molecule-core/workspace-server
core-devops 733450d249 feat(ci)(hard-gate): lint-continue-on-error-tracking (Tier 2e)
Every `continue-on-error: true` in `.gitea/workflows/*.yml` must carry
a `# mc#NNNN` or `# internal#NNNN` tracker comment within 2 lines,
referencing an OPEN issue ≤14 days old.

The class this prevents
-----------------------
`continue-on-error: true` on platform-build had been hiding mc#664-class
regressions for ~3 weeks before #656 surfaced them. A 14-day cap on
tracker age forces a review cycle: close-or-renew.

Implementation
--------------
- `.gitea/scripts/lint_continue_on_error_tracking.py` — PyYAML
  line-tracking loader to find every job-level
  `continue-on-error: <truthy>`. Treats string `"true"` as truthy
  (Gitea evaluator coerces). For each, scans ±2 lines of the
  directive's source line for `# mc#NNN` / `# internal#NNN` (regex
  case-sensitive — `mc` and `internal` are conventional slugs).
  GETs each issue from the Gitea API; valid = exists + state=open +
  `age.days <= MAX_AGE_DAYS` (inclusive 14d boundary).
  Graceful-degrades on 403 (token-scope) per Tier 2a contract.
- `.gitea/workflows/lint-continue-on-error-tracking.yml` —
  pull_request + push + daily 13:11Z schedule. Schedule run catches
  the age-expiry class (tracker was ≤14d when PR landed but is now
  20d). Phase 3 (continue-on-error: true) per RFC #219 §1.
- `tests/test_lint_continue_on_error_tracking.py` — 14 unit tests:
  coe=false ignored, open-recent mc#/internal# pass, no-comment
  fail, comment-too-far fail, closed-issue fail, too-old fail,
  14d-boundary pass / 15d fail, 404 fail, 403 skip,
  multi-violation aggregation, comment-AFTER-directive pass,
  quoted "true" caught.

Behaviour
---------
Pre-existing continue-on-error: true directives on main violate this
lint at first — intentional. They are the masked defects this lint
exists to surface (see mc#664). Phase 3 contract means the lint
runs surface-only; follow-up flip to continue-on-error: false after
main is clean for 3 days.

Auth uses DRIFT_BOT_TOKEN (same as ci-required-drift.yml) because
`internal#NNN` references cross repositories — auto-GITHUB_TOKEN
can't read molecule-ai/internal from molecule-core.

Refs: #350
2026-05-12 09:52:22 +00:00
..
cmd docs(runbook): add admin-auth.md covering test-token route lockdown 2026-05-10 02:20:30 +00:00
internal feat(ci)(hard-gate): lint-continue-on-error-tracking (Tier 2e) 2026-05-12 09:52:22 +00:00
migrations feat(plugins): plugin drift detector + queue + admin apply endpoint (#123) 2026-05-10 00:39:50 +00:00
pkg/provisionhook
.air.toml feat(local-dev): air-based hot-reload for workspace-server 2026-05-08 08:10:50 -07:00
.ci-force
.gitignore feat(local-dev): containerize platform + canvas stack via docker-compose (closes #126) 2026-05-08 10:53:39 -07:00
.golangci.yaml
Dockerfile ci(docker): pin base image digests in all Dockerfiles 2026-05-09 23:56:39 +00:00
Dockerfile.dev ci(docker): pin base image digests in all Dockerfiles 2026-05-09 23:56:39 +00:00
Dockerfile.tenant fix(dockerfile-tenant): chown /org-templates to canvas user so !external resolver can mkdir cache 2026-05-09 19:40:52 -07:00
entrypoint-tenant.sh fix(memory-plugin): gate sidecar spawn on cutover-active 2026-05-05 12:39:03 -07:00
go.mod fix(internal#214): refresh go.sum for the go.moleculesai.app/plugin/gh-identity vanity path 2026-05-09 23:55:20 -07:00
go.sum [core-lead-agent] fix(core#228): cascade fixes for PluginResolver — make main compile 2026-05-10 09:46:35 +00:00