molecule-core/.gitea/workflows/lint-workflow-yaml.yml

name: Lint workflow YAML (repository compatibility policy)

# Tier-2 hard-gate lint (RFC internal#219 §1, charter §SOP-N rule (m)).
# Enforces repository workflow-policy shapes before they reach `main`. Rules 1
# and 2 originated under the former Gitea 1.22.6 fleet; the current server
# supports additional syntax, but policy adoption requires an explicit
# fleet/status migration rather than an incidental workflow edit.
#
#   1. workflow_dispatch.inputs   — feedback_gitea_workflow_dispatch_inputs_unsupported
#                                   (2026-05-11 PyPI freeze 24h)
#   2. on: workflow_run           — not yet adopted by the status/reaper topology
#   3. name: containing "/"       — breaks status-context tokenization
#   4. cross-file name collision  — status-reaper rev1 fail-loud class
#                                   (status-reaper itself was REMOVED in
#                                    chore/delete-uninstalled-status-reaper; the
#                                    rule it motivated still stands)
#   5. cross-repo uses: org/r/p@r — feedback_gitea_cross_repo_uses_blocked
#                                   (DEFAULT_ACTIONS_URL=github → 404)
#   6. (WARN) api.github.com refs — feedback_act_runner_github_server_url
#                                   without workflow-level GITHUB_SERVER_URL
#
# Empirical history this hardens against:
#   - status-reaper rev1 caught rule-4 (name-collision) class
#   - sop-checklist DOA'd on rule-2 (workflow_run partial)
#   - #319 bootstrap-paradox (chained-defect class, related)
#   - internal#329 dispatcher race (adjacent)
#   - 2026-05-11 publish-runtime: rule-1, 24h PyPI freeze
#
# Triggers:
#   - pull_request: pre-merge gate — block hostile shapes before they land
#   - push: post-merge regression detection — catch direct-to-main edits
#
# Per RFC internal#219 §1 contract: continue-on-error: true during the
# surface-broken-shapes phase. Follow-up PR flips off after surfaced
# defects are triaged. The push-trigger ensures we catch regressions
# even if the pull_request gate is bypassed by branch-protection drift.

concurrency:
  # Auto-cancel a superseded run: a newer commit/event supersedes the old
  # one instead of leaving it queued forever (root fix for waiting-run pileup).
  # PR events group by PR number; push events group by ref.
  group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.ref }}
  cancel-in-progress: true
on:
  pull_request:
    paths:
      - '.gitea/workflows/**'
      - '.gitea/scripts/lint-workflow-yaml.py'
      - 'tests/test_lint_workflow_yaml.py'
      - 'tests/test_current_state_ci_docs.py'
  push:
    branches: [main, staging]
    paths:
      - '.gitea/workflows/**'
      - '.gitea/scripts/lint-workflow-yaml.py'
      - 'tests/test_lint_workflow_yaml.py'
      - 'tests/test_current_state_ci_docs.py'

# Belt-and-suspenders against runner default
# (feedback_act_runner_github_server_url).
env:
  GITHUB_SERVER_URL: https://git.moleculesai.app

jobs:
  # bp-required: pending #4392
  lint:
    # The live wildcard branch protection already gates every posted status.
    # #4392 tracks teaching Tier 2g that `*` covers this renamed context so the
    # directive can become `bp-required: yes` without a redundant literal.
    name: Lint workflow YAML for repository compatibility policy
    runs-on: ubuntu-latest
    # UNMASKED 2026-07-14 (was `continue-on-error: true`, the RFC #219 §1
    # "Phase 3" mask). The old comment promised a follow-up flip "after the 4
    # existing-on-main rule-2 (workflow_run) violations are migrated" — those
    # migrations landed long ago; the mask outlived its reason and left this
    # hard-gate lint unable to fail. It is now a real gate.
    #
    # Proven green before un-masking — the lint AND its unit tests, run locally
    # against this tree:
    #   $ python3 .gitea/scripts/lint-workflow-yaml.py
    #   ::notice::lint-workflow-yaml: 84 workflow file(s) checked, no fatal
    #     repository-policy violations. (0 heuristic warning(s) emitted.)  -> exit 0
    #   $ python3 -m pytest tests/test_lint_workflow_yaml.py -q  -> all pass
    steps:
      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd  # v6.0.2

      - uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405  # v6.2.0
        with:
          python-version: '3.11'

      - name: Install PyYAML
        run: pip install --quiet 'PyYAML>=6.0'

      - name: Lint .gitea/workflows/*.yml
        run: python3 .gitea/scripts/lint-workflow-yaml.py

      - name: Run lint-workflow-yaml unit tests
        run: |
          pip install --quiet pytest
          python3 -m pytest tests/test_lint_workflow_yaml.py tests/test_current_state_ci_docs.py -v