Go to file

Hongming Wang 50e84f89e9 ci(publish): bump boot-smoke timeout to 90s/120s for SDK-init-wedge coverage Pairs with molecule-core PR #2473 (run_executor_smoke now consults runtime_wedge.is_wedged() at the end of every result path). 10s smoke timeout was shorter than claude-agent-sdk's 60s initialize() handshake — when a malformed CLI argv made the SDK spin on init (PR #25 in claude-code template), the outer wait_for fired first, run_executor_smoke saw "execution proceeding past imports → timeout → PASS" and shipped the broken image to GHCR. Bumping to 90s lets the SDK time itself out, the executor's wedge catch arm runs, and runtime_wedge.mark_wedged() flips the flag that smoke_mode now reads. Outer `timeout` bumped to 120s — the runner-level safety net stays slightly longer than the inner cap so a smoke_mode regression that doesn't terminate surfaces as exit 124 with a clear error, not just exit 1. Step comment names this calibration explicitly so a future contributor doesn't shrink it back without injecting a wedge in the smoke_mode unit tests first. Error message references runtime_wedge so a failure-mode reader knows where to look.		2026-05-01 17:48:51 -07:00
.github/workflows	ci(publish): bump boot-smoke timeout to 90s/120s for SDK-init-wedge coverage	2026-05-01 17:48:51 -07:00
.molecule-ci/scripts	fix(validator): address post-merge review findings on #17 + #18 (#19 )	2026-04-28 12:17:44 -07:00
docs	docs: pin reusable-workflow examples from @main to @v1 (P133)	2026-04-30 01:04:06 -07:00
scripts	ci: lock down validate-workspace-template against fork-PR untrusted code (P135)	2026-04-30 01:07:58 -07:00
.gitignore	chore: remove accidentally-committed __pycache__ + gitignore Python caches (#20 )	2026-04-28 12:18:46 -07:00
README.md	docs: pin reusable-workflow examples from @main to @v1 (P133)	2026-04-30 01:04:06 -07:00

README.md

molecule-ci

Shared CI workflows for the Molecule AI ecosystem. Every plugin, workspace template, and org template repo calls these reusable workflows to enforce a standard validation gate.

Usage

Plugin repos (`molecule-ai-plugin-*`)

# .github/workflows/ci.yml
name: CI
on: [push, pull_request]
jobs:
  validate:
    uses: Molecule-AI/molecule-ci/.github/workflows/validate-plugin.yml@v1

Workspace template repos (`molecule-ai-workspace-template-*`)

# .github/workflows/ci.yml
name: CI
on: [push, pull_request]
jobs:
  validate:
    uses: Molecule-AI/molecule-ci/.github/workflows/validate-workspace-template.yml@v1

Org template repos (`molecule-ai-org-template-*`)

# .github/workflows/ci.yml
name: CI
on: [push, pull_request]
jobs:
  validate:
    uses: Molecule-AI/molecule-ci/.github/workflows/validate-org-template.yml@v1

Any repo with auto-merge enabled

PR-time guards (currently: disable auto-merge on follow-up push). Consume from a thin caller:

# .github/workflows/pr-guards.yml
name: pr-guards
on:
  pull_request:
    types: [synchronize]
permissions:
  pull-requests: write
jobs:
  disable-auto-merge-on-push:
    uses: Molecule-AI/molecule-ci/.github/workflows/disable-auto-merge-on-push.yml@v1

When the team lands more PR-time guards in this repo, add them as additional jobs in the same caller — keeps each consuming repo's footprint to one file.

What each workflow validates

validate-plugin

Check	Severity	What it catches
`plugin.yaml` exists	Error	Missing manifest
Required fields (name, version, description)	Error	Incomplete plugin
Has content (SKILL.md, hooks/, skills/, or rules/)	Error	Empty plugin
SKILL.md starts with heading	Warning	Bad formatting
No committed secrets	Error	Leaked API keys
No build artifacts	Error	node_modules, pycache

validate-workspace-template

Check	Severity	What it catches
`config.yaml` exists	Error	Missing config
Required fields (name, runtime)	Error	Incomplete template
`template_schema_version: 1`	Error	Missing version contract
Known runtime check	Warning	Typo in runtime name
`adapter.py` imports molecule_runtime	Warning	Legacy imports
Dockerfile builds	Error	Broken image
molecule-ai-workspace-runtime dependency	Warning	Missing base package
No committed secrets	Error	Leaked API keys

validate-org-template

Check	Severity	What it catches
`org.yaml` exists	Error	Missing org definition
Required fields (name)	Error	Incomplete template
Workspace structure valid	Error	Malformed hierarchy
`files_dir` references exist	Warning	Broken system-prompt paths
`template_schema_version` present	Warning	Missing version contract
No committed secrets	Error	Leaked API keys

disable-auto-merge-on-push

PR-time safety guard. When pull_request:synchronize fires (= a new commit pushed to an open PR) and auto-merge is already enabled, this workflow disables auto-merge and posts a comment requiring the operator to re-engage explicitly.

Why it exists: on 2026-04-27, molecule-core PR #2174 auto-merged with only its first commit because the second commit was pushed AFTER the merge queue had locked the PR's SHA. The second commit ended up orphaned on a merged-and-deleted branch.

Pairs with the org-wide repo setting "Automatically delete head branches" (already enabled on all 10 Molecule-AI repos). Defense in depth:

Repo setting blocks pushes to a merged-and-deleted branch (catches the post-merge orphan case).
This workflow catches the in-queue race (push during queue processing) by force-disabling auto-merge.

Together they cover the full lifecycle of "auto-merge enabled → new commits arrive" without operator discipline.

False-positive note: if a CI bot pushes (dependency update, secret rotation), this also disables auto-merge. That's intentional — the operator who originally enabled auto-merge gets notified and re-engages, which is exactly the verify-after-machine-edits behavior we want.