Molecule AI Core-DevOps 0970feef70 feat(ci)(hard-gate): lint-pre-flip catches continue-on-error true→false without run-log proof ... Empirical class — PR #656 / mc#664: PR #656 (RFC internal#219 Phase 4) flipped 5 platform-build-class jobs `continue-on-error: true → false` on the basis of a "verified green on main via combined-status check". But that "green" was the LIE the prior `continue-on-error: true` produced: Gitea Quirk #10 (internal#342 + dup #287) — a failed step inside a CoE:true job rolls up to a success job-level status. The precondition the PR claimed to verify was structurally fooled by the bug being flipped. mc#664 captured the surfaced defects (2 mutually-masked regressions): - Class 1: sqlmock helper drift since 2f36bb9a (24 days old) - Class 2: OFFSEC-001 contract collision since 7d1a189f (1 day old) Codified 04:35Z as hongming-pc2 charter §SOP-N rule (e) "run-log-grep-before-flip": pull the actual run log + grep for --- FAIL / FAIL\s BEFORE flipping; don't trust the masked combined-status. This commit structurally enforces that rule. What this PR adds: .gitea/workflows/lint-pre-flip-continue-on-error.yml — pre-merge pull_request gate, path-scoped to .gitea/workflows/**. Lands at continue-on-error:true (Phase 3 dogfood — flip to false in a follow-up only after this workflow has clean recent runs on main). .gitea/scripts/lint_pre_flip_continue_on_error.py — the lint: 1. Reads every .gitea/workflows/*.yml at the PR base SHA AND head SHA via git show <sha>:<path>. No checkout needed. 2. Parses both sides via PyYAML AST (per feedback_behavior_based_ast_gates — NOT grep, so comment churn and key-order changes don't false-positive). 3. For each flipped job (base=true, head=false), renders the commit-status context as "{workflow.name} / {job.name or job.key} (push)" and pulls combined commit-status for the last 5 commits on the PR base branch. 4. Fetches each matching run's log via the web-UI route {server_url}/{repo}/actions/runs/{run_id}/jobs/{job_idx}/logs (per reference_gitea_actions_log_fetch — Gitea 1.22.6 lacks REST /actions/runs/*; web-UI is the only working path, see reference_gitea_1_22_6_lacks_rest_rerun_endpoints). 5. Greps for --- FAIL / FAIL\s / ::error::. If status==success AND log shows fail markers, the job was masked. Emit ::error::file=... naming the failing test + offending run URL. .gitea/scripts/tests/test_lint_pre_flip_continue_on_error.py — 35 unittest cases covering the 5 acceptance tests from the spec + CoE coercion (truthy/falsy/quoted/absent) + context-name rendering + multi-flip aggregation + dry-run semantics + 3 graceful-degrade halt conditions (log-unavailable, zero-runs- history, zero-commits-on-branch). Live empirical confirmation: Ran the script against the PR#656 base→merge diff with RECENT_COMMITS_N=3 on main. Result: - platform-build flip BLOCKED — masked --- FAIL on TestExecuteDelegation_DeliveryConfirmedProxyError_TreatsAsSuccess + 4 more on action_run 13353. - canvas-build / shellcheck / python-lint flips PASS — no FAIL markers in their recent logs. Exactly the diagnosis hongming-pc2 charter §SOP-N rule (e) requires. Halt-condition graceful-degrade contract: - Log fetch 404 (act_runner pruned, transient outage): warn-not-block. - Zero recent runs of the flipped context (newly-added workflow): chicken-and-egg exemption — warn and allow. - YAML parse error in one workflow file: warn-not-block (the YAML lint workflows catch this separately). Cross-links: PR#656, mc#664, PR#665 (interim re-mask), Quirk #10 (internal#342 + dup #287), hongming-pc2 charter §SOP-N rule (e), feedback_strict_root_only_after_class_a, feedback_no_shared_persona_token_use. Refs: internal#342, internal#287, molecule-core#664, molecule-core#665		2026-05-12 07:27:19 +00:00
..
tests	feat(ci)(hard-gate): lint-pre-flip catches continue-on-error true→false without run-log proof	2026-05-12 07:27:19 +00:00
audit-force-merge.sh	fix(gitea): add || true guards to jq pipelines in audit-force-merge.sh	2026-05-12 03:26:36 +00:00
ci-required-drift.py	fix(ci): ci-required-drift handles 403/404 on protection endpoint gracefully	2026-05-12 03:13:37 +00:00
compare-api-diff-files.py	fix(harness-replays): use Gitea Compare API instead of git diff for detect-changes (#476)	2026-05-11 15:26:11 +00:00
lint_continue_on_error_tracking.py	feat(ci)(hard-gate): lint-continue-on-error-tracking (Tier 2e)	2026-05-12 07:05:07 +00:00
lint_mask_pr_atomicity.py	feat(ci)(hard-gate): lint-mask-pr-atomicity (Tier 2d)	2026-05-11 23:06:18 -07:00
lint_pre_flip_continue_on_error.py	feat(ci)(hard-gate): lint-pre-flip catches continue-on-error true→false without run-log proof	2026-05-12 07:27:19 +00:00
lint-required-no-paths.py	feat(ci)(hard-gate): lint-required-workflows-no-paths-filter (structural enforcement of feedback_path_filtered_workflow_cant_be_required)	2026-05-12 05:48:22 +00:00
lint-workflow-yaml.py	feat(ci)(hard-gate): lint-workflow-yaml catches Gitea-1.22.6-hostile shapes	2026-05-12 05:50:55 +00:00
main-red-watchdog.py	fix(ci): status-reaper rev4 reads per-context "status" key not "state" (compensation was unreachable since rev1)	2026-05-11 20:44:20 -07:00
push-commits-diff-files.py	fix(harness-replays): use github.event.commits for push event detect-changes (#499)	2026-05-11 15:49:48 +00:00
review-check.sh	fix(ci)(security): stop token appearing in curl argv (#541)	2026-05-11 19:30:22 +00:00
sop-checklist-gate.py	fix(ci): sop-checklist-gate exits 0 by default — POSTed status is the gate	2026-05-12 06:13:58 +00:00
sop-tier-check.sh	fix(ci): sop-tier-check gracefully handles empty/invalid token	2026-05-12 03:16:17 +00:00
sop-tier-refire.sh	feat(ci): sop-tier-check refire workflow via issue_comment (internal#292)	2026-05-11 02:44:31 -07:00
status-reaper.py	fix(ci): status-reaper rev4 reads per-context "status" key not "state" (compensation was unreachable since rev1)	2026-05-11 20:44:20 -07:00