hongming
46936bdf71
CI / Template validation (static) (push) Successful in 31s
verify-providers-projection / Regenerate projection, fail on drift, assert registry ⊆ template (pull_request) Successful in 31s
CI / Adapter unit tests (push) Successful in 1m16s
CI / Template validation (runtime) (push) Successful in 1m40s
CI / T4 tier-4 conformance (live) (push) Successful in 1m41s
CI / validate (push) Successful in 1s
CI / Template validation (static) (pull_request) Successful in 14s
CI / Adapter unit tests (pull_request) Successful in 51s
CI / Template validation (runtime) (pull_request) Successful in 1m24s
CI / T4 tier-4 conformance (live) (pull_request) Successful in 1m24s
CI / validate (pull_request) Successful in 2s
396 lines
20 KiB
YAML
396 lines
20 KiB
YAML
name: publish-image
|
|
|
|
# Builds the codex workspace template Dockerfile and pushes it to the Gitea registry (registry.moleculesai.app) as
|
|
# `<REGISTRY>/molecule-ai/workspace-template-codex:latest` + `:sha-<7>`.
|
|
#
|
|
# Ported verbatim in shape from the live-verified claude-code template
|
|
# publish-image.yml (PR#25 / bbc2dae). The codex repo had NO publish
|
|
# pipeline before this — the deployed prod image
|
|
# sha256:877e0687704cbfdd0f5fca367131088746a68c3d4fccd0d18a74863773530815
|
|
# (git 99e7f13) was the 2026-05-06 ECR-mirror rollback built
|
|
# pre-suspension from GitHub and NEVER rebuilt post-suspension because
|
|
# this workflow did not exist. This file restores the build path so a
|
|
# merge to main produces a fresh, T4-baked, list_peers-working image.
|
|
#
|
|
# Cross-repo `uses:` is BLOCKED on Gitea 1.22.6 (DEFAULT_ACTIONS_URL=
|
|
# github → 404; feedback_gitea_cross_repo_uses_blocked) so the
|
|
# publish-template-image logic is inlined.
|
|
#
|
|
# Registry: production uses ECR. The ECR repo
|
|
# `molecule-ai/workspace-template-codex` already exists (the migration
|
|
# sweep created it; that is where sha256:877e0687 lives today).
|
|
#
|
|
# Gitea 1.22.6 hostile-shape checklist applied:
|
|
# - No workflow_dispatch.inputs (silently rejected on 1.22.6)
|
|
# - No merge_group: trigger
|
|
# - No cross-repo uses:
|
|
# - GITHUB_SERVER_URL pinned at workflow level
|
|
# - No on.push.paths: (would permanently block path-excluded pushes)
|
|
# - timeout-minutes on every job
|
|
#
|
|
# Cascade signal: molecule-core/publish-runtime.yml fans out by
|
|
# git-pushing an updated `.runtime-version` to this repo's main, which
|
|
# trips `on: push: branches: [main]`. resolve-version reads it and
|
|
# forwards it as the RUNTIME_VERSION docker build-arg.
|
|
|
|
on:
|
|
push:
|
|
branches: [main]
|
|
workflow_dispatch:
|
|
|
|
env:
|
|
GITHUB_SERVER_URL: https://git.moleculesai.app
|
|
# CANONICAL content-addressed registry host (Cloudflare-fronted alias) -
|
|
# used for the promoted PIN ref and the image labels (IMAGE_NAME@<digest>).
|
|
IMAGE_NAME: registry.moleculesai.app/molecule-ai/workspace-template-codex
|
|
# CF-BYPASS local push endpoint. registry.moleculesai.app is Cloudflare-
|
|
# fronted with a ~100MB request-body cap, but buildx/docker uploads the
|
|
# 1.7-2.4GB template layers as a monolithic blob PUT -> Cloudflare 413
|
|
# Payload Too Large. Push straight to the local Gitea OCI endpoint instead:
|
|
# the runner mounts the host docker.sock, so docker login/push execute
|
|
# against the HOST docker daemon, where `localhost:3200` is the host's
|
|
# Gitea port-map (an insecure-OK localhost registry - no TLS / insecure-
|
|
# registries config required). It is the SAME Gitea backend that serves
|
|
# registry.moleculesai.app, so the pushed manifest is content-addressed
|
|
# and host-independent and the canonical-host pin resolves + pulls
|
|
# identically. Mirrors the Track-A Phase-1 host-side seed (blobs pushed
|
|
# direct to the local Gitea, not via the Cloudflare alias).
|
|
PUSH_HOST: localhost:3200
|
|
PUSH_IMAGE_NAME: localhost:3200/molecule-ai/workspace-template-codex
|
|
|
|
permissions:
|
|
contents: read
|
|
|
|
jobs:
|
|
resolve-version:
|
|
name: Resolve runtime version
|
|
runs-on: ubuntu-latest
|
|
timeout-minutes: 2
|
|
outputs:
|
|
version: ${{ steps.read.outputs.version }}
|
|
sha: ${{ steps.read.outputs.sha }}
|
|
steps:
|
|
- uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
|
|
- id: read
|
|
shell: bash
|
|
run: |
|
|
if [ -f .runtime-version ]; then
|
|
v="$(head -n1 .runtime-version | tr -d '[:space:]')"
|
|
echo "version=${v}" >> "$GITHUB_OUTPUT"
|
|
echo "resolved runtime version from .runtime-version: ${v}"
|
|
else
|
|
echo "version=" >> "$GITHUB_OUTPUT"
|
|
echo "no .runtime-version file — will use Dockerfile/requirements.txt pin"
|
|
fi
|
|
echo "sha=${GITHUB_SHA::7}" >> "$GITHUB_OUTPUT"
|
|
# Drift guard: the image pins runtime from .runtime-version (RUNTIME_VERSION build-arg).
|
|
# requirements.txt MUST agree, or a requirements-only bump silently ships the old runtime
|
|
# (root cause of the 2026-05-31 codex chat regression — PR#69 bumped only requirements.txt).
|
|
if [ -f .runtime-version ] && [ -f requirements.txt ]; then
|
|
req="$(grep -E '^molecules-workspace-runtime==' requirements.txt | head -n1 | sed -E 's/.*==//' | tr -d '[:space:]')"
|
|
if [ -n "${req}" ] && [ "${req}" != "${v:-}" ]; then
|
|
echo "::error::.runtime-version (${v:-<unset>}) != requirements.txt pin (${req}). Bump BOTH — the image pins from .runtime-version."
|
|
exit 1
|
|
fi
|
|
echo "runtime-version/requirements pin agree: ${v:-} == ${req:-<none>}"
|
|
fi
|
|
|
|
publish:
|
|
name: Build & push workspace-template-codex image
|
|
# CF-bypass (Cloudflare 413): this job PUSHES the 1.7-2.4GB image to the
|
|
# Gitea OCI registry. registry.moleculesai.app is Cloudflare-fronted with a
|
|
# ~100MB request-body cap, so a monolithic blob PUT of the layers 413s. The
|
|
# push therefore has to run on a runner CO-LOCATED with the local Gitea,
|
|
# where `localhost:3200` is the host's registry port and docker login/push
|
|
# execute against the HOST docker daemon (this runner mounts the host
|
|
# /var/run/docker.sock; act_runner docker_host = that sock). The local
|
|
# `ci-meta` runner satisfies this. The dedicated remote `[publish, release]`
|
|
# runners CANNOT reach the host's localhost:3200 (verified: `docker login
|
|
# localhost:3200` -> dial tcp 127.0.0.1:3200: connection refused), so they
|
|
# must not run this job while the registry is served locally + CF-fronted.
|
|
runs-on: ci-meta
|
|
timeout-minutes: 30
|
|
needs: resolve-version
|
|
# Bubble the Push step's digest to the job level so the downstream
|
|
# `promote-pin` job can consume `needs.publish.outputs.digest`. Without
|
|
# this block the expression resolves to "" at runtime — job-level outputs
|
|
# are the canonical Gitea/GHA mechanism for surfacing a step output across
|
|
# a `needs:` edge (`steps.push.outputs.digest` is only visible WITHIN this
|
|
# job). Mirrors the claude-code / hermes sibling templates.
|
|
outputs:
|
|
digest: ${{ steps.push.outputs.digest }}
|
|
steps:
|
|
- name: Checkout
|
|
uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
|
|
|
|
- name: Lint — no bare imports of runtime modules
|
|
shell: bash
|
|
run: |
|
|
set -eu
|
|
FALLBACK_MODULES='plugins|adapter_base|config|main|preflight|prompt|coordinator|consolidation|events|heartbeat|transcript_auth|runtime_wedge|watcher|skill_loader|policies|adapters|builtin_tools|executor_helpers|a2a_executor|a2a_client|a2a_tools|a2a_cli|a2a_mcp_server|agent|agents_md|initial_prompt|molecule_ai_status|platform_auth|configs_dir|shared_runtime'
|
|
RUNTIME_MODULES=""
|
|
mkdir -p /tmp/runtime-wheel
|
|
if pip download --quiet molecule-ai-workspace-runtime --no-deps -d /tmp/runtime-wheel 2>/dev/null; then
|
|
WHEEL=$(ls /tmp/runtime-wheel/*.whl 2>/dev/null | head -1)
|
|
if [ -n "$WHEEL" ]; then
|
|
RUNTIME_MODULES=$(unzip -p "$WHEEL" molecule_runtime/_runtime_modules.json 2>/dev/null \
|
|
| python3 -c "import sys,json; m=json.load(sys.stdin); print('|'.join(sorted(set(m['top_level_modules']) | set(m['subpackages']))))" 2>/dev/null || echo "")
|
|
fi
|
|
fi
|
|
if [ -n "$RUNTIME_MODULES" ]; then
|
|
echo "::notice::lint module list from published wheel"
|
|
else
|
|
RUNTIME_MODULES="$FALLBACK_MODULES"
|
|
echo "::warning::could not read _runtime_modules.json from wheel — using inline fallback"
|
|
fi
|
|
if HITS=$(grep -nE "^\s*from (${RUNTIME_MODULES}) import" *.py 2>/dev/null); then
|
|
echo "::error::Bare imports of runtime modules found — use 'from molecule_runtime.<module> import'"
|
|
echo "$HITS" | sed 's/^/ /'
|
|
exit 1
|
|
fi
|
|
echo "::notice::no bare imports of runtime modules in *.py files"
|
|
|
|
- name: Log in to our container registry (Gitea OCI - CF-bypass local push endpoint)
|
|
# ECR retired (operator directive: use our own registry). Push to the
|
|
# Gitea-backed OCI registry at registry.moleculesai.app. The push
|
|
# credential is the Gitea package-publisher, fetched from the Infisical
|
|
# SSOT via the CI bootstrap trio (INFISICAL_CI_*) — never hardcoded.
|
|
# FORK SAFETY: this workflow has no pull_request trigger (push:[main] +
|
|
# workflow_dispatch only) so the trio is never exposed to a fork; the
|
|
# conditional is belt-and-suspenders (Gitea also withholds secrets from
|
|
# fork runners).
|
|
if: ${{ github.event_name != 'pull_request' || github.event.pull_request.head.repo.fork == false }}
|
|
env:
|
|
INFISICAL_CI_CLIENT_ID: ${{ secrets.INFISICAL_CI_CLIENT_ID }}
|
|
INFISICAL_CI_CLIENT_SECRET: ${{ secrets.INFISICAL_CI_CLIENT_SECRET }}
|
|
INFISICAL_PROJECT_ID: ${{ secrets.INFISICAL_CI_PROJECT_ID }}
|
|
run: |
|
|
set -uo pipefail
|
|
BASE="https://key.moleculesai.app"
|
|
TOK=$(curl -fsS -X POST "$BASE/api/v1/auth/universal-auth/login" \
|
|
-H 'Content-Type: application/json' \
|
|
-d "{\"clientId\":\"$INFISICAL_CI_CLIENT_ID\",\"clientSecret\":\"$INFISICAL_CI_CLIENT_SECRET\"}" \
|
|
| python3 -c 'import sys,json; d=json.load(sys.stdin); v=d.get("accessToken"); sys.stdout.write(v if isinstance(v,str) and v else "")')
|
|
read_secret() {
|
|
curl -fsS "$BASE/api/v3/secrets/raw/$1?workspaceId=$INFISICAL_PROJECT_ID&environment=prod&secretPath=$2" \
|
|
-H "Authorization: Bearer $TOK" \
|
|
| python3 -c 'import sys,json; d=json.load(sys.stdin); v=(d.get("secret") or {}).get("secretValue"); sys.stdout.write(v if isinstance(v,str) and v else "")'
|
|
}
|
|
GITEA_USER="pypi-publisher" # canonical least-priv publisher (write:package)
|
|
GITEA_TOKEN=$(read_secret MOL_PACKAGE_TOKEN %2Fci%2Fgitea-pypi-publisher)
|
|
echo "::add-mask::$GITEA_TOKEN"
|
|
if [ -z "$GITEA_USER" ] || [ -z "$GITEA_TOKEN" ]; then
|
|
echo "::error::Infisical returned empty registry publisher creds at /ci/gitea-pypi-publisher"
|
|
exit 1
|
|
fi
|
|
echo "$GITEA_TOKEN" | docker login "$PUSH_HOST" -u "$GITEA_USER" --password-stdin \
|
|
|| { echo "::error::docker login to $PUSH_HOST failed"; exit 1; }
|
|
echo "::notice::logged in to $PUSH_HOST (CF-bypass local Gitea OCI) as $GITEA_USER"
|
|
- name: Verify Docker daemon access
|
|
run: |
|
|
set -euo pipefail
|
|
docker info >/dev/null 2>&1 || {
|
|
echo "::error::Docker daemon is not accessible — check runner sock mount"
|
|
exit 1
|
|
}
|
|
echo "Docker daemon OK"
|
|
|
|
- name: Set up Docker Buildx
|
|
uses: docker/setup-buildx-action@4d04d5d9486b7bd6fa91e7baf45bbb4f8b9deedd # v4.0.0
|
|
|
|
- name: Build image (load for smoke test, do not push yet)
|
|
uses: docker/build-push-action@bcafcacb16a39f128d818304e6c9c0c18556b85f # v7.1.0
|
|
with:
|
|
context: .
|
|
file: ./Dockerfile
|
|
platforms: linux/amd64
|
|
load: true
|
|
push: false
|
|
tags: ${{ env.PUSH_IMAGE_NAME }}:sha-${{ needs.resolve-version.outputs.sha }}
|
|
build-args: |
|
|
RUNTIME_VERSION=${{ needs.resolve-version.outputs.version }}
|
|
labels: |
|
|
org.opencontainers.image.source=https://git.moleculesai.app/${{ github.repository }}
|
|
org.opencontainers.image.revision=${{ github.sha }}
|
|
org.opencontainers.image.description=Molecule AI workspace template — codex runtime
|
|
|
|
- name: Smoke test — import every /app/*.py
|
|
shell: bash
|
|
env:
|
|
IMAGE: ${{ env.PUSH_IMAGE_NAME }}:sha-${{ needs.resolve-version.outputs.sha }}
|
|
run: |
|
|
set -eu
|
|
docker run --rm \
|
|
-e WORKSPACE_ID=smoke-test \
|
|
-e OPENAI_API_KEY=sk-fake-smoke-key \
|
|
-e MINIMAX_API_KEY=sk-fake-smoke-key \
|
|
--entrypoint sh "${IMAGE}" -c '
|
|
set -e
|
|
cd /app
|
|
for f in *.py; do
|
|
[ "$f" = "__init__.py" ] && continue
|
|
mod="${f%.py}"
|
|
python3 -c "import $mod" || { echo "::error::failed to import $mod"; exit 1; }
|
|
echo " import $mod OK"
|
|
done
|
|
'
|
|
echo "::notice::${IMAGE}: all /app/*.py modules import cleanly"
|
|
|
|
- name: Push image to registry (CF-bypass local endpoint, post-smoke)
|
|
id: push
|
|
# Smoke passed. Push the locally-loaded image straight to the local Gitea
|
|
# OCI endpoint via the HOST docker daemon with a plain `docker push` (NOT
|
|
# buildx): the blob upload travels host->localhost:3200 and never crosses
|
|
# Cloudflare, so the 1.7-2.4GB layers no longer hit the ~100MB CF request-
|
|
# body cap (413 Payload Too Large). The manifest digest is content-
|
|
# addressed and host-independent, so promote-pin still pins the CANONICAL
|
|
# host ref (IMAGE_NAME@<digest>), which resolves + pulls via Cloudflare
|
|
# all the same. Image labels are already baked by the build-load step, so
|
|
# no rebuild happens here. `steps.push.outputs.digest` is preserved for
|
|
# the downstream promote-pin job.
|
|
shell: bash
|
|
run: |
|
|
set -euo pipefail
|
|
SHA_REF="${PUSH_IMAGE_NAME}:sha-${{ needs.resolve-version.outputs.sha }}"
|
|
docker tag "${SHA_REF}" "${PUSH_IMAGE_NAME}:latest"
|
|
docker push "${PUSH_IMAGE_NAME}:latest"
|
|
PUSHOUT="$(docker push "${SHA_REF}")"
|
|
printf '%s\n' "${PUSHOUT}"
|
|
DIGEST="$(printf '%s\n' "${PUSHOUT}" | sed -n 's/.*digest: \(sha256:[0-9a-f]\{64\}\).*/\1/p' | head -1)"
|
|
if [ -z "${DIGEST}" ]; then
|
|
echo "::error::could not parse the pushed manifest digest from docker push output"
|
|
exit 1
|
|
fi
|
|
echo "digest=${DIGEST}" >> "$GITHUB_OUTPUT"
|
|
echo "::notice::pushed ${SHA_REF} + :latest to ${PUSH_HOST}; manifest digest ${DIGEST} (pins as ${IMAGE_NAME}@${DIGEST})"
|
|
|
|
promote-pin:
|
|
# RFC internal#529 Layer A — auto-promote the just-pushed digest to
|
|
# runtime_image_pins via the control-plane admin endpoint. Gitea 1.22.x
|
|
# has no `workflow_run`, so promotion has to be a job in this same
|
|
# workflow (cannot be a separate workflow listening on publish-image
|
|
# success). Gated on `if: success()` so a failed publish (smoke red,
|
|
# push red) never bumps any pin — promotion only runs AFTER a green
|
|
# build/push.
|
|
#
|
|
# staging CP `runtime_image_pins` is a SEPARATE SSOT from prod, so the
|
|
# `E2E Staging SaaS` canary boots whatever staging's pin points at. We
|
|
# promote to staging (staging-api.moleculesai.app); the prod leg is removed
|
|
# under the prod-freeze (see the matrix comment below). `strategy.fail-fast:
|
|
# false` keeps each matrix leg independent and fail-LOUD on a non-2xx for ITS
|
|
# OWN target so a stranded pin is never hidden behind a green workflow.
|
|
# Mirrors the google-adk sibling (prod-freeze-aware, staging live).
|
|
name: Promote runtime_image_pins (CP admin)
|
|
runs-on: ubuntu-latest
|
|
timeout-minutes: 2
|
|
needs: [resolve-version, publish]
|
|
if: ${{ success() && github.ref == 'refs/heads/main' }}
|
|
permissions:
|
|
contents: read
|
|
strategy:
|
|
fail-fast: false
|
|
matrix:
|
|
include:
|
|
# prod leg removed (prod-freeze). Prod cutover is pending-operator and
|
|
# the prod CP admin bearer is not provisioned to match any token these
|
|
# template repos hold, so POST /cp/admin/runtime-image/promote to
|
|
# api.moleculesai.app returns HTTP 401 by design (AdminGate bearer
|
|
# compare). Auto-promoting to prod during the freeze is exactly what
|
|
# the freeze prohibits, so this leg is de-required rather than papered
|
|
# over. Restore the prod include once prod cutover completes and a
|
|
# matching prod CP admin token is provisioned. Staging stays the live
|
|
# promote target. Mirrors the google-adk sibling.
|
|
- env_name: staging
|
|
cp_host: staging-api.moleculesai.app
|
|
steps:
|
|
- name: POST /cp/admin/runtime-image/promote (${{ matrix.env_name }})
|
|
env:
|
|
PROD_TOKEN: ${{ secrets.CP_ADMIN_API_TOKEN }}
|
|
# Staging CP admin token — same secret name the google-adk/claude-code
|
|
# siblings use (verified live: google-adk staging promote → HTTP 200).
|
|
# The old CP_ADMIN_API_TOKEN_STAGING name 401s (not the provisioned key).
|
|
STAGING_TOKEN: ${{ secrets.CP_STAGING_ADMIN_API_TOKEN }}
|
|
ENV_NAME: ${{ matrix.env_name }}
|
|
CP_HOST: ${{ matrix.cp_host }}
|
|
TEMPLATE_NAME: codex
|
|
IMAGE_DIGEST: ${{ needs.publish.outputs.digest }}
|
|
GIT_SHA: ${{ needs.resolve-version.outputs.sha }}
|
|
run: |
|
|
set -euo pipefail
|
|
if [ "${ENV_NAME}" = "prod" ]; then
|
|
CP_ADMIN_API_TOKEN="${PROD_TOKEN}"
|
|
TOKEN_SECRET_NAME="CP_ADMIN_API_TOKEN"
|
|
else
|
|
CP_ADMIN_API_TOKEN="${STAGING_TOKEN}"
|
|
TOKEN_SECRET_NAME="CP_STAGING_ADMIN_API_TOKEN"
|
|
fi
|
|
if [ -z "${CP_ADMIN_API_TOKEN}" ]; then
|
|
echo "::error::${TOKEN_SECRET_NAME} secret not configured on this repo — cannot promote ${ENV_NAME} pin"
|
|
exit 1
|
|
fi
|
|
if [ -z "${IMAGE_DIGEST}" ]; then
|
|
echo "::error::needs.publish.outputs.digest is empty — Push step did not expose digest"
|
|
exit 1
|
|
fi
|
|
body=$(printf '{"template_name":"%s","image_digest":"%s","git_sha":"%s","notes":"auto-promote via publish-image.yml @ %s -> %s"}' \
|
|
"${TEMPLATE_NAME}" "${IMAGE_DIGEST}" "${GIT_SHA}" "${GITHUB_SHA}" "${ENV_NAME}")
|
|
echo "::notice::POST runtime-image/promote env=${ENV_NAME} host=${CP_HOST} template=${TEMPLATE_NAME} digest=${IMAGE_DIGEST} git_sha=${GIT_SHA}"
|
|
# Capture body + status separately; fail-loud on non-2xx so a silent
|
|
# 4xx never strands the pin behind a green workflow.
|
|
resp=$(mktemp)
|
|
code=$(curl -sS -o "${resp}" -w '%{http_code}' \
|
|
-X POST \
|
|
-H "Authorization: Bearer ${CP_ADMIN_API_TOKEN}" \
|
|
-H "Content-Type: application/json" \
|
|
-d "${body}" \
|
|
"https://${CP_HOST}/cp/admin/runtime-image/promote")
|
|
echo "HTTP ${code}"
|
|
cat "${resp}"
|
|
echo
|
|
if [ "${code}" != "200" ] && [ "${code}" != "201" ]; then
|
|
echo "::error::${ENV_NAME} promote failed (HTTP ${code})"
|
|
exit 1
|
|
fi
|
|
echo "::notice::${ENV_NAME} runtime_image_pins.${TEMPLATE_NAME} bumped to ${IMAGE_DIGEST}"
|
|
|
|
verify-pin:
|
|
# Keystone fail-loud gate (the durable guard the CTO asked for). After the
|
|
# promote, READ BACK runtime_image_pins via GET /cp/admin/runtime-image and
|
|
# ASSERT the (codex, global) row's image_digest == the digest we just
|
|
# pushed. If they differ (promote silently skipped, wrong template, region
|
|
# skew, 4xx that somehow didn't abort, etc.) this job goes RED. This is the
|
|
# thing the old continue-on-error status-post could never do: it makes a
|
|
# missed promote impossible to hide behind a green build. Runs per
|
|
# environment (prod + staging) with the same isolation semantics as
|
|
# promote-pin. A shared, reusable copy of this gate lives in
|
|
# .gitea/scripts/verify-runtime-pin.sh in EVERY runtime template repo so the
|
|
# guard covers codex/claude-code/hermes/etc., not just codex.
|
|
name: Verify runtime_image_pins moved (fail-loud)
|
|
runs-on: ubuntu-latest
|
|
timeout-minutes: 2
|
|
needs: [resolve-version, publish, promote-pin]
|
|
if: ${{ success() && github.ref == 'refs/heads/main' }}
|
|
permissions:
|
|
contents: read
|
|
strategy:
|
|
fail-fast: false
|
|
matrix:
|
|
include:
|
|
# prod leg removed (prod-freeze) — see the promote-pin matrix comment.
|
|
# There is nothing to verify on prod because nothing is promoted there
|
|
# during the freeze. Staging stays the live verify target.
|
|
- env_name: staging
|
|
cp_host: staging-api.moleculesai.app
|
|
token_secret: CP_STAGING_ADMIN_API_TOKEN
|
|
steps:
|
|
- uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
|
|
- name: Verify runtime_image_pins[ codex, ${{ matrix.env_name }} ]
|
|
env:
|
|
CP_HOST: ${{ matrix.cp_host }}
|
|
CP_ADMIN_API_TOKEN: ${{ secrets[matrix.token_secret] }}
|
|
TEMPLATE_NAME: codex
|
|
EXPECTED_DIGEST: ${{ needs.publish.outputs.digest }}
|
|
ENV_NAME: ${{ matrix.env_name }}
|
|
TOKEN_SECRET_NAME: ${{ matrix.token_secret }}
|
|
run: bash .gitea/scripts/verify-runtime-pin.sh
|