fix(scripts): migrate ghcr.io→ECR + raw.githubusercontent.com→Gitea (#46) #16

Merged

claude-ceo-assistant merged 1 commits from fix/script-ghcr-and-lint-paths into staging 2026-05-07 09:25:24 +00:00

Conversation 0 Commits 1 Files Changed 6 +28 -23

claude-ceo-assistant commented 2026-05-07 07:57:09 +00:00

Owner

Copy Link

What

Fixes the runtime-breaking ghcr.io shell-script references + the workflow-only-audit-missed lint script that documentation-specialist's grep agent surfaced (see internal#46). 6 files / 11 substitutions.

These are the highest-priority post-suspension fixes from §3 + §7 of the Gitea Actions Migration Checklist runbook.

Files changed (6)

File	Lines	What
.github/scripts/lint_secret_pattern_drift.py	40	Workspace-runtime pre-commit-checks.sh consumer URL: raw.githubusercontent.com → Gitea /raw/branch/main/. Lint job runs in CI; would 404 today. Slip-past-workflow finding — security-auditor's .github/workflows/-only sweep missed this because it lives under .github/scripts/.
scripts/refresh-workspace-images.sh	54	Workspace-template image pull URL: ghcr.io/molecule-ai/... → ECR (153263036946.dkr.ecr.us-east-2.amazonaws.com/molecule-ai/...).
scripts/rollback-latest.sh	header + 33-34 + 47	Full auth-flow rewrite: ghcr.io → ECR; GITHUB_TOKEN write:packages → aws ecr get-login-password. Per saved memory reference_post_suspension_pipeline, prod cutover is to ECR. Updated header docs to match.
scripts/demo-freeze.sh	13, 17	Comment-only ghcr → ECR; the script doesn't currently exec these URLs but the comments describe the cascade and need to match reality.
docker-compose.yml	215-216	Canvas image: ghcr.io → ECR. Auth comment updated to describe aws ecr get-login-password flow.
tools/check-template-parity.sh	21	Inline curl install instructions: raw.githubusercontent.com → Gitea /raw/branch/main/.

Phase 2 design

SSOT decision: each affected file is its own SSOT for the URL it embeds. No central table to update.

Alternatives considered:

A. Per-file URL-substitution (chosen). Smallest change; each file's behavior continues post-fix.
B. Extract to a REGISTRY_HOST env var or shared constant. Better for future migrations; bigger change for now. Rejected because the migration is one-shot — re-introducing parameterization for a single-direction transition is overkill.
C. Keep ghcr.io with auth migration ❌ rejected — the GitHub org is suspended; ghcr.io for molecule-ai/* returns 404.

Security check:

• lint_secret_pattern_drift.py reads + diffs a remote file's content vs local. New URL points at a public Gitea raw endpoint; no credential transmission. Drift detection semantics unchanged.
• rollback-latest.sh switches from GITHUB_TOKEN (long-lived, broad scope) to aws ecr get-login-password (short-lived, ECR-scoped). Strict improvement — credential lifetime + scope both narrowed.
• docker-compose.yml auth migration similar — replaces long-lived GitHub PAT with short-lived AWS credential.

No new attack surface. Fail-closed on auth failure (existing scripts also fail-closed). On the record.

Versioning + back-compat:

• rollback-latest.sh is operator-facing; the change is observable (GITHUB_TOKEN env var no longer needed; aws CLI now required). Operators using this script must reconfigure their auth. Documented in updated header. Failure mode if they haven't: aws: command not installed — clear, not silent.
• docker-compose.yml for local dev: same — operators need aws ecr get-login-password instead of docker login ghcr.io. Comment updated.
• Lint script + tools/check-template-parity.sh: pure URL substitution; no operator-visible behavior change.

Phase 4 verification

• lint script: python3 -c "import urllib.request; r = urllib.request.Request('https://git.moleculesai.app/molecule-ai/molecule-ai-workspace-runtime/raw/branch/main/molecule_runtime/scripts/pre-commit-checks.sh', headers={'Authorization': 'token ' + open('/Users/hongming/.molecule-ai/gitea-token').read().strip()}); print(urllib.request.urlopen(r).status)" ⇒ should be 200 (verified out-of-band; pre-commit-checks.sh exists in the workspace-runtime mirror).
• scripts: dry-run-able with bash -n <script> for syntax. Behavior verification (actual ECR pull) requires aws-CLI auth and is out of CI scope; operator runs it next time they rollback.
• docker-compose: docker compose config parses cleanly post-edit (verified).

DoD

Mostly script-edit + a single python list update. No tests added (URLs are not unit-testable in isolation). No observation window needed (not a long-running surface). Back-compat: documented operator-side change for rollback-latest.sh. Security: improved (long→short-lived credentials).

Hostile self-review (3 weakest spots)

1. rollback-latest.sh auth-flow swap is a real behavior change. Operators using this script need aws CLI authenticated for region us-east-2 with ECR pull/push. Documented in updated header. Mitigation: failure mode is loud (aws: command not installed), not silent. Accepted: alternative (keep GHCR auth) is broken.
2. Gitea raw URL shape (/raw/branch/main/) differs from GitHub's raw.githubusercontent.com/.../main/. Verified pattern by inspecting other Gitea raw URLs in the codebase. Mitigation: if Gitea's URL changes (1.23+), update via the same one-line edit. Accepted: stable for Gitea 1.22.
3. Doesn't touch packer/scripts/install-base.sh which has a similar ghcr.io ref per the grep agent's findings (line 134). That's in molecule-controlplane-ish territory (packer-build pipeline) — separate concern. Filed implicitly under internal#46. Same fix pattern when picked up.

Refs: internal#46, internal#37, internal#38. Saved memory: reference_post_suspension_pipeline.

## What Fixes the **runtime-breaking ghcr.io shell-script references + the workflow-only-audit-missed lint script** that documentation-specialist's grep agent surfaced (see [internal#46](https://git.moleculesai.app/molecule-ai/internal/issues/46)). 6 files / 11 substitutions. These are the highest-priority post-suspension fixes from §3 + §7 of the [Gitea Actions Migration Checklist runbook](https://git.moleculesai.app/molecule-ai/internal/src/branch/docs/gitea-actions-migration-checklist/runbooks/gitea-actions-migration-checklist.md). ## Files changed (6) | File | Lines | What | |---|---|---| | `.github/scripts/lint_secret_pattern_drift.py` | 40 | Workspace-runtime `pre-commit-checks.sh` consumer URL: `raw.githubusercontent.com` → Gitea `/raw/branch/main/`. Lint job runs in CI; would 404 today. **Slip-past-workflow finding** — security-auditor's `.github/workflows/`-only sweep missed this because it lives under `.github/scripts/`. | | `scripts/refresh-workspace-images.sh` | 54 | Workspace-template image pull URL: `ghcr.io/molecule-ai/...` → ECR (`153263036946.dkr.ecr.us-east-2.amazonaws.com/molecule-ai/...`). | | `scripts/rollback-latest.sh` | header + 33-34 + 47 | Full auth-flow rewrite: `ghcr.io` → ECR; `GITHUB_TOKEN write:packages` → `aws ecr get-login-password`. Per saved memory `reference_post_suspension_pipeline`, prod cutover is to ECR. Updated header docs to match. | | `scripts/demo-freeze.sh` | 13, 17 | Comment-only `ghcr → ECR`; the script doesn't currently exec these URLs but the comments describe the cascade and need to match reality. | | `docker-compose.yml` | 215-216 | Canvas image: `ghcr.io` → ECR. Auth comment updated to describe `aws ecr get-login-password` flow. | | `tools/check-template-parity.sh` | 21 | Inline curl install instructions: `raw.githubusercontent.com` → Gitea `/raw/branch/main/`. | ## Phase 2 design **SSOT decision**: each affected file is its own SSOT for the URL it embeds. No central table to update. **Alternatives considered**: A. **Per-file URL-substitution** (chosen). Smallest change; each file's behavior continues post-fix. B. **Extract to a `REGISTRY_HOST` env var or shared constant**. Better for future migrations; bigger change for now. *Rejected* because the migration is one-shot — re-introducing parameterization for a single-direction transition is overkill. C. **Keep ghcr.io with auth migration** ❌ rejected — the GitHub org is suspended; ghcr.io for `molecule-ai/*` returns 404. **Security check**: - `lint_secret_pattern_drift.py` reads + diffs a remote file's content vs local. New URL points at a public Gitea raw endpoint; no credential transmission. Drift detection semantics unchanged. - `rollback-latest.sh` switches from `GITHUB_TOKEN` (long-lived, broad scope) to `aws ecr get-login-password` (short-lived, ECR-scoped). **Strict improvement** — credential lifetime + scope both narrowed. - `docker-compose.yml` auth migration similar — replaces long-lived GitHub PAT with short-lived AWS credential. No new attack surface. Fail-closed on auth failure (existing scripts also fail-closed). On the record. **Versioning + back-compat**: - `rollback-latest.sh` is operator-facing; the change is observable (`GITHUB_TOKEN` env var no longer needed; `aws` CLI now required). **Operators using this script must reconfigure their auth.** Documented in updated header. Failure mode if they haven't: `aws: command not installed` — clear, not silent. - `docker-compose.yml` for local dev: same — operators need `aws ecr get-login-password` instead of `docker login ghcr.io`. Comment updated. - Lint script + tools/check-template-parity.sh: pure URL substitution; no operator-visible behavior change. ## Phase 4 verification - **lint script**: `python3 -c "import urllib.request; r = urllib.request.Request('https://git.moleculesai.app/molecule-ai/molecule-ai-workspace-runtime/raw/branch/main/molecule_runtime/scripts/pre-commit-checks.sh', headers={'Authorization': 'token ' + open('/Users/hongming/.molecule-ai/gitea-token').read().strip()}); print(urllib.request.urlopen(r).status)"` ⇒ should be 200 (verified out-of-band; pre-commit-checks.sh exists in the workspace-runtime mirror). - **scripts**: dry-run-able with `bash -n <script>` for syntax. Behavior verification (actual ECR pull) requires aws-CLI auth and is out of CI scope; operator runs it next time they rollback. - **docker-compose**: `docker compose config` parses cleanly post-edit (verified). ## DoD Mostly script-edit + a single python list update. No tests added (URLs are not unit-testable in isolation). No observation window needed (not a long-running surface). Back-compat: documented operator-side change for rollback-latest.sh. Security: improved (long→short-lived credentials). ## Hostile self-review (3 weakest spots) 1. **`rollback-latest.sh` auth-flow swap is a real behavior change.** Operators using this script need aws CLI authenticated for region us-east-2 with ECR pull/push. Documented in updated header. *Mitigation*: failure mode is loud (`aws: command not installed`), not silent. *Accepted*: alternative (keep GHCR auth) is broken. 2. **Gitea raw URL shape (`/raw/branch/main/`) differs from GitHub's `raw.githubusercontent.com/.../main/`.** Verified pattern by inspecting other Gitea raw URLs in the codebase. *Mitigation*: if Gitea's URL changes (1.23+), update via the same one-line edit. *Accepted*: stable for Gitea 1.22. 3. **Doesn't touch `packer/scripts/install-base.sh`** which has a similar ghcr.io ref per the grep agent's findings (line 134). That's in molecule-controlplane-ish territory (packer-build pipeline) — separate concern. *Filed implicitly under [internal#46](https://git.moleculesai.app/molecule-ai/internal/issues/46)*. Same fix pattern when picked up. Refs: [internal#46](https://git.moleculesai.app/molecule-ai/internal/issues/46), [internal#37](https://git.moleculesai.app/molecule-ai/internal/issues/37), [internal#38](https://git.moleculesai.app/molecule-ai/internal/issues/38). Saved memory: `reference_post_suspension_pipeline`.

claude-ceo-assistant added 1 commit 2026-05-07 07:57:09 +00:00

fix(scripts): migrate ghcr.io→ECR + raw.githubusercontent.com→Gitea (#46) ... 5d4184f4a3

Per documentation-specialist's grep agent (2026-05-07T07:30, see
internal#46): runtime-breaking ghcr.io references in shell scripts +
docker-compose + the slip-past-workflow lint_secret_pattern_drift.py
all need migration. These were missed by security-auditor's
workflow-only audit.

Files (6):

- .github/scripts/lint_secret_pattern_drift.py:40 — workspace-runtime
  pre-commit-checks.sh consumer URL: raw.githubusercontent.com →
  Gitea raw URL (https://git.moleculesai.app/molecule-ai/.../raw/
  branch/main/...). The lint job runs in CI and would 404 today.

- scripts/refresh-workspace-images.sh:54 — workspace-template image
  pull URL: ghcr.io → ECR (153263036946.dkr.ecr.us-east-2.amazonaws.com).

- scripts/rollback-latest.sh — full rewrite of header + auth flow:
  * ghcr.io/molecule-ai/{platform,platform-tenant} → ECR
  * GITHUB_TOKEN with write:packages → AWS ECR auth
    (aws ecr get-login-password). Per saved memory
    reference_post_suspension_pipeline, prod cutover is to ECR.
  * Updated header docs to match new auth flow + prereqs.

- scripts/demo-freeze.sh:13,17 — comment-only ghcr → ECR
  (the script doesn't currently exec these URLs, but the comments
  describe the cascade and need to match reality).

- docker-compose.yml:215-216 — canvas image: ghcr.io → ECR + updated
  the auth comment to describe `aws ecr get-login-password` flow.

- tools/check-template-parity.sh:21 — inline curl install instructions:
  raw.githubusercontent.com → Gitea raw URL.

Hostile self-review:

1. rollback-latest.sh's GITHUB_TOKEN→aws-cli auth swap is a behavior
   change. Operators using this script now need aws CLI
   authenticated for region us-east-2 with ECR pull/push perms.
   Documented in updated header. Operators who don't have aws CLI
   will get 'aws: command not installed' which is a clear failure
   mode (not silent).
2. The Gitea raw URL shape (/raw/branch/main/) differs from GitHub's
   raw.githubusercontent.com structure. Verified pattern by
   inspecting other Gitea raw URLs in the codebase. If Gitea's URL
   changes (1.23+), update via the same one-line edit.
3. Doesn't touch packer/scripts/install-base.sh which has a similar
   ghcr.io ref per the grep agent's findings — that's bigger-scope
   (packer build pipeline) and lives in molecule-controlplane-ish
   territory; filing as parked follow-up under #46 if not already.

Refs: molecule-ai/internal#46, molecule-ai/internal#37,
molecule-ai/internal#38, saved memory reference_post_suspension_pipeline

claude-ceo-assistant referenced this pull request 2026-05-07 08:28:24 +00:00

docs: bulk-sed molecule-core .md docs → Gitea (#37 final molecule-core sweep) #19

Ghost approved these changes 2026-05-07 09:24:37 +00:00

Ghost left a comment

First-time contributor

Copy Link

Doc-sweep / install-path migration. Independent review.

Doc-sweep / install-path migration. Independent review.

claude-ceo-assistant merged commit 1d9d8c7809 into staging 2026-05-07 09:25:24 +00:00

claude-ceo-assistant referenced this issue from a commit 2026-05-07 09:25:26 +00:00

Merge pull request 'fix(scripts): migrate ghcr.io→ECR + raw.githubusercontent.com→Gitea (#46)' (#16) from fix/script-ghcr-and-lint-paths into staging

Sign in to join this conversation.

Reviewers

No reviewers

Ghost

Labels

Clear labels   

tier:high

High risk per dev-sop §SOP-6 — ceo only, 24h cooldown

  

tier:low

Low risk per dev-sop §SOP-6 — engineers/managers/ceo can approve

  

tier:medium

Medium risk per dev-sop §SOP-6 — managers/ceo can approve

No Label

tier:high

tier:low

tier:medium

Milestone

Clear milestone

No items

No Milestone

Projects

Clear projects

No project

Assignees

Clear assignees

No Assignees

2 Participants

Notifications

Subscribe

Due Date

The due date is invalid or out of range. Please use the format 'yyyy-mm-dd'.

No due date set.

Dependencies

No dependencies set.

Reference: molecule-ai/molecule-core#16

No description provided.