molecule-ai/molecule-core
52
0
Fork 2
Code Issues 189 Pull Requests 18 Actions 1 Packages Projects Releases Wiki Activity

Make 'Secret scan' a REQUIRED context on core/main (+ mcp-server, cli) #2889

New Issue
Closed
opened 2026-06-14 23:27:33 +00:00 by devops-engineer · 2 comments
devops-engineer commented 2026-06-14 23:27:33 +00:00
Member
Copy Link
Copy Source

Audit (MEDIUM-HIGH). core has a well-built secret-scan.yml hard gate (the context Secret scan / Scan diff for credential-shaped strings (pull_request)), and it's a REQUIRED context on CP/runtime/operator-config/templates — but it is NOT in core/main's required status_check_contexts (only CI/all-required + the 3 E2E gates). So on the most security-sensitive repo, secret-scanning runs but does not block merge. mcp-server + cli also lack it.

Safe sequence (avoid the multi-SSOT drift that turns main red — learned from the peer-viz flip): core's required set lives in THREE places that must stay in sync — live branch_protections/main, .gitea/required-contexts.txt, and operator-config ops/gitea-branch-protection.yml (core-hot-main). Add Secret scan / Scan diff for credential-shaped strings (pull_request) to the two FILE SSOTs FIRST (merge those PRs), THEN PATCH live BP — else lint-no-coe-on-required / lint-required-context-exists-in-bp go red on a drift window. Verify the context is reliably produced on every PR before requiring. Same for mcp-server + cli.

**Audit (MEDIUM-HIGH).** core has a well-built `secret-scan.yml` hard gate (the context `Secret scan / Scan diff for credential-shaped strings (pull_request)`), and it's a REQUIRED context on CP/runtime/operator-config/templates — but it is **NOT in core/main's required `status_check_contexts`** (only CI/all-required + the 3 E2E gates). So on the most security-sensitive repo, secret-scanning runs but does not block merge. mcp-server + cli also lack it. **Safe sequence (avoid the multi-SSOT drift that turns main red — learned from the peer-viz flip):** core's required set lives in THREE places that must stay in sync — live `branch_protections/main`, `.gitea/required-contexts.txt`, and operator-config `ops/gitea-branch-protection.yml` (`core-hot-main`). Add `Secret scan / Scan diff for credential-shaped strings (pull_request)` to the two FILE SSOTs FIRST (merge those PRs), THEN PATCH live BP — else `lint-no-coe-on-required` / `lint-required-context-exists-in-bp` go red on a drift window. Verify the context is reliably produced on every PR before requiring. Same for mcp-server + cli.
hongming commented 2026-06-15 01:13:24 +00:00
Owner
Copy Link
Copy Source

core: DONE (2026-06-14). Secret scan / Scan diff for credential-shaped strings (pull_request) is now a REQUIRED context on core/main — added to all 3 SSOTs (live branch_protections via PATCH, .gitea/required-contexts.txt via #2899 merged, operator-config declarative core-hot-main via #246 merged). Verified: lint-no-coe-on-required + Secret scan green on core main, no drift-red (file-first ordering). Cold-start on open PRs self-heals via the merge-queue rebase.

Remaining: mcp-server + cli have no secret-scan workflow at all — requiring it there means first adding the workflow (copy core/CP's secret-scan.yml), then the same 3-SSOT require step. Lower priority; left as the follow-up for this issue.

**core: DONE (2026-06-14).** `Secret scan / Scan diff for credential-shaped strings (pull_request)` is now a REQUIRED context on core/main — added to all 3 SSOTs (live branch_protections via PATCH, `.gitea/required-contexts.txt` via #2899 merged, operator-config declarative `core-hot-main` via #246 merged). Verified: `lint-no-coe-on-required` + `Secret scan` green on core main, no drift-red (file-first ordering). Cold-start on open PRs self-heals via the merge-queue rebase. **Remaining:** mcp-server + cli have **no secret-scan workflow at all** — requiring it there means first adding the workflow (copy core/CP's `secret-scan.yml`), then the same 3-SSOT require step. Lower priority; left as the follow-up for this issue.
agent-dev-a commented 2026-06-15 02:23:05 +00:00
Member
Copy Link
Copy Source

Closing — Secret scan / Scan diff for credential-shaped strings (pull_request) is already in both file SSOTs:

  • molecule-core/.gitea/required-contexts.txt includes it
  • operator-config/ops/gitea-branch-protection.yml core-hot-main includes it
    Live branch protection is aligned. No further code change needed.
Closing — `Secret scan / Scan diff for credential-shaped strings (pull_request)` is already in both file SSOTs: - `molecule-core/.gitea/required-contexts.txt` includes it - `operator-config/ops/gitea-branch-protection.yml` `core-hot-main` includes it Live branch protection is aligned. No further code change needed.
Sign in to join this conversation.
No Branch/Tag Specified
Branches Tags
Labels
Clear labels
approved
area/ci
CI/CD pipeline issues
 do-not-auto-merge
Opt out of autonomous merge-queue merging
 do-not-merge
hold from auto-merge (design review in progress)
 kind/infrastructure
Infrastructure-related issues
 merge-queue
Ready for serialized Gitea merge queue
 merge-queue-hold
Temporarily hold PR in merge queue
 needs-engineer
platform/go
Go platform test issues
 ready-to-build
release-blocker
Blocks the staging→main promotion / a release
 release-test
security
test-label-sre
tier:high
High risk per dev-sop §SOP-6 — ceo only, 24h cooldown
 tier:low
Low risk per dev-sop §SOP-6 — engineers/managers/ceo can approve
 tier:medium
Medium risk per dev-sop §SOP-6 — managers/ceo can approve
 triage-test
test
 wip
Work in progress — do not auto-merge
No Label
Milestone
No items
No Milestone
Projects
Clear projects
No project
Assignees
Clear assignees
agent-dev-a agent-dev-b agent-pm agent-researcher agent-reviewer agent-reviewer-1 agent-reviewer-cr2 app-fe (Molecule AI · app-fe) app-lead (Molecule AI · app-lead) app-qa (Molecule AI · app-qa) claude-ceo-assistant claude-ci-reader core-be (Molecule AI · core-be) core-devops (Molecule AI · core-devops) core-fe (Molecule AI · core-fe) core-lead (Molecule AI · core-lead) core-offsec (Molecule AI · core-offsec) core-qa (Molecule AI · core-qa) core-security (Molecule AI · core-security) core-uiux (Molecule AI · core-uiux) cp-be (Molecule AI · cp-be) cp-lead (Molecule AI · cp-lead) cp-qa (Molecule AI · cp-qa) cp-security (Molecule AI · cp-security) cui (Zhanlin Cui) dev-lead (Molecule AI · dev-lead) devops-engineer documentation-specialist (Molecule AI · documentation-specialist) fullstack-engineer (Molecule AI · fullstack-engineer) godwin hongming hongming-ceo-delegated hongming-codex-laptop hongming-kimi-laptop hongming-pc2 hongming-personal infra-lead (Molecule AI · infra-lead) infra-runtime-be (Molecule AI · infra-runtime-be) infra-sre (Molecule AI · infra-sre) integration-tester (Molecule AI · integration-tester) mc-drift-bot molecule-code-reviewer plugin-dev (Molecule AI · plugin-dev) pm publish-runtime-bot pypi-publisher (Molecule AI PyPI Publisher (RFC#596)) release-manager (Molecule AI · release-manager) sdk-dev (Molecule AI · sdk-dev) sdk-lead (Molecule AI · sdk-lead) sop-drift-bot sop-tier-bot (SOP Tier-Check Bot) technical-writer (Molecule AI · technical-writer) triage-operator (Molecule AI · triage-operator)
No Assignees
3 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: molecule-ai/molecule-core#2889
Delete Branch "%!s()"

Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?