From 2bcd52b444b2e14641f45f1d3a590264684bf178 Mon Sep 17 00:00:00 2001
From: security-auditor <security-auditor@molecule.ai>
Date: Thu, 7 May 2026 00:58:55 -0700
Subject: [PATCH] fix(ci): lowercase 'molecule-ai/' in cross-repo workflow refs

Gitea is case-sensitive on owner slugs; canonical is lowercase
`molecule-ai/...`. Mixed-case `Molecule-AI/...` refs fail-at-0s
when the runner tries to resolve the cross-repo workflow / checkout.

Same fix as molecule-controlplane#12. Mechanical case-correction;
no behavior change beyond making CI resolve again.

Refs: internal#46

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
---
 .github/workflows/auto-promote-branch.yml         | 2 +-
 .github/workflows/auto-promote-staging-pr.yml     | 4 ++--
 .github/workflows/auto-promote-staging.yml        | 2 +-
 .github/workflows/disable-auto-merge-on-push.yml  | 2 +-
 .github/workflows/publish-template-image.yml      | 4 ++--
 .github/workflows/validate-org-template.yml       | 2 +-
 .github/workflows/validate-plugin.yml             | 2 +-
 .github/workflows/validate-workspace-template.yml | 4 ++--
 8 files changed, 11 insertions(+), 11 deletions(-)

diff --git a/.github/workflows/auto-promote-branch.yml b/.github/workflows/auto-promote-branch.yml
index 4c0fc11..04ae372 100644
--- a/.github/workflows/auto-promote-branch.yml
+++ b/.github/workflows/auto-promote-branch.yml
@@ -21,7 +21,7 @@ name: Auto-promote branch (reusable)
 #     administration: read     # read branch protection (REQUIRED — see below)
 #   jobs:
 #     promote:
-#       uses: Molecule-AI/molecule-ci/.github/workflows/auto-promote-branch.yml@v1
+#       uses: molecule-ai/molecule-ci/.github/workflows/auto-promote-branch.yml@v1
 #       with:
 #         from-branch: staging
 #         to-branch: main
diff --git a/.github/workflows/auto-promote-staging-pr.yml b/.github/workflows/auto-promote-staging-pr.yml
index 21f4d3a..d3308d2 100644
--- a/.github/workflows/auto-promote-staging-pr.yml
+++ b/.github/workflows/auto-promote-staging-pr.yml
@@ -28,7 +28,7 @@ name: Auto-promote staging → main (PR-based, reusable)
 #     pull-requests: write
 #   jobs:
 #     promote:
-#       uses: Molecule-AI/molecule-ci/.github/workflows/auto-promote-staging-pr.yml@v1
+#       uses: molecule-ai/molecule-ci/.github/workflows/auto-promote-staging-pr.yml@v1
 #       with:
 #         gates: "ci.yml,e2e-staging-canvas.yml,e2e-api.yml,codeql.yml"
 #         force: ${{ github.event.inputs.force == 'true' }}
@@ -230,7 +230,7 @@ jobs:
             cat > "$BODY_FILE" <<EOFBODY
           Automated promotion of \`${SOURCE_BRANCH}\` (\`${TARGET_SHA:0:8}\`) to \`${TARGET_BRANCH}\`. Required gates green at this SHA: ${GATES_CSV}.
 
-          This PR is auto-generated by a thin caller of \`Molecule-AI/molecule-ci/.github/workflows/auto-promote-staging-pr.yml\` whenever every required gate completes green on the same source-branch SHA. It exists because protected branches require status checks "set by the expected GitHub apps" — direct \`git push\` from a workflow can't satisfy that, only PR merges through the queue can.
+          This PR is auto-generated by a thin caller of \`molecule-ai/molecule-ci/.github/workflows/auto-promote-staging-pr.yml\` whenever every required gate completes green on the same source-branch SHA. It exists because protected branches require status checks "set by the expected GitHub apps" — direct \`git push\` from a workflow can't satisfy that, only PR merges through the queue can.
 
           Merge queue lands this; no human action needed unless gates fail.
           EOFBODY
diff --git a/.github/workflows/auto-promote-staging.yml b/.github/workflows/auto-promote-staging.yml
index d2a2e45..663c57e 100644
--- a/.github/workflows/auto-promote-staging.yml
+++ b/.github/workflows/auto-promote-staging.yml
@@ -4,7 +4,7 @@ name: Auto-promote staging → main
 # `auto-promote-branch.yml` workflow factored out for org-wide reuse.
 # Other repos consume the same reusable workflow via:
 #
-#   uses: Molecule-AI/molecule-ci/.github/workflows/auto-promote-branch.yml@v1
+#   uses: molecule-ai/molecule-ci/.github/workflows/auto-promote-branch.yml@v1
 #
 # Excluded by policy: molecule-core + molecule-controlplane stay
 # manual per CEO directive 2026-04-24. Those repos do NOT call the
diff --git a/.github/workflows/disable-auto-merge-on-push.yml b/.github/workflows/disable-auto-merge-on-push.yml
index c0f1d2c..cda64cb 100644
--- a/.github/workflows/disable-auto-merge-on-push.yml
+++ b/.github/workflows/disable-auto-merge-on-push.yml
@@ -22,7 +22,7 @@ name: Disable auto-merge on push
 #     pull-requests: write
 #   jobs:
 #     disable-auto-merge-on-push:
-#       uses: Molecule-AI/molecule-ci/.github/workflows/disable-auto-merge-on-push.yml@v1
+#       uses: molecule-ai/molecule-ci/.github/workflows/disable-auto-merge-on-push.yml@v1
 #
 # False-positive behavior: if a CI bot pushes (e.g. dependency-update
 # rebase, secret rotation), this also disables auto-merge for that
diff --git a/.github/workflows/publish-template-image.yml b/.github/workflows/publish-template-image.yml
index dabe36b..067f891 100644
--- a/.github/workflows/publish-template-image.yml
+++ b/.github/workflows/publish-template-image.yml
@@ -1,6 +1,6 @@
 name: Publish Workspace Template Image
 
-# Reusable workflow for every Molecule-AI/molecule-ai-workspace-template-*
+# Reusable workflow for every molecule-ai/molecule-ai-workspace-template-*
 # repo. Builds the template's Dockerfile on main and pushes to GHCR as
 # `ghcr.io/molecule-ai/workspace-template-<runtime>:latest` (plus a
 # per-commit `sha-<7>` tag). Auto-derives <runtime> from the caller repo
@@ -17,7 +17,7 @@ name: Publish Workspace Template Image
 #     packages: write
 #   jobs:
 #     publish:
-#       uses: Molecule-AI/molecule-ci/.github/workflows/publish-template-image.yml@v1
+#       uses: molecule-ai/molecule-ci/.github/workflows/publish-template-image.yml@v1
 #       secrets: inherit
 #
 # Runner choice (2026-04-22): ubuntu-latest
diff --git a/.github/workflows/validate-org-template.yml b/.github/workflows/validate-org-template.yml
index c1b09a7..5820481 100644
--- a/.github/workflows/validate-org-template.yml
+++ b/.github/workflows/validate-org-template.yml
@@ -17,7 +17,7 @@ jobs:
       # pattern already used by validate-workspace-template.yml.
       - uses: actions/checkout@v4
         with:
-          repository: Molecule-AI/molecule-ci
+          repository: molecule-ai/molecule-ci
           path: .molecule-ci-canonical
       - uses: actions/setup-python@v5
         with:
diff --git a/.github/workflows/validate-plugin.yml b/.github/workflows/validate-plugin.yml
index 3d692cb..21051f8 100644
--- a/.github/workflows/validate-plugin.yml
+++ b/.github/workflows/validate-plugin.yml
@@ -17,7 +17,7 @@ jobs:
       # pattern already used by validate-workspace-template.yml.
       - uses: actions/checkout@v4
         with:
-          repository: Molecule-AI/molecule-ci
+          repository: molecule-ai/molecule-ci
           path: .molecule-ci-canonical
       - uses: actions/setup-python@v5
         with:
diff --git a/.github/workflows/validate-workspace-template.yml b/.github/workflows/validate-workspace-template.yml
index 981c91f..3b7e47c 100644
--- a/.github/workflows/validate-workspace-template.yml
+++ b/.github/workflows/validate-workspace-template.yml
@@ -56,7 +56,7 @@ jobs:
       # same canonical contract check on every CI run.
       - uses: actions/checkout@v4
         with:
-          repository: Molecule-AI/molecule-ci
+          repository: molecule-ai/molecule-ci
           path: .molecule-ci-canonical
       - uses: actions/setup-python@v5
         with:
@@ -135,7 +135,7 @@ jobs:
       - uses: actions/checkout@v4
       - uses: actions/checkout@v4
         with:
-          repository: Molecule-AI/molecule-ci
+          repository: molecule-ai/molecule-ci
           path: .molecule-ci-canonical
       - uses: actions/setup-python@v5
         with:
-- 
2.45.2