molecule-ai-workspace-template-claude-code/.gitea/workflows/sync-providers-yaml.yml

name: sync-providers-yaml

# Cross-repo canonical↔synced-copy drift gate (internal#718 P4 Path B,
# CTO 2026-05-27 "preserve federation contract; ship registry-projection
# artifact alongside hand-authored providers block").
#
# The canonical provider-registry SSOT is molecule-controlplane
# internal/providers/providers.yaml. This template repo has NO Go/Python
# import path back to controlplane, so instead of cross-repo dependency
# we carry a SYNCED COPY at internal/providers/providers.yaml and gate it.
#
# This workflow fetches the canonical providers.yaml from controlplane (via the
# Gitea /raw endpoint, read-only) and byte-compares it against the local synced
# copy. RED if they differ — meaning the canonical moved and this template's
# copy must be re-synced (`internal/providers/registry_projection.py generate
# <runtime>` regenerates the projection artifact alongside).
#
# AUTH: uses AUTO_SYNC_TOKEN (the existing cross-repo read token used to sync
# canonical content across repos). If the secret is absent the job emits a
# ::warning:: and exits 0 — the projection artifact's own subset+drift gate is
# the always-on backstop, so a missing cross-repo token degrades to
# "registry-canonical drift not caught here; subset gate still runs" rather
# than a hard red that blocks unrelated PRs.
#
# Why /raw not /contents: Gitea 1.22.6 ignores
# `Accept: application/vnd.gitea.raw` on /contents and returns a JSON+base64
# envelope, which would make this diff a permanent false RED. The /raw endpoint
# returns the file bytes directly (precedent: molecule-core
# .gitea/workflows/sync-providers-yaml.yml).

on:
  pull_request:
    types: [opened, synchronize, reopened]
    paths:
      - 'internal/providers/providers.yaml'
      - 'internal/providers/registry-projection.json'
      - 'internal/providers/registry_projection.py'
      - '.gitea/workflows/sync-providers-yaml.yml'
  push:
    branches: [main]
    paths:
      - 'internal/providers/providers.yaml'
      - 'internal/providers/registry-projection.json'
      - 'internal/providers/registry_projection.py'
      - '.gitea/workflows/sync-providers-yaml.yml'
  workflow_dispatch:

env:
  GITHUB_SERVER_URL: https://git.moleculesai.app

permissions:
  contents: read

concurrency:
  group: sync-providers-yaml-${{ github.ref }}
  cancel-in-progress: true

jobs:
  compare:
    name: Compare synced providers.yaml against controlplane canonical
    runs-on: ubuntu-latest
    timeout-minutes: 6
    steps:
      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2

      - name: Fetch canonical providers.yaml from controlplane and byte-compare
        env:
          AUTO_SYNC_TOKEN: ${{ secrets.AUTO_SYNC_TOKEN }}
          API_ROOT: ${{ github.server_url }}/api/v1
        run: |
          set -euo pipefail
          if [ -z "${AUTO_SYNC_TOKEN:-}" ]; then
            echo "::warning::AUTO_SYNC_TOKEN secret missing — skipping the live cross-repo compare."
            echo "The projection-artifact drift gate (verify-providers-projection.yml) still gates hand-edits of the synced copy via its own regen+diff."
            echo "Provision AUTO_SYNC_TOKEN (read scope on molecule-controlplane) to enable live canonical-drift detection."
            exit 0
          fi
          CANON_URL="${API_ROOT}/repos/molecule-ai/molecule-controlplane/raw/internal/providers/providers.yaml?ref=main"
          # /raw endpoint: returns the file bytes directly. /contents returns
          # a JSON+base64 envelope on Gitea 1.22.6 even with vnd.gitea.raw —
          # that quirk caused a permanent false RED on the molecule-core
          # precedent before the /raw switch.
          curl -fsS \
            -H "Authorization: token ${AUTO_SYNC_TOKEN}" \
            "${CANON_URL}" -o /tmp/canonical-providers.yaml
          LOCAL=internal/providers/providers.yaml
          if diff -u /tmp/canonical-providers.yaml "$LOCAL"; then
            echo "OK — the synced providers.yaml is byte-identical to the controlplane canonical."
          else
            echo "::error::The synced providers.yaml DRIFTED from the controlplane canonical (SSOT)."
            echo "Re-sync: copy controlplane internal/providers/providers.yaml verbatim over"
            echo "  $LOCAL, then run"
            echo "  python internal/providers/registry_projection.py generate <this-template-runtime>"
            echo "and commit the regenerated artifact."
            exit 1
          fi