molecule-ai-workspace-template-claude-code/.gitea/workflows/meta-ci-advisory.yml

# CANONICAL inline meta-ci (ADVISORY) consumer workflow — molecule-ai/molecule-ci SSOT.
#
# This is the file a repo copies to opt into the capability→bundle router
# (task internal#57, RFC: org CI-enforcement) in its Phase-1 ADVISORY form. Drop
# it in as `.gitea/workflows/meta-ci-advisory.yml` and commit a `repo-meta.yaml`
# at the repo root; nothing else changes (no branch-protection edit, no
# required-context add).
#
# WHY INLINE (not `uses: molecule-ai/molecule-ci/.gitea/workflows/meta-ci.yml`):
# cross-repo `workflow_call` is NOT a trustworthy gate on Gitea Actions 1.26.4 —
# a consumer job can be recorded green WITHOUT running the referenced steps
# (internal#1000). This template instead anonymously fetches the public molecule-ci SSOT
# at a reviewed immutable commit and runs the canonical `scripts/meta-ci.py`
# directly. Same single source of truth (the router lives in molecule-ci), no
# mutable or cross-repo `uses:` dependency.
#
# WHY IT CANNOT BLOCK A MERGE (advisory contract):
# the router step is `continue-on-error: true` and this workflow posts NO commit
# status. The job's own auto-status is therefore always green, so on a `["*"]`
# branch protection it adds no red-capable context (R1 verified that on 1.26.4 any
# NON-green emitted context — or an absent explicitly-required one — blocks; a
# perpetually-green advisory context never does). The real PASS/FAIL of the router
# is in this job's LOG, not its status colour.
#
# PHASE 3 PROMOTION (owner-gated, later — NOT part of adopting this template):
# keep the repository-local execution shape, fail the job on router red, assert
# its sentinel, and add the emitted local job context to branch protection only
# after it is proven. Do NOT introduce a remote reusable call.

name: meta-ci-advisory

on:
  pull_request:
  push:
    branches: [main, staging]
  workflow_dispatch: {}

permissions:
  contents: read

jobs:
  meta:
    name: meta (advisory)
    runs-on: ubuntu-latest
    timeout-minutes: 10
    env:
      MOLECULE_CI_REF: 9a2fd33e4ece9e54a3e1364c74daa59336ed151b
    # ADVISORY: never block a merge while the router beds in. The router SCRIPT
    # exits nonzero on an invalid repo-meta / failed bundle; this flag only
    # governs whether THIS job's red blocks the PR (it does not).
    continue-on-error: true
    steps:
      # Repo-controlled runners execute below, so never leave checkout auth in
      # .git/config where a crafted repository file could read and print it.
      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd  # v4
        with:
          persist-credentials: false
      # Fetch the molecule-ci SSOT by immutable SHA; run the CANONICAL scripts/meta-ci.py
      # (schemas/ is its sibling there, so schema validation is intact). Direct
      # immutable SHA fetch avoids unsupported cross-repository workflow/action resolution
      # on Gitea 1.26.4.
      # One guarded step that ALWAYS exits 0, so this job's auto commit-status is
      # always green and can never block a merge (Gitea does NOT green a red step via
      # job-level continue-on-error — the explicit `exit 0` is what guarantees it).
      # The real router PASS/FAIL is in this log, surfaced as ::warning:: on failure.
      - name: meta-ci router (advisory — never blocks)
        run: |
          set +e
          rc=0
          if ! python3 -m pip install --break-system-packages -q pyyaml jsonschema; then
            rc=1
          fi
          if [ -z "${RUNNER_TEMP:-}" ]; then
            echo "::warning::RUNNER_TEMP is missing — ADVISORY (not blocking this PR)."
            rc=1
          else
            CI_ROOT="$RUNNER_TEMP/molecule-ci-ssot"
            if [ "$rc" -eq 0 ]; then
              if ! mkdir "$CI_ROOT"; then
                echo "::warning::could not atomically allocate isolated molecule-ci path — ADVISORY (not blocking this PR)."
                rc=1
              elif ! git init -q "$CI_ROOT" ||
                ! git -C "$CI_ROOT" remote add origin \
                  https://git.moleculesai.app/molecule-ai/molecule-ci.git ||
                ! git -C "$CI_ROOT" fetch -q --depth 1 origin "$MOLECULE_CI_REF" ||
                ! git -C "$CI_ROOT" checkout -q --detach FETCH_HEAD ||
                ! test "$(git -C "$CI_ROOT" rev-parse HEAD)" = "$MOLECULE_CI_REF"; then
                rc=1
              fi
            fi
          fi
          if [ "$rc" -eq 0 ]; then
            python3 "$CI_ROOT/scripts/meta-ci.py" --repo-root . \
              | tee /tmp/meta-ci.log
            rc=${PIPESTATUS[0]}
          fi
          grep -qxF 'meta-ci:sentinel:executed' /tmp/meta-ci.log || {
            echo "::warning::meta-ci execution sentinel missing — ADVISORY (not blocking this PR)."
            rc=1
          }
          [ "$rc" -ne 0 ] && echo "::warning::meta-ci router exited $rc — ADVISORY (not blocking this PR). See log above."
          exit 0