hongming-ceo-delegated
145 lines
6.6 KiB
YAML
145 lines
6.6 KiB
YAML
name: CI
|
|
|
|
# Ported from .github/workflows/ci.yml on 2026-05-11 per internal#326.
|
|
#
|
|
# Historical root cause of the main-red CI on this repo:
|
|
# The .github/ original used
|
|
# uses: molecule-ai/molecule-ci/.github/workflows/validate-org-template.yml@main
|
|
# which the Gitea version deployed at the time rejected (the runner's
|
|
# DEFAULT_ACTIONS_URL targeted GitHub, producing a 404 against
|
|
# the remote repo even though it lives on the same Gitea instance).
|
|
# Gitea reads .github/ as a fallback when .gitea/ is absent
|
|
# (reference_per_repo_gitea_vs_github_actions_dir), so the .github/
|
|
# workflow was firing on Gitea and failing in 1s.
|
|
#
|
|
# Current Gitea accepts the reusable-workflow syntax, but cross-repository
|
|
# `workflow_call` consumers can still finish green with zero executed steps
|
|
# (tracked in molecule-ai/internal#1000). Keep this executable inline job until
|
|
# that issue is resolved. The canonical
|
|
# validator in molecule-ai/molecule-ci already self-clones into the
|
|
# runner via a direct HTTPS `git clone` step (validate-org-template.yml
|
|
# does this verbatim) — so the inline port is just "do that clone +
|
|
# invoke the validator script in-place", preserving the
|
|
# single-source-of-truth property.
|
|
#
|
|
# Four-surface migration audit (feedback_gitea_actions_migration_audit_pattern):
|
|
# 1. YAML — no `workflow_dispatch.inputs`; no `merge_group`; preserved
|
|
# `on: [push, pull_request]` from the original. Added workflow-level
|
|
# env.GITHUB_SERVER_URL (feedback_act_runner_github_server_url).
|
|
# 2. Cache — `actions/setup-python` `cache: pip` preserved.
|
|
# 3. Token — uses auto-injected GITHUB_TOKEN; validator needs only
|
|
# `contents: read` (no write).
|
|
# 4. Docs — anonymous git-clone of molecule-ci.
|
|
#
|
|
# Cross-links:
|
|
# - internal#326 — parent tracking issue
|
|
# - molecule-ai/molecule-ci/.github/workflows/validate-org-template.yml — pattern source
|
|
|
|
on: [push, pull_request]
|
|
|
|
env:
|
|
# Belt-and-suspenders against the runner-default trap
|
|
# (feedback_act_runner_github_server_url).
|
|
GITHUB_SERVER_URL: https://git.moleculesai.app
|
|
|
|
permissions:
|
|
contents: read
|
|
|
|
jobs:
|
|
validate:
|
|
name: Org template validation
|
|
runs-on: ubuntu-latest
|
|
timeout-minutes: 10
|
|
steps:
|
|
- uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
|
|
- name: Verify current install guidance
|
|
run: |
|
|
python3 - <<'PYEOF'
|
|
import re
|
|
from pathlib import Path
|
|
|
|
marker = "UNREGISTERED / UNVALIDATED SOURCE MATERIAL"
|
|
readme = Path("README.md").read_text(encoding="utf-8")
|
|
org = Path("org.yaml").read_text(encoding="utf-8")
|
|
prompts = sorted(Path(".").glob("*/system-prompt.md"))
|
|
|
|
assert marker in readme[:600], "README must lead with the unregistered marker"
|
|
assert "not present in the current control-plane template catalog" in readme
|
|
assert marker in org[:600], "org.yaml must lead with the unregistered marker"
|
|
assert not re.search(r"^required_env:", org, re.MULTILINE), (
|
|
"unregistered source material must not impose a template-wide runtime credential gate"
|
|
)
|
|
assert "ANTHROPIC_API_KEY" not in org
|
|
assert "CLAUDE_CODE_OAUTH_TOKEN" not in org
|
|
assert prompts, "expected role prompt surfaces"
|
|
for prompt in prompts:
|
|
text = prompt.read_text(encoding="utf-8")
|
|
assert marker in text[:600], f"{prompt} must lead with the unregistered marker"
|
|
|
|
assert not re.search(r"^## Import$|github://Molecule-AI", readme, re.MULTILINE), (
|
|
"README reintroduced unsupported install guidance"
|
|
)
|
|
print(f"validated unregistered marker across README, org.yaml, and {len(prompts)} prompts")
|
|
PYEOF
|
|
# Canonical validator script lives in molecule-ci, fetched fresh
|
|
# on every run. Anonymous fetch of the public molecule-ci repo —
|
|
# no token needed; no actions/checkout cross-repo idiosyncrasies.
|
|
- name: Fetch molecule-ci canonical scripts
|
|
run: git clone --depth 1 https://git.moleculesai.app/molecule-ai/molecule-ci.git .molecule-ci-canonical
|
|
- uses: actions/setup-python@v5
|
|
with:
|
|
python-version: "3.11"
|
|
cache: "pip"
|
|
cache-dependency-path: .molecule-ci-canonical/.molecule-ci/scripts/requirements.txt
|
|
- run: pip install pyyaml jsonschema -q
|
|
- run: python3 .molecule-ci-canonical/.molecule-ci/scripts/validate-org-template.py
|
|
- name: Check for secrets
|
|
run: |
|
|
python3 - << 'PYEOF'
|
|
import os, re, sys
|
|
from pathlib import Path
|
|
|
|
PATTERNS = [
|
|
re.compile(r'''["']sk-ant-[a-zA-Z0-9]{50,}["']'''),
|
|
re.compile(r'''["']ghp_[a-zA-Z0-9]{36,}["']'''),
|
|
re.compile(r'''["']AKIA[A-Z0-9]{16}["']'''),
|
|
re.compile(r'''["'][a-zA-Z0-9/+=]{40}["']'''),
|
|
re.compile(r'''["']sk_test_[a-zA-Z0-9]{24,}["']'''),
|
|
re.compile(r'''["']Bearer\s+[a-zA-Z0-9_.-]{20,}["']'''),
|
|
re.compile(r'''ghp_[a-zA-Z0-9]{36,}'''),
|
|
re.compile(r'''sk-ant-[a-zA-Z0-9]{50,}'''),
|
|
]
|
|
SKIP_DIRS = {'.molecule-ci', '.molecule-ci-canonical', '.git', 'node_modules', '__pycache__'}
|
|
EXTENSIONS = {'.yaml', '.yml', '.md', '.py', '.sh'}
|
|
|
|
def is_false_positive(line):
|
|
ctx = line.lower()
|
|
return '...' in ctx or '<example' in ctx or '</example' in ctx
|
|
|
|
root = Path(os.environ.get('GITHUB_WORKSPACE', '.'))
|
|
warnings = []
|
|
for dirpath, dirnames, filenames in os.walk(root):
|
|
dirnames[:] = [d for d in dirnames if d not in SKIP_DIRS]
|
|
for filename in filenames:
|
|
if Path(filename).suffix not in EXTENSIONS:
|
|
continue
|
|
filepath = Path(dirpath) / filename
|
|
try:
|
|
with open(filepath, 'r', encoding='utf-8', errors='ignore') as f:
|
|
for lineno, line in enumerate(f.readlines(), 1):
|
|
for pattern in PATTERNS:
|
|
for match in pattern.finditer(line):
|
|
if not is_false_positive(line):
|
|
warnings.append(f" {filepath}:{lineno}: {match.group(0)[:40]}...")
|
|
except Exception:
|
|
pass
|
|
|
|
if warnings:
|
|
print("::error::Potential secret found in committed files:")
|
|
for w in warnings:
|
|
print(w)
|
|
sys.exit(1)
|
|
else:
|
|
print("::notice::No secrets detected")
|
|
PYEOF
|