fix(ci): add explicit utf-8 encoding to Python open() calls

Python 3's open() default encoding is platform-dependent (PEP 597). On CI runners it happens to be UTF-8, but being explicit avoids surprises on Windows dev boxes or custom runner images. Files touched: - sop-checklist.py: config loading (YAML + minimal parser) - tests/_review_check_fixture.py: test fixture scenario loader - tests/_refire_fixture.py: test fixture scenario loader Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>
2026-05-27 15:35:36 +00:00
12 changed files with 25 additions and 32 deletions
@@ -642,7 +642,7 @@ def load_config(path: str) -> dict[str, Any]:
        # requiring the dep, so the ignore is safe: if yaml loads, we use it;
        # otherwise we fall back silently.
        import yaml  # type: ignore[import-not-found]
-        with open(path) as f:
+        with open(path, encoding="utf-8") as f:
            return yaml.safe_load(f)
    except ImportError:
        return _load_config_minimal(path)
@@ -656,7 +656,7 @@ def _load_config_minimal(path: str) -> dict[str, Any]:
    item map: scalars + lists of scalars. Does NOT support nested lists,
    YAML anchors, multi-doc, or flow style.
    """
-    with open(path) as f:
+    with open(path, encoding="utf-8") as f:
        lines = f.readlines()
    return _parse_minimal_yaml(lines)

@@ -33,7 +33,7 @@ def scenario() -> str:
    p = os.path.join(STATE_DIR, "scenario")
    if not os.path.isfile(p):
        return "T1_success"
-    with open(p) as f:
+    with open(p, encoding="utf-8") as f:
        return f.read().strip()


@@ -40,7 +40,7 @@ def scenario() -> str:
    p = os.path.join(STATE_DIR, "scenario")
    if not os.path.isfile(p):
        return "T1_pr_open"
-    with open(p) as f:
+    with open(p, encoding="utf-8") as f:
        return f.read().strip()


@@ -52,12 +52,12 @@ permissions:
  contents: read
  issues: write

-# Audit is idempotent — cancelling an overlapping run and starting
-# fresh avoids duplicate comments and ensures the latest branch state
-# is evaluated.
+# Serialise — two simultaneous drift runs would duel on the issue
+# create/update path. The audit is idempotent, but parallel POSTs
+# can produce duplicate comments before the title-search dedup wins.
 concurrency:
  group: ci-required-drift
-  cancel-in-progress: true
+  cancel-in-progress: false

 jobs:
  drift:
@@ -87,11 +87,12 @@ permissions:
  # minimal until that's actually wanted.

 # Serialize so two firings can never overlap. Cron firing every 20 min
-# If a run hangs we don't want N more stacking up.
-# Cancelling and starting fresh is preferred for bounded synth tests.
+# but scripts conservatively bounded at 10 min — overlap shouldn't
+# happen in steady state, but if a run hangs we don't want N more
+# stacking up.
 concurrency:
  group: continuous-synth-e2e
-  cancel-in-progress: true
+  cancel-in-progress: false

 env:
  GITHUB_SERVER_URL: https://git.moleculesai.app
@@ -13,11 +13,9 @@ on:
    - cron: '15 9 * * *'
  workflow_dispatch:

-# Advisory-only check — cancelling and re-running is safe.
-# Prefer fresh run over queued stale run.
 concurrency:
  group: e2e-legacy-advisory
-  cancel-in-progress: true
+  cancel-in-progress: false

 permissions:
  contents: read
@@ -24,11 +24,9 @@ on:
 env:
  GITHUB_SERVER_URL: https://git.moleculesai.app

-# Lightweight sanity check — cancelling and re-running is safe.
-# Prefer fresh run over queued stale run.
 concurrency:
  group: e2e-staging-sanity
-  cancel-in-progress: true
+  cancel-in-progress: false

 permissions:
  issues: write
@@ -38,11 +38,9 @@ on:
 env:
  GITHUB_SERVER_URL: https://git.moleculesai.app

-# Audit is read-only — cancelling and re-running is safe.
-# Prefer fresh run over queued stale run.
 concurrency:
  group: railway-pin-audit
-  cancel-in-progress: true
+  cancel-in-progress: false

 permissions:
  issues: write
@@ -47,11 +47,10 @@ on:
    # 1.22.6 rejects workflow_dispatch.inputs.
    - cron: '30 * * * *'
  workflow_dispatch:
-# Sweeps are idempotent — cancelling and re-running from scratch is safe.
-# Prefer fresh run over queued stale run.
+# Don't let two sweeps race the same AWS account.
 concurrency:
  group: sweep-aws-secrets
-  cancel-in-progress: true
+  cancel-in-progress: false

 permissions:
  contents: read
@@ -54,11 +54,11 @@ on:
  # AND gate the sweep step with `if: github.event_name != 'merge_group'`
  # so merge-queue evals report success without actually running.

-# CF deletes are idempotent — cancelling and re-running is safe.
-# Prefer fresh run over queued stale run.
+# Don't let two sweeps race the same zone. workflow_dispatch during a
+# scheduled run would otherwise issue duplicate DELETE calls.
 concurrency:
  group: sweep-cf-orphans
-  cancel-in-progress: true
+  cancel-in-progress: false

 permissions:
  contents: read
@@ -39,11 +39,10 @@ on:
    # Hourly at :45 — offset from sweep-cf-orphans (:15) so the two
    # janitors don't issue parallel CF API bursts at the same minute.
    - cron: '45 * * * *'
-# Sweeps are idempotent — cancelling and re-running from scratch is safe.
-# Prefer fresh run over queued stale run.
+# Don't let two sweeps race the same account.
 concurrency:
  group: sweep-cf-tunnels
-  cancel-in-progress: true
+  cancel-in-progress: false

 permissions:
  contents: read
@@ -47,11 +47,11 @@ on:
    # See molecule-controlplane#420 for the leak-class accounting that
    # motivated this tightening.
    - cron: '*/15 * * * *'
-# Org cleanup is idempotent — cancelling and re-running is safe.
-# Prefer fresh run over queued stale run.
+# Don't let two sweeps fight. Cron + workflow_dispatch could overlap
+# on a manual trigger; queue rather than parallel-delete.
 concurrency:
  group: sweep-stale-e2e-orgs
-  cancel-in-progress: true
+  cancel-in-progress: false

 permissions:
  contents: read