hongming
f5fe7d975a
Per the codegen-deferred follow-up (internal#718 issue-comment 52157)
the CTO selected Path B: ship a registry-projection artifact alongside
the hand-authored providers/models block, with a subset-relation gate,
WITHOUT retiring or codegen'ing the hand-authored block. This preserves
the federation contract.
Added (all additive; zero runtime behavior change):
* .gitea/workflows/sync-providers-yaml.yml
Mirrors molecule-core's cross-repo canonical-sync gate. Fetches
controlplane internal/providers/providers.yaml via /raw (Gitea
1.22.6 quirk; /contents returns JSON+base64 envelope) and byte-
compares against the local synced copy.
* internal/providers/providers.yaml
Synced copy of the canonical registry. NOT hand-edited; the sync
workflow keeps it in step with controlplane main.
* internal/providers/registry_projection.py
Generator + verifier. Reads the synced providers.yaml, extracts
the registry's view of THIS template's runtime, and emits the
projection artifact. Also runs the SUBSET assertion: every
(provider, model) the registry claims this runtime serves must
be servable by the template's hand-authored authoritative source
(top-level `providers:` block for claude-code/hermes/codex;
`runtime_config.models[]` for openclaw; top-level `models[]` for
langgraph). Federation fail-open for runtimes absent from the
registry (langgraph today).
* internal/providers/registry-projection.json
Checked-in projection artifact for this template's runtime.
Auto-regenerated; the verify gate fails RED on drift.
* internal/providers/README.md
Documents the informational status + the subset contract.
* .gitea/workflows/verify-providers-projection.yml
Regenerates the artifact in CI and asserts (1) byte-identity
against the checked-in copy and (2) registry ⊆ template
hand-authored block.
* tests/test_registry_projection.py
TDD coverage: positive (current state is a subset or xfailed
with the known violation list), negative (injected fake
(provider, model) pair MUST be rejected — gate has teeth).
The hand-authored block stays AUTHORITATIVE. This gate only stops the
registry from claiming the template serves something it doesn't.
Not regressed (verified):
* cp#362 — untouched, no controlplane code edited
* P1 ResolveUpstream — untouched, no proxy code edited
* P2-B billing — untouched, no billing code edited
* P3 — untouched, no canvas/templates-from-registry code edited
* P4 PR-2 (422 hard-reject) — untouched, no workspace-server validation edited
* P4 closure follow-up (LLM_PROVIDER removed) — untouched, no LLM_PROVIDER read/write
* Template runtime behavior — untouched, no adapter / config.yaml `providers:`
/ `runtime_config` / `models[]` edited
internal#718 cross-link.
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
101 lines
4.6 KiB
YAML
101 lines
4.6 KiB
YAML
name: sync-providers-yaml
|
|
|
|
# Cross-repo canonical↔synced-copy drift gate (internal#718 P4 Path B,
|
|
# CTO 2026-05-27 "preserve federation contract; ship registry-projection
|
|
# artifact alongside hand-authored providers block").
|
|
#
|
|
# The canonical provider-registry SSOT is molecule-controlplane
|
|
# internal/providers/providers.yaml. This template repo has NO Go/Python
|
|
# import path back to controlplane, so instead of cross-repo dependency
|
|
# we carry a SYNCED COPY at internal/providers/providers.yaml and gate it.
|
|
#
|
|
# This workflow fetches the canonical providers.yaml from controlplane (via the
|
|
# Gitea /raw endpoint, read-only) and byte-compares it against the local synced
|
|
# copy. RED if they differ — meaning the canonical moved and this template's
|
|
# copy must be re-synced (`internal/providers/registry_projection.py generate
|
|
# <runtime>` regenerates the projection artifact alongside).
|
|
#
|
|
# AUTH: uses AUTO_SYNC_TOKEN (the existing cross-repo read token used to sync
|
|
# canonical content across repos). If the secret is absent the job emits a
|
|
# ::warning:: and exits 0 — the projection artifact's own subset+drift gate is
|
|
# the always-on backstop, so a missing cross-repo token degrades to
|
|
# "registry-canonical drift not caught here; subset gate still runs" rather
|
|
# than a hard red that blocks unrelated PRs.
|
|
#
|
|
# Why /raw not /contents: Gitea 1.22.6 ignores
|
|
# `Accept: application/vnd.gitea.raw` on /contents and returns a JSON+base64
|
|
# envelope, which would make this diff a permanent false RED. The /raw endpoint
|
|
# returns the file bytes directly (precedent: molecule-core
|
|
# .gitea/workflows/sync-providers-yaml.yml).
|
|
|
|
on:
|
|
pull_request:
|
|
types: [opened, synchronize, reopened]
|
|
paths:
|
|
- 'internal/providers/providers.yaml'
|
|
- 'internal/providers/registry-projection.json'
|
|
- 'internal/providers/registry_projection.py'
|
|
- '.gitea/workflows/sync-providers-yaml.yml'
|
|
push:
|
|
branches: [main]
|
|
paths:
|
|
- 'internal/providers/providers.yaml'
|
|
- 'internal/providers/registry-projection.json'
|
|
- 'internal/providers/registry_projection.py'
|
|
- '.gitea/workflows/sync-providers-yaml.yml'
|
|
schedule:
|
|
# Daily at :41 — catch a canonical change in controlplane that landed
|
|
# without a paired template re-sync PR. Off-zero to spread cron load.
|
|
- cron: '41 4 * * *'
|
|
workflow_dispatch:
|
|
|
|
env:
|
|
GITHUB_SERVER_URL: https://git.moleculesai.app
|
|
|
|
permissions:
|
|
contents: read
|
|
|
|
concurrency:
|
|
group: sync-providers-yaml-${{ github.ref }}
|
|
cancel-in-progress: true
|
|
|
|
jobs:
|
|
compare:
|
|
name: Compare synced providers.yaml against controlplane canonical
|
|
runs-on: ubuntu-latest
|
|
timeout-minutes: 6
|
|
steps:
|
|
- uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
|
|
|
|
- name: Fetch canonical providers.yaml from controlplane and byte-compare
|
|
env:
|
|
AUTO_SYNC_TOKEN: ${{ secrets.AUTO_SYNC_TOKEN }}
|
|
API_ROOT: ${{ github.server_url }}/api/v1
|
|
run: |
|
|
set -euo pipefail
|
|
if [ -z "${AUTO_SYNC_TOKEN:-}" ]; then
|
|
echo "::warning::AUTO_SYNC_TOKEN secret missing — skipping the live cross-repo compare."
|
|
echo "The projection-artifact drift gate (verify-providers-projection.yml) still gates hand-edits of the synced copy via its own regen+diff."
|
|
echo "Provision AUTO_SYNC_TOKEN (read scope on molecule-controlplane) to enable live canonical-drift detection."
|
|
exit 0
|
|
fi
|
|
CANON_URL="${API_ROOT}/repos/molecule-ai/molecule-controlplane/raw/internal/providers/providers.yaml?ref=main"
|
|
# /raw endpoint: returns the file bytes directly. /contents returns
|
|
# a JSON+base64 envelope on Gitea 1.22.6 even with vnd.gitea.raw —
|
|
# that quirk caused a permanent false RED on the molecule-core
|
|
# precedent before the /raw switch.
|
|
curl -fsS \
|
|
-H "Authorization: token ${AUTO_SYNC_TOKEN}" \
|
|
"${CANON_URL}" -o /tmp/canonical-providers.yaml
|
|
LOCAL=internal/providers/providers.yaml
|
|
if diff -u /tmp/canonical-providers.yaml "$LOCAL"; then
|
|
echo "OK — the synced providers.yaml is byte-identical to the controlplane canonical."
|
|
else
|
|
echo "::error::The synced providers.yaml DRIFTED from the controlplane canonical (SSOT)."
|
|
echo "Re-sync: copy controlplane internal/providers/providers.yaml verbatim over"
|
|
echo " $LOCAL, then run"
|
|
echo " python internal/providers/registry_projection.py generate <this-template-runtime>"
|
|
echo "and commit the regenerated artifact."
|
|
exit 1
|
|
fi
|