forked from molecule-ai/molecule-core
claude-ceo-assistant (Claude Opus 4.7 on Hongming's MacBook)
87b971a292
Three workflows have been failing on every push to this Gitea repo for GitHub-shaped reasons that don't translate to act_runner. Surfaced while landing #84; bundled per `feedback_gitea_actions_migration_audit_pattern` ("bundle per-repo, not per-finding") instead of three separate PRs. 1) handlers-postgres-integration: localhost → 127.0.0.1 - lib/pq tries to dial localhost → ::1 first; the postgres service container only listens on IPv4 → ECONNREFUSED → all TestIntegration_* fail. Pin IPv4 to make the job deterministic. 2) pr-guards / disable-auto-merge-on-push: Gitea no-op - The previous reusable-workflow caller invoked `gh pr merge --disable-auto`, which calls GitHub's GraphQL API. Gitea returns HTTP 405 on /api/graphql → step always fails. Inline the step so it can detect Gitea (GITEA_ACTIONS=true OR repo url under moleculesai.app) and no-op with a notice. Auto-merge gating is moot on Gitea anyway: there's no `--auto` primitive being touched. Job stays ALWAYS-RUN so branch protection's required check still lands SUCCESS (avoids the SKIPPED-in-set trap from `feedback_branch_protection_check_name_parity`). 3) Harness Replays: cf-proxy nginx.conf via docker `configs:` (not bind) - act_runner runs the workflow inside a runner container; runc in the docker daemon below resolves bind-mount source paths on the OUTER host, not inside the runner. The path `/workspace/.../cf-proxy/nginx.conf` is invisible there → "not a directory" runc error. Switching to compose `configs:` packages the file as content rather than a host bind, sidestepping the DinD path-translation gap. Local validation: - YAML parsed clean for all 3 files. - cf-proxy nginx.conf: standalone `docker compose run cf-proxy nginx -T` reproduced the configs: mount end-to-end and dumped the config correctly. The full harness compose still renders via `docker compose config`. Real-CI verification will land on this branch's first push. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
64 lines
2.9 KiB
YAML
64 lines
2.9 KiB
YAML
name: pr-guards
|
|
|
|
# PR-time guards. Today the only guard is "disable auto-merge when a
|
|
# new commit is pushed after auto-merge was enabled" — added 2026-04-27
|
|
# after PR #2174 auto-merged with only its first commit because the
|
|
# second commit was pushed after the merge queue had locked the PR's
|
|
# SHA.
|
|
#
|
|
# Why this is inlined (not delegated to molecule-ci's reusable
|
|
# workflow): the reusable workflow uses `gh pr merge --disable-auto`,
|
|
# which calls GitHub's GraphQL API. Gitea has no GraphQL endpoint and
|
|
# returns HTTP 405 on /api/graphql, so the job failed on every Gitea
|
|
# PR push since the 2026-05-06 migration. Gitea also has no `--auto`
|
|
# merge primitive that this job could be acting on, so the right
|
|
# behaviour on Gitea is "no-op + green status" — not a 405.
|
|
#
|
|
# Inlining (vs. an `if:` on the `uses:` line) keeps the job ALWAYS
|
|
# running, which matters for branch protection: required-check names
|
|
# need a job that emits SUCCESS terminal state, not SKIPPED. See
|
|
# `feedback_branch_protection_check_name_parity` and `feedback_pr_merge_safety_guards`.
|
|
#
|
|
# Issue #88 item 1.
|
|
|
|
on:
|
|
pull_request:
|
|
types: [synchronize]
|
|
|
|
permissions:
|
|
pull-requests: write
|
|
|
|
jobs:
|
|
disable-auto-merge-on-push:
|
|
runs-on: ubuntu-latest
|
|
steps:
|
|
# Detect Gitea Actions. act_runner sets GITEA_ACTIONS=true in the
|
|
# step env on every job. Belt-and-suspenders: also check the repo
|
|
# url's host, which is independent of any runner-side env config
|
|
# (covers a future Gitea host where the env var is forgotten).
|
|
- name: Detect runner host
|
|
id: host
|
|
run: |
|
|
if [[ "${GITEA_ACTIONS:-}" == "true" ]] || [[ "${{ github.server_url }}" == *moleculesai.app* ]] || [[ "${{ github.event.repository.html_url }}" == *moleculesai.app* ]]; then
|
|
echo "is_gitea=true" >> "$GITHUB_OUTPUT"
|
|
echo "::notice::Gitea Actions detected — auto-merge gating is not applicable here (Gitea has no --auto merge primitive). Job will no-op."
|
|
else
|
|
echo "is_gitea=false" >> "$GITHUB_OUTPUT"
|
|
fi
|
|
|
|
- name: Disable auto-merge (GitHub only)
|
|
if: steps.host.outputs.is_gitea != 'true'
|
|
env:
|
|
GH_TOKEN: ${{ github.token }}
|
|
PR: ${{ github.event.pull_request.number }}
|
|
REPO: ${{ github.repository }}
|
|
NEW_SHA: ${{ github.sha }}
|
|
run: |
|
|
set -eu
|
|
gh pr merge "$PR" --disable-auto -R "$REPO" || true
|
|
gh pr comment "$PR" -R "$REPO" --body "🔒 Auto-merge disabled — new commit (\`${NEW_SHA:0:7}\`) pushed after auto-merge was enabled. The merge queue locks SHAs at entry, so subsequent pushes can race. Verify the new commit and re-enable with \`gh pr merge --auto\`."
|
|
|
|
- name: Gitea no-op
|
|
if: steps.host.outputs.is_gitea == 'true'
|
|
run: echo "Gitea Actions — auto-merge gating not applicable; no-op (job intentionally green so branch protection's required-check name lands SUCCESS)."
|