Sweep companion to PR#372 (ci.yml port). These two .github/workflows/
files have working .gitea/workflows/ twins active on Gitea Actions:
- publish-runtime.yml — .gitea/ version is the canonical PyPI publisher
(ported 2026-05-10 in issue #206). The .github/ version explicitly
marks itself DEPRECATED in its own header comment and is kept "for
reference only". The .gitea/ port drops OIDC trusted publisher,
workflow_dispatch.inputs, merge_group, and the GitHub-only
pypa/gh-action-pypi-publish action.
- secret-scan.yml — .gitea/ version is the active branch-protection
gate (matches "Secret scan / Scan diff for credential-shaped strings
(pull_request)" required check name). The .github/ version retains a
workflow_call entry point for reusable cross-repo invocation, but per
saved memory feedback_gitea_cross_repo_uses_blocked cross-repo `uses:`
is blocked on Gitea 1.22.6 anyway (DEFAULT_ACTIONS_URL=self), so the
reusable shape no longer has callers.
Both files are silently dead — verified by reading the molecule-core
Gitea Actions page (only the 6 .gitea/ workflows appear in the workflow
filter sidebar; none of the .github/ files have ever produced a run).
Per RFC §1: this PR is a hygiene cleanup. Removing the dead .github/
copies eliminates the ongoing confusion of two workflow files claiming
the same job name and converges molecule-core toward a single source
of truth under .gitea/. Branch protection on main was checked and does
NOT reference any removed file — only the .gitea/ secret-scan and
sop-tier-check check names are required.
DO NOT MERGE without orchestrator-dispatched Five-Axis review +
@hongmingwang chat-go (per feedback_pr_review_via_other_agents).
Cross-links:
- RFC: molecule-ai/internal#219
- Companion: PR#372 (ci.yml port — Category C-style)
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
