molecule-ai-sdk/.gitea/workflows/dispatch-core-sdk-pin-bump.yml

# Trigger molecule-core's SDK consumer-pin bump whenever this repo's main moves.
#
# THE PIPELINE, AND THE LEG THAT WAS MISSING
# molecule-core carries the OPENER (`sdk-pin-bump.yml` — go get, regenerate
# internal/providers/gen/registry_gen.go, move canonicalRegistrySHA256, test,
# open a PR) and the DETECTOR (`sdk-pin-drift.yml`). The opener is
# `workflow_dispatch:`-only and its header says it is dispatched "by a human, or
# by the SDK side on merge to main" — but no workflow in this repository ever
# dispatched it. So the standing requirement that the SDK pin "always bump with
# our CI pipeline instead of manual" was only half met: the lane existed and
# nothing pulled the lever. Five consecutive bumps were hand-authored, the last
# of them three minutes after PR #210 merged and 3.5 hours after the lane was
# armed, and each hand bump moved only go.mod/go.sum — skipping the regeneration
# and the checkpoint move the lane performs. This file is that missing leg.
#
# NO PATHS FILTER — deliberately.
# The consumer pin is a Go pseudo-version, `v0.0.0-<ts>-<sha12>`: it names a
# COMMIT, not a subset of this repo's content. molecule-core's detector compares
# the pinned sha against this repo's main HEAD and measures lag from the oldest
# unadopted commit, with no path awareness at all. So a docs-only commit on main
# makes the pin lag by the detector's own definition. Path-filtering the
# dispatch would mean no bump PR is opened for such a commit, and 72h later the
# detector classifies the pin STUCK and goes BLOCKING on every molecule-core PR
# (its branch protection is contexts ["*"]). A filter here would manufacture
# exactly the red that the detector reserves for "a human must act". If the
# dispatch is ever narrowed, the detector's staleness definition must be
# narrowed in the same commit.
#
# BURSTS COLLAPSE, AND THAT IS SAFE.
# `cancel-in-progress: true` means a rapid series of merges results in one
# dispatch rather than N. That is safe because the receiving lane takes NO
# inputs — it resolves molecule-ai-sdk@main itself at run time — so whichever
# dispatch survives targets the true head. Redundant dispatches would also be
# harmless (the lane's ALREADY CURRENT / ALREADY PROPOSED exits are green
# no-ops), but collapsing avoids queueing several multi-minute go-get+generate
# runs behind molecule-core's own `concurrency: sdk-pin-bump,
# cancel-in-progress: false`.
#
# PUSH-TO-MAIN ONLY — no workflow_dispatch, no pull_request arm.
# Same rule as notify-molecule-ci-schema-sync.yml: Gitea executes the workflow
# definition from the ref it runs on, so giving a SECRET-BEARING workflow a
# manual or PR trigger would let an unprotected branch rewrite the code that
# receives the credential. main is protected; nothing else here is.
#
# IT FAILS CLOSED.
# With the credential absent the script exits 1 before any network call — it does
# not warn and continue. The receiving lane's original defect was precisely a
# green-skip on a missing credential (run 620174: green in 19s, bump done by hand
# four minutes later), and reintroducing that shape in the trigger would recreate
# the same invisible failure one repo upstream. A green run of this job also
# cannot mean "dispatched nothing": the script asks the dispatch endpoint for
# `return_run_details` and treats a response without a workflow_run_id as an
# error, so success always carries a molecule-core run id.
#
# CREDENTIAL: repo-scoped Actions secret SDK_PIN_BUMP_DISPATCH_TOKEN on this
# repository (not org-scoped — exactly one lane in one repo uses it). It is a
# Gitea PAT named `sdk-pin-bump-dispatch-from-sdk` owned by molecule-sdk-pin-bot,
# whose ENTIRE write surface is molecule-ai/molecule-core and which is absent
# from the reviewer set, so it cannot approve the PRs it causes to be opened.
# write:repository is the minimum Gitea grants for this endpoint — a
# read:repository token is rejected with "required=[write:repository]" — and PAT
# scopes are category-wide, so narrowing the identity is the only way to narrow
# the credential. Runbook: molecule-core docs/runbooks/sdk-pin-bump-credential.md.

name: Dispatch molecule-core sdk-pin-bump

on:
  push:
    branches: [main]

permissions:
  contents: read

concurrency:
  group: dispatch-core-sdk-pin-bump
  cancel-in-progress: true

jobs:
  dispatch:
    name: Dispatch molecule-core sdk-pin-bump
    runs-on: ubuntu-latest
    timeout-minutes: 5
    steps:
      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
        with:
          persist-credentials: false

      - name: Dispatch the consumer pin bump
        env:
          SDK_PIN_BUMP_DISPATCH_TOKEN: ${{ secrets.SDK_PIN_BUMP_DISPATCH_TOKEN }}
        run: python3 -I tools/dispatch_core_sdk_pin_bump.py