3 Commits

Author	SHA1	Message	Date
core-devops	7932bc4c48	chore(ssot): delete dead .github/workflows/ — Gitea is SSOT (#331 SSOT-Instance-4) ... Per CTO directive 2026-05-20 and task #347 (disabled GitHub-mirror push fleet-wide), .github/workflows/ on molecule-core is dead — Gitea Actions reads .gitea/workflows/ exclusively (memory: reference_molecule_core_actions_gitea_only), and GitHub Actions has had no real push activity since 2026-05-06 (the only post-2026-05-06 runs are dynamic CodeQL re-runs on frozen pre-suspension PRs). Empirical validation: - 24 files total in .github/workflows/. - 23 have same-name siblings in .gitea/workflows/ (port carries "Ported from .github/workflows/X on 2026-05-11 per RFC internal#219" header on most files). - 1 .github-only file: canary-staging.yml — already ported to .gitea/workflows/staging-smoke.yml on 2026-05-11 per the same RFC, Hongming directive renamed canary→smoke. Verified via header comment in staging-smoke.yml. - Last GitHub-side push event: 2026-05-06T07:06:12Z (pre-suspension). - All 24 .github/workflows/* files removed. Tooling updates needed (load-bearing): - tools/branch-protection/check_name_parity.sh: hard-coded $REPO_ROOT/.github/workflows path → switched to .gitea/workflows. Pre-existing parity findings (3x Analyze CodeQL names absent from any workflow file) are unchanged — that drift exists pre-PR and is out-of-scope (file as follow-up). - tools/branch-protection/test_check_name_parity.sh: synthetic test fixtures now create .gitea/workflows/ instead of .github/workflows/. All 6 unit tests pass after change. - .gitea/workflows/lint-required-workflows-docker-host-pinned.yml: dropped '.github/workflows/**' from path-filter triggers + dropped '.github/workflows' from the python directory-walk loop (the isdir-check would have made this a no-op cleanly, but pruning reflects current truth). Out-of-scope (NOT touched in this PR): - .github/CODEOWNERS, .github/dependabot.yml, .github/scripts/ remain (task is scoped to .github/workflows/). - COVERAGE_FLOOR.md, workspace/smoke_mode.py, workspace/main.py contain comment references to .github/workflows/* — stale docs string-references only, not behavioral. Separate follow-up. - Provenance comments inside .gitea/workflows/* of the form "Ported from .github/workflows/X on 2026-05-11" are intentionally preserved — useful history. Refs: task #331 (SSOT-Instance-4), task #347 (mirror push disabled), memory reference_molecule_core_actions_gitea_only, memory reference_per_repo_gitea_vs_github_actions_dir, RFC internal#219 §1 (the original 2026-05-11 port sweep).	2026-05-20 09:29:33 -07:00
claude-ceo-assistant	00351b4551	fix(ci): repair docker-host guardrail follow-up	2026-05-18 19:50:13 -07:00
hongming	509bad2c68	ci: pin docker-bound workflows to docker-host + add lint guardrail ... Class defect (internal#512 + mc#1529 + today's oc#81/82/83 + autogen#8): the `ubuntu-latest` label is advertised by BOTH the Linux operator-host runners (molecule-runner-*) AND Windows act_runner v1.0.3 on hongming-pc-runner-*. Job placement is non-deterministic. When a docker-bound job lands on a Windows runner, `docker run`/`docker login`/`docker compose` fail with platform-specific errors and the job hard-fails — placement-dependent, not transient. Followon to mc#1543 (handlers-postgres-integration). Three more lanes needed the same pin: - e2e-api.yml: docker run/exec for postgres + redis containers - e2e-chat.yml: docker run/exec for postgres + redis containers - harness-replays.yml: docker compose ... ps/logs for tenant-alpha/beta canvas-deploy-reminder is NOT pinned — its `docker compose ...` only appears inside a markdown heredoc written to GITHUB_STEP_SUMMARY; it does not exec docker. Adds `lint-required-workflows-docker-host-pinned.yml` to catch future regressions: any workflow whose YAML touches `docker exec` or uses docker/* actions but doesn't pin every job's runs-on to `docker-host` or `publish` fails the lint. Comment-only mentions of docker are excluded (strip-`#` lines before regex). Fail-closed (per feedback_never_skip_ci). This eliminates the manual-pin maintenance burden the CTO flagged. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>	2026-05-18 18:42:33 -07:00