molecule-ai-workspace-template-hermes/.gitea/workflows/sync-providers-yaml.yml

name: sync-providers-yaml

# Cross-repo canonical↔synced-copy drift gate (internal#718 P4 Path B,
# CTO 2026-05-27 "preserve federation contract; ship registry-projection
# artifact alongside hand-authored providers block").
#
# The canonical provider-registry SSOT is molecule-controlplane
# internal/providers/providers.yaml. This template repo has NO Go/Python
# import path back to controlplane, so instead of cross-repo dependency
# we carry a SYNCED COPY at internal/providers/providers.yaml and gate it.
#
# This workflow fetches the canonical providers.yaml from controlplane (via the
# Gitea /raw endpoint, read-only) and byte-compares it against the local synced
# copy. RED if they differ — meaning the canonical moved and this template's
# copy must be re-synced (`internal/providers/registry_projection.py generate
# <runtime>` regenerates the projection artifact alongside).
#
# AUTH: reads AUTO_SYNC_TOKEN at runtime from its Infisical SSOT
# (/shared/dev-utils, prod) using the same INFISICAL_CI_* bootstrap trio this
# repo's protected publish workflow already uses. This avoids a duplicated
# long-lived Gitea Actions copy drifting after token rotation. Fork PRs do not
# receive the bootstrap trio; when it is absent the job emits a warning and
# exits 0. The projection artifact's own subset+drift gate remains the
# always-on backstop.
#
# Why /raw not /contents: /contents returns a JSON+base64 envelope, which
# would make this diff a permanent false RED. The /raw endpoint returns the
# file bytes directly (precedent: molecule-core
# .gitea/workflows/sync-providers-yaml.yml).

on:
  pull_request:
    types: [opened, synchronize, reopened]
    paths:
      - 'internal/providers/providers.yaml'
      - 'internal/providers/registry-projection.json'
      - 'internal/providers/registry_projection.py'
      - '.gitea/workflows/sync-providers-yaml.yml'
  push:
    branches: [main]
    paths:
      - 'internal/providers/providers.yaml'
      - 'internal/providers/registry-projection.json'
      - 'internal/providers/registry_projection.py'
      - '.gitea/workflows/sync-providers-yaml.yml'
  workflow_dispatch:

env:
  GITHUB_SERVER_URL: https://git.moleculesai.app

permissions:
  contents: read

concurrency:
  group: sync-providers-yaml-${{ github.ref }}
  cancel-in-progress: true

jobs:
  compare:
    name: Compare synced providers.yaml against controlplane canonical
    runs-on: ubuntu-latest
    timeout-minutes: 6
    steps:
      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2

      - name: Fetch canonical providers.yaml from controlplane and byte-compare
        env:
          INFISICAL_CI_CLIENT_ID: ${{ secrets.INFISICAL_CI_CLIENT_ID }}
          INFISICAL_CI_CLIENT_SECRET: ${{ secrets.INFISICAL_CI_CLIENT_SECRET }}
          INFISICAL_PROJECT_ID: ${{ secrets.INFISICAL_CI_PROJECT_ID }}
          API_ROOT: ${{ github.server_url }}/api/v1
        run: |
          set -euo pipefail
          if [ -z "${INFISICAL_CI_CLIENT_ID:-}" ] || \
             [ -z "${INFISICAL_CI_CLIENT_SECRET:-}" ] || \
             [ -z "${INFISICAL_PROJECT_ID:-}" ]; then
            echo "::warning::Infisical CI bootstrap credentials unavailable — skipping the live cross-repo compare."
            echo "The projection-artifact drift gate (verify-providers-projection.yml) still gates hand-edits of the synced copy via its own regen+diff."
            exit 0
          fi
          BASE="https://key.moleculesai.app"
          UA="curl/8.4.0"
          TOK=$(curl -fsS -A "$UA" --max-time 30 -X POST \
            "$BASE/api/v1/auth/universal-auth/login" \
            -H 'Content-Type: application/json' \
            -d "{\"clientId\":\"${INFISICAL_CI_CLIENT_ID}\",\"clientSecret\":\"${INFISICAL_CI_CLIENT_SECRET}\"}" \
            | python3 -c 'import sys,json; d=json.load(sys.stdin); v=d.get("accessToken"); sys.stdout.write(v if isinstance(v,str) and v else "")')
          AUTO_SYNC_TOKEN=$(curl -fsS -A "$UA" --max-time 30 \
            "$BASE/api/v3/secrets/raw/AUTO_SYNC_TOKEN?workspaceId=$INFISICAL_PROJECT_ID&environment=prod&secretPath=%2Fshared%2Fdev-utils" \
            -H "Authorization: Bearer $TOK" \
            | python3 -c 'import sys,json; d=json.load(sys.stdin); v=(d.get("secret") or {}).get("secretValue"); sys.stdout.write(v if isinstance(v,str) and v else "")')
          echo "::add-mask::$AUTO_SYNC_TOKEN"
          if [ -z "$AUTO_SYNC_TOKEN" ]; then
            echo "::error::Infisical returned empty for AUTO_SYNC_TOKEN at /shared/dev-utils."
            exit 1
          fi
          CANON_URL="${API_ROOT}/repos/molecule-ai/molecule-controlplane/raw/internal/providers/providers.yaml?ref=main"
          # /raw returns file bytes directly; /contents returns a JSON+base64
          # envelope that is not suitable for a byte-for-byte diff.
          curl -fsS \
            -A "$UA" \
            -H "Authorization: token ${AUTO_SYNC_TOKEN}" \
            "${CANON_URL}" -o /tmp/canonical-providers.yaml
          LOCAL=internal/providers/providers.yaml
          if diff -u /tmp/canonical-providers.yaml "$LOCAL"; then
            echo "OK — the synced providers.yaml is byte-identical to the controlplane canonical."
          else
            echo "::error::The synced providers.yaml DRIFTED from the controlplane canonical (SSOT)."
            echo "Re-sync: copy controlplane internal/providers/providers.yaml verbatim over"
            echo "  $LOCAL, then run"
            echo "  python internal/providers/registry_projection.py generate <this-template-runtime>"
            echo "and commit the regenerated artifact."
            exit 1
          fi