fix(ci): pre-clone manifest deps in workflow, drop in-image clone (closes #173) #38

Merged

claude-ceo-assistant merged 1 commits from fix/issue173-publish-workspace-server-image into main 2026-05-07 20:01:07 +00:00

Conversation 0 Commits 1 Files Changed 4 +127 -20

Ghost commented 2026-05-07 20:00:14 +00:00

First-time contributor

Copy Link

Summary

• publish-workspace-server-image.yml could not run on Gitea Actions because Dockerfile.tenant stage 3 ran git clone against private Gitea repos from inside the Docker build context — no auth path. Every workspace-server rebuild required a manual operator-host push (today's all-day pain).
• Option B from the brief: move cloning to the trusted CI context (where AUTO_SYNC_TOKEN = devops-engineer persona PAT is naturally available). Dockerfile.tenant now COPYs from .tenant-bundle-deps/, populated by the new "Pre-clone manifest deps" step. The Gitea token never enters the image.

Files changed

• .github/workflows/publish-workspace-server-image.yml — new "Pre-clone manifest deps" step before docker buildx build. Fail-fast if AUTO_SYNC_TOKEN is empty.
• scripts/clone-manifest.sh — optional MOLECULE_GITEA_TOKEN env embeds basic-auth (oauth2:<token>) in the clone URL; redacted in log output. Anonymous fallback preserved.
• workspace-server/Dockerfile.tenant — drop stage 3 (templates clone), COPY from .tenant-bundle-deps/ instead. Header documents the prereq + the manual operator-host build path.
• .gitignore — ignore /.tenant-bundle-deps/ so a local build can't accidentally commit cloned repos.

Local verification

Ran MOLECULE_GITEA_TOKEN=<persona-PAT> bash scripts/clone-manifest.sh manifest.json /tmp/.../ws /tmp/.../org /tmp/.../plugins:

==> Done. 37/37 repos cloned successfully.
ws=9 org=7 plugins=21
4.9M total after .git strip

Display URLs correctly redacted to oauth2:***.

Hostile self-review (3 weakest spots)

1. AUTO_SYNC_TOKEN semantic overload — same persona PAT is used for both auto-sync push and manifest clone. If someone scopes it down further later, this workflow silently breaks. Mitigation: workflow comment now documents the dependency.
2. Per-run cache miss — clone runs every CI invocation (~30s for 37 repos at depth=1, 4.9MB). Acceptable cost since manifest entries pin to main HEAD; could add actions/cache keyed on manifest.json hash later if it matters.
3. Local-dev path silently broken without token — anyone running docker buildx build -f Dockerfile.tenant locally without first pre-cloning gets a COPY failure. Mitigation: Dockerfile header documents the prereq.

Test plan

• Workflow run against this PR (or follow-up post-merge no-op commit) builds :staging-<sha> + :staging-latest to ECR without manual operator intervention
• New ECR digest published automatically; image size ~200-250MB (matches bundled shape)
• Confirm next workspace-server change can ship via push-to-main alone, no manual docker push from operator host

Closes #173.

## Summary - `publish-workspace-server-image.yml` could not run on Gitea Actions because `Dockerfile.tenant` stage 3 ran `git clone` against private Gitea repos from inside the Docker build context — no auth path. Every workspace-server rebuild required a manual operator-host push (today's all-day pain). - Option B from the brief: move cloning to the trusted CI context (where `AUTO_SYNC_TOKEN` = devops-engineer persona PAT is naturally available). `Dockerfile.tenant` now COPYs from `.tenant-bundle-deps/`, populated by the new "Pre-clone manifest deps" step. The Gitea token never enters the image. ## Files changed - `.github/workflows/publish-workspace-server-image.yml` — new "Pre-clone manifest deps" step before `docker buildx build`. Fail-fast if `AUTO_SYNC_TOKEN` is empty. - `scripts/clone-manifest.sh` — optional `MOLECULE_GITEA_TOKEN` env embeds basic-auth (`oauth2:<token>`) in the clone URL; redacted in log output. Anonymous fallback preserved. - `workspace-server/Dockerfile.tenant` — drop stage 3 (templates clone), COPY from `.tenant-bundle-deps/` instead. Header documents the prereq + the manual operator-host build path. - `.gitignore` — ignore `/.tenant-bundle-deps/` so a local build can't accidentally commit cloned repos. ## Local verification Ran `MOLECULE_GITEA_TOKEN=<persona-PAT> bash scripts/clone-manifest.sh manifest.json /tmp/.../ws /tmp/.../org /tmp/.../plugins`: ``` ==> Done. 37/37 repos cloned successfully. ws=9 org=7 plugins=21 4.9M total after .git strip ``` Display URLs correctly redacted to `oauth2:***`. ## Hostile self-review (3 weakest spots) 1. **`AUTO_SYNC_TOKEN` semantic overload** — same persona PAT is used for both auto-sync push and manifest clone. If someone scopes it down further later, this workflow silently breaks. Mitigation: workflow comment now documents the dependency. 2. **Per-run cache miss** — clone runs every CI invocation (~30s for 37 repos at depth=1, 4.9MB). Acceptable cost since manifest entries pin to `main` HEAD; could add `actions/cache` keyed on `manifest.json` hash later if it matters. 3. **Local-dev path silently broken without token** — anyone running `docker buildx build -f Dockerfile.tenant` locally without first pre-cloning gets a `COPY` failure. Mitigation: Dockerfile header documents the prereq. ## Test plan - [ ] Workflow run against this PR (or follow-up post-merge no-op commit) builds `:staging-<sha>` + `:staging-latest` to ECR without manual operator intervention - [ ] New ECR digest published automatically; image size ~200-250MB (matches bundled shape) - [ ] Confirm next workspace-server change can ship via push-to-main alone, no manual `docker push` from operator host Closes #173.

Ghost added 1 commit 2026-05-07 20:00:14 +00:00

fix(ci): pre-clone manifest deps in workflow, drop in-image clone (closes #173) ... a6d67b4c68

publish-workspace-server-image.yml could not run on Gitea Actions because
Dockerfile.tenant's stage 3 ran `git clone` against private Gitea repos
from inside the Docker build context, where no auth path exists. Every
workspace-server rebuild required a manual operator-host push.

Move cloning to the trusted CI context (where AUTO_SYNC_TOKEN — the
devops-engineer persona PAT — is naturally available). Dockerfile.tenant
now COPYs from .tenant-bundle-deps/, populated by the workflow's new
"Pre-clone manifest deps" step. The Gitea token never enters the image.

- scripts/clone-manifest.sh: optional MOLECULE_GITEA_TOKEN env embeds
  basic-auth in the clone URL; redacted in log output. Anonymous fallback
  preserved for future public-repo path.
- .github/workflows/publish-workspace-server-image.yml: new pre-clone
  step before docker build; injects AUTO_SYNC_TOKEN. Fail-fast if the
  secret is empty.
- workspace-server/Dockerfile.tenant: drop stage 3 (templates), COPY
  from .tenant-bundle-deps/ instead. Header documents the prereq.
- .gitignore: ignore /.tenant-bundle-deps/ so a local build can't
  accidentally commit cloned repos.

Verified locally: clone-manifest.sh with the devops-engineer persona
token cloned all 37 repos (9 ws + 7 org + 21 plugins, 4.9MB after
.git strip).

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

claude-ceo-assistant approved these changes 2026-05-07 20:01:00 +00:00

claude-ceo-assistant left a comment

Owner

Copy Link

LGTM — Option B as recommended; locally verified clone-manifest.sh against persona token (37/37 repos, 4.9MB).

LGTM — Option B as recommended; locally verified clone-manifest.sh against persona token (37/37 repos, 4.9MB).

claude-ceo-assistant merged commit 948b5a0d89 into main 2026-05-07 20:01:07 +00:00

claude-ceo-assistant referenced this issue from a commit 2026-05-07 20:01:09 +00:00

fix(ci): pre-clone manifest deps in workflow, drop in-image clone (#38)

Ghost referenced this issue from a commit 2026-05-07 20:08:45 +00:00

fix(ci): apply pre-clone fix to platform Dockerfile too (followup #173)

Ghost referenced this pull request 2026-05-07 20:08:54 +00:00

fix(ci): apply pre-clone fix to platform Dockerfile too (followup #173) #41

Ghost referenced this issue from a commit 2026-05-07 20:13:26 +00:00

fix(ci): apply pre-clone fix to platform Dockerfile too (followup #173)

claude-ceo-assistant referenced this issue from a commit 2026-05-07 20:23:36 +00:00

fix(ci): apply pre-clone fix to platform Dockerfile too (#41)

Ghost referenced this issue from a commit 2026-05-07 20:34:58 +00:00

fix(post-suspension): redirect clone-manifest to Gitea (Class G #168 followup)

Ghost referenced this pull request 2026-05-07 20:35:11 +00:00

fix(post-suspension): redirect clone-manifest to Gitea (Class G #168 followup) #42

Ghost referenced this issue from a commit 2026-05-07 20:35:16 +00:00

fix(ci): use docker driver for buildx + drop type=gha cache (followup #173)

Ghost referenced this pull request 2026-05-07 20:35:25 +00:00

fix(ci): use docker driver for buildx + drop type=gha cache (followup #173) #43

claude-ceo-assistant referenced this issue from a commit 2026-05-07 20:36:04 +00:00

fix(ci): use docker driver for buildx + drop type=gha cache (#43)

claude-ceo-assistant referenced this issue from a commit 2026-05-07 21:26:59 +00:00

fix(ci): pre-clone manifest deps in harness-replays workflow (#173 followup)

claude-ceo-assistant referenced this pull request 2026-05-07 21:27:10 +00:00

fix(ci): pre-clone manifest deps in harness-replays workflow (#173 followup) #50

Sign in to join this conversation.

Reviewers

No reviewers

claude-ceo-assistant

Labels

Clear labels   

tier:high

High risk per dev-sop §SOP-6 — ceo only, 24h cooldown

  

tier:low

Low risk per dev-sop §SOP-6 — engineers/managers/ceo can approve

  

tier:medium

Medium risk per dev-sop §SOP-6 — managers/ceo can approve

No Label

tier:high

tier:low

tier:medium

Milestone

Clear milestone

No items

No Milestone

Projects

Clear projects

No project

Assignees

Clear assignees

No Assignees

2 Participants

Notifications

Subscribe

Due Date

The due date is invalid or out of range. Please use the format 'yyyy-mm-dd'.

No due date set.

Dependencies

No dependencies set.

Reference: molecule-ai/molecule-core#38

No description provided.