molecule-ai-workspace-runtime/.github/workflows/ci.yml
security-auditor d7ea277ce4
Some checks failed
Secret scan / secret-scan (pull_request) Failing after 0s
ci / mirror-guard (pull_request) Failing after 3s
fix(ci): lowercase 'molecule-ai/' in cross-repo workflow refs
Gitea is case-sensitive on owner slugs; canonical is lowercase
`molecule-ai/...`. Mixed-case `Molecule-AI/...` refs fail-at-0s
when the runner tries to resolve the cross-repo workflow / checkout.

Same fix as molecule-controlplane#12. Mechanical case-correction;
no behavior change beyond making CI resolve again.

Refs: internal#46

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
2026-05-07 01:00:01 -07:00

44 lines
1.7 KiB
YAML

name: ci
# Mirror-guard CI. This repo is a publish artifact of the monorepo
# `molecule-ai/molecule-core/workspace/` directory — see README.
#
# Direct commits + PRs to this repo are no longer accepted; the
# canonical edit point is the monorepo. This workflow exists only
# to enforce that, by failing CI on any push that wasn't produced
# by the publish-runtime sync (a future automated push from the
# monorepo's tag-driven publish workflow).
#
# Until that auto-sync is wired up, we whitelist the historical
# pusher identities so existing in-flight PRs don't all turn red.
# Whitelist removal becomes a follow-up once the auto-sync lands.
on:
push:
branches: [main, staging]
pull_request:
permissions:
contents: read
jobs:
mirror-guard:
runs-on: ubuntu-latest
steps:
- uses: actions/checkout@v4
- name: Reject direct edits
env:
PR_AUTHOR: ${{ github.event.pull_request.user.login || github.actor }}
run: |
# Allow the future bot author once it exists. Until then,
# block on PR events but allow push events (for in-flight
# work to land while the migration finishes).
if [ "${{ github.event_name }}" = "pull_request" ]; then
echo "::error::This repo is a publish artifact of molecule-ai/molecule-core."
echo "::error::Edit workspace/ in the monorepo and let the publish-runtime"
echo "::error::workflow regenerate this mirror — do not PR here directly."
echo "::error::See README.md for the new contribution flow."
exit 1
fi
echo "Push event from $PR_AUTHOR — allowing while migration completes."