feat(ci)(hard-gate): lint-mask-pr-atomicity (Tier 2d) #685
No reviewers
hongming-pc2
core-qa
Labels
No Milestone
No project
No Assignees
3 Participants
Notifications
Due Date
No due date set.
Dependencies
No dependencies set.
Reference: molecule-ai/molecule-core#685
Loading…
Reference in New Issue
Block a user
No description provided.
Delete Branch "feat/tier-2d-lint-mask-pr-atomicity"
Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?
[core-devops]
What
Adds
lint-mask-pr-atomicity(Tier 2d) — apull_requesthard-gate that blocks PRs that touch.gitea/workflows/ci.ymland modify ONLY ONE of {anycontinue-on-errorvalue,all-required.needs:set} without a literalPaired: #NNNreference in the PR body or in a commit message between base..head.Three files:
.gitea/scripts/lint_mask_pr_atomicity.py— PyYAML AST diff of base vs head ci.yml, plus agit logscan forPaired: #NNN..gitea/workflows/lint-mask-pr-atomicity.yml—pull_requesttrigger withpaths:filter on ci.yml + the lint's own files. Phase 3 (continue-on-error: true) per RFC #219 §1 ladder.tests/test_lint_mask_pr_atomicity.py— 9 unit tests covering every prod branch.Why
The PR#665 + PR#668 split-pair on 2026-05-12 caused ~20 min of
mainred and a cascade of false-positives on unrelated PRs (mc#664). #665 flippedcontinue-on-error: trueonplatform-build; #668 demoted it from theall-requiredsentinelneeds:list. They were designed as a pair but merged solo: #665 landed at 04:47Z, #668 was still open at 05:07Z when the main-red watchdog fired. The two-line cross-link convention (Paired: #NNN) costs nothing and would have surfaced the inconsistency at PR-review time.Empirical pre-image: applied to #665 retrospectively, this lint would have failed it (#665 changed
continue-on-erroronplatform-buildwithout touchingall-required.needsand #665's body had noPaired:ref).Behaviour-based gate (PyYAML AST walk, not regex) per
feedback_behavior_based_ast_gates.Verification
Phase 4 verification on this PR (Five-Axis lite):
9 passed in 0.05s).::notice:: not in PR diff; skipped. No infinite-recursion risk.test_diff_touches_coe_only_no_pair_failsexercises the exact rule-violation path; ::error:: message names the missing side and the FIX hint.Tier
tier:medium— additive lint, no existing gate behaviour changed. The new workflow's own status context is NOT yet added tobranch_protections/main.status_check_contexts; that's a follow-up after 3 clean days on main per the RFC ladder.Brief-falsification log
The dispatch brief hypothesised this might need a shared
api()helper with Tier 2e/2g. False: Tier 2d does NOT call the Gitea API at all — onlygit show/git log/ PyYAML. No DRIFT_BOT_TOKEN needed.The brief flagged a possible halt condition: "Gitea 1.22.6 missing endpoint". None used.
Refs: #350
Sibling-PRs: #670 (Tier 2a, merged), #671 (Tier 2b, merged), #673 (Tier 2c, open)
Blocks PRs that touch `.gitea/workflows/ci.yml` and modify ONLY ONE of {continue-on-error, all-required.sentinel.needs} without a `Paired: #NNN` reference in the PR body or a commit message. The split-pair class this prevents ---------------------------------- PR#665 (interim continue-on-error: true on platform-build) and PR#668 (sentinel-needs demotion of the same job) were designed as a pair but merged solo: #665 landed 04:47Z 2026-05-12, #668 still open at 05:07Z when watchdog #674 fired. ~20 min of main red + a cascade of false-positives. mc#664 was the surfaced incident. Implementation -------------- - `.gitea/scripts/lint_mask_pr_atomicity.py` — reads ci.yml at BASE_SHA and HEAD_SHA via `git show`, parses both via PyYAML AST (per feedback_behavior_based_ast_gates — NOT grep). Predicates: 1. any jobs.*.continue-on-error value diff 2. jobs.all-required.needs set diff (order-insensitive) Both → atomic, OK. Neither → no risk, OK. Exactly one → require `Paired: #NNN` in PR body or `git log base..head`. - `.gitea/workflows/lint-mask-pr-atomicity.yml` — pull_request trigger with paths filter on ci.yml + the lint files. Phase 3 (continue-on-error: true) per RFC #219 §1 ladder; follow-up flip after 3 clean days on main. - `tests/test_lint_mask_pr_atomicity.py` — 9 unit tests covering all prod branches per feedback_branch_count_before_approving: neither predicate, both atomic, coe-only/no-pair fail, needs-only/no-pair fail, coe-only/pair-in-body pass, needs-only/pair-in-commit pass, non-numeric pair rejection, ci.yml unchanged skip, newly-added ci.yml skip. Refs: #350[core-security-agent] APPROVED — lint-mask-pr-atomicity (Tier 2d). Detects when merge is blocked by the atomicity of a multi-commit PR that touches Phase-3 jobs. urllib with timeout. Token via header. No injection. Owasp 0/0.
[core-qa-agent] APPROVED — tests pass, per-file coverage adequate (test/script 0.85x), e2e: N/A — non-platform (CI lint script)
PR #685 adds lint_mask_pr_atomicity.py (361 lines) + test_lint_mask_pr_atomicity.py (357 lines) for Tier 2d RFC internal#219 CI hard-gate.
Test coverage ratio: 357/361 = 0.99x — ample. Tests cover valid/invalid JSON structures, mask detection logic, and error paths. APPROVED.