From 56facc8a42726aeaa904079fa05313919c871787 Mon Sep 17 00:00:00 2001 From: Hongming Wang Date: Wed, 29 Apr 2026 01:56:25 -0700 Subject: [PATCH] fix(validate): fetch validator scripts from molecule-ci instead of expecting them in caller MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit The validate-org-template.yml and validate-plugin.yml workflows expected `.molecule-ci/scripts/` to be vendored INTO each calling repo. That worked for the repos that copied the directory in, but broke on the ones that didn't: - molecule-ai-org-template-medo-smoke - molecule-ai-org-template-molecule-worker-gemini - molecule-ai-org-template-reno-stars - molecule-ai-plugin-molecule-compliance - molecule-ai-plugin-molecule-freeze-scope - molecule-ai-plugin-molecule-prompt-watchdog Surfaced when the secret-scan rollout PRs hit those repos and the required validate check failed on missing `.molecule-ci/scripts/requirements.txt`. Mirror the same fix already in validate-workspace-template.yml: a second `actions/checkout@v4` of molecule-ci into `.molecule-ci-canonical/`, with script paths re-pointed accordingly. Single source of truth — callers never need to vendor or sync. Also adds `.molecule-ci-canonical` to the secret-scan SKIP_DIRS so the side-checked-out tree doesn't get walked. Callers can drop their vendored `.molecule-ci/scripts/` copies in a follow-up cleanup. Both shapes work after this PR — the vendored copy is harmless dead weight, not a conflict. Co-Authored-By: Claude Opus 4.7 (1M context) --- .github/workflows/validate-org-template.yml | 16 +++++++++++++--- .github/workflows/validate-plugin.yml | 16 +++++++++++++--- 2 files changed, 26 insertions(+), 6 deletions(-) diff --git a/.github/workflows/validate-org-template.yml b/.github/workflows/validate-org-template.yml index 2fc55e8..c1b09a7 100644 --- a/.github/workflows/validate-org-template.yml +++ b/.github/workflows/validate-org-template.yml @@ -9,13 +9,23 @@ jobs: timeout-minutes: 10 steps: - uses: actions/checkout@v4 + # Canonical validator script lives in molecule-ci, fetched fresh on + # every run. The previous setup expected `.molecule-ci/scripts/` to + # be vendored INTO each org-template repo, which drifted across the + # 5 org-template repos as the validator evolved. Single source of + # truth eliminates that drift class entirely. Mirrors the same + # pattern already used by validate-workspace-template.yml. + - uses: actions/checkout@v4 + with: + repository: Molecule-AI/molecule-ci + path: .molecule-ci-canonical - uses: actions/setup-python@v5 with: python-version: "3.11" cache: "pip" - cache-dependency-path: .molecule-ci/scripts/requirements.txt + cache-dependency-path: .molecule-ci-canonical/.molecule-ci/scripts/requirements.txt - run: pip install pyyaml -q - - run: python3 .molecule-ci/scripts/validate-org-template.py + - run: python3 .molecule-ci-canonical/.molecule-ci/scripts/validate-org-template.py - name: Check for secrets run: | python3 - << 'PYEOF' @@ -32,7 +42,7 @@ jobs: re.compile(r'''ghp_[a-zA-Z0-9]{36,}'''), re.compile(r'''sk-ant-[a-zA-Z0-9]{50,}'''), ] - SKIP_DIRS = {'.molecule-ci', '.git', 'node_modules', '__pycache__'} + SKIP_DIRS = {'.molecule-ci', '.molecule-ci-canonical', '.git', 'node_modules', '__pycache__'} EXTENSIONS = {'.yaml', '.yml', '.md', '.py', '.sh'} def is_false_positive(line): diff --git a/.github/workflows/validate-plugin.yml b/.github/workflows/validate-plugin.yml index 102316f..3d692cb 100644 --- a/.github/workflows/validate-plugin.yml +++ b/.github/workflows/validate-plugin.yml @@ -9,13 +9,23 @@ jobs: timeout-minutes: 10 steps: - uses: actions/checkout@v4 + # Canonical validator script lives in molecule-ci, fetched fresh on + # every run. The previous setup expected `.molecule-ci/scripts/` to + # be vendored INTO each plugin repo, which drifted across the + # 20+ plugin repos as the validator evolved. Single source of + # truth eliminates that drift class entirely. Mirrors the same + # pattern already used by validate-workspace-template.yml. + - uses: actions/checkout@v4 + with: + repository: Molecule-AI/molecule-ci + path: .molecule-ci-canonical - uses: actions/setup-python@v5 with: python-version: "3.11" cache: "pip" - cache-dependency-path: .molecule-ci/scripts/requirements.txt + cache-dependency-path: .molecule-ci-canonical/.molecule-ci/scripts/requirements.txt - run: pip install pyyaml -q - - run: python3 .molecule-ci/scripts/validate-plugin.py + - run: python3 .molecule-ci-canonical/.molecule-ci/scripts/validate-plugin.py - name: Check for secrets run: | python3 - << 'PYEOF' @@ -32,7 +42,7 @@ jobs: re.compile(r'''ghp_[a-zA-Z0-9]{36,}'''), re.compile(r'''sk-ant-[a-zA-Z0-9]{50,}'''), ] - SKIP_DIRS = {'.molecule-ci', '.git', 'node_modules', '__pycache__'} + SKIP_DIRS = {'.molecule-ci', '.molecule-ci-canonical', '.git', 'node_modules', '__pycache__'} EXTENSIONS = {'.yaml', '.yml', '.md', '.py', '.sh'} def is_false_positive(line):