molecule-ai/molecule-core
41
0
Fork 2
Code Issues 103 Pull Requests 147 Actions 173 Packages Projects Releases Wiki Activity
0970feef70
molecule-core/.gitea/workflows
History
Molecule AI Core-DevOps 0970feef70
Some checks failed
Block internal-flavored paths / Block forbidden paths (pull_request) Successful in 23s
Details
CI / Detect changes (pull_request) Successful in 56s
Details
Lint curl status-code capture / Scan workflows for curl status-capture pollution (pull_request) Successful in 15s
Details
E2E API Smoke Test / detect-changes (pull_request) Successful in 42s
Details
E2E Staging Canvas (Playwright) / detect-changes (pull_request) Successful in 44s
Details
Handlers Postgres Integration / detect-changes (pull_request) Successful in 46s
Details
Secret scan / Scan diff for credential-shaped strings (pull_request) Successful in 15s
Details
Runtime PR-Built Compatibility / detect-changes (pull_request) Successful in 35s
Details
gate-check-v3 / gate-check (pull_request) Failing after 22s
Details
lint-continue-on-error-tracking / lint-continue-on-error-tracking (pull_request) Failing after 1m17s
Details
qa-review / approved (pull_request) Failing after 19s
Details
sop-checklist / all-items-acked (pull_request) acked: 0/7 — missing: comprehensive-testing, local-postgres-e2e, staging-smoke, +4 — body-unfilled: 7
Details
security-review / approved (pull_request) Failing after 21s
Details
sop-checklist-gate / gate (pull_request) Successful in 19s
Details
lint-required-no-paths / lint-required-no-paths (pull_request) Successful in 1m16s
Details
sop-tier-check / tier-check (pull_request) Successful in 25s
Details
Lint workflow YAML (Gitea-1.22.6-hostile shapes) / Lint workflow YAML for Gitea-1.22.6-hostile shapes (pull_request) Successful in 1m32s
Details
Lint pre-flip continue-on-error / Verify continue-on-error flips have run-log proof (pull_request) Successful in 1m52s
Details
CI / Platform (Go) (pull_request) Successful in 11s
Details
CI / Canvas (Next.js) (pull_request) Successful in 8s
Details
CI / Shellcheck (E2E scripts) (pull_request) Successful in 5s
Details
CI / Python Lint & Test (pull_request) Successful in 9s
Details
E2E API Smoke Test / E2E API Smoke Test (pull_request) Successful in 10s
Details
Handlers Postgres Integration / Handlers Postgres Integration (pull_request) Successful in 9s
Details
E2E Staging Canvas (Playwright) / Canvas tabs E2E (pull_request) Successful in 11s
Details
Runtime PR-Built Compatibility / PR-built wheel + import smoke (pull_request) Successful in 9s
Details
CI / Canvas Deploy Reminder (pull_request) Has been skipped
Details
CI / all-required (pull_request) Successful in 9s
Details
feat(ci)(hard-gate): lint-pre-flip catches continue-on-error true→false without run-log proof 
Empirical class — PR #656 / mc#664:
PR #656 (RFC internal#219 Phase 4) flipped 5 platform-build-class jobs
`continue-on-error: true → false` on the basis of a "verified green
on main via combined-status check". But that "green" was the LIE
the prior `continue-on-error: true` produced: Gitea Quirk #10
(internal#342 + dup #287) — a failed step inside a CoE:true job rolls
up to a success job-level status. The precondition the PR claimed to
verify was structurally fooled by the bug being flipped.

mc#664 captured the surfaced defects (2 mutually-masked regressions):
- Class 1: sqlmock helper drift since 2f36bb9a (24 days old)
- Class 2: OFFSEC-001 contract collision since 7d1a189f (1 day old)

Codified 04:35Z as hongming-pc2 charter §SOP-N rule (e)
"run-log-grep-before-flip": pull the actual run log + grep for
--- FAIL / FAIL\s BEFORE flipping; don't trust the masked
combined-status. This commit structurally enforces that rule.

What this PR adds:

.gitea/workflows/lint-pre-flip-continue-on-error.yml — pre-merge
  pull_request gate, path-scoped to .gitea/workflows/**. Lands at
  continue-on-error:true (Phase 3 dogfood — flip to false in a
  follow-up only after this workflow has clean recent runs on main).

.gitea/scripts/lint_pre_flip_continue_on_error.py — the lint:
  1. Reads every .gitea/workflows/*.yml at the PR base SHA AND head
     SHA via git show <sha>:<path>. No checkout needed.
  2. Parses both sides via PyYAML AST (per
     feedback_behavior_based_ast_gates — NOT grep, so comment churn
     and key-order changes don't false-positive).
  3. For each flipped job (base=true, head=false), renders the
     commit-status context as "{workflow.name} / {job.name or job.key}
     (push)" and pulls combined commit-status for the last 5
     commits on the PR base branch.
  4. Fetches each matching run's log via the web-UI route
     {server_url}/{repo}/actions/runs/{run_id}/jobs/{job_idx}/logs
     (per reference_gitea_actions_log_fetch — Gitea 1.22.6 lacks
     REST /actions/runs/*; web-UI is the only working path, see
     reference_gitea_1_22_6_lacks_rest_rerun_endpoints).
  5. Greps for --- FAIL / FAIL\s / ::error::. If status==success
     AND log shows fail markers, the job was masked. Emit
     ::error::file=... naming the failing test + offending run URL.

.gitea/scripts/tests/test_lint_pre_flip_continue_on_error.py —
  35 unittest cases covering the 5 acceptance tests from the spec
  + CoE coercion (truthy/falsy/quoted/absent) + context-name
  rendering + multi-flip aggregation + dry-run semantics + 3
  graceful-degrade halt conditions (log-unavailable, zero-runs-
  history, zero-commits-on-branch).

Live empirical confirmation:
Ran the script against the PR#656 base→merge diff with
RECENT_COMMITS_N=3 on main. Result:
- platform-build flip BLOCKED — masked --- FAIL on
  TestExecuteDelegation_DeliveryConfirmedProxyError_TreatsAsSuccess
  + 4 more on action_run 13353.
- canvas-build / shellcheck / python-lint flips PASS — no FAIL
  markers in their recent logs.
Exactly the diagnosis hongming-pc2 charter §SOP-N rule (e) requires.

Halt-condition graceful-degrade contract:
- Log fetch 404 (act_runner pruned, transient outage): warn-not-block.
- Zero recent runs of the flipped context (newly-added workflow):
  chicken-and-egg exemption — warn and allow.
- YAML parse error in one workflow file: warn-not-block (the YAML
  lint workflows catch this separately).

Cross-links: PR#656, mc#664, PR#665 (interim re-mask), Quirk #10
(internal#342 + dup #287), hongming-pc2 charter §SOP-N rule (e),
feedback_strict_root_only_after_class_a,
feedback_no_shared_persona_token_use.

Refs: internal#342, internal#287, molecule-core#664, molecule-core#665
2026-05-12 07:27:19 +00:00
..
audit-force-merge.yml fix(ci): RFC internal#219 Phase 4 — all-required sentinel enforced, stable jobs hard-fail 2026-05-12 04:09:44 +00:00
block-internal-paths.yml ci: port 9 gates/lints/audits to .gitea/workflows/ (RFC internal#219 §1, Category C-1) 2026-05-10 21:18:11 -07:00
cascade-list-drift-gate.yml ci: port 9 gates/lints/audits to .gitea/workflows/ (RFC internal#219 §1, Category C-1) 2026-05-10 21:18:11 -07:00
check-migration-collisions.yml ci: port 9 gates/lints/audits to .gitea/workflows/ (RFC internal#219 §1, Category C-1) 2026-05-10 21:18:11 -07:00
ci-required-drift.yml fix(ci): ci-required-drift handles 403/404 on protection endpoint gracefully 2026-05-12 03:13:37 +00:00
ci.yml fix(ci)(interim): re-add continue-on-error to platform-build (mc#664 fix-forward in flight) 2026-05-12 04:40:32 +00:00
continuous-synth-e2e.yml refactor(ci): drop "canary-" prefix → staging-smoke/staging-verify (Hongming directive 2026-05-11) (#443) 2026-05-11 11:25:29 +00:00
e2e-api.yml ci: port 10 E2E workflows to .gitea/workflows/ (RFC internal#219 §1, Category C-2) 2026-05-10 21:23:30 -07:00
e2e-staging-canvas.yml fix(ci): canonicalize MOLECULE_STAGING_ADMIN_TOKEN -> CP_STAGING_ADMIN_API_TOKEN (post-#443 rebase) + drop staging-smoke continue-on-error 2026-05-11 04:33:56 -07:00
e2e-staging-external.yml fix(ci): canonicalize MOLECULE_STAGING_ADMIN_TOKEN -> CP_STAGING_ADMIN_API_TOKEN (post-#443 rebase) + drop staging-smoke continue-on-error 2026-05-11 04:33:56 -07:00
e2e-staging-saas.yml fix(ci): restore pull_request trigger + pr-validate to e2e-staging-saas 2026-05-11 18:14:50 +00:00
e2e-staging-sanity.yml fix(ci): canonicalize MOLECULE_STAGING_ADMIN_TOKEN -> CP_STAGING_ADMIN_API_TOKEN (post-#443 rebase) + drop staging-smoke continue-on-error 2026-05-11 04:33:56 -07:00
gate-check-v3.yml fix(sre): add explicit 15s timeout to gate-check-v3 HTTP calls (closes #603) 2026-05-11 23:36:21 +00:00
handlers-postgres-integration.yml ci: port 10 E2E workflows to .gitea/workflows/ (RFC internal#219 §1, Category C-2) 2026-05-10 21:23:30 -07:00
harness-replays.yml fix(ci): strip JSON5 comments from manifest.json before clone-manifest.sh 2026-05-11 22:19:55 +00:00
lint-continue-on-error-tracking.yml feat(ci)(hard-gate): lint-continue-on-error-tracking (Tier 2e) 2026-05-12 07:05:07 +00:00
lint-curl-status-capture.yml ci: port 9 gates/lints/audits to .gitea/workflows/ (RFC internal#219 §1, Category C-1) 2026-05-10 21:18:11 -07:00
lint-mask-pr-atomicity.yml feat(ci)(hard-gate): lint-mask-pr-atomicity (Tier 2d) 2026-05-11 23:06:18 -07:00
lint-pre-flip-continue-on-error.yml feat(ci)(hard-gate): lint-pre-flip catches continue-on-error true→false without run-log proof 2026-05-12 07:27:19 +00:00
lint-required-no-paths.yml feat(ci)(hard-gate): lint-required-workflows-no-paths-filter (structural enforcement of feedback_path_filtered_workflow_cant_be_required) 2026-05-12 05:48:22 +00:00
lint-workflow-yaml.yml feat(ci)(hard-gate): lint-workflow-yaml catches Gitea-1.22.6-hostile shapes 2026-05-12 05:50:55 +00:00
main-red-watchdog.yml fix(ci): status-reaper rev3 widens window 10->30 + raises watchdog timeout + re-enables both crons 2026-05-11 20:29:06 -07:00
publish-canvas-image.yml revert(ci): restore ubuntu-latest runner for publish workflows 2026-05-12 00:02:03 +00:00
publish-runtime-autobump.yml fix(ci): publish-runtime-autobump bump-and-tag condition is always-skipped 2026-05-11 20:41:57 +00:00
publish-runtime.yml fix(ci): cascade wait-step SHA capture leaked pip stdout (4th defect) 2026-05-10 19:51:18 -07:00
publish-workspace-server-image.yml revert(ci): restore ubuntu-latest runner for publish workflows 2026-05-12 00:02:03 +00:00
qa-review.yml fix(ci)(security): stop token appearing in curl argv (#541) 2026-05-11 19:30:22 +00:00
railway-pin-audit.yml ci: port 9 gates/lints/audits to .gitea/workflows/ (RFC internal#219 §1, Category C-1) 2026-05-10 21:18:11 -07:00
redeploy-tenants-on-main.yml fix(ci): replace workflow_run triggers with push+paths (Gitea 1.22.6) 2026-05-12 07:19:50 +00:00
redeploy-tenants-on-staging.yml fix(ci): replace workflow_run triggers with push+paths (Gitea 1.22.6) 2026-05-12 07:19:50 +00:00
review-check-tests.yml fix(ci): add jq install to review-check-tests workflow + fix /tmp/jq hardcode 2026-05-12 01:24:24 +00:00
runtime-pin-compat.yml ci: port 9 gates/lints/audits to .gitea/workflows/ (RFC internal#219 §1, Category C-1) 2026-05-10 21:18:11 -07:00
runtime-prbuild-compat.yml ci: port 9 gates/lints/audits to .gitea/workflows/ (RFC internal#219 §1, Category C-1) 2026-05-10 21:18:11 -07:00
secret-pattern-drift.yml ci: port 9 gates/lints/audits to .gitea/workflows/ (RFC internal#219 §1, Category C-1) 2026-05-10 21:18:11 -07:00
secret-scan.yml ci(secret-scan): port from .github/ to .gitea/ — fix unsatisfiable required check 2026-05-08 20:13:06 -07:00
security-review.yml fix(ci)(security): stop token appearing in curl argv (#541) 2026-05-11 19:30:22 +00:00
sop-checklist-gate.yml feat(ci): sop-checklist-gate — peer-ack merge gate (RFC#351 Phase 2) 2026-05-12 06:08:36 +00:00
sop-tier-check.yml fix(sop-tier-check): flip jq install to apt-get-first (infra#241 follow-up) 2026-05-11 08:19:02 +00:00
sop-tier-refire.yml feat(ci): sop-tier-check refire workflow via issue_comment (internal#292) 2026-05-11 02:44:31 -07:00
staging-smoke.yml fix(ci): canonicalize MOLECULE_STAGING_ADMIN_TOKEN -> CP_STAGING_ADMIN_API_TOKEN (post-#443 rebase) + drop staging-smoke continue-on-error 2026-05-11 04:33:56 -07:00
staging-verify.yml fix(ci): replace workflow_run triggers with push+paths (Gitea 1.22.6) 2026-05-12 07:19:50 +00:00
status-reaper.yml fix(ci): status-reaper rev3 widens window 10->30 + raises watchdog timeout + re-enables both crons 2026-05-11 20:29:06 -07:00
sweep-aws-secrets.yml fix(ci): reconcile sweep workflow secrets — use confirmed-existing names (#482) 2026-05-11 14:07:53 +00:00
sweep-cf-orphans.yml fix(ci): reconcile sweep workflow secrets — use confirmed-existing names (#482) 2026-05-11 14:07:53 +00:00
sweep-cf-tunnels.yml fix(ci): reconcile sweep workflow secrets — use confirmed-existing names (#482) 2026-05-11 14:07:53 +00:00
sweep-stale-e2e-orgs.yml fix(ci): sweep-stale-e2e-orgs reference + drop continue-on-error (closes EC2 leak) (#461) 2026-05-11 12:05:36 +00:00
test-ops-scripts.yml ci: port 9 gates/lints/audits to .gitea/workflows/ (RFC internal#219 §1, Category C-1) 2026-05-10 21:18:11 -07:00
weekly-platform-go.yml fix(ci): make go vet hard-failing in weekly-platform-go 2026-05-12 03:37:52 +00:00