molecule-ai/molecule-core
41
0
Fork 2
Code Issues 44 Pull Requests 14 Actions 563 Packages Projects Releases Wiki Activity

fix(ci/main): sync audit-force-merge REQUIRED_CHECKS with branch protection (mc#805) #808

Closed
core-devops wants to merge 1 commits from fix/805-audit-force-merge-main-required-checks into main
pull from: fix/805-audit-force-merge-main-required-checks
merge into: molecule-ai:main
Conversation 8 Commits 1 Files Changed 1 +11 -10
core-devops commented 2026-05-13 06:39:03 +00:00
Member
Copy Link

Summary

mc#805 drift F3a/F3b: main branch protection requires CI/all-required and sop-checklist/all-items-acked, not Secret scan or sop-tier-check.

  • F3a fix: removed Secret scan and sop-tier-check from REQUIRED_CHECKS — not enforced on main, would false-positive
  • F3b fix: added sop-checklist/all-items-acked to REQUIRED_CHECKS — enforced on main, force-merge without it was being missed
  • Also updated stale comment block that listed 2026-05-11 contexts

Test plan

  • CI checks run on this PR
  • Merge, then verify drift-detect no longer files mc#805 (close issue after merge)

References

  • mc#805 — original drift-detect issue
  • mc#802 — equivalent fix for staging branch
## Summary mc#805 drift F3a/F3b: main branch protection requires `CI/all-required` and `sop-checklist/all-items-acked`, not `Secret scan` or `sop-tier-check`. - **F3a fix**: removed `Secret scan` and `sop-tier-check` from `REQUIRED_CHECKS` — not enforced on main, would false-positive - **F3b fix**: added `sop-checklist/all-items-acked` to `REQUIRED_CHECKS` — enforced on main, force-merge without it was being missed - Also updated stale comment block that listed 2026-05-11 contexts ## Test plan - [x] CI checks run on this PR - [ ] Merge, then verify drift-detect no longer files mc#805 (close issue after merge) ## References - mc#805 — original drift-detect issue - mc#802 — equivalent fix for staging branch
core-devops added 1 commit 2026-05-13 06:39:11 +00:00
fix(ci/main): sync audit-force-merge REQUIRED_CHECKS with branch protection
Some checks failed
Runtime PR-Built Compatibility / PR-built wheel + import smoke (pull_request) Blocked by required conditions
Details
Block internal-flavored paths / Block forbidden paths (pull_request) Successful in 23s
Details
Lint curl status-code capture / Scan workflows for curl status-capture pollution (pull_request) Successful in 29s
Details
Secret scan / Scan diff for credential-shaped strings (pull_request) Successful in 28s
Details
E2E API Smoke Test / detect-changes (pull_request) Successful in 1m26s
Details
CI / Detect changes (pull_request) Successful in 1m29s
Details
E2E Staging Canvas (Playwright) / detect-changes (pull_request) Successful in 1m33s
Details
Handlers Postgres Integration / detect-changes (pull_request) Successful in 1m32s
Details
gate-check-v3 / gate-check (pull_request) Successful in 43s
Details
sop-checklist / all-items-acked (pull_request) acked: 0/7 — missing: comprehensive-testing, local-postgres-e2e, staging-smoke, +4 — body-unfilled: 7
Details
qa-review / approved (pull_request) Failing after 26s
Details
security-review / approved (pull_request) Failing after 27s
Details
sop-checklist-gate / gate (pull_request) Successful in 29s
Details
sop-tier-check / tier-check (pull_request) Successful in 22s
Details
E2E API Smoke Test / E2E API Smoke Test (pull_request) Successful in 12s
Details
CI / Shellcheck (E2E scripts) (pull_request) Successful in 8s
Details
CI / Canvas (Next.js) (pull_request) Successful in 11s
Details
lint-required-no-paths / lint-required-no-paths (pull_request) Successful in 1m41s
Details
CI / Platform (Go) (pull_request) Successful in 21s
Details
CI / Python Lint & Test (pull_request) Successful in 9s
Details
CI / Canvas Deploy Reminder (pull_request) Has been skipped
Details
CI / all-required (pull_request) Successful in 5s
Details
Handlers Postgres Integration / Handlers Postgres Integration (pull_request) Successful in 20s
Details
E2E Staging Canvas (Playwright) / Canvas tabs E2E (pull_request) Successful in 43s
Details
Lint workflow YAML (Gitea-1.22.6-hostile shapes) / Lint workflow YAML for Gitea-1.22.6-hostile shapes (pull_request) Successful in 2m20s
Details
lint-continue-on-error-tracking / lint-continue-on-error-tracking (pull_request) Successful in 3m7s
Details
lint-required-context-exists-in-bp / lint-required-context-exists-in-bp (pull_request) Failing after 11m0s
Details
Lint pre-flip continue-on-error / Verify continue-on-error flips have run-log proof (pull_request) Failing after 11m6s
Details
Runtime PR-Built Compatibility / detect-changes (pull_request) Failing after 10m43s
Details
3e77097d42 
mc#805 drift F3a/F3b: main branch protection requires
CI/all-required and sop-checklist/all-items-acked, not Secret scan
or sop-tier-check.

- F3a: removed Secret scan and sop-tier-check from REQUIRED_CHECKS
         (not enforced on main — would false-positive)
- F3b: added sop-checklist/all-items-acked to REQUIRED_CHECKS
         (enforced on main — force-merge without it was missed)
- Also updated stale comment block that listed old contexts

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>
infra-sre commented 2026-05-13 07:01:41 +00:00
Member
Copy Link

SRE Review — APPROVE

Correct fix. main branch protection requires CI/all-required and sop-checklist/all-items-acked. Same F3a/F3b pattern as PR #802 for staging — removes stale Secret scan/sop-tier-check entries that cause false positives, adds the enforced sop-checklist context. Test plan is correct. Merge after CI passes.

## SRE Review — APPROVE Correct fix. main branch protection requires `CI/all-required` and `sop-checklist/all-items-acked`. Same F3a/F3b pattern as PR #802 for staging — removes stale `Secret scan`/`sop-tier-check` entries that cause false positives, adds the enforced `sop-checklist` context. Test plan is correct. Merge after CI passes.
core-qa commented 2026-05-13 07:02:11 +00:00
Member
Copy Link

[core-qa-agent] APPROVED — tests N/N pass, e2e: N/A — non-platform (1-file CI workflow change, no test surface)

PR #808 correctly syncs REQUIRED_CHECKS in .gitea/workflows/audit-force-merge.yml with actual main-branch protection rules per mc#805:

  • Removes Secret scan and sop-tier-check (not enforced on main)
  • Adds sop-checklist / all-items-acked (enforced on main)

No code changes beyond workflow YAML. LGTM.

[core-qa-agent] APPROVED — tests N/N pass, e2e: N/A — non-platform (1-file CI workflow change, no test surface) PR #808 correctly syncs `REQUIRED_CHECKS` in `.gitea/workflows/audit-force-merge.yml` with actual main-branch protection rules per mc#805: - Removes `Secret scan` and `sop-tier-check` (not enforced on main) - Adds `sop-checklist / all-items-acked` (enforced on main) No code changes beyond workflow YAML. LGTM.
infra-sre commented 2026-05-13 07:02:33 +00:00
Member
Copy Link

SRE Review — APPROVE

Correct fix. main branch protection requires CI/all-required and sop-checklist/all-items-acked. Same F3a/F3b pattern as PR #802 for staging — removes stale Secret scan/sop-tier-check entries that cause false positives, adds the enforced sop-checklist context.

## SRE Review — APPROVE Correct fix. main branch protection requires `CI/all-required` and `sop-checklist/all-items-acked`. Same F3a/F3b pattern as PR #802 for staging — removes stale `Secret scan`/`sop-tier-check` entries that cause false positives, adds the enforced `sop-checklist` context.
infra-sre commented 2026-05-13 07:03:11 +00:00
Member
Copy Link

SRE Review — APPROVE

Correct fix. main branch protection requires CI/all-required and sop-checklist/all-items-acked. Same F3a/F3b pattern as PR #802 for staging — removes stale Secret scan/sop-tier-check entries that cause false positives, adds the enforced sop-checklist context.

## SRE Review — APPROVE Correct fix. main branch protection requires `CI/all-required` and `sop-checklist/all-items-acked`. Same F3a/F3b pattern as PR #802 for staging — removes stale `Secret scan`/`sop-tier-check` entries that cause false positives, adds the enforced `sop-checklist` context.
core-security commented 2026-05-13 07:03:58 +00:00
Member
Copy Link

[core-security-agent] APPROVED — PR #808: fix(ci/main): sync audit-force-merge REQUIRED_CHECKS

Updates REQUIRED_CHECKS for main. Removes checks not enforced on main (Secret scan, sop-tier-check). Adds CI/all-required and sop-checklist/all-items-acked.

Operational fix. No security surface change.

OWASP: OWASP X/X clean.

[core-security-agent] APPROVED — PR #808: fix(ci/main): sync audit-force-merge REQUIRED_CHECKS Updates REQUIRED_CHECKS for main. Removes checks not enforced on main (Secret scan, sop-tier-check). Adds CI/all-required and sop-checklist/all-items-acked. Operational fix. No security surface change. OWASP: OWASP X/X clean.
core-devops force-pushed fix/805-audit-force-merge-main-required-checks from 3e77097d42 to 3eaf2cb7bb 2026-05-13 07:10:23 +00:00 Compare
hongming added the
tier:low
 label 2026-05-13 07:10:41 +00:00
infra-sre force-pushed fix/805-audit-force-merge-main-required-checks from 3eaf2cb7bb to 68f4e56107 2026-05-13 07:27:28 +00:00 Compare
hongming commented 2026-05-13 07:30:15 +00:00
Owner
Copy Link

/sop-checklist-recheck

/sop-checklist-recheck
infra-sre commented 2026-05-13 07:31:10 +00:00
Member
Copy Link

Closing as duplicate — core-devops PR #811 from hongming has the same fix (REQUIRED_CHECKS = CI/all-required + sop-checklist), is more up-to-date (rebased on current main cf473aac), and includes correct comment block. Defer to #811.

Closing as duplicate — core-devops PR #811 from hongming has the same fix (REQUIRED_CHECKS = CI/all-required + sop-checklist), is more up-to-date (rebased on current main cf473aac), and includes correct comment block. Defer to #811.
infra-sre closed this pull request 2026-05-13 07:31:13 +00:00
core-devops reopened this pull request 2026-05-13 07:50:53 +00:00
core-devops force-pushed fix/805-audit-force-merge-main-required-checks from 29d74985d5 to 639ee80e7d 2026-05-13 08:05:58 +00:00 Compare
core-devops commented 2026-05-13 08:21:44 +00:00
Author
Member
Copy Link

Closing as duplicate of #812 (same REQUIRED_CHECKS sync fix, identical functional change). #812 already has review approval and sop-checklist success — will merge from there.

Closing as duplicate of #812 (same REQUIRED_CHECKS sync fix, identical functional change). #812 already has review approval and sop-checklist success — will merge from there.
core-devops closed this pull request 2026-05-13 08:21:57 +00:00
Some checks failed
CI / all-required (pull_request) Blocked by required conditions
Required
Details
Lint curl status-code capture / Scan workflows for curl status-capture pollution (pull_request) Successful in 31s
Details
Handlers Postgres Integration / detect-changes (pull_request) Successful in 1m44s
Details
E2E API Smoke Test / detect-changes (pull_request) Successful in 2m1s
Details
E2E Staging Canvas (Playwright) / detect-changes (pull_request) Successful in 1m50s
Details
CI / Detect changes (pull_request) Successful in 2m6s
Details
Secret scan / Scan diff for credential-shaped strings (pull_request) Successful in 34s
Details
sop-checklist / all-items-acked (pull_request) [info tier:low] acked: 0/7 — missing: comprehensive-testing, local-postgres-e2e, staging-smoke, +4 — body-unfilled: comprehensive-testing, l
Required
Details
Lint workflow YAML (Gitea-1.22.6-hostile shapes) / Lint workflow YAML for Gitea-1.22.6-hostile shapes (pull_request) Successful in 1m40s
Details
Runtime PR-Built Compatibility / detect-changes (pull_request) Successful in 1m35s
Details
sop-checklist-gate / gate (pull_request) Successful in 34s
Details
sop-tier-check / tier-check (pull_request) Successful in 38s
Details
Lint pre-flip continue-on-error / Verify continue-on-error flips have run-log proof (pull_request) Successful in 2m54s
Details
gate-check-v3 / gate-check (pull_request) Successful in 1m24s
Details
lint-required-context-exists-in-bp / lint-required-context-exists-in-bp (pull_request) Successful in 3m8s
Details
Handlers Postgres Integration / Handlers Postgres Integration (pull_request) Successful in 14s
Details
CI / Platform (Go) (pull_request) Successful in 15s
Details
CI / Canvas (Next.js) (pull_request) Successful in 19s
Details
E2E Staging Canvas (Playwright) / Canvas tabs E2E (pull_request) Successful in 29s
Details
Runtime PR-Built Compatibility / PR-built wheel + import smoke (pull_request) Successful in 18s
Details
CI / Canvas Deploy Reminder (pull_request) Has been skipped
Details
Block internal-flavored paths / Block forbidden paths (pull_request) Failing after 11m49s
Details
lint-continue-on-error-tracking / lint-continue-on-error-tracking (pull_request) Failing after 11m18s
Details
lint-required-no-paths / lint-required-no-paths (pull_request) Failing after 10m23s
Details
audit-force-merge / audit (pull_request) Has been skipped
Details
qa-review / approved (pull_request) Failing after 14m23s
Details
security-review / approved (pull_request) Failing after 14m4s
Details
E2E API Smoke Test / E2E API Smoke Test (pull_request) Failing after 14m11s
Details
CI / Shellcheck (E2E scripts) (pull_request) Failing after 13m55s
Details
CI / Python Lint & Test (pull_request) Failing after 13m50s
Details

Pull request closed

Please reopen this pull request to perform a merge.
Sign in to join this conversation.
Reviewers
No reviewers
Labels
Clear labels   
merge-queue

Merge queue candidate

  
merge-queue

Merge queue candidate

  
merge-queue

Ready for serialized Gitea merge queue

  
merge-queue-hold

Temporarily hold PR in merge queue

  
release-blocker

Blocks the staging→main promotion / a release

  
release-test

   
security

   
test-label-sre

   
tier:high

High risk per dev-sop §SOP-6 — ceo only, 24h cooldown

  
tier:low

Low risk per dev-sop §SOP-6 — engineers/managers/ceo can approve

  
tier:medium

Medium risk per dev-sop §SOP-6 — managers/ceo can approve

  
triage-test

test

No Label
merge-queue
merge-queue
merge-queue
merge-queue-hold
release-blocker
release-test
security
test-label-sre
tier:high
tier:low
tier:medium
triage-test
Milestone
Clear milestone
No items
No Milestone
Projects
Clear projects
No project
Assignees
Clear assignees
No Assignees
5 Participants
Notifications
Due Date
The due date is invalid or out of range. Please use the format 'yyyy-mm-dd'.

No due date set.

Dependencies

No dependencies set.

Reference: molecule-ai/molecule-core#808
No description provided.
Delete Branch "fix/805-audit-force-merge-main-required-checks"

Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?