molecule-ai-plugin-gh-identity/.gitea/workflows/ci.yml

name: CI

# Plugin contract-conformance gate (RFC internal#476 Phase 1).
#
# This repo's pre-existing go + shell jobs (real Go build/test/vet +
# shellcheck/wrapper tests) are PRESERVED verbatim — additive only, no
# weakening of any existing gate. RFC internal#476 P1 adds the canonical
# cross-class `validate` job so this plugin runs the same molecule-ci
# `validate-plugin.py` every other plugin does (it previously ran NONE —
# self-masking drift, RFC finding #3).
#
# `validate` uses the proven inline self-clone pattern (green on real CI
# for molecule-ai-org-template-molecule-dev / -workspace-template-claude-
# code), NOT the cross-repo `uses:` form which no-ops on Gitea 1.22.6
# (feedback_gitea_cross_repo_uses_blocked = fake-green). Canonical
# validator fetched fresh each run (no vendored .molecule-ci — vendoring
# is the drift). Job name `validate` -> context
# `CI / validate (pull_request)` matching the canonical plugin BP shape.
#
# KNOWN TRUE-POSITIVE: validate-plugin.py requires one of
# SKILL.md/hooks/skills/rules. gh-identity is a Go env-mutator plugin
# (kind: env-mutator) whose content is Go + an embedded wrapper.sh — it
# has none of those claude-skill-class markers. The job will FAIL on
# that check until RFC internal#476 resolves the validator-semantics gap
# for Go-class plugins (recognize `kind: env-mutator` / a Go content
# marker). Per RFC#476 P1 "wiring only, no validator rewrites" this is
# surfaced, NOT papered over with a fabricated hooks/ dir, and the
# `CI / validate` context is deliberately NOT yet made BP-required for
# this repo (would force-break a legitimate plugin). The go + shell
# jobs remain the enforced required contexts here.
#
# Cross-links:
#   - RFC internal#476 — consolidated cross-class base-contract gate family
#   - molecule-ai/molecule-ci/scripts/validate-plugin.py — canonical validator

on:
  push:
    branches: [main]
  pull_request:

env:
  GITHUB_SERVER_URL: https://git.moleculesai.app

jobs:
  go:
    name: Go build + test + vet
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - uses: actions/setup-go@v5
        with: { go-version: "1.25" }
      - run: go mod tidy && git diff --exit-code go.mod go.sum
      - run: go build ./...
      - run: go vet ./...
      - run: go test -race ./...

  shell:
    name: Shellcheck + wrapper tests
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - name: Install shellcheck
        run: sudo apt-get update -qq && sudo apt-get install -y -qq shellcheck
      - name: Shellcheck
        run: shellcheck internal/ghidentity/wrapper.sh scripts/test-wrapper.sh
      - name: Run wrapper tests
        run: bash scripts/test-wrapper.sh

  validate:
    name: validate
    runs-on: ubuntu-latest
    timeout-minutes: 10
    permissions:
      contents: read
    steps:
      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
      # Canonical validator script lives in molecule-ci, fetched fresh
      # on every run. Anonymous fetch of the public molecule-ci repo.
      - name: Fetch molecule-ci canonical scripts
        run: git clone --depth 1 https://git.moleculesai.app/molecule-ai/molecule-ci.git .molecule-ci-canonical
      - uses: actions/setup-python@v5
        with:
          python-version: "3.11"
          cache: "pip"
          cache-dependency-path: .molecule-ci-canonical/.molecule-ci/scripts/requirements.txt
      - run: pip install pyyaml -q
      - run: python3 .molecule-ci-canonical/.molecule-ci/scripts/validate-plugin.py
      - name: Check for secrets
        run: |
          python3 - << 'PYEOF'
          import os, re, sys
          from pathlib import Path

          PATTERNS = [
              re.compile(r'''["']sk-ant-[a-zA-Z0-9]{50,}["']'''),
              re.compile(r'''["']ghp_[a-zA-Z0-9]{36,}["']'''),
              re.compile(r'''["']AKIA[A-Z0-9]{16}["']'''),
              re.compile(r'''["'][a-zA-Z0-9/+=]{40}["']'''),
              re.compile(r'''["']sk_test_[a-zA-Z0-9]{24,}["']'''),
              re.compile(r'''["']Bearer\s+[a-zA-Z0-9_.-]{20,}["']'''),
              re.compile(r'''ghp_[a-zA-Z0-9]{36,}'''),
              re.compile(r'''sk-ant-[a-zA-Z0-9]{50,}'''),
          ]
          SKIP_DIRS = {'.molecule-ci', '.molecule-ci-canonical', '.git', 'node_modules', '__pycache__'}
          EXTENSIONS = {'.yaml', '.yml', '.md', '.py', '.sh'}

          def is_false_positive(line):
              ctx = line.lower()
              return '...' in ctx or '<example' in ctx or '</example' in ctx

          root = Path(os.environ.get('GITHUB_WORKSPACE', '.'))
          warnings = []
          for dirpath, dirnames, filenames in os.walk(root):
              dirnames[:] = [d for d in dirnames if d not in SKIP_DIRS]
              for filename in filenames:
                  if Path(filename).suffix not in EXTENSIONS:
                      continue
                  filepath = Path(dirpath) / filename
                  try:
                      with open(filepath, 'r', encoding='utf-8', errors='ignore') as f:
                          for lineno, line in enumerate(f.readlines(), 1):
                              for pattern in PATTERNS:
                                  for match in pattern.finditer(line):
                                      if not is_false_positive(line):
                                          warnings.append(f"  {filepath}:{lineno}: {match.group(0)[:40]}...")
                  except Exception:
                      pass

          if warnings:
              print("::error::Potential secret found in committed files:")
              for w in warnings:
                  print(w)
              sys.exit(1)
          else:
              print("::notice::No secrets detected")
          PYEOF