From e01077be38ebbaeefaeeae8034285b89e109fa04 Mon Sep 17 00:00:00 2001 From: security-auditor Date: Thu, 7 May 2026 01:00:10 -0700 Subject: [PATCH] fix(ci): lowercase 'molecule-ai/' in cross-repo workflow refs Gitea is case-sensitive on owner slugs; canonical is lowercase `molecule-ai/...`. Mixed-case `Molecule-AI/...` refs fail-at-0s when the runner tries to resolve the cross-repo workflow / checkout. Same fix as molecule-controlplane#12. Mechanical case-correction; no behavior change beyond making CI resolve again. Refs: internal#46 Co-Authored-By: Claude Opus 4.7 (1M context) --- .github/workflows/block-internal-paths.yml | 4 ++-- .github/workflows/canary-verify.yml | 2 +- .github/workflows/ci.yml | 10 +++++----- .github/workflows/codeql.yml | 2 +- .github/workflows/harness-replays.yml | 2 +- .github/workflows/pr-guards.yml | 2 +- .github/workflows/publish-runtime.yml | 6 +++--- .github/workflows/publish-workspace-server-image.yml | 4 ++-- .github/workflows/redeploy-tenants-on-main.yml | 4 ++-- .github/workflows/redeploy-tenants-on-staging.yml | 2 +- .github/workflows/retarget-main-to-staging.yml | 2 +- .github/workflows/secret-scan.yml | 2 +- 12 files changed, 21 insertions(+), 21 deletions(-) diff --git a/.github/workflows/block-internal-paths.yml b/.github/workflows/block-internal-paths.yml index a24e613a..7629a669 100644 --- a/.github/workflows/block-internal-paths.yml +++ b/.github/workflows/block-internal-paths.yml @@ -1,7 +1,7 @@ name: Block internal-flavored paths # Hard CI gate. Internal content (positioning, competitive briefs, sales -# playbooks, PMM/press drip, draft campaigns) lives in Molecule-AI/internal — +# playbooks, PMM/press drip, draft campaigns) lives in molecule-ai/internal — # this public monorepo must never re-acquire those paths. CEO directive # 2026-04-23 after a fleet-wide audit found 79 internal files leaked here. # @@ -135,7 +135,7 @@ jobs: echo "::error::Forbidden internal-flavored paths detected:" printf "$OFFENDING" echo "" - echo "These paths belong in Molecule-AI/internal, not this public repo." + echo "These paths belong in molecule-ai/internal, not this public repo." echo "See docs/internal-content-policy.md for canonical locations." echo "" echo "If your file is genuinely public-facing (e.g. a blog post" diff --git a/.github/workflows/canary-verify.yml b/.github/workflows/canary-verify.yml index 6972194e..c26958ae 100644 --- a/.github/workflows/canary-verify.yml +++ b/.github/workflows/canary-verify.yml @@ -108,7 +108,7 @@ jobs: echo echo "One or more canary secrets are unset (\`CANARY_TENANT_URLS\`, \`CANARY_ADMIN_TOKENS\`, \`CANARY_CP_SHARED_SECRET\`)." echo "Phase 2 canary fleet has not been stood up yet —" - echo "see [canary-tenants.md](https://github.com/Molecule-AI/molecule-controlplane/blob/main/docs/canary-tenants.md)." + echo "see [canary-tenants.md](https://github.com/molecule-ai/molecule-controlplane/blob/main/docs/canary-tenants.md)." echo echo "**Skipped — promote-to-latest will NOT auto-fire.** Dispatch \`promote-latest.yml\` manually when ready." } >> "$GITHUB_STEP_SUMMARY" diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml index 3fda3fac..6b447291 100644 --- a/.github/workflows/ci.yml +++ b/.github/workflows/ci.yml @@ -87,7 +87,7 @@ jobs: run: go mod download - if: needs.changes.outputs.platform == 'true' run: go build ./cmd/server - # CLI (molecli) moved to standalone repo: github.com/Molecule-AI/molecule-cli + # CLI (molecli) moved to standalone repo: github.com/molecule-ai/molecule-cli - if: needs.changes.outputs.platform == 'true' run: go vet ./... || true - if: needs.changes.outputs.platform == 'true' @@ -165,7 +165,7 @@ jobs: # Strip the package-import prefix so we can match .coverage-allowlist.txt # entries written as paths relative to workspace-server/. # Handle both module paths: platform/workspace-server/... and platform/... - rel=$(echo "$file" | sed 's|^github.com/Molecule-AI/molecule-monorepo/platform/workspace-server/||; s|^github.com/Molecule-AI/molecule-monorepo/platform/||') + rel=$(echo "$file" | sed 's|^github.com/molecule-ai/molecule-monorepo/platform/workspace-server/||; s|^github.com/molecule-ai/molecule-monorepo/platform/||') if echo "$ALLOWLIST" | grep -qxF "$rel"; then echo "::warning file=workspace-server/$rel::Critical file at ${pct}% coverage (allowlisted, #1823) — fix before expiry." @@ -243,8 +243,8 @@ jobs: if-no-files-found: warn # MCP Server + SDK removed from CI — now in standalone repos: - # - github.com/Molecule-AI/molecule-mcp-server (npm CI) - # - github.com/Molecule-AI/molecule-sdk-python (PyPI CI) + # - github.com/molecule-ai/molecule-mcp-server (npm CI) + # - github.com/molecule-ai/molecule-sdk-python (PyPI CI) # e2e-api job moved to .github/workflows/e2e-api.yml (issue #458). # It now has workflow-level concurrency (cancel-in-progress: false) so @@ -434,5 +434,5 @@ jobs: fi # SDK + plugin validation moved to standalone repo: - # github.com/Molecule-AI/molecule-sdk-python + # github.com/molecule-ai/molecule-sdk-python diff --git a/.github/workflows/codeql.yml b/.github/workflows/codeql.yml index 3db01cdc..14624d91 100644 --- a/.github/workflows/codeql.yml +++ b/.github/workflows/codeql.yml @@ -62,7 +62,7 @@ jobs: if: matrix.language == 'go' uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 with: - repository: Molecule-AI/molecule-ai-plugin-github-app-auth + repository: molecule-ai/molecule-ai-plugin-github-app-auth path: molecule-ai-plugin-github-app-auth token: ${{ secrets.PLUGIN_REPO_PAT || secrets.GITHUB_TOKEN }} diff --git a/.github/workflows/harness-replays.yml b/.github/workflows/harness-replays.yml index 5dc5d36d..b028b431 100644 --- a/.github/workflows/harness-replays.yml +++ b/.github/workflows/harness-replays.yml @@ -102,7 +102,7 @@ jobs: if: needs.detect-changes.outputs.run == 'true' uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 with: - repository: Molecule-AI/molecule-ai-plugin-github-app-auth + repository: molecule-ai/molecule-ai-plugin-github-app-auth path: molecule-ai-plugin-github-app-auth token: ${{ secrets.PLUGIN_REPO_PAT || secrets.GITHUB_TOKEN }} diff --git a/.github/workflows/pr-guards.yml b/.github/workflows/pr-guards.yml index 29645b58..151757fe 100644 --- a/.github/workflows/pr-guards.yml +++ b/.github/workflows/pr-guards.yml @@ -19,4 +19,4 @@ permissions: jobs: disable-auto-merge-on-push: - uses: Molecule-AI/molecule-ci/.github/workflows/disable-auto-merge-on-push.yml@main + uses: molecule-ai/molecule-ci/.github/workflows/disable-auto-merge-on-push.yml@main diff --git a/.github/workflows/publish-runtime.yml b/.github/workflows/publish-runtime.yml index b3750a61..fa8f64b3 100644 --- a/.github/workflows/publish-runtime.yml +++ b/.github/workflows/publish-runtime.yml @@ -25,7 +25,7 @@ name: publish-runtime # 3. Publishes to PyPI via the PyPA Trusted Publisher action (OIDC). # No static API token is stored — PyPI verifies the workflow's # OIDC claim against the trusted-publisher config registered for -# molecule-ai-workspace-runtime (Molecule-AI/molecule-core, +# molecule-ai-workspace-runtime (molecule-ai/molecule-core, # publish-runtime.yml, environment pypi-publish). # # After publish: the 8 template repos pick up the new version on their @@ -166,7 +166,7 @@ jobs: - name: Publish to PyPI (Trusted Publisher / OIDC) # PyPI side is configured: project molecule-ai-workspace-runtime → - # publisher Molecule-AI/molecule-core, workflow publish-runtime.yml, + # publisher molecule-ai/molecule-core, workflow publish-runtime.yml, # environment pypi-publish. The action mints a short-lived OIDC # token and exchanges it for a PyPI upload credential — no static # API token in this repo's secrets. @@ -342,7 +342,7 @@ jobs: TEMPLATES="claude-code hermes openclaw codex langgraph crewai autogen deepagents gemini-cli" FAILED="" for tpl in $TEMPLATES; do - REPO="Molecule-AI/molecule-ai-workspace-template-$tpl" + REPO="molecule-ai/molecule-ai-workspace-template-$tpl" STATUS=$(curl -sS -o /tmp/dispatch.out -w "%{http_code}" \ -X POST "https://api.github.com/repos/$REPO/dispatches" \ -H "Authorization: Bearer $DISPATCH_TOKEN" \ diff --git a/.github/workflows/publish-workspace-server-image.yml b/.github/workflows/publish-workspace-server-image.yml index a0113b4e..1b87052c 100644 --- a/.github/workflows/publish-workspace-server-image.yml +++ b/.github/workflows/publish-workspace-server-image.yml @@ -80,12 +80,12 @@ jobs: # # Uses a fine-grained PAT (PLUGIN_REPO_PAT) because the plugin repo # is private and the default GITHUB_TOKEN is scoped to THIS repo. - # The PAT needs Contents:Read on Molecule-AI/molecule-ai-plugin- + # The PAT needs Contents:Read on molecule-ai/molecule-ai-plugin- # github-app-auth. Falls back to the default token for the (rare) # case where an operator made the plugin repo public. uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 with: - repository: Molecule-AI/molecule-ai-plugin-github-app-auth + repository: molecule-ai/molecule-ai-plugin-github-app-auth path: molecule-ai-plugin-github-app-auth token: ${{ secrets.PLUGIN_REPO_PAT || secrets.GITHUB_TOKEN }} diff --git a/.github/workflows/redeploy-tenants-on-main.yml b/.github/workflows/redeploy-tenants-on-main.yml index f862c487..0625fc3f 100644 --- a/.github/workflows/redeploy-tenants-on-main.yml +++ b/.github/workflows/redeploy-tenants-on-main.yml @@ -9,7 +9,7 @@ name: redeploy-tenants-on-main # # This workflow closes the gap by calling the control-plane admin # endpoint that performs a canary-first, batched, health-gated rolling -# redeploy across every live tenant. Implemented in Molecule-AI/ +# redeploy across every live tenant. Implemented in molecule-ai/ # molecule-controlplane as POST /cp/admin/tenants/redeploy-fleet # (feat/tenant-auto-redeploy, landing alongside this workflow). # @@ -146,7 +146,7 @@ jobs: - name: Call CP redeploy-fleet # CP_ADMIN_API_TOKEN must be set as a repo/org secret on - # Molecule-AI/molecule-core, matching the staging/prod CP's + # molecule-ai/molecule-core, matching the staging/prod CP's # CP_ADMIN_API_TOKEN env. Stored in Railway, mirrored to this # repo's secrets for CI. env: diff --git a/.github/workflows/redeploy-tenants-on-staging.yml b/.github/workflows/redeploy-tenants-on-staging.yml index e0d69544..2726db9e 100644 --- a/.github/workflows/redeploy-tenants-on-staging.yml +++ b/.github/workflows/redeploy-tenants-on-staging.yml @@ -97,7 +97,7 @@ jobs: - name: Call staging-CP redeploy-fleet # CP_STAGING_ADMIN_API_TOKEN must be set as a repo/org secret - # on Molecule-AI/molecule-core, matching staging-CP's + # on molecule-ai/molecule-core, matching staging-CP's # CP_ADMIN_API_TOKEN env var (visible in Railway controlplane # / staging environment). Stored separately from the prod # CP_ADMIN_API_TOKEN so a leak of one doesn't auth the other. diff --git a/.github/workflows/retarget-main-to-staging.yml b/.github/workflows/retarget-main-to-staging.yml index 5e1ff8bc..1958a4b9 100644 --- a/.github/workflows/retarget-main-to-staging.yml +++ b/.github/workflows/retarget-main-to-staging.yml @@ -96,7 +96,7 @@ jobs: --body "$(cat <<'BODY' [retarget-bot] This PR was opened against `main` and has been retargeted to `staging` automatically. - **Why:** per [SHARED_RULES rule 8](https://github.com/Molecule-AI/molecule-ai-org-template-molecule-dev/blob/main/SHARED_RULES.md), all feature work targets `staging` first; the CEO promotes `staging → main` separately. + **Why:** per [SHARED_RULES rule 8](https://github.com/molecule-ai/molecule-ai-org-template-molecule-dev/blob/main/SHARED_RULES.md), all feature work targets `staging` first; the CEO promotes `staging → main` separately. **What changed:** just the base branch — no code change. CI will re-run against `staging`. If you get merge conflicts, rebase on `staging`. diff --git a/.github/workflows/secret-scan.yml b/.github/workflows/secret-scan.yml index 2a38d1e4..edea6bf9 100644 --- a/.github/workflows/secret-scan.yml +++ b/.github/workflows/secret-scan.yml @@ -12,7 +12,7 @@ name: Secret scan # # jobs: # secret-scan: -# uses: Molecule-AI/molecule-core/.github/workflows/secret-scan.yml@staging +# uses: molecule-ai/molecule-core/.github/workflows/secret-scan.yml@staging # # Pin to @staging not @main — staging is the active default branch, # main lags via the staging-promotion workflow. Updates ride along -- 2.45.2