hongming-ceo-delegated
bcc06d4a3d
Declare this repo to the SSOT capability→bundle CI router and add the ADVISORY meta-ci workflow. layer=plugin caps=[skills, settings-fragment] The workflow is inline (anon-clones molecule-ci, runs the canonical router), continue-on-error, and posts NO commit status — it CANNOT block a merge and is NOT added to branch protection. Proof-of-adoption for the org-wide RFC; enforcing mode is a later owner-gated phase. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
65 lines
3.1 KiB
YAML
65 lines
3.1 KiB
YAML
# CANONICAL inline meta-ci (ADVISORY) consumer workflow — molecule-ai/molecule-ci SSOT.
|
|
#
|
|
# This is the file a repo copies to opt into the capability→bundle router
|
|
# (task internal#57, RFC: org CI-enforcement) in its Phase-1 ADVISORY form. Drop
|
|
# it in as `.gitea/workflows/meta-ci-advisory.yml` and commit a `repo-meta.yaml`
|
|
# at the repo root; nothing else changes (no branch-protection edit, no
|
|
# required-context add).
|
|
#
|
|
# WHY INLINE (not `uses: molecule-ai/molecule-ci/.gitea/workflows/meta-ci.yml`):
|
|
# cross-repo `workflow_call` is NOT a trustworthy gate on Gitea Actions 1.26.4 —
|
|
# a consumer job can be recorded green WITHOUT running the referenced steps
|
|
# (internal#1000). This template instead anon-clones the public molecule-ci SSOT
|
|
# at CI time and runs the canonical `scripts/meta-ci.py` directly. Same single
|
|
# source of truth (the router lives in molecule-ci, fetched fresh every run), no
|
|
# cross-repo `uses:` dependency.
|
|
#
|
|
# WHY IT CANNOT BLOCK A MERGE (advisory contract):
|
|
# the router step is `continue-on-error: true` and this workflow posts NO commit
|
|
# status. The job's own auto-status is therefore always green, so on a `["*"]`
|
|
# branch protection it adds no red-capable context (R1 verified that on 1.26.4 any
|
|
# NON-green emitted context — or an absent explicitly-required one — blocks; a
|
|
# perpetually-green advisory context never does). The real PASS/FAIL of the router
|
|
# is in this job's LOG, not its status colour.
|
|
#
|
|
# PHASE 3 PROMOTION (owner-gated, later — NOT part of adopting this template):
|
|
# to make meta-ci enforcing, switch to calling the reusable with `advisory: false`
|
|
# (which posts a real-state `meta-ci / required` context and fails the job on red),
|
|
# once cross-repo execution is proven or this inline form is given a status POST +
|
|
# `exit`. Do NOT do that here.
|
|
|
|
name: meta-ci-advisory
|
|
|
|
on:
|
|
pull_request:
|
|
push:
|
|
branches: [main, staging]
|
|
workflow_dispatch: {}
|
|
|
|
permissions:
|
|
contents: read
|
|
|
|
jobs:
|
|
meta:
|
|
name: meta (advisory)
|
|
runs-on: ubuntu-latest
|
|
timeout-minutes: 10
|
|
# ADVISORY: never block a merge while the router beds in. The router SCRIPT
|
|
# exits nonzero on an invalid repo-meta / failed bundle; this flag only
|
|
# governs whether THIS job's red blocks the PR (it does not).
|
|
continue-on-error: true
|
|
steps:
|
|
- uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v4
|
|
# Anon-clone the molecule-ci SSOT; run the CANONICAL scripts/meta-ci.py
|
|
# (schemas/ is its sibling there, so schema validation is intact). Direct
|
|
# git-clone for the cross-repo fetch — see molecule-ci validate-plugin.yml
|
|
# for the Gitea 1.26.4 auth reason.
|
|
- name: Fetch molecule-ci canonical router
|
|
run: git clone --depth 1 https://git.moleculesai.app/molecule-ai/molecule-ci.git .molecule-ci-canonical
|
|
- uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065 # v5
|
|
with:
|
|
python-version: "3.11"
|
|
- run: pip install --break-system-packages pyyaml jsonschema -q
|
|
- name: Run meta-ci router (advisory)
|
|
run: python3 .molecule-ci-canonical/scripts/meta-ci.py --repo-root .
|