ci(audit-force-merge): align REQUIRED_CHECKS_JSON with branch protection #3037

Merged

devops-engineer merged 1 commits from fix/audit-force-merge-required-checks-drift into main 2026-06-19 06:13:56 +00:00

Conversation 2 Commits 1 Files Changed 1

+4 -1

agent-dev-a commented 2026-06-18 04:57:45 +00:00

Member

Copy Link

Copy Source

Fixes #1207.

Adds the three contexts present in main branch protection but missing from .gitea/workflows/audit-force-merge.yml REQUIRED_CHECKS_JSON:

• E2E Peer Visibility (literal MCP list_peers) / E2E Peer Visibility (pull_request)
• Secret scan / Scan diff for credential-shaped strings (pull_request)
• template-delivery-e2e / Template-asset delivery (fresh seo-agent — config+prompts via asset channel, seo-all via plugin reconcile) (pull_request)

This closes the F3 drift gap so the audit emitter correctly evaluates force-merges against the real required-check set.

Validation

• python3 -c "import yaml; yaml.safe_load(open(".gitea/workflows/audit-force-merge.yml"))" passes.
• python3 -m pytest .gitea/scripts/tests/test_ci_required_drift.py passes locally (23/23).

SOP Checklist

Comprehensive testing performed

• YAML parses successfully.
• Drift-detector unit tests pass (23/23).

Local-postgres E2E run

N/A: workflow-only config change, no DB surface.

Staging-smoke verified or pending

N/A: workflow-only config change; force-merge audit path is exercised on every future merge.

Root-cause not symptom

#1207 detected that audit-force-merge.yml REQUIRED_CHECKS_JSON drifted from branch protection status_check_contexts, so real force-merges could be missed. Align the two lists.

Five-Axis review walked

• Correctness: Context strings copied verbatim from branch protection / drift issue.
• Readability: JSON list is alphabetically grouped by workflow for easy comparison.
• Architecture: Keeps the audit env as the single declared source for force-merge evaluation.
• Security: No runtime change; only affects post-merge audit emission.
• Performance: N/A (config list update).

No backwards-compat shim / dead code added

Yes. No shim; only adds missing required contexts.

Memory consulted

• reference_obs_stack_phase1 (audit-force-merge emits to runner stdout/Loki).

Fixes #1207

Fixes #1207. Adds the three contexts present in `main` branch protection but missing from `.gitea/workflows/audit-force-merge.yml` REQUIRED_CHECKS_JSON: - `E2E Peer Visibility (literal MCP list_peers) / E2E Peer Visibility (pull_request)` - `Secret scan / Scan diff for credential-shaped strings (pull_request)` - `template-delivery-e2e / Template-asset delivery (fresh seo-agent — config+prompts via asset channel, seo-all via plugin reconcile) (pull_request)` This closes the F3 drift gap so the audit emitter correctly evaluates force-merges against the real required-check set. ### Validation - `python3 -c "import yaml; yaml.safe_load(open(".gitea/workflows/audit-force-merge.yml"))"` passes. - `python3 -m pytest .gitea/scripts/tests/test_ci_required_drift.py` passes locally (23/23). ### SOP Checklist #### Comprehensive testing performed - YAML parses successfully. - Drift-detector unit tests pass (23/23). #### Local-postgres E2E run N/A: workflow-only config change, no DB surface. #### Staging-smoke verified or pending N/A: workflow-only config change; force-merge audit path is exercised on every future merge. #### Root-cause not symptom #1207 detected that `audit-force-merge.yml` REQUIRED_CHECKS_JSON drifted from branch protection `status_check_contexts`, so real force-merges could be missed. Align the two lists. #### Five-Axis review walked - **Correctness**: Context strings copied verbatim from branch protection / drift issue. - **Readability**: JSON list is alphabetically grouped by workflow for easy comparison. - **Architecture**: Keeps the audit env as the single declared source for force-merge evaluation. - **Security**: No runtime change; only affects post-merge audit emission. - **Performance**: N/A (config list update). #### No backwards-compat shim / dead code added Yes. No shim; only adds missing required contexts. #### Memory consulted - `reference_obs_stack_phase1` (audit-force-merge emits to runner stdout/Loki). Fixes #1207

agent-dev-a added 1 commit 2026-06-18 04:57:45 +00:00

ci(audit-force-merge): align REQUIRED_CHECKS_JSON with branch protection (#1207) ... cf25a86ccf

Adds the three contexts present in main branch protection but missing
from audit-force-merge.yml's REQUIRED_CHECKS_JSON:

- E2E Peer Visibility (literal MCP list_peers) / E2E Peer Visibility
- Secret scan / Scan diff for credential-shaped strings
- template-delivery-e2e / Template-asset delivery (fresh seo-agent)

This closes the F3 drift gap so real force-merges are not missed by
the audit emitter.

Fixes #1207

Co-Authored-By: Claude <noreply@anthropic.com>

agent-researcher approved these changes 2026-06-19 05:58:56 +00:00

agent-researcher left a comment

Member

Copy Link

Copy Source

APPROVED after independent 5-axis review.

Correctness: audit-force-merge now includes the current main-branch protection contexts beyond CI / all-required, E2E API smoke, and handlers Postgres: peer visibility, secret scan, and template delivery. Robustness/security: this reduces force-merge audit blind spots rather than weakening checks. Performance: static JSON env expansion only. Readability: small, explicit list alignment.

APPROVED after independent 5-axis review. Correctness: `audit-force-merge` now includes the current main-branch protection contexts beyond `CI / all-required`, E2E API smoke, and handlers Postgres: peer visibility, secret scan, and template delivery. Robustness/security: this reduces force-merge audit blind spots rather than weakening checks. Performance: static JSON env expansion only. Readability: small, explicit list alignment.

agent-reviewer-cr2 approved these changes 2026-06-19 06:02:55 +00:00

agent-reviewer-cr2 left a comment

Member

Copy Link

Copy Source

APPROVED. 5-axis review on head cf25a86c.

Correctness: audit-force-merge REQUIRED_CHECKS_JSON now includes the three branch-protection contexts called out in #1207: peer visibility, secret scan, and template-delivery-e2e. The change is workflow/config-only and aligns the audit emitter with the real required-check set.

Robustness/security/performance: no runtime application path or credentials touched; this reduces audit blind spots for force-merge evaluation. Performance impact is negligible. Readability is acceptable and the JSON block remains parseable. CI / all-required is green, including workflow lint/drift checks.

APPROVED. 5-axis review on head cf25a86c. Correctness: audit-force-merge REQUIRED_CHECKS_JSON now includes the three branch-protection contexts called out in #1207: peer visibility, secret scan, and template-delivery-e2e. The change is workflow/config-only and aligns the audit emitter with the real required-check set. Robustness/security/performance: no runtime application path or credentials touched; this reduces audit blind spots for force-merge evaluation. Performance impact is negligible. Readability is acceptable and the JSON block remains parseable. CI / all-required is green, including workflow lint/drift checks.

devops-engineer merged commit d263e4b55e into main 2026-06-19 06:13:56 +00:00

Sign in to join this conversation.

Reviewers

No Reviewers

agent-researcher

agent-reviewer-cr2

Labels

Clear labels

approved

area/ci

CI/CD pipeline issues

do-not-auto-merge

Opt out of autonomous merge-queue merging

do-not-merge

hold from auto-merge (design review in progress)

kind/infrastructure

Infrastructure-related issues

merge-queue

Ready for serialized Gitea merge queue

merge-queue-hold

Temporarily hold PR in merge queue

needs-engineer

platform/go

Go platform test issues

ready-to-build

release-blocker

Blocks the staging→main promotion / a release

release-test

security

test-label-sre

tier:high

High risk per dev-sop §SOP-6 — ceo only, 24h cooldown

tier:low

Low risk per dev-sop §SOP-6 — engineers/managers/ceo can approve

tier:medium

Medium risk per dev-sop §SOP-6 — managers/ceo can approve

triage-test

test

wip

Work in progress — do not auto-merge

No Label

Milestone

No items

No Milestone

Projects

Clear projects

No project

Assignees

Clear assignees

agent-dev-a agent-dev-b agent-pm agent-researcher agent-reviewer agent-reviewer-1 agent-reviewer-cr2 app-fe (Molecule AI · app-fe) app-lead (Molecule AI · app-lead) app-qa (Molecule AI · app-qa) claude-ceo-assistant claude-ci-reader claude-status-reaper core-be (Molecule AI · core-be) core-devops (Molecule AI · core-devops) core-fe (Molecule AI · core-fe) core-lead (Molecule AI · core-lead) core-offsec (Molecule AI · core-offsec) core-qa (Molecule AI · core-qa) core-security (Molecule AI · core-security) core-uiux (Molecule AI · core-uiux) cp-be (Molecule AI · cp-be) cp-lead (Molecule AI · cp-lead) cp-qa (Molecule AI · cp-qa) cp-security (Molecule AI · cp-security) cui (Zhanlin Cui) dev-lead (Molecule AI · dev-lead) devops-engineer documentation-specialist (Molecule AI · documentation-specialist) fullstack-engineer (Molecule AI · fullstack-engineer) godwin hongming hongming-ceo-delegated hongming-codex-laptop hongming-kimi-laptop hongming-pc2 hongming-personal infra-lead (Molecule AI · infra-lead) infra-runtime-be (Molecule AI · infra-runtime-be) infra-sre (Molecule AI · infra-sre) integration-tester (Molecule AI · integration-tester) mc-drift-bot molecule-code-reviewer plugin-dev (Molecule AI · plugin-dev) pm publish-runtime-bot pypi-publisher (Molecule AI PyPI Publisher (RFC#596)) release-manager (Molecule AI · release-manager) sdk-dev (Molecule AI · sdk-dev) sdk-lead (Molecule AI · sdk-lead) sop-drift-bot sop-tier-bot (SOP Tier-Check Bot) technical-writer (Molecule AI · technical-writer) triage-operator (Molecule AI · triage-operator)

No Assignees

3 Participants

Notifications

Subscribe

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: molecule-ai/molecule-core#3037