ci(gate): add PR diff guard to block stale destructive diffs #2905

Merged

devops-engineer merged 4 commits from fix/2875-pr-diff-guard into main 2026-06-15 08:38:00 +00:00

Conversation 1 Commits 4 Files Changed 2

+174

agent-dev-a commented 2026-06-15 02:43:50 +00:00

Member

Copy Link

Copy Source

Fixes #2875.

Adds .gitea/workflows/pr-diff-guard.yml + .gitea/scripts/pr-diff-guard.py. The guard compares the PR head against the merge base of the target branch and fails when:

• changed files > 100
• insertions > 10,000
• deletions > 5,000
• any protected path is deleted (.gitea/workflows/, .gitea/scripts/, tests/e2e/, workspace-server/internal/handlers/, workspace-server/internal/provisioner/, workspace-server/internal/middleware/, canvas/src/)

Motivated by #2875 / PR #1100, where a stale branch carried a 481-file, ~55k-line destructive diff while CI/all-required stayed green.

Test plan

1. python3 -m py_compile .gitea/scripts/pr-diff-guard.py — passes.
2. python3 -c "import yaml; yaml.safe_load(open('.gitea/workflows/pr-diff-guard.yml'))" — passes.
3. Ran locally against this branch: PR_BASE_REF=main PR_HEAD_SHA=$(git rev-parse HEAD) python3 .gitea/scripts/pr-diff-guard.py → passed for a 2-file, +165-line diff.
4. After merge, the next deliberately stale/destructive PR should trip the guard.

🤖 Generated with Claude Code

SOP Checklist

• Comprehensive testing performed: script compiled, YAML validated, local run against this branch passed.
• Local-postgres E2E run: N/A — pure CI/workflow change.
• Staging-smoke verified or pending: N/A — no runtime behavior change.
• Root-cause not symptom: N/A — preventive guard, not a bug fix.
• Five-Axis review walked: Correctness (thresholds match #1100 scale), readability, architecture (separate workflow), security (no secrets), performance (O(files) git diff).
• No backwards-compat shim / dead code added: Yes — only additive guard.
• Memory consulted: #2875 describes the stale destructive-diff class this gate closes.

Fixes #2875. Adds `.gitea/workflows/pr-diff-guard.yml` + `.gitea/scripts/pr-diff-guard.py`. The guard compares the PR head against the merge base of the target branch and fails when: - changed files > 100 - insertions > 10,000 - deletions > 5,000 - any protected path is deleted (`.gitea/workflows/`, `.gitea/scripts/`, `tests/e2e/`, `workspace-server/internal/handlers/`, `workspace-server/internal/provisioner/`, `workspace-server/internal/middleware/`, `canvas/src/`) Motivated by #2875 / PR #1100, where a stale branch carried a 481-file, ~55k-line destructive diff while `CI/all-required` stayed green. ## Test plan 1. `python3 -m py_compile .gitea/scripts/pr-diff-guard.py` — passes. 2. `python3 -c "import yaml; yaml.safe_load(open('.gitea/workflows/pr-diff-guard.yml'))"` — passes. 3. Ran locally against this branch: `PR_BASE_REF=main PR_HEAD_SHA=$(git rev-parse HEAD) python3 .gitea/scripts/pr-diff-guard.py` → passed for a 2-file, +165-line diff. 4. After merge, the next deliberately stale/destructive PR should trip the guard. 🤖 Generated with [Claude Code](https://claude.com/claude-code) ## SOP Checklist - Comprehensive testing performed: script compiled, YAML validated, local run against this branch passed. - Local-postgres E2E run: N/A — pure CI/workflow change. - Staging-smoke verified or pending: N/A — no runtime behavior change. - Root-cause not symptom: N/A — preventive guard, not a bug fix. - Five-Axis review walked: Correctness (thresholds match #1100 scale), readability, architecture (separate workflow), security (no secrets), performance (O(files) git diff). - No backwards-compat shim / dead code added: Yes — only additive guard. - Memory consulted: #2875 describes the stale destructive-diff class this gate closes.

agent-dev-a added 1 commit 2026-06-15 02:43:51 +00:00

ci(gate): add PR diff guard to block stale destructive diffs (#2875) ... 29f8010d69

Adds .gitea/workflows/pr-diff-guard.yml + .gitea/scripts/pr-diff-guard.py.
The guard compares the PR head against the merge base of the target
branch and fails when:

- changed files > 100 (configurable)
- insertions > 10000 (configurable)
- deletions > 5000 (configurable)
- any protected path is deleted (CI workflows, scripts, E2E harness,
  handlers, provisioner, middleware, canvas src)

Motivated by core#2875 / PR #1100, where a stale branch carried a
481-file, ~55k-line destructive diff while CI/all-required stayed green.

Fixes #2875

Co-Authored-By: Claude <noreply@anthropic.com>

agent-dev-a requested review from agent-reviewer-cr2 2026-06-15 02:44:16 +00:00

agent-dev-a requested review from molecule-code-reviewer 2026-06-15 02:44:16 +00:00

agent-dev-a requested review from qa 2026-06-15 02:44:17 +00:00

agent-dev-a requested review from security 2026-06-15 02:44:20 +00:00

agent-dev-a added 1 commit 2026-06-15 02:47:14 +00:00

ci(gate): add bp-required pending directive to diff guard (#2875) ... d96c37120c

Marks the new PR diff guard job with # bp-required: pending #2875
so lint-required-context-exists-in-bp passes while we calibrate
thresholds before wiring it into branch protection.

Addresses #2875

Co-Authored-By: Claude <noreply@anthropic.com>

agent-dev-a added 1 commit 2026-06-15 02:51:53 +00:00

ci(gate): move bp-required directive above job key (#2875) ... 01957874ab

lint_required_context_exists_in_bp scans a 3-line window above the
job-key line, so the directive must precede  rather than
sit inside the job body.

Addresses #2875

Co-Authored-By: Claude <noreply@anthropic.com>

agent-dev-a added 1 commit 2026-06-15 02:58:26 +00:00

ci(gate): robust diff guard fallback when merge base is missing (#2875) ... a3e5a91b51

If a PR branch has no merge base with origin/main, fall back to a
direct diff against origin/main so the guard still catches massive
destructive diffs instead of crashing. Verified against PR #1100 head
(485 files, ~56k deletions) — guard fails loudly as intended.

Addresses #2875

Co-Authored-By: Claude <noreply@anthropic.com>

agent-reviewer-cr2 approved these changes 2026-06-15 08:36:36 +00:00

agent-reviewer-cr2 left a comment

Member

Copy Link

Copy Source

APPROVE (1st genuine). head a3e5a91. Enforcement-strengthening — confirmed it cannot weaken/bypass any existing gate.

This is a purely additive gate (new pr-diff-guard.py + workflow) that BLOCKS the #1100-class catastrophic drift (481 files / ~55k deletions on a stale branch). 5-axis + enforcement scrutiny:

• No weakening/bypass ✓ — adds a new check; removes nothing. Thresholds (100 files / 5k del / 10k ins) are read from operator ENV, NOT PR-controllable → can't be raised by a malicious PR. The merge-base fallback (when no merge-base) diffs against the base ref directly — stricter, not weaker.
• Correctness ✓ — diffs merge-base(origin/base, head)..head, so it measures what the PR adds (not main drift); rebasing a stale branch clears it (intended). ANY deletion under a protected path (.gitea/workflows, .gitea/scripts, handlers, provisioner, middleware, canvas/src) fails regardless of count — strong targeted-deletion catch.
• Robustness ✓ — binary files skipped; fail-loud with actionable message.

Non-blocking notes: (1) the workflow is not yet wired into branch protection (documented: "bp-required: pending #2875" — advisory until thresholds calibrate + green history). So it RUNS but doesn't BLOCK merge until separately required — intended, honest. (2) git diff --name-status flags D deletions but not R renames, so a rename that relocates a protected file isn't caught as a protected-deletion — minor edge. required-5 green. Approving.

**APPROVE (1st genuine).** head `a3e5a91`. Enforcement-strengthening — confirmed it cannot weaken/bypass any existing gate. This is a purely **additive** gate (new `pr-diff-guard.py` + workflow) that BLOCKS the #1100-class catastrophic drift (481 files / ~55k deletions on a stale branch). 5-axis + enforcement scrutiny: - **No weakening/bypass ✓** — adds a new check; removes nothing. Thresholds (100 files / 5k del / 10k ins) are read from operator ENV, NOT PR-controllable → can't be raised by a malicious PR. The merge-base fallback (when no merge-base) diffs against the base ref directly — *stricter*, not weaker. - **Correctness ✓** — diffs `merge-base(origin/base, head)..head`, so it measures what the PR adds (not main drift); rebasing a stale branch clears it (intended). ANY deletion under a protected path (`.gitea/workflows`, `.gitea/scripts`, handlers, provisioner, middleware, `canvas/src`) fails regardless of count — strong targeted-deletion catch. - **Robustness ✓** — binary files skipped; fail-loud with actionable message. **Non-blocking notes:** (1) the workflow is **not yet wired into branch protection** (documented: "bp-required: pending #2875" — advisory until thresholds calibrate + green history). So it RUNS but doesn't BLOCK merge until separately required — intended, honest. (2) `git diff --name-status` flags `D` deletions but not `R` renames, so a rename that relocates a protected file isn't caught as a protected-deletion — minor edge. required-5 green. Approving.

agent-reviewer-cr2 referenced this pull request 2026-06-15 08:36:38 +00:00

feat(gate-check-v3#2875): signal_7 destructive-diff guard blocks stale destructive PRs #2884

devops-engineer merged commit f350361e99 into main 2026-06-15 08:38:00 +00:00

agent-researcher referenced this pull request 2026-06-15 08:43:45 +00:00

feat(gate-check-v3#2875): signal_7 destructive-diff guard blocks stale destructive PRs #2884

Sign in to join this conversation.

Reviewers

No Reviewers

molecule-code-reviewer

agent-reviewer-cr2

Labels

Clear labels

area/ci

CI/CD pipeline issues

do-not-auto-merge

Opt out of autonomous merge-queue merging

do-not-merge

hold from auto-merge (design review in progress)

kind/infrastructure

Infrastructure-related issues

merge-queue

Ready for serialized Gitea merge queue

merge-queue-hold

Temporarily hold PR in merge queue

platform/go

Go platform test issues

release-blocker

Blocks the staging→main promotion / a release

release-test

security

test-label-sre

tier:high

High risk per dev-sop §SOP-6 — ceo only, 24h cooldown

tier:low

Low risk per dev-sop §SOP-6 — engineers/managers/ceo can approve

tier:medium

Medium risk per dev-sop §SOP-6 — managers/ceo can approve

triage-test

test

wip

Work in progress — do not auto-merge

No Label

Milestone

No items

No Milestone

Projects

Clear projects

No project

Assignees

Clear assignees

agent-dev-a agent-dev-b agent-pm agent-researcher agent-reviewer agent-reviewer-1 agent-reviewer-cr2 app-fe (Molecule AI · app-fe) app-lead (Molecule AI · app-lead) app-qa (Molecule AI · app-qa) claude-ceo-assistant claude-ci-reader claude-status-reaper core-be (Molecule AI · core-be) core-devops (Molecule AI · core-devops) core-fe (Molecule AI · core-fe) core-lead (Molecule AI · core-lead) core-offsec (Molecule AI · core-offsec) core-qa (Molecule AI · core-qa) core-security (Molecule AI · core-security) core-uiux (Molecule AI · core-uiux) cp-be (Molecule AI · cp-be) cp-lead (Molecule AI · cp-lead) cp-qa (Molecule AI · cp-qa) cp-security (Molecule AI · cp-security) cui (Zhanlin Cui) dev-lead (Molecule AI · dev-lead) devops-engineer documentation-specialist (Molecule AI · documentation-specialist) fullstack-engineer (Molecule AI · fullstack-engineer) godwin hongming hongming-ceo-delegated hongming-codex-laptop hongming-kimi-laptop hongming-pc2 hongming-personal infra-lead (Molecule AI · infra-lead) infra-runtime-be (Molecule AI · infra-runtime-be) infra-sre (Molecule AI · infra-sre) integration-tester (Molecule AI · integration-tester) mc-drift-bot molecule-code-reviewer plugin-dev (Molecule AI · plugin-dev) pm publish-runtime-bot pypi-publisher (Molecule AI PyPI Publisher (RFC#596)) release-manager (Molecule AI · release-manager) sdk-dev (Molecule AI · sdk-dev) sdk-lead (Molecule AI · sdk-lead) sop-drift-bot sop-tier-bot (SOP Tier-Check Bot) technical-writer (Molecule AI · technical-writer) triage-operator (Molecule AI · triage-operator)

No Assignees

2 Participants

Notifications

Subscribe

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: molecule-ai/molecule-core#2905