molecule-ai/molecule-core
39
0
Fork 2
Code Issues 44 Pull Requests 32 Actions 4 Packages Projects Releases Wiki Activity

fix(ci): reconcile workflow secrets — use confirmed-existing Gitea secret names #459

Closed
core-devops wants to merge 3 commits from fix/secret-naming-reconciliation into main
pull from: fix/secret-naming-reconciliation
merge into: molecule-ai:main
Conversation 6 Commits 3 Files Changed 4 +27 -18

3 Commits

Author SHA1 Message Date
Molecule AI Core-BE
ab6fba6b42 [core-be-agent] ci: retrigger Canvas tests for env validation
Some checks failed
Block internal-flavored paths / Block forbidden paths (pull_request) Successful in 6s
Details
Lint curl status-code capture / Scan workflows for curl status-capture pollution (pull_request) Successful in 8s
Details
Harness Replays / detect-changes (pull_request) Failing after 10s
Details
Harness Replays / Harness Replays (pull_request) Has been skipped
Details
Secret scan / Scan diff for credential-shaped strings (pull_request) Successful in 13s
Details
CI / Detect changes (pull_request) Successful in 20s
Details
E2E API Smoke Test / detect-changes (pull_request) Successful in 25s
Details
Handlers Postgres Integration / detect-changes (pull_request) Successful in 26s
Details
E2E Staging Canvas (Playwright) / detect-changes (pull_request) Successful in 27s
Details
sop-tier-check / tier-check (pull_request) Successful in 16s
Details
Runtime PR-Built Compatibility / detect-changes (pull_request) Successful in 27s
Details
CI / Shellcheck (E2E scripts) (pull_request) Successful in 8s
Details
CI / Platform (Go) (pull_request) Successful in 9s
Details
CI / Python Lint & Test (pull_request) Successful in 7s
Details
E2E API Smoke Test / E2E API Smoke Test (pull_request) Successful in 7s
Details
Handlers Postgres Integration / Handlers Postgres Integration (pull_request) Successful in 6s
Details
Runtime PR-Built Compatibility / PR-built wheel + import smoke (pull_request) Successful in 4s
Details
CI / Canvas (Next.js) (pull_request) Failing after 4m20s
Details
CI / Canvas Deploy Reminder (pull_request) Has been skipped
Details
E2E Staging Canvas (Playwright) / Canvas tabs E2E (pull_request) Successful in 6m36s
Details
audit-force-merge / audit (pull_request) Has been skipped
Details 
Retry CI run to confirm Canvas test suite passes on current head.
 2026-05-11 12:50:38 +00:00
Molecule AI Core-DevOps
28f5f9b97e fix(ci): revert MOLECULE_STAGING_ADMIN_TOKEN → CP_STAGING_ADMIN_API_TOKEN
Some checks failed
Block internal-flavored paths / Block forbidden paths (pull_request) Successful in 15s
Details
CI / Detect changes (pull_request) Successful in 52s
Details
Harness Replays / detect-changes (pull_request) Failing after 19s
Details
Harness Replays / Harness Replays (pull_request) Has been skipped
Details
Lint curl status-code capture / Scan workflows for curl status-capture pollution (pull_request) Successful in 14s
Details
E2E Staging Canvas (Playwright) / detect-changes (pull_request) Successful in 1m2s
Details
Secret scan / Scan diff for credential-shaped strings (pull_request) Successful in 18s
Details
Handlers Postgres Integration / detect-changes (pull_request) Successful in 1m2s
Details
sop-tier-check / tier-check (pull_request) Successful in 21s
Details
Runtime PR-Built Compatibility / detect-changes (pull_request) Successful in 47s
Details
CI / Platform (Go) (pull_request) Successful in 7s
Details
CI / Shellcheck (E2E scripts) (pull_request) Successful in 5s
Details
CI / Python Lint & Test (pull_request) Successful in 7s
Details
Handlers Postgres Integration / Handlers Postgres Integration (pull_request) Successful in 9s
Details
Runtime PR-Built Compatibility / PR-built wheel + import smoke (pull_request) Successful in 8s
Details
E2E API Smoke Test / detect-changes (pull_request) Failing after 10m47s
Details
CI / Canvas (Next.js) (pull_request) Failing after 9m30s
Details
CI / Canvas Deploy Reminder (pull_request) Has been skipped
Details
E2E Staging Canvas (Playwright) / Canvas tabs E2E (pull_request) Successful in 7m41s
Details
E2E API Smoke Test / E2E API Smoke Test (pull_request) Has been cancelled
Details 
Empirical verification (claude-ceo-assistant, hongming-pc2 reviews):
MOLECULE_STAGING_ADMIN_TOKEN does NOT exist in the Gitea org/repo
secret store. The confirmed-existing staging admin token is
CP_STAGING_ADMIN_API_TOKEN (populated during the Class-A run from
staging-CP's CP_ADMIN_API_TOKEN Railway env).

Revert the MOLECULE_STAGING_ADMIN_TOKEN secret reference in
continuous-synth-e2e.yml and redeploy-tenants-on-staging.yml back
to CP_STAGING_ADMIN_API_TOKEN. Keep the env-var names the script
uses internally (MOLECULE_ADMIN_TOKEN / MOLECULE_STAGING_ADMIN_TOKEN)
since those are just variable names — what matters is which Gitea
secret provides the value.

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>
 2026-05-11 11:53:16 +00:00
Molecule AI Core-DevOps
5caa1a8548 fix(ci): reconcile workflow secrets — use confirmed-existing names 
Per issue #425 §425 audit and issue #436.

Three concrete fixes:

1. sweep-aws-secrets.yml: AWS credentials
   - Was: secrets.AWS_JANITOR_ACCESS_KEY_ID / AWS_JANITOR_SECRET_ACCESS_KEY
     (MISSING in Gitea — never populated during GitHub→Gitea migration)
   - Now: secrets.AWS_ACCESS_KEY_ID / AWS_SECRET_ACCESS_KEY
     (CONFIRMED EXISTING per issue #425 audit)
   - Updated comment: the dedicated-janitor-IAM concern (molecule-cp lacks
     ListSecrets) is noted; if ListSecrets is ever revoked from molecule-cp,
     a new dedicated janitor principal + Gitea secret would need to be
     created and this workflow updated to reference them.

2. redeploy-tenants-on-staging.yml: staging admin token
   - Was: secrets.CP_STAGING_ADMIN_API_TOKEN (MISSING per #425)
   - Now: secrets.MOLECULE_STAGING_ADMIN_TOKEN (CONFIRMED EXISTING,
     shared with canary-staging.yml and all e2e-staging-*.yml)
   - Updated all env-refs and error messages.

3. continuous-synth-e2e.yml: staging admin token
   - Same issue as #2: secrets.CP_STAGING_ADMIN_API_TOKEN → MOLECULE_STAGING_ADMIN_TOKEN
   - Updated error message to reference the correct secret name.

Also added notes to sweep-cf-orphans.yml and sweep-cf-tunnels.yml header
comments documenting which secrets are confirmed-existing vs unconfirmed,
so future operators know what to create in Gitea.

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>
 2026-05-11 11:53:16 +00:00