feat(actions): a failed run is no longer a dead end — re-run, and surface the AI healer #5560

Split out of #5559 — this commit was pushed eight minutes after that PR merged, so it missed the train. Its parent (83cd6f9) is already in main, so this is a clean single-commit diff.

The problem

The workflow run detail page had exactly one action — Cancel — and it renders only while a run is still in flight. So a failed run offered nothing at all: you could read the job logs, and that was the entire surface.

Verified against production rather than the source alone: the only <form> elements on the failed-run page were global search and the repo star button.

Re-run

Re-runs the same workflow at the same commit, not at the branch head.

That distinction is the whole point. Re-running a failure asks a question about that commit — was it flaky, or is it really broken? Quietly answering it about different code would make a green run mean nothing.

Refuses while a run is still queued or running: two runs racing on one commit isn't a re-run, and Cancel is the verb for that — it sits right beside it.

AI failure analysis

lib/ai-ci-healer.ts already root-causes failed runs and opens patch PRs on a five-minute autopilot tick, recording ai.ci.healed or ai.ci.gave_up against the run id.

None of it was surfaced anywhere. A failure that had been analysed and judged unfixable looked identical to one nothing had ever looked at — the platform was doing real work and showing no evidence of it, which is the same "advertises liveness, proves deadness" shape we've fixed elsewhere.

The page now reads the marker and says which happened, links the PR when there is one, and offers Analyse failure to run the same call on demand instead of waiting for a tick. healOneRun is internally idempotent (it no-ops when a marker exists), so a double submit cannot open two PRs.

It degrades honestly. With no ANTHROPIC_API_KEY the panel says so plainly and names re-run and the job logs as what you actually have, rather than rendering a button that would quietly do nothing.

Verification

• bun run typecheck clean
• Full CI green on this exact commit: 4827 pass, 0 fail, no error line
• Write-surface scanner passes — both new routes are requireAuth + owner-checked, so they classify as guarded with no allowlist entry needed

Coverage, stated plainly: the guard test covers their auth, but the handlers have no behavioural test. That surface needs a database and CI strips DATABASE_URL by design. Flagging it rather than shipping a weak test that looks like coverage.

Deliberately not built

• Re-run from the actions list page — same verb, one level up
• Re-run failed jobs only — needs per-job replay the runner doesn't currently support

🤖 Generated with Claude Code