molecule-core/.gitea/workflows/lint-continue-on-error-tracking.yml

name: lint-continue-on-error-tracking

# Tier 2e hard-gate lint (per mc#1982) — every
# `continue-on-error: true` in `.gitea/workflows/*.yml` must carry a
# `# mc#NNNN` or `# internal#NNNN` tracker comment within 2 lines,
# the referenced issue must be OPEN, and ≤14 days old.
#
# Why this exists
# ---------------
# `continue-on-error: true` on `platform-build` had been hiding
# mc#1982-class regressions for ~3 weeks before #656 surfaced them on
# 2026-05-12. A 14-day cap on tracker age forces a review cycle and
# surfaces mask-drift within at most 14 days of the original defect.
# Each `continue-on-error: true` gets a paper trail — close or renew.
#
# How the gate works
# ------------------
# 1. Walk `.gitea/workflows/*.yml` via PyYAML's line-tracking loader
#    (per `feedback_behavior_based_ast_gates`) and find every job
#    whose `continue-on-error` evaluates truthy (`true` or string
#    `"true"` — Gitea's evaluator coerces strings).
# 2. For each, scan ±2 lines of the directive's source line for a
#    `# mc#NNNN` or `# internal#NNNN` comment. Inline-trailing
#    comments on the directive line count.
# 3. For each tracker reference, GET the issue from the Gitea API.
#    Validate: exists, `state == open`, `created_at` ≤ MAX_AGE_DAYS.
# 4. Aggregate ALL violations (not short-circuit) and exit 1 if any.
#
# Triggers
# --------
# Runs on PR events (paths-filter on `.gitea/workflows/**`) AND on
# a daily schedule. PR runs catch the violation at introduction time.
# Schedule runs catch the AGE-EXPIRY class: a tracker that was ≤14d
# old when the PR landed but is now 20d old, with the underlying
# defect still unfixed. Per `feedback_chained_defects_in_never_tested_workflows`,
# scheduled drift detection is the second half of the gate.
#
# Phase contract (RFC internal#219 §1 ladder)
# -------------------------------------------
# Now at Phase 4 (`continue-on-error: false` — BLOCKING). The Phase-3
# burndown is complete: every job-level `continue-on-error: true` on
# `main` carries an OPEN, ≤14-day tracker, so this lint runs green when
# enforcing. A future mask that lands untracked, closes its tracker, or
# lets it age past 14 days will now RED the run and block merge — which
# is the whole point of the meta-gate. Tracking: mc#1982.
#
# Cross-links
# -----------
# - mc#1982 (the RFC that specs this lint)
# - mc#1982 (the empirical masked-3-weeks case)
# - feedback_chained_defects_in_never_tested_workflows
# - feedback_behavior_based_ast_gates
# - feedback_strict_root_only_after_class_a
#
# Auth: DRIFT_BOT_TOKEN — same persona used by ci-required-drift.yml
# (provisioned under internal#329). Auto-injected GITHUB_TOKEN is
# insufficient because `internal#NNN` references cross repositories
# (molecule-core → molecule-ai/internal).

on:
  pull_request:
    types: [opened, synchronize, reopened]
    paths:
      - '.gitea/workflows/**'
      - '.gitea/scripts/lint_continue_on_error_tracking.py'
      - 'tests/test_lint_continue_on_error_tracking.py'
  push:
    branches: [main, staging]
    paths:
      - '.gitea/workflows/**'
      - '.gitea/scripts/lint_continue_on_error_tracking.py'
  workflow_dispatch:

env:
  GITHUB_SERVER_URL: https://git.moleculesai.app

permissions:
  contents: read

concurrency:
  group: lint-coe-tracking-${{ github.event.pull_request.number || github.ref }}
  cancel-in-progress: true

jobs:
  # bp-exempt: meta-lint for masked jobs; tracked separately until masks are burned down.
  lint:
    name: lint-continue-on-error-tracking
    runs-on: ubuntu-latest
    timeout-minutes: 20
    # Phase 4 (RFC #219 §1): the keystone is now BLOCKING. Every job-level
    # `continue-on-error: true` on main currently carries an OPEN, ≤14-day
    # tracker (verified 2026-07-11: all 23 masks reference mc#3436 / mc#3616 /
    # mc#3617 / mc#3760, each open and within the 14d cap), so this lint passes
    # green when enforcing. Keeping it masked would let the meta-gate itself rot
    # undetected — the exact class it exists to prevent. Flipped true→false.
    continue-on-error: false
    steps:
      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd  # v6.0.2
      - uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065  # v5.6.0
        with:
          python-version: '3.12'
      - name: Install PyYAML
        run: python -m pip install --quiet 'PyYAML==6.0.2'
      # KMS consolidation (#971/#3274 pattern): the lint below previously read
      # the per-bot Gitea Actions secret `DRIFT_BOT_TOKEN`. We now fetch the
      # consolidated DRIFT_BOT_TOKEN from the Infisical SSOT (prod
      # /shared/drift-bot) via the CI machine identity and export it to
      # $GITHUB_ENV. The lint keeps reading it under the GITEA_TOKEN env var
      # name it already expects, so the script is unchanged. The old
      # DRIFT_BOT_TOKEN Gitea secret is left in place until a green run
      # validates this path (validate-before-delete).
      #
      # Trust boundary: molecule-core PRs are same-repo (not forks), so the
      # INFISICAL_CI_* machine-identity secrets are present on pull_request /
      # push — the same assumption the prior direct consumption made.
      - name: Fetch DRIFT_BOT_TOKEN from Infisical SSOT
        env:
          INFISICAL_CI_CLIENT_ID: ${{ secrets.INFISICAL_CI_CLIENT_ID }}
          INFISICAL_CI_CLIENT_SECRET: ${{ secrets.INFISICAL_CI_CLIENT_SECRET }}
          INFISICAL_PROJECT_ID: ${{ secrets.INFISICAL_CI_PROJECT_ID }}
        run: |
          set -uo pipefail
          BASE="https://key.moleculesai.app"
          TOK=$(curl -fsS -X POST "$BASE/api/v1/auth/universal-auth/login" \
            -H 'Content-Type: application/json' \
            -d "{\"clientId\":\"$INFISICAL_CI_CLIENT_ID\",\"clientSecret\":\"$INFISICAL_CI_CLIENT_SECRET\"}" \
            | python3 -c 'import sys,json; v=json.load(sys.stdin).get("accessToken"); sys.stdout.write(v if isinstance(v,str) else "")')
          if [ -z "$TOK" ]; then echo "::error::Infisical accessToken empty - failing closed"; exit 1; fi
          read_secret() {
            curl -fsS "$BASE/api/v3/secrets/raw/$1?workspaceId=$INFISICAL_PROJECT_ID&environment=prod&secretPath=$2" \
              -H "Authorization: Bearer $TOK" \
              | python3 -c 'import sys,json; v=json.load(sys.stdin).get("secret",{}).get("secretValue"); sys.stdout.write(v if isinstance(v,str) else "")'
          }
          DRIFT_BOT_TOKEN=$(read_secret DRIFT_BOT_TOKEN %2Fshared%2Fdrift-bot)
          echo "::add-mask::$DRIFT_BOT_TOKEN"
          if [ -z "$DRIFT_BOT_TOKEN" ]; then
            echo "::error::Infisical returned empty DRIFT_BOT_TOKEN at prod /shared/drift-bot — failing closed."
            exit 1
          fi
          echo "DRIFT_BOT_TOKEN=$DRIFT_BOT_TOKEN" >> "$GITHUB_ENV"
          echo "DRIFT_BOT_TOKEN loaded from Infisical (len=${#DRIFT_BOT_TOKEN})"
      - name: Run lint-continue-on-error-tracking
        env:
          # KMS consolidation: now arrives via $GITHUB_ENV from the fetch step
          # above (was secrets.DRIFT_BOT_TOKEN).
          GITEA_TOKEN: ${{ env.DRIFT_BOT_TOKEN }}
          GITEA_HOST: git.moleculesai.app
          REPO: ${{ github.repository }}
          INTERNAL_REPO: molecule-ai/internal
          WORKFLOWS_DIR: .gitea/workflows
          MAX_AGE_DAYS: '14'
        run: python3 .gitea/scripts/lint_continue_on_error_tracking.py
      - name: Run lint-continue-on-error-tracking unit tests
        run: |
          python -m pip install --quiet pytest
          python3 -m pytest tests/test_lint_continue_on_error_tracking.py -v