molecule-core/.gitea/workflows/lint-env-coupling-dismissal.yml

name: lint-env-coupling-dismissal

# No-flaky / env-coupling governance lint (task#233; SOP
# docs/engineering/testing-strategy.md §"No flaky, no environmental").
#
# Two mechanical checks over the PR's changed files:
#   1. A COE/incident/postmortem markdown doc may not dismiss a red as
#      "flaky"/"environmental" without naming a deterministic root cause.
#   2. A changed e2e file may not introduce a fixed sleep/setTimeout/time.Sleep
#      as a readiness wait without a real-signal poll (class-E coupling).
# Escape hatch for a genuine wait / correctly-labelled retro: an inline
# `lint-allow: env-coupling` marker.
#
# This is a standalone red-status lint (bp-exempt): it is NOT itself an
# enumerated branch-protection required context, so it never freezes the merge
# queue looking for a phantom emitter — but under the core/main [*] all-green
# wildcard gate a red here blocks merge, and the paired sop-checklist item
# `no-flaky-env-coupling` carries the human/agent review half.
#
# No API token needed: the scanners run on the git diff only.

on:
  pull_request:
    types: [opened, synchronize, reopened]
  push:
    branches: [main, staging]
  workflow_dispatch:

permissions:
  contents: read

concurrency:
  group: lint-env-coupling-dismissal-${{ github.event.pull_request.number || github.ref }}
  cancel-in-progress: true

jobs:
  # This job is a standalone red-status governance lint, enforced under the
  # core/main [*] all-green wildcard gate. It is NOT an enumerated branch-
  # protection required context, so it never freezes the merge queue looking
  # for a phantom emitter; the review half rides the paired sop-checklist item
  # `no-flaky-env-coupling`.
  # bp-exempt: no-flaky/env-coupling governance lint, not a gate context.
  lint:
    name: lint-env-coupling-dismissal
    runs-on: ubuntu-latest
    timeout-minutes: 10
    steps:
      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
        with:
          fetch-depth: 0
      - uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065 # v5.6.0
        with:
          python-version: '3.12'
      - name: Resolve diff base
        env:
          BASE_BRANCH: ${{ github.base_ref }}
        run: |
          set -uo pipefail
          if [ -n "${BASE_BRANCH:-}" ]; then
            # pull_request: diff the PR head against its target branch.
            git fetch --quiet origin "$BASE_BRANCH" || true
            echo "BASE_REF=origin/$BASE_BRANCH" >> "$GITHUB_ENV"
          else
            # push: diff against the previous commit on this ref.
            echo "BASE_REF=HEAD~1" >> "$GITHUB_ENV"
          fi
      - name: Run lint-env-coupling-dismissal
        env:
          BASE_REF: ${{ env.BASE_REF }}
        run: python3 .gitea/scripts/lint_env_coupling_dismissal.py
      - name: Run unit tests
        run: |
          python -m pip install --quiet pytest
          python3 -m pytest tests/test_lint_env_coupling_dismissal.py -q