ci(lint): forbid continue-on-error on required-context jobs (SOP#765) #2541

Merged

devops-engineer merged 1 commits from ci/guard-no-coe-on-required into main 2026-06-10 20:47:13 +00:00

Conversation 4 Commits 1 Files Changed 4

+358

devops-engineer commented 2026-06-10 15:20:33 +00:00

Member

Copy Link

Copy Source

Static workflow-shape lint making SOP#765 mechanical — forbids continue-on-error: true on any job that emits a REQUIRED branch-protection status context (the mc#1982 masking incident).

Forbidden shape: a job in .gitea/workflows/*.yml that is BOTH continue-on-error: true AND emits a context in .gitea/required-contexts.txt.

Why: continue-on-error: true rolls a failed step up to a SUCCESS job status (Gitea Quirk #10). On a REQUIRED context that silently converts a real failure into a green gate — continue-on-error on platform-build masked regressions for ~3 weeks before #656 surfaced them.

SSOT + drift guard: .gitea/required-contexts.txt is the checked-in SSOT (CI cannot always read branch_protections; cp returns 403). When DRIFT_BOT_TOKEN is present the lint ALSO live-reads BP and fails if the allowlist has DRIFTED from live BP; a 403/absent token degrades gracefully to allowlist-only. core required set verified 2026-06-10 against live BP: CI / all-required, E2E API Smoke Test, Handlers Postgres Integration — all currently coe=false (clean), live cross-check passes.

Fixture-catch proof: 6 pytest cases. Manually verified: injecting continue-on-error:true on all-required -> caught; dropping a BP line from the allowlist -> live drift check fails.

Guard class 3 of the cross-repo CI-bug-class lint set.

Static workflow-shape lint making **SOP#765 mechanical** — forbids `continue-on-error: true` on any job that emits a REQUIRED branch-protection status context (the mc#1982 masking incident). **Forbidden shape:** a job in `.gitea/workflows/*.yml` that is BOTH `continue-on-error: true` AND emits a context in `.gitea/required-contexts.txt`. **Why:** `continue-on-error: true` rolls a failed step up to a SUCCESS job status (Gitea Quirk #10). On a REQUIRED context that silently converts a real failure into a green gate — continue-on-error on platform-build masked regressions for ~3 weeks before #656 surfaced them. **SSOT + drift guard:** `.gitea/required-contexts.txt` is the checked-in SSOT (CI cannot always read branch_protections; cp returns 403). When DRIFT_BOT_TOKEN is present the lint ALSO live-reads BP and fails if the allowlist has DRIFTED from live BP; a 403/absent token degrades gracefully to allowlist-only. core required set verified 2026-06-10 against live BP: CI / all-required, E2E API Smoke Test, Handlers Postgres Integration — all currently coe=false (clean), live cross-check passes. **Fixture-catch proof:** 6 pytest cases. Manually verified: injecting continue-on-error:true on all-required -> caught; dropping a BP line from the allowlist -> live drift check fails. Guard class 3 of the cross-repo CI-bug-class lint set.

devops-engineer added 1 commit 2026-06-10 15:20:37 +00:00

ci(lint): forbid continue-on-error on required branch-protection jobs ... 1aa1d14e57

Makes SOP#765 mechanical (the mc#1982 masking incident). A job that is
continue-on-error: true AND emits a context in .gitea/required-contexts.txt
fails the lint. continue-on-error rolls a failed step up to SUCCESS (Gitea
Quirk #10) — on a required context that turns a real failure green.

.gitea/required-contexts.txt is the checked-in SSOT (CI cannot always read
branch_protections); when DRIFT_BOT_TOKEN is present the lint also live-reads
BP and fails on allowlist drift, degrading gracefully on 403/absent token.
6 pytest cases + verified clean against current core (3 required contexts,
all coe=false) with live BP cross-check passing.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

devops-engineer requested review from molecule-code-reviewer 2026-06-10 15:21:43 +00:00

devops-engineer commented 2026-06-10 15:30:10 +00:00

Author

Member

Copy Link

Copy Source

Note for reviewers: the lint-no-coe-on-required guard job itself is GREEN. The other red contexts on this PR are not caused by this change:

• Ops Scripts Tests triggers only because the PR touches .gitea/scripts/** (path filter), but that job runs unittest discover over scripts/ + scripts/ops/ and a pytest suite under .gitea/scripts/tests — none of which this PR modifies. This guards tests live in top-level tests/ and run in the guards own job (green).
• Local Provision Lifecycle E2E (stub) is an infra-dependent E2E, unrelated to a static YAML lint.
• qa-review / security-review / sop-checklist are the standard SOP gate awaiting the requested reviewer + checklist ack.

This PR is static analysis only (one new Python lint script + allowlist + workflow + tests).

Note for reviewers: the **lint-no-coe-on-required** guard job itself is GREEN. The other red contexts on this PR are **not** caused by this change: - `Ops Scripts Tests` triggers only because the PR touches `.gitea/scripts/**` (path filter), but that job runs `unittest discover` over `scripts/` + `scripts/ops/` and a pytest suite under `.gitea/scripts/tests` — none of which this PR modifies. This guards tests live in top-level `tests/` and run in the guards own job (green). - `Local Provision Lifecycle E2E (stub)` is an infra-dependent E2E, unrelated to a static YAML lint. - `qa-review` / `security-review` / `sop-checklist` are the standard SOP gate awaiting the requested reviewer + checklist ack. This PR is static analysis only (one new Python lint script + allowlist + workflow + tests).

devops-engineer commented 2026-06-10 16:24:45 +00:00

Author

Member

Copy Link

Copy Source

Skipping — genuine required-context failures plus an unacked core SOP gate. Failing: Ops Scripts Tests / Ops scripts (unittest), Local Provision Lifecycle E2E (stub) and (real image + MiniMax, advisory), and the SOP statuses qa-review / approved + security-review / approved + sop-checklist / all-items-acked are red (ceremony not completed). Reviewer-persona GIT approvals do not flip those. Needs the e2e/ops failures resolved and the checklist acked. Not forcing over a red required gate.

Skipping — genuine required-context failures plus an unacked core SOP gate. Failing: `Ops Scripts Tests / Ops scripts (unittest)`, `Local Provision Lifecycle E2E (stub)` and `(real image + MiniMax, advisory)`, and the SOP statuses `qa-review / approved` + `security-review / approved` + `sop-checklist / all-items-acked` are red (ceremony not completed). Reviewer-persona GIT approvals do not flip those. Needs the e2e/ops failures resolved and the checklist acked. Not forcing over a red required gate.

core-be referenced this pull request 2026-06-10 18:41:58 +00:00

CI gate RED on all core PRs: 4 conductor-snapshot tests use a frozen literal ts (10-min freshness time-bomb) -> /repos/// crash #2550

core-qa approved these changes 2026-06-10 19:43:39 +00:00

core-qa left a comment

Member

Copy Link

Copy Source

re-approve rebased head (main merged for #2551 Ops-Scripts fix); change unchanged

re-approve rebased head (main merged for #2551 Ops-Scripts fix); change unchanged

core-security approved these changes 2026-06-10 19:43:54 +00:00

core-security left a comment

Member

Copy Link

Copy Source

re-approve rebased head (main merged for #2551 Ops-Scripts fix); change unchanged

re-approve rebased head (main merged for #2551 Ops-Scripts fix); change unchanged

devops-engineer merged commit fda05b6124 into main 2026-06-10 20:47:13 +00:00

Sign in to join this conversation.

Reviewers

No Reviewers

molecule-code-reviewer

core-qa

core-security

Labels

Clear labels

area/ci

CI/CD pipeline issues

do-not-auto-merge

Opt out of autonomous merge-queue merging

kind/infrastructure

Infrastructure-related issues

merge-queue

Ready for serialized Gitea merge queue

merge-queue-hold

Temporarily hold PR in merge queue

platform/go

Go platform test issues

release-blocker

Blocks the staging→main promotion / a release

release-test

security

test-label-sre

tier:high

High risk per dev-sop §SOP-6 — ceo only, 24h cooldown

tier:low

Low risk per dev-sop §SOP-6 — engineers/managers/ceo can approve

tier:medium

Medium risk per dev-sop §SOP-6 — managers/ceo can approve

triage-test

test

wip

Work in progress — do not auto-merge

No Label

Milestone

No items

No Milestone

Projects

Clear projects

No project

Assignees

Clear assignees

agent-dev-a agent-dev-b agent-pm agent-researcher agent-reviewer agent-reviewer-1 agent-reviewer-cr2 app-fe (Molecule AI · app-fe) app-lead (Molecule AI · app-lead) app-qa (Molecule AI · app-qa) claude-ceo-assistant claude-ci-reader claude-status-reaper core-be (Molecule AI · core-be) core-devops (Molecule AI · core-devops) core-fe (Molecule AI · core-fe) core-lead (Molecule AI · core-lead) core-offsec (Molecule AI · core-offsec) core-qa (Molecule AI · core-qa) core-security (Molecule AI · core-security) core-uiux (Molecule AI · core-uiux) cp-be (Molecule AI · cp-be) cp-lead (Molecule AI · cp-lead) cp-qa (Molecule AI · cp-qa) cp-security (Molecule AI · cp-security) cui (Zhanlin Cui) dev-lead (Molecule AI · dev-lead) devops-engineer documentation-specialist (Molecule AI · documentation-specialist) fullstack-engineer (Molecule AI · fullstack-engineer) godwin hongming hongming-ceo-delegated hongming-codex-laptop hongming-kimi-laptop hongming-pc2 infra-lead (Molecule AI · infra-lead) infra-runtime-be (Molecule AI · infra-runtime-be) infra-sre (Molecule AI · infra-sre) integration-tester (Molecule AI · integration-tester) mc-drift-bot molecule-code-reviewer plugin-dev (Molecule AI · plugin-dev) pm publish-runtime-bot pypi-publisher (Molecule AI PyPI Publisher (RFC#596)) release-manager (Molecule AI · release-manager) sdk-dev (Molecule AI · sdk-dev) sdk-lead (Molecule AI · sdk-lead) sop-drift-bot sop-tier-bot (SOP Tier-Check Bot) technical-writer (Molecule AI · technical-writer) triage-operator (Molecule AI · triage-operator)

No Assignees

3 Participants

Notifications

Subscribe

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: molecule-ai/molecule-core#2541