hongming-ceo-delegatedandClaude Opus 5.5
5ab27be33e
Block internal-flavored paths / Block forbidden paths (push) Skipped
CI / Detect changes (push) Skipped
CI / Platform (Go) (push) Skipped
CI / Canvas (Next.js) (push) Skipped
CI / Shellcheck (E2E scripts) (push) Skipped
CI / Canvas Deploy Status (push) Skipped
CI / Python Lint & Test (push) Skipped
CI / all-required (push) Skipped
Concierge Creates Workspace Hermetic / Concierge Creates Workspace Hermetic (push) Skipped
E2E API Smoke Test / detect-changes (push) Skipped
E2E API Smoke Test / E2E API Smoke Test (push) Skipped
E2E Chat / E2E Chat (push) Skipped
Handlers Postgres Integration / Handlers Postgres Integration (push) Skipped
Harness Replays / detect-changes (push) Skipped
Harness Replays / Harness Replays (push) Skipped
lint-bp-context-emit-match / lint-bp-context-emit-match (push) Skipped
lint-continue-on-error-tracking / lint-continue-on-error-tracking (push) Skipped
Lint schedule budget / Zero-cron ratchet (push) Skipped
Local Provision Lifecycle E2E / Local Provision Lifecycle E2E (stub) (push) Skipped
main-canary / canary (push) Skipped
merge-commit-guard / Verify merged PR commits are on main (push) Skipped
pin-provenance-guard / Pin provenance (push) Skipped
publish-canvas-image / Build & push canvas image (push) Skipped
publish-desktop-image / Build & push desktop image (push) Skipped
publish-desktop-image / Promote desktop :latest to CI-green build (push) Skipped
publish-workspace-server-image / Build & push tenant image (push) Skipped
runtime-default-flip-gate / flip-gate (push) Skipped
sdk-pin-drift / SDK consumer pin vs molecule-ai-sdk main (push) Skipped
sdk-route-milestone-contract-drift / SDK route + milestone derive-gates (push) Skipped
SECRET_PATTERNS drift lint / Detect SECRET_PATTERNS drift (push) Skipped
Secret scan / Scan diff for credential-shaped strings (push) Skipped
Self-Host Concierge Schedules E2E / Self-Host Concierge Schedules E2E (stub) (push) Skipped
staging-tenant-cd / await-image (staging-<sha> published) (push) Skipped
staging-tenant-cd / advance-pin (staging tenant image DB pin) (push) Skipped
staging-tenant-cd / rollback-pin (revert pin if the fleet roll failed) (push) Skipped
verify-providers-gen / Regenerate providers artifact and fail on drift (push) Skipped
SECRET_PATTERNS drift lint / Detect SECRET_PATTERNS drift (pull_request) Skipped
Block integration-tester contamination artifacts / Block staging-trigger / invalid manifest contamination (push) Skipped
boot-to-registration-e2e / Minimal cell (SSOT runtime + molecules-server) (push) Skipped
ci-required-drift / drift (push) Skipped
contract-ssot-sync / Verify vendored plugin-manifest schema matches the molecule-ai-sdk SSOT (push) Skipped
cron-fixtures-ssot-drift / Verify vendored cron fixtures are byte-identical to the molecule-ai-sdk SSOT (push) Skipped
design-token-drift / Canvas ↔ app design-token SSOT drift (push) Skipped
E2E Ephemeral CP Happy Path / detect (push) Skipped
E2E Ephemeral CP Happy Path / E2E Ephemeral CP Happy Path (push) Skipped
E2E External Connect-Snippet + Leak-Lint / E2E External Connect-Snippet + Leak-Lint (push) Skipped
E2E Workspace Lifecycle (staginge2e) / E2E Workspace Lifecycle (compile+skip) (push) Skipped
Handlers Postgres Integration / detect-changes (push) Skipped
Lint forbidden tenant-env keys / Scan for repo-host token write into tenant workspace surface (push) Skipped
Lint forbidden hand-written mcp__ tool-id literals / Scan for hand-written mcp__ tool-id literals (push) Skipped
lint-no-coe-on-required / lint-no-coe-on-required (push) Skipped
lint-phantom-gate / lint-phantom-gate (push) Skipped
Lint publish-runner timeout-minutes / Lint publish-runner timeout-minutes (push) Skipped
lint-required-workflows-docker-host-pinned / Lint docker-host pin on docker-touching workflows (push) Skipped
lint-setup-go-cache / lint-setup-go-cache (push) Skipped
lint-staging-tenant-cd-gate-chain / lint-staging-tenant-cd-gate-chain (push) Skipped
Lint workflow YAML (repository compatibility policy) / Lint workflow YAML for repository compatibility policy (push) Skipped
Local Provision Lifecycle E2E / Local Provision Lifecycle E2E (real image + MiniMax LLM, advisory) (push) Skipped
mcp-plugin-delivery-contract-drift / Compare MCP plugin delivery contract against template and runtime canonicals (push) Skipped
nodup-lint / no-duplication (push) Skipped
provision-request-ssot-sync / Verify core's provision-request mirror matches the molecule-ai-sdk SSOT (push) Skipped
publish-workspace-server-image / Promote tenant :latest to CI-green build (push) Skipped
staging-tenant-cd / redeploy-fleet (roll staging tenants, session-preserving) (push) Skipped
staging-tenant-cd / runtime-image-readiness (exact promoted digests served by the registry) (push) Skipped
staging-tenant-cd / e2e-smoke (staging real provision + A2A HARD GATE) (push) Skipped
Ops Scripts Tests / Ops scripts (unittest) (push) Skipped
Lint curl status-code capture / Scan workflows for curl status-capture pollution (push) Skipped
lint-env-coupling-dismissal / lint-env-coupling-dismissal (push) Skipped
Lint forbidden tenant-env keys / Scan workspace_secrets writers for forbidden env keys (push) Skipped
mcp-verb-published-manifest / Published mcp-server manifest ⊇ contract required verbs (push) Skipped
staging-tenant-cd / rollback-audit (prove rollback-pin itself actually executed) (push) Skipped
Sweep stale e2e-* orgs (staging) / Sweep e2e orgs (push) Skipped
sync-providers-yaml / Verify SDK registry dependency (push) Skipped
template-delivery-e2e / detect-changes (push) Skipped
template-delivery-e2e / Template-asset delivery (fresh seo-agent — config+prompts via asset channel, seo-all via plugin reconcile) (push) Skipped
Block internal-flavored paths / Block forbidden paths (pull_request) Successful in 3s
Block integration-tester contamination artifacts / Block staging-trigger / invalid manifest contamination (pull_request) Successful in 4s
CI / Python Lint & Test (pull_request) Successful in 3s
CI / Detect changes (pull_request) Successful in 7s
Handlers Postgres Integration / detect-changes (pull_request) Successful in 5s
E2E API Smoke Test / detect-changes (pull_request) Successful in 7s
Lint curl status-code capture / Scan workflows for curl status-capture pollution (pull_request) Successful in 6s
E2E Ephemeral CP Happy Path / detect (pull_request) Successful in 8s
boot-to-registration-e2e / Minimal cell (SSOT runtime + molecules-server) (pull_request) Skipped
Check migration collisions / Migration version collision check (pull_request) Skipped
contract-ssot-sync / Verify vendored plugin-manifest schema matches the molecule-ai-sdk SSOT (pull_request) Skipped
cron-fixtures-ssot-drift / Verify vendored cron fixtures are byte-identical to the molecule-ai-sdk SSOT (pull_request) Skipped
design-token-drift / Canvas ↔ app design-token SSOT drift (pull_request) Skipped
E2E External Connect-Snippet + Leak-Lint / E2E External Connect-Snippet + Leak-Lint (pull_request) Skipped
E2E Workspace Lifecycle (staginge2e) / E2E Workspace Lifecycle (compile+skip) (pull_request) Skipped
Harness Replays / detect-changes (pull_request) Skipped
Harness Replays / Harness Replays (pull_request) Skipped
manifest-entry-existence-check / Verify manifest entries exist on Gitea (pull_request) Skipped
mcp-plugin-delivery-contract-drift / Compare MCP plugin delivery contract against template and runtime canonicals (pull_request) Skipped
mcp-verb-published-manifest / Published mcp-server manifest ⊇ contract required verbs (pull_request) Skipped
nodup-lint / no-duplication (pull_request) Skipped
provision-request-ssot-sync / Verify core's provision-request mirror matches the molecule-ai-sdk SSOT (pull_request) Skipped
Self-Host Concierge Schedules E2E / Self-Host Concierge Schedules E2E (stub) (pull_request) Skipped
sync-providers-yaml / Verify SDK registry dependency (pull_request) Skipped
verify-providers-gen / Regenerate providers artifact and fail on drift (pull_request) Skipped
Lint forbidden tenant-env keys / Scan workspace_secrets writers for forbidden env keys (pull_request) Successful in 5s
Lint forbidden tenant-env keys / Scan for repo-host token write into tenant workspace surface (pull_request) Successful in 4s
Lint forbidden hand-written mcp__ tool-id literals / Scan for hand-written mcp__ tool-id literals (pull_request) Successful in 4s
Concierge Creates Workspace Hermetic / Concierge Creates Workspace Hermetic (pull_request) Successful in 19s
lint-continue-on-error-tracking / lint-continue-on-error-tracking (pull_request) Successful in 29s
Lint publish-runner timeout-minutes / Lint publish-runner timeout-minutes (pull_request) Successful in 20s
Lint pre-flip continue-on-error / Verify continue-on-error flips have run-log proof (pull_request) Successful in 21s
lint-phantom-gate / lint-phantom-gate (pull_request) Successful in 23s
lint-mask-pr-atomicity / lint-mask-pr-atomicity (pull_request) Successful in 28s
lint-env-coupling-dismissal / lint-env-coupling-dismissal (pull_request) Successful in 36s
lint-required-workflows-docker-host-pinned / Lint docker-host pin on docker-touching workflows (pull_request) Successful in 5s
ci-required-drift / drift (pull_request) Successful in 41s
lint-required-context-exists-in-bp / lint-required-context-exists-in-bp (pull_request) Successful in 21s
lint-bp-context-emit-match / lint-bp-context-emit-match (pull_request) Successful in 40s
lint-no-coe-on-required / lint-no-coe-on-required (pull_request) Successful in 33s
lint-required-no-paths / lint-required-no-paths (pull_request) Successful in 17s
E2E API Smoke Test / E2E API Smoke Test (pull_request) Successful in 6s
Lint schedule budget / Zero-cron ratchet (pull_request) Successful in 22s
lint-setup-go-cache / lint-setup-go-cache (pull_request) Successful in 21s
Handlers Postgres Integration / Handlers Postgres Integration (pull_request) Successful in 6s
lint-staging-tenant-cd-gate-chain / lint-staging-tenant-cd-gate-chain (pull_request) Successful in 22s
Secret scan / Scan diff for credential-shaped strings (pull_request) No credential-shaped strings (deterministic re-assert)
Secret scan / Scan diff for credential-shaped strings (pull_request) Successful in 9s
template-delivery-e2e / detect-changes (pull_request) Successful in 9s
Lint workflow YAML (repository compatibility policy) / Lint workflow YAML for repository compatibility policy (pull_request) Successful in 30s
pin-provenance-guard / Pin provenance (pull_request) Successful in 24s
template-delivery-e2e / Template-asset delivery (fresh seo-agent — config+prompts via asset channel, seo-all via plugin reconcile) (pull_request) Successful in 5s
sdk-pin-drift / SDK consumer pin vs molecule-ai-sdk main (pull_request) Successful in 21s
sdk-route-milestone-contract-drift / SDK route + milestone derive-gates (pull_request) Successful in 22s
lint-context-set-shrink / lint-context-set-shrink (pull_request) Successful in 1m30s
Local Provision Lifecycle E2E / Local Provision Lifecycle E2E (stub) (pull_request) Successful in 1m8s
Local Provision Lifecycle E2E / Local Provision Lifecycle E2E (real image + MiniMax LLM, advisory) (pull_request) Successful in 1m10s
Ops Scripts Tests / Ops scripts (unittest) (pull_request) Successful in 2m13s
E2E Chat / E2E Chat (pull_request) Successful in 3m51s
CI / Canvas (Next.js) (pull_request) Successful in 5m53s
CI / Canvas Deploy Status (pull_request) Successful in 1s
CI / Shellcheck (E2E scripts) (pull_request) Successful in 6m48s
CI / Platform (Go) (pull_request) Successful in 8m13s
CI / all-required (pull_request) Successful in 3s
E2E Ephemeral CP Happy Path / E2E Ephemeral CP Happy Path (pull_request) Successful in 27m42s
Both control planes provision on k8s (staging k8s=1, prod k8s=9, docker=0), and molecule-local-host (the Docker endpoint the local-deploy runner pointed at) is gone. Every staging-tenant-cd run since 10-13 failed at the daemon fingerprint, its rollback failed the same way, and the prod release lane has no qualified staging run to promote. - redeploy-fleet and rollback-pin roll with redeploy-staging-fleet.sh --k8s-only, which never contacts Docker; a census row on any other substrate stops the roll before the first mutation. - runtime-image-readiness verifies that the registry serves every promoted runtime digest (manifest bytes hash to the digest, registry credential sent only to the canonical host) instead of pulling onto a daemon that runs no workspaces (internal#1207). - require-local-deploy-daemon.sh is removed; the gate-chain lint, tests and docs follow. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
52 lines
1.8 KiB
YAML
52 lines
1.8 KiB
YAML
name: lint-staging-tenant-cd-gate-chain
|
|
|
|
# Static gate-shape lint for the gated staging tenant CD pipeline. Reuses the
|
|
# same behavior-based (needs-graph) approach as the control-plane's
|
|
# lint_deploy_gate_chain.py, encoding the tenant CD contract:
|
|
#
|
|
# - advance-pin directly needs await-image
|
|
# - redeploy-fleet directly needs advance-pin
|
|
# - runtime-image-readiness needs advance-pin and runs the exact
|
|
# registry-verification consumer on local-deploy
|
|
# - e2e-smoke directly needs both redeploy-fleet and readiness
|
|
# - no continue-on-error on any gating job or step
|
|
# - no provider-specific CP deploy/reload adapter in tenant-image CI
|
|
#
|
|
# A future edit that drops either pre-E2E path, moves readiness off local-deploy,
|
|
# masks a gate failure with continue-on-error, or reintroduces Railway/other
|
|
# provider-specific CP deploy wiring into this tenant-image workflow FAILS this
|
|
# lint.
|
|
#
|
|
# No paths: filter — a genuine gate, runs on every PR (merge-blocking via
|
|
# ci / all-required).
|
|
|
|
on:
|
|
pull_request:
|
|
types: [opened, synchronize, reopened]
|
|
push:
|
|
branches: [main, staging]
|
|
|
|
permissions:
|
|
contents: read
|
|
|
|
concurrency:
|
|
group: lint-staging-tenant-cd-gate-chain-${{ github.event.pull_request.number || github.ref }}
|
|
cancel-in-progress: true
|
|
|
|
jobs:
|
|
lint:
|
|
name: lint-staging-tenant-cd-gate-chain
|
|
runs-on: ubuntu-latest
|
|
timeout-minutes: 5
|
|
steps:
|
|
- uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
|
|
with:
|
|
fetch-depth: 1
|
|
- uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065 # v5.6.0
|
|
with:
|
|
python-version: '3.12'
|
|
- name: Install PyYAML
|
|
run: python -m pip install --quiet 'PyYAML==6.0.2'
|
|
- name: Lint staging tenant CD gate chain
|
|
run: python3 .gitea/scripts/lint_staging_tenant_cd_gate_chain.py
|