Mechanical porter inserted a duplicate `env:` block in
.gitea/workflows/publish-canvas-image.yml — the file already had
`env: { IMAGE_NAME: ghcr.io/molecule-ai/canvas }` so the second
`env: { GITHUB_SERVER_URL: ... }` block triggered Gitea's parser
error "yaml: mapping key 'env' already defined".
Merged the two blocks into one. Also clarified the dropped
workflow_dispatch comment that the porter left dangling above
`permissions:`.
Verified via fresh `docker logs molecule-gitea-1 --since 5m` after
push — no new parser-rejection warnings for publish-canvas-image.yml.
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
Sweep companion to PR#372 (ci.yml), PR#378 (Cat A), PR#379 (Cat B),
PR#383 (Cat C-1), PR#386 (Cat C-2). Final port batch.
Ports 7 deploy/publish/janitor workflows from .github/workflows/ to
.gitea/workflows/. Each port applies the four-surface audit pattern;
every job has `continue-on-error: true` (RFC §1 contract).
Files ported:
- publish-canvas-image.yml — canvas Docker image build/push.
IMPORTANT OPEN QUESTION (flagged in file header): this workflow
pushes to ghcr.io. GHCR was retired during the 2026-05-06 Gitea
migration in favor of ECR. The pushed image may not be consumable
post-migration. Review needs to decide: retarget to ECR
(153263036946.dkr.ecr.us-east-2.amazonaws.com/molecule-ai/canvas)
or retire entirely and route canvas deploys via operator-host.
- redeploy-tenants-on-main.yml — prod tenant SSM redeploy on new
workspace-server image. workflow_run trigger retained (same
Gitea support caveat as canary-verify.yml — flagged in header).
Simplified the job `if:` condition by dropping the
`workflow_dispatch` branch.
- redeploy-tenants-on-staging.yml — staging mirror of above. Same
workflow_run caveat + same `if:` simplification.
- sweep-aws-secrets.yml — hourly AWS Secrets Manager tenant-secret
janitor. Dropped workflow_dispatch.inputs (dry_run/max_delete_pct/
grace_hours); cron triggers run with the script defaults instead.
if-step gates conditional on github.event_name=='workflow_dispatch'
are dead-code post-port but harmless.
- sweep-cf-orphans.yml — hourly CF DNS janitor. Same shape.
- sweep-cf-tunnels.yml — hourly CF Tunnels janitor. Same shape.
- sweep-stale-e2e-orgs.yml — every-15-min staging tenant cleanup.
Same shape.
Open questions for review:
1. workflow_run on redeploy-tenants-on-* — same caveat as
canary-verify.yml (Cat C-2). If Gitea ignores the event, the
follow-up triage PR replaces with push-with-paths-filter on
.gitea/workflows/publish-workspace-server-image.yml.
2. publish-canvas-image GHCR target — decide retarget-to-ECR vs
retire-entirely with reviewer.
3. workflow_dispatch.inputs replacements — the four janitor sweeps
lost their operator-facing dry_run/cap-override knobs. If a
manual override is needed today, edit the cron envs in the file
directly. Follow-up could add a "manual override commit" pattern
that the cron reads from a checked-in JSON.
DO NOT MERGE without orchestrator-dispatched Five-Axis review +
@hongmingwang chat-go.
Cross-links:
- RFC: molecule-ai/internal#219
- Companions: PR#372, PR#378, PR#379, PR#383, PR#386
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
