molecule-ai/molecule-core
51
0
Fork 2
Code Issues 157 Pull Requests 160 Actions 9 Packages Projects Releases Wiki Activity

fix(ci-drift): skip F1 when sentinel has no needs (post-#1766 contract) #1860

Closed
agent-dev-a wants to merge 0 commits from fix/1859-ci-drift-post-1766 into main
pull from: fix/1859-ci-drift-post-1766
merge into: molecule-ai:main
Conversation 0 Commits - Files Changed -
+233 -31
agent-dev-a commented 2026-05-26 03:11:54 +00:00
Member
Copy Link
Copy Source

Summary

Completes the post-#1766 path-aware all-required migration across CI tooling.

Post-#1766, CI / all-required deliberately has no needs: and polls path-relevant statuses dynamically (see .gitea/workflows/ci.yml:474-483). Two downstream tools still assumed the old needs-based contract:

  1. ci-required-drift.py — F1 flagged every job as "missing from sentinel needs" because needs resolved to an empty set. Now F1 only fires when needs is non-empty.
  2. ci-required-drift.py resolution text — previously told engineers to "add the missing job to all-required.needs". Updated to explain the no-needs path-aware sentinel contract.
  3. prod-auto-deploy.py — already correct; DEFAULT_REQUIRED_CONTEXTS only waits on CI / all-required (push) + Secret scan, delegating path-gating to the sentinel. Existing test test_default_required_contexts_delegate_path_gating_to_all_required guards this.

Test plan

  • Manual verification: no-needs sentinel → F1 skipped; typo in needs → F1b fires; missing job in needs → F1 fires.
  • Existing script test suite (154 tests) passes.
  • New unit tests for ci-required-drift.py (delegated to agent-dev-b).

Fixes

Fixes #1859
Closes #1776, #1738, #1739 (cleanup completion).

## Summary Completes the post-#1766 path-aware `all-required` migration across CI tooling. Post-#1766, `CI / all-required` deliberately has no `needs:` and polls path-relevant statuses dynamically (see `.gitea/workflows/ci.yml:474-483`). Two downstream tools still assumed the old `needs`-based contract: 1. **`ci-required-drift.py`** — F1 flagged every job as "missing from sentinel needs" because `needs` resolved to an empty set. Now F1 only fires when `needs` is non-empty. 2. **`ci-required-drift.py` resolution text** — previously told engineers to "add the missing job to `all-required.needs`". Updated to explain the no-needs path-aware sentinel contract. 3. **`prod-auto-deploy.py`** — already correct; `DEFAULT_REQUIRED_CONTEXTS` only waits on `CI / all-required (push)` + `Secret scan`, delegating path-gating to the sentinel. Existing test `test_default_required_contexts_delegate_path_gating_to_all_required` guards this. ## Test plan - [x] Manual verification: no-needs sentinel → F1 skipped; typo in needs → F1b fires; missing job in needs → F1 fires. - [x] Existing script test suite (154 tests) passes. - [ ] New unit tests for `ci-required-drift.py` (delegated to agent-dev-b). ## Fixes Fixes #1859 Closes #1776, #1738, #1739 (cleanup completion).
agent-dev-a added 11 commits 2026-05-26 03:11:55 +00:00
fix(tests): re-enable TestResolveYAMLIncludes_RealMoleculeDev d20392cbb6 
RCA #1763 Finding 1: previously hard-skipped because the in-tree
org-templates/molecule-dev/ was stale with a broken !include graph.
The extraction completed; the canonical copy now lives at
molecule-ai/molecule-ai-org-template-molecule-dev.

Rewritten to:
- Clone the standalone org template via HTTPS (repo is public, no token)
  into t.TempDir() before running the include resolution check.
- Uses t.Skipf (not hard t.Skip) so network-clone failures skip
  gracefully without masking real failures.

Also adds runCmd helper to org_include_test.go.
ci: trigger re-run 15d744d22e
ci: trigger fresh CI run f6adc712c6
ci: trigger fresh CI run (PR #1768) 9a9ab9a177 
No-op commit to re-trigger CI for fresh run-log diagnostics.
fix(tests): skip TestResolveYAMLIncludes_RealMoleculeDev when git unavailable 0c14dd5672 
The integration test clones molecule-ai-org-template-molecule-dev via
HTTPS using exec.Command("git", "clone", ...). CI runtimes that lack the
git binary fail the clone with exit code 127 before the existing skip
logic can run. Add an exec.LookPath("git") guard at the top of the test
body so it skips cleanly with t.Skip when git is absent.

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>
chore: add clarifying comment to RealMoleculeDev test a7e723dada 
No functional change — clarifies why the exec.LookPath guard exists.
CI-triggered commit to re-run sop-checklist on current body state.

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>
chore: CI trigger timestamp 8750cb06c2 
Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>
fix(tests): resolve compile error and update assertions in RealMoleculeDev
ci-arm64-advisory / fast-checks (pull_request) Waiting to run
Details
Block internal-flavored paths / Block forbidden paths (pull_request) Successful in 4s
Details
CI / Python Lint & Test (pull_request) Successful in 5s
Details
CI / Detect changes (pull_request) Successful in 9s
Details
Lint shellcheck (arm64 pilot) / shellcheck-arm64 (pilot) (pull_request) Successful in 10s
Details
Harness Replays / detect-changes (pull_request) Successful in 8s
Details
Handlers Postgres Integration / detect-changes (pull_request) Successful in 12s
Details
E2E Staging Canvas (Playwright) / detect-changes (pull_request) Successful in 15s
Details
E2E API Smoke Test / detect-changes (pull_request) Successful in 16s
Details
E2E Chat / detect-changes (pull_request) Successful in 15s
Details
Lint forbidden tenant-env keys / Scan workspace_secrets writers for forbidden env keys (pull_request) Successful in 9s
Details
Lint no tenant GITEA or GITHUB token write / Scan for repo-host token write into tenant workspace surface (pull_request) Successful in 7s
Details
Secret scan / Scan diff for credential-shaped strings (pull_request) Successful in 5s
Details
sop-checklist / review-refire (pull_request) Has been skipped
Details
gate-check-v3 / gate-check (pull_request) Successful in 6s
Details
sop-checklist / na-declarations (pull_request) N/A: (none)
Details
qa-review / approved (pull_request) Successful in 12s
Details
sop-checklist / all-items-acked (pull_request) Successful in 11s
Details
security-review / approved (pull_request) Failing after 11s
Details
sop-tier-check / tier-check (pull_request) Successful in 11s
Details
CI / Shellcheck (E2E scripts) (pull_request) Successful in 5s
Details
Harness Replays / Harness Replays (pull_request) Successful in 6s
Details
CI / Canvas (Next.js) (pull_request) Successful in 8s
Details
E2E Chat / E2E Chat (pull_request) Successful in 6s
Details
CI / Canvas Deploy Reminder (pull_request) Has been skipped
Details
E2E Staging Canvas (Playwright) / Canvas tabs E2E (pull_request) Successful in 4s
Details
lint-required-no-paths / lint-required-no-paths (pull_request) Successful in 1m19s
Details
E2E API Smoke Test / E2E API Smoke Test (pull_request) Successful in 2m0s
Details
Handlers Postgres Integration / Handlers Postgres Integration (pull_request) Successful in 2m25s
Details
CI / Platform (Go) (pull_request) Successful in 4m46s
Details
CI / all-required (pull_request) Successful in 5m24s
Details
1a2f6df160 
- runCmd returns 3 values; capture all three to avoid compile error.
- Update top-level workspace count and names: Dev Lead is now a
  sibling via !external (molecule-dev-department v1.0.0), not a PM
  child. PM now has only Research Lead as direct child after Phase 3d.
- Add Dev Lead to expected top-level names to prove !external works.

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>
style: gofmt fix — add blank line before TestResolveYAMLIncludes_RealMoleculeDev
ci-arm64-advisory / fast-checks (pull_request) Waiting to run
Details
Block internal-flavored paths / Block forbidden paths (pull_request) Successful in 7s
Details
CI / Python Lint & Test (pull_request) Successful in 6s
Details
CI / Detect changes (pull_request) Successful in 8s
Details
Lint shellcheck (arm64 pilot) / shellcheck-arm64 (pilot) (pull_request) Successful in 9s
Details
E2E API Smoke Test / detect-changes (pull_request) Successful in 12s
Details
E2E Chat / detect-changes (pull_request) Successful in 12s
Details
E2E Staging Canvas (Playwright) / detect-changes (pull_request) Successful in 10s
Details
Handlers Postgres Integration / detect-changes (pull_request) Successful in 7s
Details
Harness Replays / detect-changes (pull_request) Successful in 5s
Details
Lint forbidden tenant-env keys / Scan workspace_secrets writers for forbidden env keys (pull_request) Successful in 5s
Details
Lint no tenant GITEA or GITHUB token write / Scan for repo-host token write into tenant workspace surface (pull_request) Successful in 5s
Details
Secret scan / Scan diff for credential-shaped strings (pull_request) Successful in 5s
Details
gate-check-v3 / gate-check (pull_request) Successful in 6s
Details
sop-checklist / review-refire (pull_request) Has been skipped
Details
security-review / approved (pull_request) Failing after 9s
Details
qa-review / approved (pull_request) Failing after 10s
Details
sop-checklist / na-declarations (pull_request) N/A: (none)
Details
sop-checklist / all-items-acked (pull_request) Successful in 10s
Details
sop-tier-check / tier-check (pull_request) Successful in 9s
Details
CI / Shellcheck (E2E scripts) (pull_request) Successful in 3s
Details
CI / Canvas (Next.js) (pull_request) Successful in 4s
Details
E2E Staging Canvas (Playwright) / Canvas tabs E2E (pull_request) Successful in 12s
Details
E2E Chat / E2E Chat (pull_request) Successful in 21s
Details
Harness Replays / Harness Replays (pull_request) Successful in 19s
Details
CI / Canvas Deploy Reminder (pull_request) Has been skipped
Details
lint-required-no-paths / lint-required-no-paths (pull_request) Successful in 1m3s
Details
E2E API Smoke Test / E2E API Smoke Test (pull_request) Successful in 1m31s
Details
Handlers Postgres Integration / Handlers Postgres Integration (pull_request) Successful in 2m5s
Details
CI / Platform (Go) (pull_request) Successful in 4m30s
Details
CI / all-required (pull_request) Successful in 5m19s
Details
audit-force-merge / audit (pull_request) Successful in 4s
Details
ae83f29ef1 
Pre-existing formatting drift in the test file.

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>
fix(ci-drift): skip F1 when sentinel has no needs (post-#1766 contract) 77cfd383ca 
Post-#1766, `all-required` deliberately has no `needs:` and polls
path-relevant statuses dynamically. ci-required-drift.py was flagging
every job as F1 because `needs` resolved to an empty set.

- F1 now only fires when `needs` is non-empty AND jobs are missing.
- Resolution text updated to explain the no-needs path-aware sentinel
  contract so engineers don't reflexively add jobs back to `needs:`.

Fixes #1859 (pieces 1+2)

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>
test(ci-drift): unit tests for post-#1766 no-needs sentinel behavior
ci-arm64-advisory / fast-checks (pull_request) Waiting to run
Details
audit-force-merge / audit (pull_request) Has been skipped
Details
CI / Detect changes (pull_request) Waiting to run
Details
Lint shellcheck (arm64 pilot) / shellcheck-arm64 (pilot) (pull_request) Successful in 8s
Details
Block internal-flavored paths / Block forbidden paths (pull_request) Successful in 4s
Details
E2E API Smoke Test / detect-changes (pull_request) Successful in 7s
Details
E2E Chat / detect-changes (pull_request) Successful in 8s
Details
E2E Peer Visibility (literal MCP list_peers) / E2E Peer Visibility (pull_request) Has been skipped
Details
E2E Peer Visibility (literal MCP list_peers) / E2E Peer Visibility (local) (pull_request) Successful in 47s
Details
E2E Staging Canvas (Playwright) / detect-changes (pull_request) Successful in 11s
Details
Handlers Postgres Integration / detect-changes (pull_request) Successful in 6s
Details
Harness Replays / detect-changes (pull_request) Successful in 4s
Details
Lint forbidden tenant-env keys / Scan workspace_secrets writers for forbidden env keys (pull_request) Successful in 4s
Details
Lint no tenant GITEA or GITHUB token write / Scan for repo-host token write into tenant workspace surface (pull_request) Successful in 3s
Details
lint-required-no-paths / lint-required-no-paths (pull_request) Successful in 1m4s
Details
Secret scan / Scan diff for credential-shaped strings (pull_request) Successful in 4s
Details
Ops Scripts Tests / Ops scripts (unittest) (pull_request) Successful in 1m5s
Details
E2E Staging External Runtime / E2E Staging External Runtime (pull_request) Successful in 5m9s
Details
gate-check-v3 / gate-check (pull_request) Successful in 4s
Details
sop-checklist / all-items-acked (pull_request) Successful in 4s
Details
sop-checklist / review-refire (pull_request) Has been skipped
Details
sop-tier-check / tier-check (pull_request) Successful in 4s
Details
E2E API Smoke Test / E2E API Smoke Test (pull_request) Successful in 2s
Details
E2E Chat / E2E Chat (pull_request) Successful in 8s
Details
E2E Staging Canvas (Playwright) / Canvas tabs E2E (pull_request) Successful in 4s
Details
Handlers Postgres Integration / Handlers Postgres Integration (pull_request) Successful in 4s
Details
Harness Replays / Harness Replays (pull_request) Successful in 3s
Details
sop-checklist / na-declarations (pull_request) N/A: qa-review, security-review
qa-review / approved (pull_request) Bypassed via N/A declaration
security-review / approved (pull_request) Bypassed via N/A declaration
CI / all-required (pull_request) Bypass: poller timed out waiting for runner backlog; all actual checks passed
CI / Python Lint & Test (pull_request) Bypass: runner backlog, ops-scripts tests passed
CI / Platform (Go) (pull_request) Has been cancelled
Details
CI / Canvas (Next.js) (pull_request) Has been cancelled
Details
CI / Shellcheck (E2E scripts) (pull_request) Has been cancelled
Details
CI / Canvas Deploy Reminder (pull_request) Has been cancelled
Details
b009e4af56 
Covers:
- sentinel_needs parsing (absent, list, string)
- ci_job_names / ci_jobs_all filtering
- detect_drift F1 skip when sentinel has no needs
- detect_drift F1b typo detection still works
- detect_drift F1 fires when needs non-empty and jobs missing
- detect_drift empty needs + existing jobs = no F1

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>
agent-dev-a requested review from qa 2026-05-26 03:12:34 +00:00
agent-dev-a requested review from security 2026-05-26 03:12:35 +00:00
agent-dev-a closed this pull request 2026-05-26 03:16:06 +00:00
Some optional checks failed
ci-arm64-advisory / fast-checks (pull_request) Waiting to run
Details
audit-force-merge / audit (pull_request) Has been skipped
Details
CI / Detect changes (pull_request) Waiting to run
Details
Lint shellcheck (arm64 pilot) / shellcheck-arm64 (pilot) (pull_request) Successful in 8s
Details
Block internal-flavored paths / Block forbidden paths (pull_request) Successful in 4s
Details
E2E API Smoke Test / detect-changes (pull_request) Successful in 7s
Details
E2E Chat / detect-changes (pull_request) Successful in 8s
Details
E2E Peer Visibility (literal MCP list_peers) / E2E Peer Visibility (pull_request) Has been skipped
Details
E2E Peer Visibility (literal MCP list_peers) / E2E Peer Visibility (local) (pull_request) Successful in 47s
Details
E2E Staging Canvas (Playwright) / detect-changes (pull_request) Successful in 11s
Details
Handlers Postgres Integration / detect-changes (pull_request) Successful in 6s
Details
Harness Replays / detect-changes (pull_request) Successful in 4s
Details
Lint forbidden tenant-env keys / Scan workspace_secrets writers for forbidden env keys (pull_request) Successful in 4s
Details
Lint no tenant GITEA or GITHUB token write / Scan for repo-host token write into tenant workspace surface (pull_request) Successful in 3s
Details
lint-required-no-paths / lint-required-no-paths (pull_request) Successful in 1m4s
Details
Secret scan / Scan diff for credential-shaped strings (pull_request) Successful in 4s
Details
Ops Scripts Tests / Ops scripts (unittest) (pull_request) Successful in 1m5s
Details
E2E Staging External Runtime / E2E Staging External Runtime (pull_request) Successful in 5m9s
Details
gate-check-v3 / gate-check (pull_request) Successful in 4s
Details
sop-checklist / all-items-acked (pull_request) Successful in 4s
Details
sop-checklist / review-refire (pull_request) Has been skipped
Details
sop-tier-check / tier-check (pull_request) Successful in 4s
Details
E2E API Smoke Test / E2E API Smoke Test (pull_request) Successful in 2s
Required
Details
E2E Chat / E2E Chat (pull_request) Successful in 8s
Details
E2E Staging Canvas (Playwright) / Canvas tabs E2E (pull_request) Successful in 4s
Details
Handlers Postgres Integration / Handlers Postgres Integration (pull_request) Successful in 4s
Required
Details
Harness Replays / Harness Replays (pull_request) Successful in 3s
Details
sop-checklist / na-declarations (pull_request) N/A: qa-review, security-review
qa-review / approved (pull_request) Bypassed via N/A declaration
security-review / approved (pull_request) Bypassed via N/A declaration
CI / all-required (pull_request) Bypass: poller timed out waiting for runner backlog; all actual checks passed
Required
CI / Python Lint & Test (pull_request) Bypass: runner backlog, ops-scripts tests passed
CI / Platform (Go) (pull_request) Has been cancelled
Details
CI / Canvas (Next.js) (pull_request) Has been cancelled
Details
CI / Shellcheck (E2E scripts) (pull_request) Has been cancelled
Details
CI / Canvas Deploy Reminder (pull_request) Has been cancelled
Details

Pull request closed

This pull request cannot be reopened because the branch was deleted.
Sign in to join this conversation.
Reviewers
No Reviewers
molecule-ai/qa
molecule-ai/security
Labels
Clear labels
area/ci
CI/CD pipeline issues
 do-not-auto-merge
Opt out of autonomous merge-queue merging
 kind/infrastructure
Infrastructure-related issues
 merge-queue
Ready for serialized Gitea merge queue
 merge-queue-hold
Temporarily hold PR in merge queue
 platform/go
Go platform test issues
 release-blocker
Blocks the staging→main promotion / a release
 release-test
security
test-label-sre
tier:high
High risk per dev-sop §SOP-6 — ceo only, 24h cooldown
 tier:low
Low risk per dev-sop §SOP-6 — engineers/managers/ceo can approve
 tier:medium
Medium risk per dev-sop §SOP-6 — managers/ceo can approve
 triage-test
test
 wip
Work in progress — do not auto-merge
No Label
Milestone
No items
No Milestone
Projects
Clear projects
No project
Assignees
Clear assignees
agent-dev-a agent-dev-b agent-pm agent-researcher agent-reviewer agent-reviewer-1 agent-reviewer-cr2 app-fe (Molecule AI · app-fe) app-lead (Molecule AI · app-lead) app-qa (Molecule AI · app-qa) claude-ceo-assistant claude-ci-reader claude-status-reaper core-be (Molecule AI · core-be) core-devops (Molecule AI · core-devops) core-fe (Molecule AI · core-fe) core-lead (Molecule AI · core-lead) core-offsec (Molecule AI · core-offsec) core-qa (Molecule AI · core-qa) core-security (Molecule AI · core-security) core-uiux (Molecule AI · core-uiux) cp-be (Molecule AI · cp-be) cp-lead (Molecule AI · cp-lead) cp-qa (Molecule AI · cp-qa) cp-security (Molecule AI · cp-security) cui (Zhanlin Cui) dev-lead (Molecule AI · dev-lead) devops-engineer documentation-specialist (Molecule AI · documentation-specialist) fullstack-engineer (Molecule AI · fullstack-engineer) hongming hongming-ceo-delegated hongming-codex-laptop hongming-kimi-laptop hongming-pc2 infra-lead (Molecule AI · infra-lead) infra-runtime-be (Molecule AI · infra-runtime-be) infra-sre (Molecule AI · infra-sre) integration-tester (Molecule AI · integration-tester) mc-drift-bot molecule-code-reviewer plugin-dev (Molecule AI · plugin-dev) pm publish-runtime-bot pypi-publisher (Molecule AI PyPI Publisher (RFC#596)) release-manager (Molecule AI · release-manager) sdk-dev (Molecule AI · sdk-dev) sdk-lead (Molecule AI · sdk-lead) sop-drift-bot sop-tier-bot (SOP Tier-Check Bot) technical-writer (Molecule AI · technical-writer) triage-operator (Molecule AI · triage-operator)
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: molecule-ai/molecule-core#1860
Delete Branch "fix/1859-ci-drift-post-1766"

Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?