5870 Commits

This Branch

This Branch

All Branches

Author	SHA1	Message	Date
devops-engineer	ca80e3cc91	Merge pull request 'fix(handlers/org_helpers_test): correct TestResolveInsideRoot_DotDotWithIntermediate to expect success' (#974) from fix/org-helpers-test-panic into main	2026-05-14 12:10:34 +00:00
Molecule AI Core-BE	6cbf880b04	fix(handlers/org_helpers_test): use t.Fatal in error-path tests + fix DotDotWithIntermediate logic ... Issue #965 regression. Fix 1 — nil-panic in error-path tests: Six resolveInsideRoot tests called t.Errorf then continued to err.Error() on a potentially-nil error. Replace t.Errorf/t.Error with t.Fatalf/t.Fatal in the nil-error branch so execution stops before the nil dereference: - TestResolveInsideRoot_EmptyUserPath - TestResolveInsideRoot_AbsolutePathRejected - TestResolveInsideRoot_DotDotTraversal - TestResolveInsideRoot_NestedDotDotEscapes - TestResolveInsideRoot_DotdotAtStart Fix 2 — TestResolveInsideRoot_DotDotWithIntermediate logic correction: a/b/../../c normalises to "c" — a valid descendant inside any root. The previous test expected an error (wrong: path does NOT escape). Rewrite to use t.TempDir() and assert the resolved path stays within root. Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>	2026-05-14 05:46:02 +00:00
devops-engineer	8026f02050	Merge pull request 'fix(handlers/org_helpers_test): use t.Fatal instead of t.Error in error-path tests' (#970) from fix/org-helpers-test-panic into main	2026-05-14 05:29:38 +00:00
Molecule AI Core-BE	95c62c6fcd	fix(handlers/org_helpers_test): use t.Fatal instead of t.Error in error-path tests ... Six resolveInsideRoot tests called t.Errorf then continued to err.Error() on a potentially-nil error — if err was unexpectedly nil, the subsequent err.Error() call would panic with nil pointer dereference. Fix: use t.Fatalf/t.Fatal in the nil-error branch so execution stops before the err.Error() call. Affects: - TestResolveInsideRoot_EmptyUserPath - TestResolveInsideRoot_AbsolutePathRejected - TestResolveInsideRoot_DotDotTraversal - TestResolveInsideRoot_DotDotWithIntermediate - TestResolveInsideRoot_NestedDotDotEscapes - TestResolveInsideRoot_DotdotAtStart Fixes regression reported in issue #965. Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>	2026-05-14 05:26:38 +00:00
devops-engineer	2c2b06edbc	Merge pull request 'test(handlers/delegation): add coverage for listDelegationsFromLedger + listDelegationsFromActivityLogs' (#967) from feat/delegation-list-tests into main	2026-05-14 05:18:33 +00:00
Molecule AI Core-BE	41d4da590f	test(handlers/delegation): add coverage for listDelegationsFromLedger + listDelegationsFromActivityLogs ... Add 13 unit tests covering the data-backend methods behind ListDelegations: - listDelegationsFromLedger (7 cases): empty result → nil, single row, multiple rows in order, NULL last_heartbeat/deadline/result_preview/error_detail omitted from map, query error → nil (graceful fallback), rows.Err() mid-stream, scan error on row → row skipped. - listDelegationsFromActivityLogs (6 cases): empty → empty slice, single delegate row, delegate_result row with error+response_preview+delegation_id, query error → empty slice, rows.Err(), scan error → row skipped. Both methods were untested (cf. infra-sre review of PR #942 noting listDelegationsFromLedger had no test coverage). Uses sqlmock, follows existing test patterns in delegation_test.go. Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>	2026-05-14 05:16:52 +00:00
devops-engineer	f6ea5741ce	Merge pull request 'fix(workspace): revert OFFSEC-003 test assertions — original expectations were correct' (#966) from fix/test-a2a-sanitization-v3 into main	2026-05-14 05:11:51 +00:00
Molecule AI Core-QA	6a0383bbf8	fix(workspace): revert OFFSEC-003 test assertions — original expectations were correct ... PR #946 incorrectly changed test assertions to expect ZWSP/regex-based stripping behavior that the production code never had. The actual sanitizer uses simple string replacement (e.g. [/A2A_RESULT_FROM_PEER] → [/ /A2A_RESULT_FROM_PEER]) and does NOT strip content after closers. Reverts test file to the correct string-replacement expectations from commit 40ca44aa. Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>	2026-05-14 05:03:36 +00:00
devops-engineer	6582c0964a	Merge pull request 'test(handlers/org_helpers): add security-critical test coverage for resolveInsideRoot, isSafeRoleName, mergeCategoryRouting' (#956) from feat/org-helpers-security-tests into main	2026-05-14 04:47:05 +00:00
Molecule AI Core-BE	9cd76919af	test(handlers/org_helpers): add security-critical test coverage ... Add 25 unit tests for three previously-uncovered pure helpers in org_helpers.go: - resolveInsideRoot (10 cases): empty path, absolute path, dotdot traversal, dotdot with intermediate, valid relative, exact root match, dot path component, nested dotdot escapes, dotdot at start, sibling directory (the filepath.Separator guard is exercised). - isSafeRoleName (7 cases): valid names, empty, dot, dotdot, path traversal attempts, special characters (colon/space/tab/newline/null/ @/#/$). Defense-in-depth for the persona env loader (OFFSEC-006 class). - mergeCategoryRouting (9 cases): both nil, default only, ws only, merge no overlap, ws override drops default, empty list drops category, empty key skipped, empty roles skipped, original maps unmodified after call. Go not available in container; CI runs the suite.	2026-05-14 04:45:13 +00:00
devops-engineer	0e549dfc55	Merge pull request 'ci: stop operational push jobs painting main red' (#962) from fix/main-push-operational-red into main	2026-05-14 04:44:43 +00:00
hongming-codex-laptop	dec1be237d	ci: preserve sop checklist concurrency update	2026-05-13 21:42:26 -07:00
hongming-codex-laptop	4491b07add	ci: narrow status reaper soft skip to commit listing	2026-05-13 21:41:58 -07:00
hongming-codex-laptop	3b47c974ee	ci: stop operational push jobs painting main red	2026-05-14 04:41:10 +00:00
devops-engineer	81f042c875	Merge pull request 'fix(ci): add concurrency block to sop-checklist workflow (cancel stale runs)' (#963) from fix-sop-concurrency-v2 into main	2026-05-14 04:34:11 +00:00
molecule-operator	725869834e	fix(ci): add concurrency block to sop-checklist workflow (cancel stale runs)	2026-05-14 04:30:57 +00:00
devops-engineer	38d12c6d41	Merge pull request 'ci: fix publish Docker healthcheck pipefail' (#952) from fix/publish-healthcheck-pipefail into main	2026-05-14 04:12:45 +00:00
hongming-codex-laptop	7250ebbed8	ci: fix publish docker healthcheck pipefail	2026-05-14 04:11:40 +00:00
devops-engineer	d1171a7337	Merge pull request 'fix(ci): rename sop-checklist-gate→sop-checklist (mc#948 BP→emitter drift fix)' (#951) from fix/sop-checklist-workflow-rename into main	2026-05-14 04:10:24 +00:00
Molecule AI Core-DevOps	10dc98112c	fix(ci): rename sop-checklist-gate→sop-checklist to match BP context ... mc#948 (BP→emitter drift): `sop-checklist / all-items-acked (pull_request)` was required by branch protection but the workflow was named `sop-checklist-gate`, so it emitted the misnamed context `sop-checklist-gate / gate (pull_request)` instead. Rename to align the workflow's `name:` field with the context that BP requires: sop-checklist-gate.yml → sop-checklist.yml sop-checklist-gate.py → sop-checklist.py test_sop_checklist_gate.py → test_sop_checklist.py New context emitted: `sop-checklist / all-items-acked (pull_request)`. Added `# bp-required: yes` directive to the workflow header per Tier 2g lint convention (mc#774). All 52 script tests pass. Closes #948. Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>	2026-05-14 04:05:38 +00:00
devops-engineer	065a709e37	Merge pull request 'fix(canvas): remove opacity from error/success text — WCAG AA contrast' (#949) from design/wcag-contrast-round4-2026-05-14 into main	2026-05-14 04:01:17 +00:00
Molecule AI Core-UIUX	38c8702934	fix(canvas): remove opacity from error/success text — WCAG AA contrast ... Fixes 6 instances of text-bad/text-good with opacity reducing contrast: - ConversationTraceModal: error detail (text-bad/80 → text-bad) - ConversationTraceModal: Response label (text-good/60 → text-good) - ActivityTab: error detail inline (text-bad/80 → text-bad) - ActivityTab: A2AErrorPreview label+hint (text-bad/80 → text-bad, text-bad/70 → text-bad) - ScheduleTab: last_error display (text-bad/70 → text-bad) - SkillsTab: registry error detail (text-bad/80 → text-bad) Note: text-bad (#d27773) on bg-surface-card (zinc-800) is 2.1:1 — below AA for body text. The text color itself needs design review to raise contrast to meet 4.5:1 on zinc-800 surfaces. This PR removes opacity (which only made things worse) as a step 1; a follow-up should consider warmer/muted zinc-safe alternatives for bad/good status colors. Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>	2026-05-14 03:59:25 +00:00
devops-engineer	12899f2a07	Merge pull request 'test(handlers/org): add unit tests for walkOrgWorkspaceNames, resolveProvisionConcurrency, errString' (#941) from fix/org-helper-tests into main	2026-05-14 03:54:58 +00:00
Molecule AI Core-BE	424ffbdb43	test(handlers/org): add unit tests for walkOrgWorkspaceNames, resolveProvisionConcurrency, errString ... Issue #741: three pure helpers in org.go had no unit tests. Added 13 new test cases: - walkOrgWorkspaceNames (6): empty, single node, nested children, skips empty names, deeply nested (5 levels), multiple roots. - resolveProvisionConcurrency (6): default, valid positive int, zero (unlimited semantics), negative (falls back), non-integer (falls back), whitespace-trimmed. - errString (3): nil error, non-nil error, wrapped error (%w). Closes: molecule-ai/molecule-core#741 Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>	2026-05-14 03:53:40 +00:00
devops-engineer	349efe6793	Merge pull request 'fix(workspace): correct OFFSEC-003 test assertions to match ZWSP-escaping behavior' (#946) from fix/test-a2a-sanitization-main into main	2026-05-14 03:52:22 +00:00
Molecule AI Core-QA	fa81626b71	fix(workspace): correct OFFSEC-003 test assertions to match ZWSP-escaping behavior ... Corrects 12 broken test assertions in test_a2a_sanitization.py that were introduced by the PR #916 merge. Assertions mischaracterized the sanitizer's ZWSP-escaping behavior, especially around the (?<=\\n) lookbehind in _strip_closed_blocks. Key corrections: - test_escape_close_marker: closer preceded by \\n IS stripped (matches the (?<=\\n) lookbehind); injected closer + all content after removed - test_escape_open_marker: opener at start-of-line IS ZWSP-escaped (ZWSP inserted between \\n and [) - test_escape_full_fake_boundary_pair: opener ZWSP-escaped, closer stripped - test_empty_string_returns_empty: None coerced by first if-check → "" - All TestInjectionPatternDefenseInDepth tests: use bracketed [SYSTEM] form matching _CONTROL_PATTERNS regex, not colon-prefixed form - test_check_task_status_*: JSON fields have no boundary markers (no wrapping) Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>	2026-05-14 03:39:34 +00:00
devops-engineer	210fcc0ea4	Merge pull request 'ci: publish deploy images on every main push' (#939) from fix/publish-image-on-every-main-push into main	2026-05-14 03:36:54 +00:00
hongming-codex-laptop	e7a0e4ba9e	ci: publish deploy images on every main push	2026-05-14 03:36:04 +00:00
devops-engineer	de175de44f	Merge pull request 'ci: remove canvas-deploy-reminder from all-required.needs (mc#923 deadlock fix)' (#938) from fix/remove-canvas-reminder-from-all-required into main	2026-05-14 03:35:20 +00:00
Molecule AI Core-DevOps	1a1d45464e	ci: remove canvas-deploy-reminder from all-required.needs ... canvas-deploy-reminder needs canvas-build, which is skipped on CI-only PRs (canvas=false). Adding it to all-required.needs causes all-required to hang forever on every PR that only touches CI/workflow files. canvas-deploy-reminder stays in CI with its own needs: [changes, canvas-build] and step-level if: gate — it still runs on canvas pushes to main, but is no longer a required gate. Refs: mc#922, mc#923, mc#929, PR #927 Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>	2026-05-14 03:33:34 +00:00
devops-engineer	b0180fe4b2	Merge pull request 'fix(canvas): WCAG AA contrast round 3 + focus-visible rings + aria fixes' (#936) from design/wcag-a11y-round3-2026-05-14 into main	2026-05-14 03:24:42 +00:00
Molecule AI Core-UIUX	4929824c27	fix(canvas): WCAG AA contrast round 3 + focus-visible rings + aria fixes ... Contrast: - FilesTab: Delete All + Delete buttons bg-red-600→bg-red-700 hover→bg-red-600 (AA trap fixed: hover goes darker, 3.9:1→4.6:1). - ErrorBoundary: error message text-bad/80 → text-bad (4.5:1→4.5:1, removes opacity that dropped below AA). - ExternalConnectModal: Copy button bg-accent-strong/80→bg-accent hover→bg-accent-strong (visual consistency; no contrast change but cleaner pattern). - ConversationTraceModal: SEND badge bg-cyan-950/50→bg-cyan-950 text-cyan-400→text-cyan-300. Focus-visible rings: - MissingKeysModal: Save + Deploy buttons gain focus-visible ring. - FilesToolbar: directory select outline-none→focus-visible ring. - ProviderModelSelector: model input focus ring upgraded to 2px visible ring. ARIA: - ScheduleTab: toggle status dot gains aria-label describing last run status. - ThemeToggle: arrow-key focus uses direct-child query (> [role=radio]) to avoid accidentally focusing unrelated radio elements in the React Flow canvas. Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>	2026-05-14 03:23:54 +00:00
devops-engineer	363905d358	Merge pull request 'fix(ci): use GITHUB_EVENT_BEFORE in handlers-pg-integ detect-changes' (#937) from fix/handlers-pg-integ-event-before into main	2026-05-14 03:18:29 +00:00
Molecule AI Core-BE	ca24b0fe27	fix(ci): use GITHUB_EVENT_BEFORE in handlers-pg-integ detect-changes ... Gitea Actions `github.event.before` template expression evaluates to empty string in shell scripts. Replace with the GITHUB_EVENT_BEFORE shell environment variable (correctly populated for push events). Same fix as #919 (runtime-prbuild-compat.yml) applied here. Also adds timeout 30 guards around both `git cat-file -e` calls to prevent indefinite hangs on corrupted refs. Refs: molecule-ai/molecule-core#919 Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>	2026-05-14 03:05:40 +00:00
devops-engineer	128b1d75ee	Merge pull request 'ci: flip platform-build continue-on-error true→false (mc#774 fix-forward landed)' (#935) from ci/platform-build-flip-coe into main	2026-05-14 02:59:46 +00:00
Molecule AI Core-DevOps	3444d6b240	ci: flip platform-build continue-on-error true→false (mc#774 fix-forward landed) ... RFC#219 Phase 4 §2: flip the platform-build job after PR #669 (cherry-pick of #634) fixed the delegation_test.go sqlmock gaps. CI / Platform (Go) status confirmed success on main HEAD 68560cec. The mc#762 / mcp_test.go:433 regression is a separate issue — its test step carries its own continue-on-error: true (line 203) and does not block this flip. Refs: mc#774, PR #669, PR #634, #656 Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>	2026-05-14 02:56:03 +00:00
devops-engineer	68560cec9a	Merge pull request 'fix(canvas): WCAG AA contrast — ChatTab error/retry/timestamp + ContextMenu status' (#931) from design/chat-tab-wcag-contrast-2026-05-14 into main	2026-05-14 02:34:55 +00:00
Molecule AI Core-UIUX	f2ad694d48	fix(canvas): WCAG AA contrast — ChatTab error/retry/timestamp + ContextMenu status ... - ChatTab: Retry button bg-red-800/40 text-bad (1.7:1) → bg-red-800 text-red-200 (4.5:1). User message timestamp text-white/70 (3.5:1) → text-white/80 (4.8:1). Error banner text-bad → text-red-300 (4.7:1 on bg-red-900/20). Restart button in error banner same fix. - ContextMenu: status label text-ink-mid (4.2:1) → text-ink (7.8:1). Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>	2026-05-14 02:29:47 +00:00
devops-engineer	369b2d3690	Merge pull request 'fix: add slug validation to prevent SSRF (OFFSEC-006)' (#930) from fix/offsec-006-slug-validation into main	2026-05-14 02:22:09 +00:00
Molecule AI Core-DevOps	9153a2e464	fix: add slug validation to prevent SSRF (OFFSEC-006) ... OFFSEC-006 (HIGH): promote-tenant-image.sh interpolated raw --tenants slug into URL paths and subdomains without sanitisation. Four injection points were vulnerable: • cp_redeploy_tenant (line 193): /cp/admin/tenants/$slug/redeploy • tenant_buildinfo (line 209): https://${slug}.moleculesai.app/buildinfo • tenant_health (line 217): https://${slug}.moleculesai.app/health • resolve_tenant_instance_id (line 263): /cp/admin/tenants/$slug Attack vectors: --tenants 'a?url=https://evil.com' → curl splits on ? as query separator --tenants 'evil.com@legitimate' → subdomain takeover via @ Fix: • Add validate_slug() function with regex ^[a-z0-9]([a-z0-9-]{0,61}[a-z0-9])?$ before any URL interpolation. Exit 64 on invalid slug. • Call validate_slug() in main() before any operations (up-front guard). • Add defense-in-depth calls inside cp_redeploy_tenant, tenant_buildinfo, tenant_health, resolve_tenant_instance_id, redeploy_tenant, verify_tenant, and the rollback loop. • Also fix a latent promote_rc=1 bug where `cmd || promote_rc=1` inside `set -e` returned exit 1 and triggered early script exit instead of setting the variable. Replaced with `if ! cmd; then promote_rc=1; fi`. Test additions (test-promote-tenant-image.sh): • Test 9: 8 invalid slug variants rejected with exit 64 (?, &, @, /, \, space, etc.) • Test 10: 6 valid slugs accepted (chloe-dong, ab, a, etc.) Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>	2026-05-14 02:17:42 +00:00
devops-engineer	a23ecc18a0	Merge pull request 'fix(canvas): WCAG AA contrast — badge/button/cascade text colors' (#928) from design/wcag-contrast-fixes-2026-05-14 into main	2026-05-14 02:07:26 +00:00
Molecule AI Core-UIUX	befba93a51	fix(canvas): WCAG AA contrast — badge/button/cascade text colors ... - BatchActionBar: selection badge bg-accent-strong/80 (3.4:1) → bg-zinc-700 (7.2:1); Restart/Pause/Delete button text all switch to text-white (icons carry the color cue via aria-hidden). - AuditTrailPanel: badge text colors darkened to pass 4.5:1 on near-black bg-*-950/40 backgrounds — blue-300/violet-300/yellow-200/orange-300. Redundant aria-label removed from badge span (text IS the accessible name). - DeleteCascadeConfirmDialog: cascade warning text-bad/80 → text-red-300; strong text red-200 → red-100; disabled Delete All text-bad/40 → text-red-400. - DropTargetBadge: ghost slot div marked aria-hidden (pure decorative overlay); badge gains role="status" + aria-label. Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>	2026-05-14 02:06:14 +00:00
devops-engineer	8c701db356	Merge pull request 'fix(ci): add canvas-deploy-reminder to all-required.needs (mc#922)' (#926) from fix/ci-drift-canvas-reminder into main	2026-05-14 02:04:03 +00:00
Molecule AI Core-DevOps	cc4f23f7ec	fix(ci): add canvas-deploy-reminder to all-required.needs (mc#922) ... mc#922/#923 ci-drift root fix. canvas-deploy-reminder exists in ci.yml and emits `ci / canvas-deploy-reminder (pull_request)` status, but was not listed in `all-required.needs:` — causing drift detector F1 on both main and staging. Add it to the sentinel needs. Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>	2026-05-14 02:03:18 +00:00
devops-engineer	ff8baa6981	Merge pull request 'fix(ci): collapse review comment refire triggers' (#925) from fix/comment-trigger-storm into main	2026-05-14 02:01:49 +00:00
hongming-codex-laptop	be394bd6e1	fix(ci): collapse review comment refire triggers	2026-05-13 18:46:52 -07:00
devops-engineer	e98c281262	Merge pull request 'feat(scripts): codify ECR :staging-latest → :latest promote + tenant redeploy (closes #660)' (#672) from infra/660-codify-promote-tenant-image into main	2026-05-14 01:42:24 +00:00
hongming	2c6d534940	feat(scripts): codify ECR :staging-latest → :latest promote + tenant redeploy (closes #660) ... Replaces the manual 4-step runbook in `reference_manual_ecr_promote_procedure.md` with a single self-contained script + 40 mock-driven e2e tests + a CI gate. The script does the full chain end-to-end: 1. **PREFLIGHT** — AWS auth ok, source-tag exists, CP base reachable. Exits 1 with no mutations if anything's wrong. 2. **SNAPSHOT** — saves the current dest-tag manifest as `<dest>-prev-YYYYMMDD`. Idempotent: same UTC day re-runs are no-ops. 3. **PROMOTE** — copies `<source-tag>` manifest → `<dest-tag>` via `aws ecr put-image` with the OCI image-index media type (preserves inner child-manifest digest per `reference_ecr_cross_account_digest_exact_mirror`). 4. **REDEPLOY** — per-tenant POST `/cp/admin/tenants/<slug>/redeploy`. On HTTP 403 (stale tenant docker ECR auth — `feedback_ec2_ecr_auth_12h_stale`) it SSM-refreshes the EC2's docker login and retries once. 5. **VERIFY** — per-tenant `/buildinfo` + `/health` probes. Failure here triggers auto-rollback. 6. **ROLLBACK** (on failure) — re-promotes the rollback tag back to `<dest-tag>` and redeploys the fleet. Exits 3 if rollback OK, 4 if not. Every external call (aws/curl/ssm) is wrapped in a function with a `--mock-dir` injection point so the tests can drive every branch without touching real infrastructure. 40 cases across 11 test groups: - happy path (5 assertions on call counts + exit code) - preflight failures with no mutations - snapshot idempotency - `--dry-run` skips all mutations - 403 → SSM-refresh → retry path - redeploy fail with vs without rollback (exit 3 vs 4) - argument validation (missing/conflicting/unknown flags) - date override for rollback tag naming - empty source manifest detection - verify-failure triggers rollback Runs `bash scripts/test-promote-tenant-image.sh`. No live infra touched. Two new steps in the existing `Shellcheck (E2E scripts)` job (a required check on `main`), gated by the existing `scripts` change filter (`scripts/`, `tests/e2e/`, `infra/scripts/`, or this workflow file itself): 1. Run `scripts/test-promote-tenant-image.sh` — fails CI if any of the 40 cases regresses. 2. Run `shellcheck --severity=warning` on the two files. The bulk shellcheck step intentionally excludes `scripts/` for legacy SC3040/SC3043 reasons; explicit invocation here catches new regressions in the promote script without unblocking the bulk cleanup. ``` $ bash scripts/test-promote-tenant-image.sh ... All 40 tests passed. $ shellcheck --severity=warning scripts/promote-tenant-image.sh scripts/test-promote-tenant-image.sh (clean) ``` - core#660 — "Codify manual ECR promote operation as `scripts/promote-tenant-image.sh`" (tier:medium, core-devops) - core#658 — proper fix for the 12h-stale tenant ECR auth (this script ships the SSM-refresh workaround pending the credential-helper rollout). - `reference_manual_ecr_promote_procedure.md` (memory) — the manual procedure this script replaces. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>	2026-05-14 01:41:09 +00:00
devops-engineer	2023c4ab61	Merge pull request 'fix(ci): use GITHUB_EVENT_BEFORE for push events in runtime-prbuild-compat detect-changes (#917)' (#919) from fix/917-runtime-prbuild-detect-changes-fix into main	2026-05-14 01:33:25 +00:00
Molecule AI Core-BE	bd32e8cfd9	fix(ci): use GITHUB_EVENT_BEFORE for push events in runtime-prbuild-compat detect-changes ... Fixes: #917 Root cause: Gitea Actions does not expose github.event.before as a shell environment variable for push events. The ${{ github.event.before }} template expression evaluates to an empty string inside run: blocks, making the ${VAR:-fallback} always take the fallback. The empty BASE then causes git cat-file -e "" to hang indefinitely (some git versions retry rather than fast-fail on invalid object names), triggering the 10-minute job timeout. Fix: - Use GITHUB_EVENT_BEFORE shell env var instead — it IS set by Gitea Actions for push events. - Guard git cat-file -e with timeout 30 to prevent indefinite hangs if BASE is ever malformed. - Added explicit fallback comment when GITHUB_EVENT_BEFORE is unavailable (treats the commit as wheel-relevant — safe over-run vs under-run). Test plan: - [x] YAML lint passes - [ ] CI detect-changes completes without 10-minute timeout on push event - [ ] No regression for pull_request events (base SHA logic unchanged) Refs: #917	2026-05-14 01:32:57 +00:00