molecule-core/.gitea/workflows/lint-no-coe-on-required.yml

name: lint-no-coe-on-required

# Static workflow-shape lint: forbid `continue-on-error: true` on any job
# that emits a REQUIRED branch-protection status context. Makes SOP#765
# mechanical (the mc#1982 masking incident).
#
# Forbidden shape
# ---------------
# A job in `.gitea/workflows/*.yml` that is BOTH continue-on-error: true
# AND emits a context in `.gitea/required-contexts.txt` (the checked-in
# SSOT of merge-required contexts).
#
# Why this rule exists (mc#1982 / SOP#765)
# ----------------------------------------
# `continue-on-error: true` makes a failed step roll up to a SUCCESS job
# status (Gitea Quirk #10). On a REQUIRED context that silently converts
# a real failure into a green gate — continue-on-error on platform-build
# masked regressions for ~3 weeks before #656 surfaced them. SOP#765
# banned it on required jobs; this lint enforces it at PR time.
#
# Required-context SSOT + drift guard
# -----------------------------------
# `.gitea/required-contexts.txt` is authoritative (CI cannot always read
# branch_protections — cp returns 403). When a repo-admin token is
# present (DRIFT_BOT_TOKEN) the lint ALSO live-reads BP and fails if the
# checked-in allowlist has DRIFTED from live BP. A 403/absent token
# degrades gracefully to allowlist-only (warn, not fail).
#
# Not path-filtered on the required-contexts file because BP can change
# out-of-band; the live cross-check catches that on every run.

on:
  pull_request:
    types: [opened, synchronize, reopened]
    paths:
      - '.gitea/workflows/**'
      - '.gitea/required-contexts.txt'
      - '.gitea/scripts/lint_no_coe_on_required.py'
      - 'tests/test_lint_no_coe_on_required.py'
  push:
    branches: [main, staging]
  workflow_dispatch:

env:
  GITHUB_SERVER_URL: https://git.moleculesai.app

permissions:
  contents: read

concurrency:
  group: lint-no-coe-on-required-${{ github.event.pull_request.number || github.ref }}
  cancel-in-progress: true

jobs:
  # bp-exempt: meta-lint guarding the required set; standalone red-status
  # lint, not itself a branch-protection required context.
  lint:
    name: lint-no-coe-on-required
    runs-on: ubuntu-latest
    timeout-minutes: 10
    steps:
      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
      - uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065 # v5.6.0
        with:
          python-version: '3.12'
      - name: Install PyYAML
        run: python -m pip install --quiet 'PyYAML==6.0.2'
      # KMS consolidation (#971/#3274 pattern): the lint below previously read
      # the per-bot Gitea Actions secret `DRIFT_BOT_TOKEN`. We now fetch the
      # consolidated DRIFT_BOT_TOKEN from the Infisical SSOT (prod
      # /shared/drift-bot) via the CI machine identity and export it to
      # $GITHUB_ENV. The lint keeps reading it under the GITEA_TOKEN env var
      # name it already expects, so the script is unchanged. The old
      # DRIFT_BOT_TOKEN Gitea secret is left in place until a green run
      # validates this path (validate-before-delete).
      #
      # Trust boundary: molecule-core PRs are same-repo (not forks), so the
      # INFISICAL_CI_* machine-identity secrets are present on pull_request /
      # push — the same assumption the prior direct consumption made.
      - name: Fetch DRIFT_BOT_TOKEN from Infisical SSOT
        env:
          INFISICAL_CI_CLIENT_ID: ${{ secrets.INFISICAL_CI_CLIENT_ID }}
          INFISICAL_CI_CLIENT_SECRET: ${{ secrets.INFISICAL_CI_CLIENT_SECRET }}
          INFISICAL_PROJECT_ID: ${{ secrets.INFISICAL_CI_PROJECT_ID }}
        run: |
          set -uo pipefail
          BASE="https://key.moleculesai.app"
          TOK=$(curl -fsS -X POST "$BASE/api/v1/auth/universal-auth/login" \
            -H 'Content-Type: application/json' \
            -d "{\"clientId\":\"$INFISICAL_CI_CLIENT_ID\",\"clientSecret\":\"$INFISICAL_CI_CLIENT_SECRET\"}" \
            | python3 -c 'import sys,json; v=json.load(sys.stdin).get("accessToken"); sys.stdout.write(v if isinstance(v,str) else "")')
          if [ -z "$TOK" ]; then echo "::error::Infisical accessToken empty - failing closed"; exit 1; fi
          read_secret() {
            curl -fsS "$BASE/api/v3/secrets/raw/$1?workspaceId=$INFISICAL_PROJECT_ID&environment=prod&secretPath=$2" \
              -H "Authorization: Bearer $TOK" \
              | python3 -c 'import sys,json; v=json.load(sys.stdin).get("secret",{}).get("secretValue"); sys.stdout.write(v if isinstance(v,str) else "")'
          }
          DRIFT_BOT_TOKEN=$(read_secret DRIFT_BOT_TOKEN %2Fshared%2Fdrift-bot)
          echo "::add-mask::$DRIFT_BOT_TOKEN"
          if [ -z "$DRIFT_BOT_TOKEN" ]; then
            echo "::error::Infisical returned empty DRIFT_BOT_TOKEN at prod /shared/drift-bot — failing closed."
            exit 1
          fi
          echo "DRIFT_BOT_TOKEN=$DRIFT_BOT_TOKEN" >> "$GITHUB_ENV"
          echo "DRIFT_BOT_TOKEN loaded from Infisical (len=${#DRIFT_BOT_TOKEN})"
      - name: Run lint-no-coe-on-required
        env:
          # KMS consolidation: now arrives via $GITHUB_ENV from the fetch step
          # above (was secrets.DRIFT_BOT_TOKEN).
          GITEA_TOKEN: ${{ env.DRIFT_BOT_TOKEN }}
          GITEA_HOST: git.moleculesai.app
          REPO: ${{ github.repository }}
        run: python3 .gitea/scripts/lint_no_coe_on_required.py
      - name: Run unit tests
        run: |
          python -m pip install --quiet pytest
          python3 -m pytest tests/test_lint_no_coe_on_required.py -q