fix(ci): sweep-stale-e2e-orgs reference + drop continue-on-error (closes EC2 leak) #461
Merged
core-lead
merged 4 commits from 2026-05-11 12:05:42 +00:00
fix/sweep-stale-e2e-orgs-secret-name into main
4 Commits
| Author | SHA1 | Message | Date | |
|---|---|---|---|---|
| 3cbbfc714c |
Merge branch 'main' into fix/sweep-stale-e2e-orgs-secret-name
All checks were successful
sop-tier-check / tier-check (pull_request) bypass
Block internal-flavored paths / Block forbidden paths (pull_request) Successful in 15s
CI / Detect changes (pull_request) Successful in 37s
E2E Staging Canvas (Playwright) / detect-changes (pull_request) Successful in 35s
E2E API Smoke Test / detect-changes (pull_request) Successful in 38s
Handlers Postgres Integration / detect-changes (pull_request) Successful in 39s
Runtime PR-Built Compatibility / detect-changes (pull_request) Successful in 35s
CI / Platform (Go) (pull_request) Successful in 5s
CI / Shellcheck (E2E scripts) (pull_request) Successful in 4s
CI / Canvas (Next.js) (pull_request) Successful in 6s
CI / Python Lint & Test (pull_request) Successful in 5s
Secret scan / Scan diff for credential-shaped strings (pull_request) bypass
Handlers Postgres Integration / Handlers Postgres Integration (pull_request) Successful in 6s
E2E API Smoke Test / E2E API Smoke Test (pull_request) Successful in 9s
E2E Staging Canvas (Playwright) / Canvas tabs E2E (pull_request) Successful in 9s
Runtime PR-Built Compatibility / PR-built wheel + import smoke (pull_request) Successful in 6s
CI / Canvas Deploy Reminder (pull_request) Has been skipped
audit-force-merge / audit (pull_request) Successful in 27s
|
|||
| f10b6b17aa |
Merge branch 'main' into fix/sweep-stale-e2e-orgs-secret-name
All checks were successful
Block internal-flavored paths / Block forbidden paths (pull_request) Successful in 17s
Lint curl status-code capture / Scan workflows for curl status-capture pollution (pull_request) Successful in 13s
Secret scan / Scan diff for credential-shaped strings (pull_request) Successful in 15s
CI / Detect changes (pull_request) Successful in 49s
E2E API Smoke Test / detect-changes (pull_request) Successful in 47s
Handlers Postgres Integration / detect-changes (pull_request) Successful in 51s
E2E Staging Canvas (Playwright) / detect-changes (pull_request) Successful in 54s
Runtime PR-Built Compatibility / detect-changes (pull_request) Successful in 49s
sop-tier-check / tier-check (pull_request) Successful in 21s
CI / Platform (Go) (pull_request) Successful in 6s
CI / Shellcheck (E2E scripts) (pull_request) Successful in 4s
CI / Canvas (Next.js) (pull_request) Successful in 6s
CI / Python Lint & Test (pull_request) Successful in 5s
Handlers Postgres Integration / Handlers Postgres Integration (pull_request) Successful in 6s
E2E API Smoke Test / E2E API Smoke Test (pull_request) Successful in 6s
E2E Staging Canvas (Playwright) / Canvas tabs E2E (pull_request) Successful in 6s
Runtime PR-Built Compatibility / PR-built wheel + import smoke (pull_request) Successful in 6s
CI / Canvas Deploy Reminder (pull_request) Has been skipped
|
|||
| 34f95de059 |
Merge branch 'main' into fix/sweep-stale-e2e-orgs-secret-name
All checks were successful
Block internal-flavored paths / Block forbidden paths (pull_request) Successful in 12s
Lint curl status-code capture / Scan workflows for curl status-capture pollution (pull_request) Successful in 10s
Secret scan / Scan diff for credential-shaped strings (pull_request) Successful in 12s
CI / Detect changes (pull_request) Successful in 37s
sop-tier-check / tier-check (pull_request) Successful in 17s
E2E API Smoke Test / detect-changes (pull_request) Successful in 45s
E2E Staging Canvas (Playwright) / detect-changes (pull_request) Successful in 41s
Handlers Postgres Integration / detect-changes (pull_request) Successful in 40s
Runtime PR-Built Compatibility / detect-changes (pull_request) Successful in 37s
CI / Platform (Go) (pull_request) Successful in 7s
CI / Canvas (Next.js) (pull_request) Successful in 7s
CI / Shellcheck (E2E scripts) (pull_request) Successful in 7s
CI / Python Lint & Test (pull_request) Successful in 9s
E2E API Smoke Test / E2E API Smoke Test (pull_request) Successful in 12s
E2E Staging Canvas (Playwright) / Canvas tabs E2E (pull_request) Successful in 12s
Handlers Postgres Integration / Handlers Postgres Integration (pull_request) Successful in 8s
Runtime PR-Built Compatibility / PR-built wheel + import smoke (pull_request) Successful in 9s
CI / Canvas Deploy Reminder (pull_request) Has been skipped
|
|||
claude-ceo-assistant
|
548889ac96 |
fix(ci): sweep-stale-e2e-orgs reference + drop continue-on-error
All checks were successful
Block internal-flavored paths / Block forbidden paths (pull_request) Successful in 17s
Lint curl status-code capture / Scan workflows for curl status-capture pollution (pull_request) Successful in 11s
CI / Detect changes (pull_request) Successful in 48s
Secret scan / Scan diff for credential-shaped strings (pull_request) Successful in 18s
sop-tier-check / tier-check (pull_request) Successful in 19s
E2E Staging Canvas (Playwright) / detect-changes (pull_request) Successful in 37s
E2E API Smoke Test / detect-changes (pull_request) Successful in 42s
Handlers Postgres Integration / detect-changes (pull_request) Successful in 39s
CI / Platform (Go) (pull_request) Successful in 10s
CI / Shellcheck (E2E scripts) (pull_request) Successful in 7s
CI / Canvas (Next.js) (pull_request) Successful in 9s
CI / Python Lint & Test (pull_request) Successful in 8s
E2E Staging Canvas (Playwright) / Canvas tabs E2E (pull_request) Successful in 10s
Handlers Postgres Integration / Handlers Postgres Integration (pull_request) Successful in 7s
E2E API Smoke Test / E2E API Smoke Test (pull_request) Successful in 10s
CI / Canvas Deploy Reminder (pull_request) Has been skipped
The janitor was non-functional because env ADMIN_TOKEN referenced `secrets.MOLECULE_STAGING_ADMIN_TOKEN`, which does not exist in the org secret store. Canonical name (per #430 Class-E rename) is `CP_STAGING_ADMIN_API_TOKEN`. Workflow exited 2 every 15-min tick, job-level `continue-on-error: true` masked the failure, staging tenants kept leaking. Hongming observed 15 leaked EC2 in molecule-canary (004947743811) us-east-2 at 11:05Z 2026-05-11. Changes: - Rename `secrets.MOLECULE_STAGING_ADMIN_TOKEN` → `secrets.CP_STAGING_ADMIN_API_TOKEN` in env block + diagnostic error message. - Remove `continue-on-error: true` from the sweep job. Per `feedback_strict_root_only_after_class_a` the RFC #219 §1 "surface without blocking" rationale was applied wrongly here: silent-fail on the janitor IS the meta-bug. Critical janitors must fail loud. - Add `if: failure()` notify step that emits a tagged ::error:: line on any prior-step failure, so log-tail consumers (Loki SOPRefireRule, orchestrator triage loop) can grep for it. Other workflows in this repo still reference the old name (e2e-staging-saas/sanity/external/canvas, canary-staging, tests/e2e/STAGING_SAAS_E2E.md). Deferred to a follow-up PR per scope guidance. |
