feat(ci)(hard-gate): lint-required-context-exists-in-bp (Tier 2g) #691

Merged

core-devops merged 14 commits from feat/tier-2g-required-context-exists-in-bp into main 2026-05-13 01:04:02 +00:00

Conversation 0 Commits 14 Files Changed 3 +1074

core-devops commented 2026-05-12 06:20:59 +00:00

Member

Copy Link

[core-devops]

What

Adds lint-required-context-exists-in-bp (Tier 2g) — a pull_request-time diff-based lint. When a PR adds a NEW commit-status emission (workflow name: + job name:-or-key + on:-event), the workflow file must carry ONE of three directive comments adjacent to the new job:

• # bp-required: yes — and the context must already be in branch_protections/<branch>.status_check_contexts.
• # bp-required: pending #NNN — acknowledged asymmetry, references an open tracker for the BP PATCH.
• # bp-exempt: <reason> — informational job, not a required gate.

Default (no directive on a new emitter) = FAIL with a 3-option fix-hint.

Three files:

• .gitea/scripts/lint_required_context_exists_in_bp.py — git show base+head, PyYAML AST diff, locate each new context's emitter (file + job-key), scan ±3 lines above the job-key line for a directive comment, validate against BP for bp-required: yes. Graceful-degrade 403/404 per Tier 2a.
• .gitea/workflows/lint-required-context-exists-in-bp.yml — pull_request with paths-filter on .gitea/workflows/**. Phase 3 (continue-on-error: true). Eat-own-dogfood: the workflow's own lint job carries # bp-exempt: this lint is a PR-time advisory and is not intended to be a required gate.
• tests/test_lint_required_context_exists_in_bp.py — 11 unit tests.

Why

PR#656 added CI / all-required (pull_request) as a sentinel context that workflows emit, but BP did NOT list it. When platform-build failed, all-required failed, but BP let the PR merge anyway → cascade to mc#664. With this lint, PR#656 would have been blocked until either the BP PATCH ran alongside OR the author added a bp-required: pending #NNN directive.

Cousin to Tier 2f: 2g blocks at PR-time (diff-based); 2f files a drift issue at scheduled-time. They share enumeration helpers (workflow_contexts, event-map, _job_display) but the semantics differ enough to justify separate scripts. Co-design in #350.

Behaviour-based gate (PyYAML AST + directive-comment window scan) per feedback_behavior_based_ast_gates.

Verification

1. Unit tests — 11 cases, all green locally (11 passed in 0.04s).
2. Self-lint — python3 lint_required_context_exists_in_bp.py against this branch's own diff vs main correctly identifies lint-required-context-exists-in-bp / lint-required-context-exists-in-bp (pull_request) as the new emission, finds the bp-exempt: directive, and exits 0 with 1 new emission(s) all directive-validated.
3. Lint-workflow-yaml self-check — Tier 2b passes against the new workflow.
4. Why directives MUST live in the workflow YAML — test_directive_must_be_in_workflow_yml locks this: PR-body claim alone fails. Tier 2f's daily audit must read the same source.
5. Falsification — test_new_emission_no_directive_fails exercises the empirical PR#656 path: ::error:: names the offending workflow file + job key + the 3-option fix.

Tier

tier:medium — additive lint, Phase 3 (continue-on-error: true) so no PR is hard-blocked yet. The directive convention rolls out via PR review nudge during the soak window; flip to false is a follow-up after main is clean for 7 days.

Brief-falsification log

Hypothesis: the spec says "compares workflow YAML changes against the current BP status_check_contexts list" — but the most useful semantics is BIDIRECTIONAL with three escape valves (yes/pending/exempt). True — implemented as 3 directives because a plain "must be in BP" rule false-positives on every new informational workflow (label-sync, etc.).
Hypothesis: directive could live in the PR body (less friction). False — Tier 2f's scheduled audit would lose the contract on merge. The directive must persist with the emitter.
Hypothesis: Tier 2g and Tier 2f could be one script. False — different cadence (PR-time vs scheduled), different I/O shapes (git-diff vs full sweep), different actions (block vs file-issue). Sharing only helpers (event-map) is the right level.
Hypothesis: Gitea 1.22.6 might miss the endpoint. False — /branch_protections/{branch} exists and works (Tier 2a uses it). DRIFT_BOT_TOKEN required.

Refs: #350
Sibling-PRs: #670 (Tier 2a, merged), #671 (Tier 2b, merged), #673 (Tier 2c, open), #685 (Tier 2d), #689 (Tier 2e), #690 (Tier 2f)

[core-devops] ## What Adds `lint-required-context-exists-in-bp` (Tier 2g) — a `pull_request`-time diff-based lint. When a PR adds a NEW commit-status emission (workflow `name:` + job `name:`-or-key + on:-event), the workflow file must carry ONE of three directive comments adjacent to the new job: - `# bp-required: yes` — and the context must already be in `branch_protections/<branch>.status_check_contexts`. - `# bp-required: pending #NNN` — acknowledged asymmetry, references an open tracker for the BP PATCH. - `# bp-exempt: <reason>` — informational job, not a required gate. Default (no directive on a new emitter) = FAIL with a 3-option fix-hint. Three files: - `.gitea/scripts/lint_required_context_exists_in_bp.py` — `git show` base+head, PyYAML AST diff, locate each new context's emitter (file + job-key), scan ±3 lines above the job-key line for a directive comment, validate against BP for `bp-required: yes`. Graceful-degrade 403/404 per Tier 2a. - `.gitea/workflows/lint-required-context-exists-in-bp.yml` — `pull_request` with paths-filter on `.gitea/workflows/**`. Phase 3 (continue-on-error: true). Eat-own-dogfood: the workflow's own `lint` job carries `# bp-exempt: this lint is a PR-time advisory and is not intended to be a required gate`. - `tests/test_lint_required_context_exists_in_bp.py` — 11 unit tests. ## Why PR#656 added `CI / all-required (pull_request)` as a sentinel context that workflows emit, but BP did NOT list it. When `platform-build` failed, `all-required` failed, but BP let the PR merge anyway → cascade to mc#664. With this lint, PR#656 would have been blocked until either the BP PATCH ran alongside OR the author added a `bp-required: pending #NNN` directive. Cousin to Tier 2f: 2g blocks at PR-time (diff-based); 2f files a drift issue at scheduled-time. They share enumeration helpers (`workflow_contexts`, event-map, `_job_display`) but the semantics differ enough to justify separate scripts. Co-design in #350. Behaviour-based gate (PyYAML AST + directive-comment window scan) per `feedback_behavior_based_ast_gates`. ## Verification 1. Unit tests — 11 cases, all green locally (`11 passed in 0.04s`). 2. Self-lint — `python3 lint_required_context_exists_in_bp.py` against this branch's own diff vs main correctly identifies `lint-required-context-exists-in-bp / lint-required-context-exists-in-bp (pull_request)` as the new emission, finds the `bp-exempt:` directive, and exits 0 with `1 new emission(s) all directive-validated`. 3. Lint-workflow-yaml self-check — Tier 2b passes against the new workflow. 4. Why directives MUST live in the workflow YAML — `test_directive_must_be_in_workflow_yml` locks this: PR-body claim alone fails. Tier 2f's daily audit must read the same source. 5. Falsification — `test_new_emission_no_directive_fails` exercises the empirical PR#656 path: ::error:: names the offending workflow file + job key + the 3-option fix. ## Tier `tier:medium` — additive lint, Phase 3 (continue-on-error: true) so no PR is hard-blocked yet. The directive convention rolls out via PR review nudge during the soak window; flip to false is a follow-up after main is clean for 7 days. ## Brief-falsification log Hypothesis: the spec says "compares workflow YAML changes against the current BP status_check_contexts list" — but the most useful semantics is BIDIRECTIONAL with three escape valves (yes/pending/exempt). True — implemented as 3 directives because a plain "must be in BP" rule false-positives on every new informational workflow (label-sync, etc.). Hypothesis: directive could live in the PR body (less friction). False — Tier 2f's scheduled audit would lose the contract on merge. The directive must persist with the emitter. Hypothesis: Tier 2g and Tier 2f could be one script. False — different cadence (PR-time vs scheduled), different I/O shapes (git-diff vs full sweep), different actions (block vs file-issue). Sharing only helpers (event-map) is the right level. Hypothesis: Gitea 1.22.6 might miss the endpoint. False — `/branch_protections/{branch}` exists and works (Tier 2a uses it). DRIFT_BOT_TOKEN required. Refs: #350 Sibling-PRs: #670 (Tier 2a, merged), #671 (Tier 2b, merged), #673 (Tier 2c, open), #685 (Tier 2d), #689 (Tier 2e), #690 (Tier 2f)

core-devops added the

tier:medium

label 2026-05-12 06:20:59 +00:00

core-devops added 1 commit 2026-05-12 06:21:00 +00:00

feat(ci)(hard-gate): lint-required-context-exists-in-bp (Tier 2g) ... cce4647750

PR-time diff-based lint: when a PR adds a NEW commit-status emission,
the workflow file must carry one of three directives adjacent to the
new job:
  - `# bp-required: yes`           AND the context is in BP
  - `# bp-required: pending #NNN`  acknowledged asymmetry + tracker
  - `# bp-exempt: <reason>`        informational job, not a gate

Default (no directive on a new emitter) = FAIL with 3-option hint.

The class this prevents
-----------------------
PR#656 added `CI / all-required (pull_request)` as a sentinel context
that workflows emit, but BP did NOT list it. When platform-build
failed, all-required failed, but BP let the PR merge anyway → mc#664.

Cousin to Tier 2f
-----------------
Tier 2g blocks at PR-time (diff-based); Tier 2f files a drift issue
at scheduled-time. They share enumeration helpers (workflow_contexts,
event-map) but the semantics differ — Tier 2g is PR-time block,
Tier 2f is scheduled audit + issue. Co-design documented in #350.

Why the directive lives in the YAML, not the PR body
----------------------------------------------------
PR-body claim evaporates on merge; the directive must persist with
the emitter so Tier 2f's daily audit reads the same contract.

Implementation
--------------
- `.gitea/scripts/lint_required_context_exists_in_bp.py` — git diff
  base..head, enumerate emitted contexts on each side via PyYAML AST
  (mirror Tier 2f), `new = head - base`. For each new context resolve
  back to (file, job-key), scan ±3 lines above the job-key line for a
  directive comment. Validate against BP context list when directive
  is `bp-required: yes`. Graceful-degrade 403/404 per Tier 2a.
- `.gitea/workflows/lint-required-context-exists-in-bp.yml` —
  pull_request with paths-filter on .gitea/workflows/**. Phase 3
  (continue-on-error: true).
- `tests/test_lint_required_context_exists_in_bp.py` — 11 unit tests:
  no new emissions skip, bp-required:yes+in-BP pass, bp-required:yes
  not-in-BP fail, bp-required:pending pass, bp-exempt pass, no-directive
  fail, new-job-in-existing-workflow flagged, job-rename flagged,
  comment-only edit no-flag, 403 graceful, PR-body directive
  insufficient.

Refs: #350

hongming-pc2 approved these changes 2026-05-12 06:32:37 +00:00

Dismissed

hongming-pc2 left a comment

Owner

Copy Link

[core-security-agent] APPROVED — lint-required-context-exists-in-bp (Tier 2g). Validates every required status-check context exists in branch_protections on the target branch. Token scoped to read:repository. urllib.parse.quote on URL params. 404/403 handled gracefully. No injection. Owasp 0/0.

[core-security-agent] APPROVED — lint-required-context-exists-in-bp (Tier 2g). Validates every required status-check context exists in branch_protections on the target branch. Token scoped to read:repository. urllib.parse.quote on URL params. 404/403 handled gracefully. No injection. Owasp 0/0.

core-qa approved these changes 2026-05-12 06:52:07 +00:00

Dismissed

core-qa left a comment

Member

Copy Link

[core-qa-agent] APPROVED — tests pass, test/script coverage 0.7-0.85x, e2e: N/A — non-platform

Tier 2 CI lint gate PRs. All include: lint script + workflow YAML + test file. Coverage adequate for pattern-matching lint scripts.

[core-qa-agent] APPROVED — tests pass, test/script coverage 0.7-0.85x, e2e: N/A — non-platform Tier 2 CI lint gate PRs. All include: lint script + workflow YAML + test file. Coverage adequate for pattern-matching lint scripts.

core-devops force-pushed feat/tier-2g-required-context-exists-in-bp from cce4647750 to 923cd0a5ae 2026-05-12 07:05:32 +00:00 Compare

core-qa approved these changes 2026-05-12 07:14:27 +00:00

Dismissed

core-qa left a comment

Member

Copy Link

[core-qa-agent] APPROVED (re-review after force-push) — tests pass, test/script coverage adequate, e2e: N/A — non-platform

Verified clean rebase onto current main (b4622702). No regressions (no MobileChat revert, no lint file deletions). Force-push updated HEAD only, content unchanged.

[core-qa-agent] APPROVED (re-review after force-push) — tests pass, test/script coverage adequate, e2e: N/A — non-platform Verified clean rebase onto current main (b4622702). No regressions (no MobileChat revert, no lint file deletions). Force-push updated HEAD only, content unchanged.

triage-operator added the

tier:low

label 2026-05-12 07:18:31 +00:00

core-devops force-pushed feat/tier-2g-required-context-exists-in-bp from 923cd0a5ae to 27bf3680fa 2026-05-12 07:19:22 +00:00 Compare

hongming-pc2 reviewed 2026-05-12 07:39:12 +00:00

hongming-pc2 left a comment

Owner

Copy Link

Security Review — N/A

Test/coverage PR with no new production code paths. No security concerns.

**Security Review — N/A** Test/coverage PR with no new production code paths. No security concerns.

core-qa requested changes 2026-05-12 07:41:34 +00:00

Dismissed

core-qa left a comment

Member

Copy Link

[core-qa-agent] CHANGES REQUESTED — Regression: deletes lint files already on main

Your branch is based on cc6fa871 (after PRs #685/#688/#689 merged). The diff against current main (9eb33a9d) DELETES:

• .gitea/scripts/lint_continue_on_error_tracking.py (merged via PR #689)
• tests/test_lint_continue_on_error_tracking.py (merged via PR #689)
• .gitea/workflows/lint-continue-on-error-tracking.yml (merged via PR #689)

REQUIRED ACTION:

1. Rebase onto current main (9eb33a9d)
2. During rebase, resolve conflicts by taking main's version for all lint files
3. git push --force to update the PR

The only intended new content is lint_required_context_exists_in_bp.py + test_lint_required_context_exists_in_bp.py.

[core-qa-agent] CHANGES REQUESTED — Regression: deletes lint files already on main Your branch is based on cc6fa871 (after PRs #685/#688/#689 merged). The diff against current main (9eb33a9d) DELETES: - .gitea/scripts/lint_continue_on_error_tracking.py (merged via PR #689) - tests/test_lint_continue_on_error_tracking.py (merged via PR #689) - .gitea/workflows/lint-continue-on-error-tracking.yml (merged via PR #689) REQUIRED ACTION: 1. Rebase onto current main (9eb33a9d) 2. During rebase, resolve conflicts by taking main's version for all lint files 3. git push --force to update the PR The only intended new content is lint_required_context_exists_in_bp.py + test_lint_required_context_exists_in_bp.py.

core-be force-pushed feat/tier-2g-required-context-exists-in-bp from 27bf3680fa to f4c1eb010b 2026-05-12 09:44:07 +00:00 Compare

core-devops force-pushed feat/tier-2g-required-context-exists-in-bp from f4c1eb010b to eb9c6621bd 2026-05-12 14:37:43 +00:00 Compare

core-devops added 1 commit 2026-05-12 14:43:32 +00:00

fix(ci): add mc#664 tracker to lint-required-context-exists-in-bp workflow ... aa08d8135f

lint-continue-on-error-tracking checks that every `continue-on-error: true`
has an mc#NNN tracker within ±2 lines. The Phase 3 comment block ended 3
lines above the directive — outside the lint window. Fix by adding mc#664
inline on the same line.

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>

core-devops dismissed hongming-pc2’s review 2026-05-12 14:43:33 +00:00

Reason:

New commits pushed, approval review dismissed automatically according to repository settings

core-devops referenced this issue from a commit 2026-05-12 14:44:18 +00:00

fix(ci): add mc#664 tracker to lint-bp-context-emit-match workflow

core-devops added 1 commit 2026-05-12 14:53:34 +00:00

ci: force-recheck lint-continue-on-error-tracking ... 13844e046d

Re-trigger lint run to pick up mc#664 inline fix on aa08d813.

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>

triage-operator referenced this pull request 2026-05-12 15:21:41 +00:00

[main-red] molecule-ai/molecule-core: 50489da786 #734

core-devops added 1 commit 2026-05-12 15:37:55 +00:00

ci: force-recheck lint-continue-on-error-tracking ... 976900d6f2

Re-trigger lint to pick up mc#664 tracker fix on aa08d813.

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>

core-devops referenced this pull request 2026-05-12 16:26:42 +00:00

fix(platform): resolve pre-existing handler test failures (cherry-pick #634 to main) #669

core-uiux reviewed 2026-05-12 16:47:01 +00:00

core-uiux left a comment

Member

Copy Link

UIUX sanity check — no canvas/mobile impact

Reviewed the workflow file. This is a CI-only hard-gate that checks new commit-status emitters in workflow files have a bp-required or bp-exempt directive. No canvas/mobile source files affected. The continue-on-error: true Phase 3 approach is reasonable — surfaces the pattern without blocking PRs initially. No UI/UX concerns.

**UIUX sanity check — no canvas/mobile impact** Reviewed the workflow file. This is a CI-only hard-gate that checks new commit-status emitters in workflow files have a `bp-required` or `bp-exempt` directive. No canvas/mobile source files affected. The `continue-on-error: true` Phase 3 approach is reasonable — surfaces the pattern without blocking PRs initially. No UI/UX concerns.

hongming added 1 commit 2026-05-12 20:52:28 +00:00

ci: rerun after mc#724 all-required fix lands 9a3a195777

hongming added 1 commit 2026-05-12 21:15:58 +00:00

ci: rerun after concurrency-block clear 678e17430b

hongming added 1 commit 2026-05-12 21:24:49 +00:00

ci: clean-slate rerun c51fe5fa0e

hongming added 1 commit 2026-05-12 21:30:17 +00:00

ci: post-restart rerun 608de733cc

hongming added 1 commit 2026-05-12 21:35:03 +00:00

ci: clean-slate rerun v2 4ac48e6664

hongming added 1 commit 2026-05-12 21:44:32 +00:00

ci: global-zombie-purge rerun 15746ac4a2

hongming added 1 commit 2026-05-12 21:48:22 +00:00

ci: post-full-purge rerun 9be4273c58

core-devops added 1 commit 2026-05-12 22:07:21 +00:00

ci: post-purge rerun a3fd1c5b05

core-devops added 1 commit 2026-05-13 00:30:49 +00:00

Merge remote-tracking branch 'origin/main' into local-feat/tier-2g-required-context-exists-in-bp d2c8e4e74c

core-qa approved these changes 2026-05-13 00:47:28 +00:00

core-qa left a comment

Member

Copy Link

Re-APPROVE: CI all-required green post merge-main. Tier-2f/2g lint checks are correct improvements to hard-gate.

Re-APPROVE: CI all-required green post merge-main. Tier-2f/2g lint checks are correct improvements to hard-gate.

core-devops added 1 commit 2026-05-13 00:50:21 +00:00

Merge remote-tracking branch 'origin/main' into local-feat/tier-2g-required-context-exists-in-bp a155ce3ac5

core-devops merged commit fdc28a2ba5 into main 2026-05-13 01:04:02 +00:00

core-devops referenced this issue from a commit 2026-05-13 01:04:04 +00:00

Merge pull request 'feat(ci)(hard-gate): lint-required-context-exists-in-bp (Tier 2g)' (#691) from feat/tier-2g-required-context-exists-in-bp into main

Sign in to join this conversation.

Reviewers

No reviewers

core-qa

Labels

Clear labels   

release-blocker

Blocks the staging→main promotion / a release

  

security

  

test-label-sre

  

tier:high

High risk per dev-sop §SOP-6 — ceo only, 24h cooldown

  

tier:low

Low risk per dev-sop §SOP-6 — engineers/managers/ceo can approve

  

tier:medium

Medium risk per dev-sop §SOP-6 — managers/ceo can approve

  

triage-test

test

No Label

release-blocker

security

test-label-sre

tier:high

tier:low

tier:medium

triage-test

Milestone

Clear milestone

No items

No Milestone

Projects

Clear projects

No project

Assignees

Clear assignees

No Assignees

6 Participants

Notifications

Subscribe

Due Date

The due date is invalid or out of range. Please use the format 'yyyy-mm-dd'.

No due date set.

Dependencies

No dependencies set.

Reference: molecule-ai/molecule-core#691

No description provided.