feat(ci): send workspace_patch_cache_key when uploading a workspace patch

[ischolten]

Summary

The run request now carries the same cache key the CLI uses to upload a workspace patch, so the backend can pull the right blob before workflow compile.

What was happening

depot ci run could upload a local workspace patch to Depot Cache while the run request did not include a matching cache key. Without that alignment, patch-only paths (for example a reusable workflow that only exists in the patch) were not always visible when workflows were compiled or planned.

What happens now

When a patch is uploaded, the CLI sets workspace_patch_cache_key on the run request to match the upload key. The server can fetch and apply that patch before compile, so local-only workflow and action references resolve consistently.

Made with Cursor

---

Note

Medium Risk
Medium risk because it changes the CI API contract (RunRequest) and alters how depot ci run uploads/identifies workspace patches; mismatches could break patch-based runs if the backend/client versions diverge.

Overview
Propagates workspace patch cache metadata into CI runs. When depot ci run detects local changes, it now validates the patch, computes a stable patch/<mergeBasePrefix>/<contentHash> cache key, uploads the patch under that key, and reuses the same key when injecting the “apply patch” workflow step.

Adds API support to let the backend apply the same patch during workflow compile. RunRequest gains optional workspace_patch_cache_key, and the CLI sets it (alongside sha=mergeBase) so server-side compilation can fetch/apply the uploaded patch before resolving workflow/action references. Includes new unit tests covering patch validation, cache key formatting, and RunRequest context setting.

^{Reviewed by Cursor Bugbot for commit 170bca1. Bugbot is set up for automated code reviews on this repo. Configure here.}

[linear]

DEP-3975 cli: orchestrator should apply workspace patch before compile-time repo resolution