molecule-ai/molecule-core
39
0
Fork 2
Code Issues 23 Pull Requests 12 Actions 85 Packages Projects Releases Wiki Activity

fix(ci): ci-required-drift uses scoped mc-drift-bot token (mirrors controlplane)
Some checks failed
Block internal-flavored paths / Block forbidden paths (pull_request) Successful in 27s
Details
CI / Detect changes (pull_request) Successful in 1m39s
Details
E2E API Smoke Test / detect-changes (pull_request) Successful in 1m29s
Details
Lint curl status-code capture / Scan workflows for curl status-capture pollution (pull_request) Successful in 21s
Details
E2E Staging Canvas (Playwright) / detect-changes (pull_request) Successful in 1m29s
Details
Handlers Postgres Integration / detect-changes (pull_request) Successful in 1m27s
Details
Secret scan / Scan diff for credential-shaped strings (pull_request) Successful in 20s
Details
Runtime PR-Built Compatibility / detect-changes (pull_request) Successful in 1m19s
Details
gate-check-v3 / gate-check (pull_request) Successful in 33s
Details
qa-review / approved (pull_request) Failing after 27s
Details
sop-tier-check / tier-check (pull_request) Successful in 27s
Details
security-review / approved (pull_request) Failing after 36s
Details
CI / Platform (Go) (pull_request) Successful in 17s
Details
CI / Shellcheck (E2E scripts) (pull_request) Successful in 26s
Details
CI / Canvas (Next.js) (pull_request) Successful in 28s
Details
E2E API Smoke Test / E2E API Smoke Test (pull_request) Successful in 16s
Details
CI / Python Lint & Test (pull_request) Successful in 23s
Details
Handlers Postgres Integration / Handlers Postgres Integration (pull_request) Successful in 7s
Details
E2E Staging Canvas (Playwright) / Canvas tabs E2E (pull_request) Successful in 11s
Details
Runtime PR-Built Compatibility / PR-built wheel + import smoke (pull_request) Successful in 8s
Details
audit-force-merge / audit (pull_request) Successful in 21s
Details
CI / Canvas Deploy Reminder (pull_request) Has been skipped
Details
CI / all-required (pull_request) Successful in 6s
Details

Browse Source 
Companion to molecule-controlplane PR#134. The `ci-required-drift`
detector calls GET /repos/{owner}/{repo}/branch_protections/{branch},
which Gitea 1.22.6 gates behind the repo-ADMIN role. The previous
fallback chain (`secrets.SOP_TIER_CHECK_TOKEN || secrets.GITHUB_TOKEN`)
had only read or write — neither admin — so drift runs would 403.

Switch to `secrets.DRIFT_BOT_TOKEN`, owned by the new least-privilege
`mc-drift-bot` persona (team: drift-bot, permission: admin, scope:
read:repository,write:issue,read:organization, repos: this + CP).

Note: this repo's drift detector additionally requires the
`all-required` sentinel job in ci.yml, which is being added in PR#553.
After both PRs merge the drift workflow will be fully green.

Audit trail in internal#329. Sibling pattern: internal#327
(publish-runtime-bot). Per feedback_per_agent_gitea_identity_default.
This commit is contained in:
Molecule AI · core-devops 2026-05-11 12:47:51 -07:00
parent 9558b7d8fb
commit 02aed70291
1 changed files with 12 additions and 7 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

19
.gitea/workflows/ci-required-drift.yml
View File

@ -77,13 +77,18 @@ jobs:
run: python -m pip install --quiet 'PyYAML==6.0.2'
- name: Run drift detector
env:
# GITEA_TOKEN reads protection + writes issues. molecule-core
# uses `SOP_TIER_CHECK_TOKEN` as the org-level secret name for
# read-only Gitea API access from CI (set by audit-force-merge
# and sop-tier-check too). Falls back to the auto-injected
# GITHUB_TOKEN if the org-level secret isn't set
# (transitional repos).
GITEA_TOKEN: ${{ secrets.SOP_TIER_CHECK_TOKEN || secrets.GITHUB_TOKEN }}
# DRIFT_BOT_TOKEN is owned by mc-drift-bot, a least-privilege
# Gitea persona whose ONLY job is reading branch_protections
# and posting the [ci-drift] tracking issue. The endpoint
# `GET /repos/.../branch_protections/{branch}` requires
# repo-ADMIN role (Gitea 1.22.6) — SOP_TIER_CHECK_TOKEN and the
# auto-injected GITHUB_TOKEN do NOT have it (read-only / write
# without admin), so the previous fallback chain 403'd.
# Mirrors the controlplane fix landed in CP PR#134.
# Provisioning trail: internal#329 (audit) + parent pattern
# internal#327 (publish-runtime-bot). Per
# `feedback_per_agent_gitea_identity_default`.
GITEA_TOKEN: ${{ secrets.DRIFT_BOT_TOKEN }}
GITEA_HOST: git.moleculesai.app
REPO: ${{ github.repository }}
# Branches whose protection we compare against. molecule-core