Merge pull request 'ci: rename .github/workflows -> .gitea/workflows (post-suspension sweep)' (#8) from ci-rename-github-to-gitea into main

GitHub org Molecule-AI was suspended 2026-05-06; SCM moved to Gitea
(git.moleculesai.app). The wholesale `git push --mirror` migration left
workflow files under .github/workflows/, which Gitea Actions does NOT
read - it reads .gitea/workflows/ exclusively.

This rename + the cross-repo `uses:` path rewrite are the minimum
edits to make CI fire on this repo again. The workflow content itself
is not modified (other than the path rewrites and lowercasing of the
old `Molecule-AI` org reference to the post-suspension `molecule-ai`).

Refs: feedback_post_suspension_migration_must_sweep_dormant_repos

.gitea/workflows/ci.yml

@@ -0,0 +1,5 @@
+name: CI
+on: [push, pull_request]
+jobs:
+  validate:
+    uses: molecule-ai/molecule-ci/.gitea/workflows/validate-plugin.yml@main

.github/workflows/ci.yml

@@ -1,5 +0,0 @@
-name: CI
-on: [push, pull_request]
-jobs:
-  validate:
-    uses: molecule-ai/molecule-ci/.github/workflows/validate-plugin.yml@main

.gitignore

@@ -19,3 +19,20 @@
 # Workspace auth tokens
 .auth-token
 .auth_token
+
+# Python bytecode (append only — do not remove entries above)
+__pycache__/
+*.pyc
+.pytest_cache/
+# Python bytecode (append only — do not remove entries above)
+__pycache__/
+*.pyc
+*.py[cod]
+*$py.class
+.Python
+*.egg-info/
+*.egg
+.pytest_cache/
+build/
+dist/
+.eggs/

plugin.yaml

@@ -1,5 +1,5 @@
 name: molecule-careful-bash
-version: 1.0.0
+version: 1.0.1
 description: Refuse destructive bash commands (git push --force to main, rm -rf at root, DROP TABLE prod). PreToolUse:Bash hook.
 author: Molecule AI
 tags: [molecule, guardrails]

tests/README.md

@@ -0,0 +1,27 @@
+# Test Coverage — molecule-careful-bash
+
+## What We Test
+
+This plugin has **executable hooks** (Python), so it warrants real unit tests.
+
+| File | Tests | Coverage |
+|------|-------|---------|
+| `hooks/pre-bash-careful.py` | 35 pytest tests | Destructive command blocking, token exfiltration prevention |
+
+## Test Categories
+
+| Class | Count | What |
+|-------|-------|------|
+| `TestRefuseForcePush` | 5 | `git push --force` to main/master blocked; feature branches allowed |
+| `TestRefuseGitResetHard` | 3 | `git reset --hard` on main blocked; feature branches allowed |
+| `TestRefuseSQLDestructive` | 4 | `DROP TABLE/DATABASE prod` blocked; test/sandbox allowed |
+| `TestRefuseRmRf` | 5 | `rm -rf /`, home, `.git` blocked; safe paths allowed |
+| `TestTokenExfiltrationBlocking` | 13 | Token file reads, `env \| grep` secrets, credential path exfil blocked |
+| `TestWarnList` | 2 | Warning-only patterns: `--force-with-lease`, `close` PR |
+| Safe-prompt passthrough | 3 | Legitimate commands (normal push, grep for non-secret, non-token files) pass through |
+
+## Running Tests
+
+```bash
+python -m pytest tests/ -v
+```