[follow-up] [internal#71] drop gh-identity allowlist + update workspace-server import after plugin#3 merges #91

New Issue

claude-ceo-assistant · 2026-05-08T00:05:25Z

2026-05-08 00:05:25 +00:00

Summary

Follow-up to molecule-ai/internal#71 + molecule-core#82 (workspace-server vanity migration). Two locations in molecule-core/workspace-server still reference the legacy github.com/Molecule-AI/molecule-ai-plugin-gh-identity path:

workspace-server/go.mod — require github.com/Molecule-AI/molecule-ai-plugin-gh-identity v0.0.0-20260424033845-4fd5ac7be30f
workspace-server/cmd/server/main.go — import ghidentity "github.com/Molecule-AI/molecule-ai-plugin-gh-identity/pluginloader"

These are explicitly allowlisted in the lint gate (workspace-server/internal/lint/import_path_lint_test.go):

var allowlistedFiles = map[string]bool{
    // go.mod "require" line + main.go import for molecule-ai-plugin-gh-identity.
    // This cross-repo dep is in transit: gh-identity's vanity migration is
    // PR molecule-ai-plugin-gh-identity#3 ...
    "go.mod":             true,
    "cmd/server/main.go": true,
}

Cleanup sequence

molecule-ai-plugin-gh-identity#3 merges. The migrated branch declares module go.moleculesai.app/plugin/gh-identity.
Cut a tag at the new module path (e.g., v0.1.0 or a fresh pseudo-version on main after the merge commit).
go.moleculesai.app responder is deployed (depends on internal#71 phase 1 — Cloudflare Worker + DNS).
In molecule-core/workspace-server:
- Update cmd/server/main.go import: github.com/Molecule-AI/molecule-ai-plugin-gh-identity/pluginloader → go.moleculesai.app/plugin/gh-identity/pluginloader
- Run go get go.moleculesai.app/plugin/gh-identity@<sha-or-tag> to refresh go.mod + go.sum
- Drop both entries from allowlistedFiles in the lint gate
- Verify go build ./... && go test ./... clean
Open PR. Run mutation test on the lint gate (canary in main.go must trigger gate now that allowlist is gone).

Acceptance criteria

grep -r 'github\.com/Molecule-AI' workspace-server/ returns zero matches.
lint gate's allowlistedFiles is back to {} (intentionally empty).
go install go.moleculesai.app/core/platform/cmd/server@latest resolves end-to-end (responder + Gitea).

Why this is its own issue

Cleanest log + bisect history: one PR per concern. Keeps the migration PR (core#82) reviewable and the cleanup mechanical.

Class

Carry-over from internal#71 phase 2. NOT a regression of any other PR. Track until allowlist is empty.

## Summary Follow-up to molecule-ai/internal#71 + molecule-core#82 (workspace-server vanity migration). Two locations in molecule-core/workspace-server still reference the legacy `github.com/Molecule-AI/molecule-ai-plugin-gh-identity` path: - `workspace-server/go.mod` — `require github.com/Molecule-AI/molecule-ai-plugin-gh-identity v0.0.0-20260424033845-4fd5ac7be30f` - `workspace-server/cmd/server/main.go` — `import ghidentity "github.com/Molecule-AI/molecule-ai-plugin-gh-identity/pluginloader"` These are explicitly **allowlisted** in the lint gate (`workspace-server/internal/lint/import_path_lint_test.go`): ```go var allowlistedFiles = map[string]bool{ // go.mod "require" line + main.go import for molecule-ai-plugin-gh-identity. // This cross-repo dep is in transit: gh-identity's vanity migration is // PR molecule-ai-plugin-gh-identity#3 ... "go.mod": true, "cmd/server/main.go": true, } ``` ## Cleanup sequence 1. **molecule-ai-plugin-gh-identity#3** merges. The migrated branch declares `module go.moleculesai.app/plugin/gh-identity`. 2. Cut a tag at the new module path (e.g., `v0.1.0` or a fresh pseudo-version on `main` after the merge commit). 3. `go.moleculesai.app` responder is deployed (depends on internal#71 phase 1 — Cloudflare Worker + DNS). 4. In molecule-core/workspace-server: - Update `cmd/server/main.go` import: `github.com/Molecule-AI/molecule-ai-plugin-gh-identity/pluginloader` → `go.moleculesai.app/plugin/gh-identity/pluginloader` - Run `go get go.moleculesai.app/plugin/gh-identity@<sha-or-tag>` to refresh `go.mod` + `go.sum` - Drop both entries from `allowlistedFiles` in the lint gate - Verify `go build ./... && go test ./...` clean 5. Open PR. Run mutation test on the lint gate (canary in main.go must trigger gate now that allowlist is gone). ## Acceptance criteria - `grep -r 'github\.com/Molecule-AI' workspace-server/` returns zero matches. - `lint gate's allowlistedFiles` is back to `{}` (intentionally empty). - `go install go.moleculesai.app/core/platform/cmd/server@latest` resolves end-to-end (responder + Gitea). ## Why this is its own issue Cleanest log + bisect history: one PR per concern. Keeps the migration PR (core#82) reviewable and the cleanup mechanical. ## Class Carry-over from internal#71 phase 2. NOT a regression of any other PR. Track until allowlist is empty.

Sign in to join this conversation.

No Label

tier:high

tier:low

tier:medium

No Milestone

No project

No Assignees

1 Participants

Notifications

Due Date

The due date is invalid or out of range. Please use the format 'yyyy-mm-dd'.

No due date set.

Dependencies

No dependencies set.

Reference: molecule-ai/molecule-core#91