/updated and passing
• No new warnings introduced
• I confirm that I have read and agree to the terms outlined in the Contributor License Agreement (CLA)

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
docs	Ready	Preview, Comment	Jul 21, 2026 11:12pm

[cursor]

PR Summary

Low Risk
Changes are limited to GitHub Actions workflows and comments; they affect break-glass runner selection and a test dependency install, not production app code.

Overview
Makes GitHub break-glass CI (CI_PROVIDER=github) able to finish tests and app image builds instead of failing on missing tooling or runner memory.

Tests: Adds an Install ripgrep step in test-build.yml before bun run test (command -v rg or apt-get install), so cloud-review-tools.test.ts can shell out to rg on GitHub-hosted images that don't ship it.

Image builds: When not on Blacksmith, docker matrix jobs no longer all use ubuntu-latest / ubuntu-24.04-arm. runs-on now uses per-image matrix.gh_runner: the app Dockerfile targets linux-x64-8-core (AMD64) and linux-arm64-8-core (ARM64); db/realtime/pii stay on the smaller free runners. ci.yml header comments are tightened and now call out that the app next build needs ~32 GB and OOMs (exit 137) on 16 GB runners.

Docs-only in composite actions: Shorter input descriptions and inline comments in cache-mount and docker-build; behavior unchanged.

^{Reviewed by Cursor Bugbot for commit 50bed00. Bugbot is set up for automated code reviews on this repo. Configure here.}

[greptile-apps]

Greptile Summary

This PR makes the GitHub-hosted CI fallback able to complete builds and tests. The main changes are:

• Installs ripgrep before running the test suite.
• Uses larger GitHub runners for app image builds.
• Removes caller-controlled Docker build arguments.
• Clarifies provider fallback and cache behavior.

Confidence Score: 5/5

This looks safe to merge.

• The caller override path has been removed.
• App image builds now use larger GitHub-hosted runners.
• No blocking issue remains from the previously reported build path.

Important Files Changed

Filename	Overview
.github/actions/cache-mount/action.yml	Clarifies cache input descriptions and fallback behavior without changing execution.
.github/actions/docker-build/action.yml	Removes the caller-controlled build-argument surface and keeps provider-specific build steps.
.github/workflows/ci.yml	Assigns larger GitHub runners to app image builds and standard runners to lighter images.
.github/workflows/test-build.yml	Installs ripgrep before tests that invoke it.

_{Reviews (4): Last reviewed commit: "fix(ci): build the app image on a larger..." | Re-trigger Greptile}

[TheodoreSpeaks]

@greptile

[TheodoreSpeaks]

@cursor review

[cursor]

✅ Bugbot reviewed your changes and found no new issues!

Comment @cursor review or bugbot run to trigger another review on this PR

^{Reviewed by Cursor Bugbot for commit 39ef8b2. Configure here.}

[TheodoreSpeaks]

@greptile

[TheodoreSpeaks]

@cursor review

[cursor]

✅ Bugbot reviewed your changes and found no new issues!

Comment @cursor review or bugbot run to trigger another review on this PR

^{Reviewed by Cursor Bugbot for commit 7867d86. Configure here.}

[TheodoreSpeaks]

@greptile

[TheodoreSpeaks]

@cursor review

[cursor]

✅ Bugbot reviewed your changes and found no new issues!

Comment @cursor review or bugbot run to trigger another review on this PR

^{Reviewed by Cursor Bugbot for commit 50bed00. Configure here.}