molecule-core/workspace-server/internal
core-devops 04d5736895 feat(ci)(hard-gate): lint-continue-on-error-tracking (Tier 2e)
Every `continue-on-error: true` in `.gitea/workflows/*.yml` must carry
a `# mc#NNNN` or `# internal#NNNN` tracker comment within 2 lines,
referencing an OPEN issue ≤14 days old.

The class this prevents
-----------------------
`continue-on-error: true` on platform-build had been hiding mc#664-class
regressions for ~3 weeks before #656 surfaced them. A 14-day cap on
tracker age forces a review cycle: close-or-renew.

Implementation
--------------
- `.gitea/scripts/lint_continue_on_error_tracking.py` — PyYAML
  line-tracking loader to find every job-level
  `continue-on-error: <truthy>`. Treats string `"true"` as truthy
  (Gitea evaluator coerces). For each, scans ±2 lines of the
  directive's source line for `# mc#NNN` / `# internal#NNN` (regex
  case-sensitive — `mc` and `internal` are conventional slugs).
  GETs each issue from the Gitea API; valid = exists + state=open +
  `age.days <= MAX_AGE_DAYS` (inclusive 14d boundary).
  Graceful-degrades on 403 (token-scope) per Tier 2a contract.
- `.gitea/workflows/lint-continue-on-error-tracking.yml` —
  pull_request + push + daily 13:11Z schedule. Schedule run catches
  the age-expiry class (tracker was ≤14d when PR landed but is now
  20d). Phase 3 (continue-on-error: true) per RFC #219 §1.
- `tests/test_lint_continue_on_error_tracking.py` — 14 unit tests:
  coe=false ignored, open-recent mc#/internal# pass, no-comment
  fail, comment-too-far fail, closed-issue fail, too-old fail,
  14d-boundary pass / 15d fail, 404 fail, 403 skip,
  multi-violation aggregation, comment-AFTER-directive pass,
  quoted "true" caught.

Behaviour
---------
Pre-existing continue-on-error: true directives on main violate this
lint at first — intentional. They are the masked defects this lint
exists to surface (see mc#664). Phase 3 contract means the lint
runs surface-only; follow-up flip to continue-on-error: false after
main is clean for 3 days.

Auth uses DRIFT_BOT_TOKEN (same as ci-required-drift.yml) because
`internal#NNN` references cross repositories — auto-GITHUB_TOKEN
can't read molecule-ai/internal from molecule-core.

Refs: #350
2026-05-13 21:50:32 +00:00
..
artifacts
buildinfo
bundle
channels fix(platform): clear golangci-lint findings 2026-05-12 22:53:22 -07:00
crypto
db
envx
events fix(platform): clear golangci-lint findings 2026-05-12 22:53:22 -07:00
handlers feat(ci)(hard-gate): lint-continue-on-error-tracking (Tier 2e) 2026-05-13 21:50:32 +00:00
imagewatch
memory fix(go): remove ineffectual pgplugin index increment 2026-05-13 14:32:41 -07:00
messagestore
metrics
middleware fix(platform): clear golangci-lint findings 2026-05-12 22:53:22 -07:00
models
orgtoken
pendinguploads
plugins fix(platform): clear golangci-lint findings 2026-05-12 22:53:22 -07:00
provisioner fix(provisioner): inject ADMIN_TOKEN into workspace container env (core#831) 2026-05-13 21:05:02 +00:00
provlog
registry
router
scheduler
supervised
textutil
ws chore: drop org_layout_test, hub.go, hub_test.go (already in staging with better coverage) 2026-05-13 18:04:00 +00:00
wsauth