5 Commits

Author	SHA1	Message	Date
Molecule AI Core-DevOps	df821c8258	fix(ci): sop-tier-check gracefully handles empty/invalid token ... SOP_FAIL_OPEN=1 was not preventing CI failures because three API calls with `set -euo pipefail` would abort the script before reaching the SOP_FAIL_OPEN exit block: 1. `WHOAMI=$(curl ... | jq -r ...)` — jq exits 1 on empty input, triggering set -e → script exits before SOP_FAIL_OPEN check. 2. `curl` for reviews — curl exits non-zero on 401 from empty token, triggering set -e → same problem. 3. `curl` for org teams list — same issue. Fix: add `|| true` to jq pipelines and `set +e` / `set -e` guards around curl calls that may fail with empty token. When SOP_FAIL_OPEN=1 and the token is invalid, the script now exits 0 instead of 1, preventing blocking CI failures on unconfigured runners. Refs: sop-tier-check failure on PRs #617, #621, #587, #562	2026-05-12 03:16:17 +00:00
Molecule AI Infra-SRE	7a731f6b42	fix(runbooks): correct Gitea runner fetch timing facts (post-#457) (#478) ... Co-authored-by: Molecule AI Infra-SRE <infra-sre@agents.moleculesai.app> Co-committed-by: Molecule AI Infra-SRE <infra-sre@agents.moleculesai.app>	2026-05-11 13:45:42 +00:00
Molecule AI Core-DevOps	94b08ef0de	docs(runbooks): add Gitea Actions operational quirks reference ... Documents four persistent operational findings from the 2026-05-11 Gitea migration and CI noise investigation: 1. Runner network isolation (git remote unreachable from container) 2. continue-on-error only works at step level, not job level 3. workflow_dispatch.inputs not supported 4. fetch-depth:0 on actions/checkout times out References PR #441 (harness-replays detect-changes fix) and Task #173 (pre-clone manifest deps pattern). Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>	2026-05-11 12:25:54 +00:00
claude-ceo-assistant	ae30cdef87	refactor(ci): drop "canary-" prefix → staging-smoke/staging-verify (Hongming directive 2026-05-11) (#443) ... Co-authored-by: claude-ceo-assistant <claude-ceo-assistant@agents.moleculesai.app> Co-committed-by: claude-ceo-assistant <claude-ceo-assistant@agents.moleculesai.app>	2026-05-11 11:25:29 +00:00
dev-lead	f0745619d2	ci: retire 6 .github/workflows GitHub-only files + add migration runbook (RFC internal#219 §1, Category B) ... Sweep companion to PR#372 + PR#378 (Cat A). These six .github/workflows files depend on GitHub-specific surface that Gitea does not provide: - auto-tag-runtime.yml — superseded by .gitea/publish-runtime-autobump.yml for patch bumps. Release:minor/major label-driven bumps are lost; follow-up issue suggested if anyone uses them. - branch-protection-drift.yml — drift_check.sh + apply.sh target Molecule-AI/molecule-core via `gh api` against GitHub's branch-protection schema. Gitea's schema differs; rebuilding is out of scope. Follow-up issue needed. - check-merge-group-trigger.yml — file's own header documents this is a structural no-op on Gitea (no merge queue, no `merge_group:` event type, no gh-readonly-queue refs). - codeql.yml — file's own header documents CodeQL Action incompatibility (github/codeql-action hits api.github.com bundle endpoints not implemented by Gitea). Per Hongming decision 2026-05-07 task #156 CodeQL is non-blocking until Gitea-compatible SAST lands. - pr-guards.yml — file's own header documents that Gitea has no `gh pr merge --auto` primitive; guard is a no-op. Branch protection on main doesn't require the pr-guards check name. - promote-latest.yml — uses imjasonh/setup-crane against ghcr.io, which was retired during the 2026-05-06 migration in favor of ECR (per canary-verify.yml header notes). Workflow has nothing left to retag. Also adds runbooks/gitea-actions-migration-checklist.md documenting: - Four-surface audit pattern (feedback_gitea_actions_migration_audit_pattern) - Category A/B/C/D file lists with rationale - Verification steps after all sweep PRs land - Cross-link to follow-up issues (label-driven bumps, Gitea-compatible drift detection, ECR-based promote) Branch protection check: required status checks on main are only `Secret scan / Scan diff for credential-shaped strings (pull_request)` and `sop-tier-check / tier-check (pull_request)`. No deleted file's job name appears in required_status_checks. DO NOT MERGE without orchestrator-dispatched Five-Axis review + @hongmingwang chat-go. Cross-links: - RFC: molecule-ai/internal#219 - Companion: PR#372 (ci.yml port), PR#378 (Cat A mirrored deletions) Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>	2026-05-10 21:12:29 -07:00