core-devops
66 lines
3.1 KiB
YAML
66 lines
3.1 KiB
YAML
# SSOT-inheritance gate for the platform-agent (Org Concierge) template.
|
|
#
|
|
# WHY: this template ships only config.yaml + prompts (no Dockerfile / adapter.py
|
|
# / template_schema_version), so it does NOT adopt the full workspace-template
|
|
# validator. It DOES need the model-re-pin gate: the concierge inherits the
|
|
# platform SSOT default model (MOLECULE_LLM_DEFAULT_MODEL) and must never re-pin
|
|
# its own model. molecule-ci's check_no_hardcoded_provider_model is the SSOT; we
|
|
# run it in its focused `--ssot-inheritance-only` mode against THIS repo's
|
|
# config.yaml. The `.official` marker (committed) opts in + selects flags:
|
|
# • --official : turn the gate on
|
|
# • --allow-platform-route: exempt the concierge's legitimate CP-proxy route
|
|
# (provider: platform + the platform proxy base_url);
|
|
# a re-pinned MODEL is still gated RED.
|
|
#
|
|
# Cross-repo `uses:` (workflow_call) does not resolve on this Gitea, so the
|
|
# canonical validator is fetched by an anonymous clone of the public molecule-ci
|
|
# (same pattern as molecule-ci/.gitea/workflows/validate-plugin.yml). Cloned into
|
|
# `.molecule-ci-canonical` so check-secrets-style scans prune it.
|
|
name: SSOT inheritance
|
|
|
|
on:
|
|
pull_request:
|
|
push:
|
|
branches: [main, staging]
|
|
workflow_dispatch: {}
|
|
|
|
permissions:
|
|
contents: read
|
|
|
|
jobs:
|
|
ssot-inheritance:
|
|
name: SSOT inheritance (no concierge model re-pin)
|
|
runs-on: ubuntu-latest
|
|
timeout-minutes: 10
|
|
steps:
|
|
- uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v4
|
|
- name: Fetch molecule-ci canonical validator
|
|
run: git clone --depth 1 https://git.moleculesai.app/molecule-ai/molecule-ci.git .molecule-ci-canonical
|
|
- uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065 # v5
|
|
with:
|
|
python-version: "3.11"
|
|
# Install the canonical validator's own dependency set before importing
|
|
# it. Keeping this pointed at molecule-ci's requirements file prevents a
|
|
# newly imported validator dependency from being omitted here.
|
|
- name: Install canonical validator requirements
|
|
run: python3 -m pip install -r .molecule-ci-canonical/scripts/requirements.txt -q
|
|
- name: Detect .official SSOT-inheritance flags
|
|
id: official
|
|
run: |
|
|
FLAGS=""
|
|
if [ -f .official ]; then
|
|
FLAGS="--official"
|
|
if grep -qi 'allow-self-model' .official 2>/dev/null; then
|
|
FLAGS="$FLAGS --allow-self-model"
|
|
fi
|
|
if grep -qi 'allow-platform-route' .official 2>/dev/null; then
|
|
FLAGS="$FLAGS --allow-platform-route"
|
|
fi
|
|
echo "::notice::Official template (.official) — SSOT-inheritance flags: $FLAGS"
|
|
else
|
|
echo "::warning::no .official marker — SSOT-inheritance gate is a no-op"
|
|
fi
|
|
echo "flags=$FLAGS" >> "$GITHUB_OUTPUT"
|
|
- name: SSOT-inheritance gate (gates a concierge model re-pin)
|
|
run: python3 .molecule-ci-canonical/scripts/validate-workspace-template.py --ssot-inheritance-only ${{ steps.official.outputs.flags }}
|