Standardize CI / validate as canonical generated-repo validate-context in molecule-ci (inline validate job, sidestep Gitea-1.22 cross-repo uses:) #33

Merged
claude-ceo-assistant merged 2 commits from feat/canonical-ci-validate-templates into main 2026-06-11 21:27:19 +00:00
3 changed files with 206 additions and 0 deletions
+61
View File
@@ -0,0 +1,61 @@
# CANONICAL consumer ci.yml for org-template repos — molecule-ai/molecule-ci SSOT.
#
# This is the file NEW org-template repos inherit. It standardizes the
# emitted commit-status context to `CI / validate` (workflow `name: CI` +
# a job whose status display-name is `validate`), so a single canonical
# branch-protection required context — `CI / validate (pull_request)` —
# works fleet-wide. See molecule-ci .gitea/workflows/bp-context-drift-gate.yml
# and the design doc bp-drift-durable-fix.md for the drift root cause this
# resolves (a BP-required context with no emitter = perma-pending = HTTP 405
# merge-block forever).
#
# WHY INLINE (not `uses: molecule-ai/molecule-ci/.gitea/workflows/...`):
# cross-repo `uses:` (workflow_call) does NOT resolve on Gitea 1.22.6 —
# [actions].DEFAULT_ACTIONS_URL=github routes the fetch to github.com where
# the `molecule-ai` org is suspended → 404/no-op. So the reusable
# validate-org-template.yml in molecule-ci is currently un-callable from a
# consumer. This template instead INLINES the validate job: it anon-clones
# the public molecule-ci SSOT at CI time and runs the canonical validator
# script directly. Same single-source-of-truth (the validator lives in
# molecule-ci, fetched fresh on every run), no cross-repo `uses:` dependency.
#
# When the operator-host actions/* mirror lands (internal task #109) and
# cross-repo `uses:` resolves, this inline job can collapse back to a
# `uses:` call WITHOUT changing the emitted `CI / validate` context.
#
# The SSOT is cloned into `.molecule-ci` (NOT `.molecule-ci-canonical`) so
# that the canonical check-secrets.py — whose SKIP_DIRS prunes `.molecule-ci`
# — does not scan molecule-ci's own fixtures and self-flag.
name: CI
on:
pull_request:
push:
branches: [main, staging]
workflow_dispatch: {}
permissions:
contents: read
jobs:
validate:
name: validate
runs-on: ubuntu-latest
timeout-minutes: 10
steps:
- uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v4
# Fetch the canonical validator from the molecule-ci SSOT. Anonymous
# clone of the public repo — see molecule-ci/.gitea/workflows/
# validate-plugin.yml for why a direct git-clone is used instead of
# actions/checkout for the cross-repo fetch on Gitea 1.22.6.
- name: Fetch molecule-ci canonical scripts
run: git clone --depth 1 https://git.moleculesai.app/molecule-ai/molecule-ci.git .molecule-ci
- uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065 # v5
with:
python-version: "3.11"
- run: pip install pyyaml -q
- name: Validate org-template contract
run: python3 .molecule-ci/.molecule-ci/scripts/validate-org-template.py
- name: Check for secrets
run: python3 .molecule-ci/.molecule-ci/scripts/check-secrets.py
+61
View File
@@ -0,0 +1,61 @@
# CANONICAL consumer ci.yml for plugin repos — molecule-ai/molecule-ci SSOT.
#
# This is the file NEW plugin repos inherit. It standardizes the emitted
# commit-status context to `CI / validate` (workflow `name: CI` + a job
# whose status display-name is `validate`), so a single canonical
# branch-protection required context — `CI / validate (pull_request)` —
# works fleet-wide. See molecule-ci .gitea/workflows/bp-context-drift-gate.yml
# and the design doc bp-drift-durable-fix.md for the drift root cause this
# resolves (a BP-required context with no emitter = perma-pending = HTTP 405
# merge-block forever).
#
# WHY INLINE (not `uses: molecule-ai/molecule-ci/.gitea/workflows/...`):
# cross-repo `uses:` (workflow_call) does NOT resolve on Gitea 1.22.6 —
# [actions].DEFAULT_ACTIONS_URL=github routes the fetch to github.com where
# the `molecule-ai` org is suspended → 404/no-op. So the reusable
# validate-plugin.yml in molecule-ci is currently un-callable from a
# consumer. This template instead INLINES the validate job: it anon-clones
# the public molecule-ci SSOT at CI time and runs the canonical validator
# script directly. Same single-source-of-truth (the validator lives in
# molecule-ci, fetched fresh on every run), no cross-repo `uses:` dependency.
#
# When the operator-host actions/* mirror lands (internal task #109) and
# cross-repo `uses:` resolves, this inline job can collapse back to a
# `uses:` call WITHOUT changing the emitted `CI / validate` context.
#
# The SSOT is cloned into `.molecule-ci` (NOT `.molecule-ci-canonical`) so
# that the canonical check-secrets.py — whose SKIP_DIRS prunes `.molecule-ci`
# — does not scan molecule-ci's own fixtures and self-flag.
name: CI
on:
pull_request:
push:
branches: [main, staging]
workflow_dispatch: {}
permissions:
contents: read
jobs:
validate:
name: validate
runs-on: ubuntu-latest
timeout-minutes: 10
steps:
- uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v4
# Fetch the canonical validator from the molecule-ci SSOT. Anonymous
# clone of the public repo — see molecule-ci/.gitea/workflows/
# validate-plugin.yml for why a direct git-clone is used instead of
# actions/checkout for the cross-repo fetch on Gitea 1.22.6.
- name: Fetch molecule-ci canonical scripts
run: git clone --depth 1 https://git.moleculesai.app/molecule-ai/molecule-ci.git .molecule-ci
- uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065 # v5
with:
python-version: "3.11"
- run: pip install pyyaml -q
- name: Validate plugin contract
run: python3 .molecule-ci/.molecule-ci/scripts/validate-plugin.py
- name: Check for secrets
run: python3 .molecule-ci/.molecule-ci/scripts/check-secrets.py
+84
View File
@@ -0,0 +1,84 @@
# CANONICAL consumer ci.yml for workspace-template repos — molecule-ai/molecule-ci SSOT.
#
# This is the file NEW workspace-template repos inherit. It standardizes the
# emitted commit-status context to `CI / validate` (workflow `name: CI` + a
# job whose status display-name is `validate`), so a single canonical
# branch-protection required context — `CI / validate (pull_request)` —
# works fleet-wide. See molecule-ci .gitea/workflows/bp-context-drift-gate.yml
# and the design doc bp-drift-durable-fix.md for the drift root cause this
# resolves (a BP-required context with no emitter = perma-pending = HTTP 405
# merge-block forever).
#
# WHY INLINE (not `uses: molecule-ai/molecule-ci/.gitea/workflows/...`):
# cross-repo `uses:` (workflow_call) does NOT resolve on Gitea 1.22.6 —
# [actions].DEFAULT_ACTIONS_URL=github routes the fetch to github.com where
# the `molecule-ai` org is suspended → 404/no-op. So the reusable
# validate-workspace-template.yml in molecule-ci is currently un-callable
# from a consumer. This template instead INLINES the validate job: it
# anon-clones the public molecule-ci SSOT at CI time and runs the canonical
# validator script directly. Same single-source-of-truth (the validator
# lives in molecule-ci, fetched fresh on every run), no cross-repo `uses:`.
#
# When the operator-host actions/* mirror lands (internal task #109) and
# cross-repo `uses:` resolves, this inline job can collapse back to a
# `uses:` call WITHOUT changing the emitted `CI / validate` context.
#
# Fork-PR security: on EXTERNAL fork PRs the validator runs in --static-only
# mode (no pip install of the template's requirements.txt, no adapter.py
# import, no docker build) — those are arbitrary-code-execution primitives
# from an untrusted PR's perspective. Internal PRs and pushes get the full
# runtime validation. This mirrors the static/runtime split in the reusable
# validate-workspace-template.yml while still emitting the single
# `CI / validate` context.
#
# The SSOT is cloned into `.molecule-ci` (NOT `.molecule-ci-canonical`) so
# that the canonical check-secrets.py — whose SKIP_DIRS prunes `.molecule-ci`
# — does not scan molecule-ci's own fixtures and self-flag.
name: CI
on:
pull_request:
push:
branches: [main, staging]
workflow_dispatch: {}
permissions:
contents: read
jobs:
validate:
name: validate
runs-on: ubuntu-latest
timeout-minutes: 15
steps:
- uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v4
# Fetch the canonical validator from the molecule-ci SSOT. Anonymous
# clone of the public repo — see molecule-ci/.gitea/workflows/
# validate-plugin.yml for why a direct git-clone is used instead of
# actions/checkout for the cross-repo fetch on Gitea 1.22.6.
- name: Fetch molecule-ci canonical scripts
run: git clone --depth 1 https://git.moleculesai.app/molecule-ai/molecule-ci.git .molecule-ci
- uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065 # v5
with:
python-version: "3.11"
- run: pip install pyyaml -q
# Secret scan — always runs, including on external fork PRs (static,
# no code execution; the most important security check).
- name: Check for secrets
run: python3 .molecule-ci/.molecule-ci/scripts/check-secrets.py
# On external fork PRs: STATIC-ONLY validation (no pip install of the
# template's requirements.txt, no adapter.py import). Untrusted code.
- name: Validate workspace-template contract (static-only, fork PR)
if: github.event.pull_request.head.repo.fork == true
run: python3 .molecule-ci/.molecule-ci/scripts/validate-workspace-template.py --static-only
# Internal PRs and pushes: FULL runtime validation. Install the
# template's own runtime deps so the validator can import adapter.py
# the same way the workspace container does at boot.
- if: github.event.pull_request.head.repo.fork != true && hashFiles('requirements.txt') != ''
run: pip install -q -r requirements.txt
- if: github.event.pull_request.head.repo.fork != true && hashFiles('requirements.txt') == ''
run: pip install -q molecule-ai-workspace-runtime
- name: Validate workspace-template contract (full)
if: github.event.pull_request.head.repo.fork != true
run: python3 .molecule-ci/.molecule-ci/scripts/validate-workspace-template.py