molecule-ai/molecule-core
36
0
Fork 2
Code Issues 24 Pull Requests 16 Actions 90 Packages Projects Releases Wiki Activity
bea6d25543
molecule-core/.github/workflows
History
Molecule AI Core-DevOps 03689e3d9a
All checks were successful
Secret scan / Scan diff for credential-shaped strings (pull_request) Successful in 4s
Details
sop-tier-check / tier-check (pull_request) Successful in 5s
Details
audit-force-merge / audit (pull_request) Successful in 6s
Details
ci: pin GitHub Actions by SHA instead of mutable tags 
- actions/checkout@v6 → @de0fac2e4500dabe0009e67214ff5f5447ce83dd (v6.0.2)
  in secret-pattern-drift.yml
- pypa/gh-action-pypi-publish@release/v1 →
  @cef221092ed1bacb1cc03d23a2d87d1d172e277b in publish-runtime.yml

Mutable action tags (e.g. @v6, @release/v1) can silently resolve to
different code over time, creating supply-chain risk. SHA-pinning
ensures the exact commit runs every time. Workspace Dockerfile was
already compliant (python:3.11-slim@sha256:...).

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>
2026-05-10 07:55:39 +00:00
..
auto-tag-runtime.yml fix(ci): replace gh pr CLI with Gitea v1 REST in workflows + scripts (#75 class A) 2026-05-07 15:29:26 -07:00
block-internal-paths.yml
branch-protection-drift.yml ci(branch-protection): check-name parity gate (#144) 2026-05-07 14:42:50 -07:00
canary-staging.yml chore(canary): workflow_dispatch input keep_on_failure for log capture 2026-05-08 10:58:19 -07:00
canary-verify.yml fix(ci): migrate canary-verify from GHCR to ECR + add POST route smoke tests 2026-05-10 02:10:12 +00:00
cascade-list-drift-gate.yml
check-merge-group-trigger.yml [core-be-agent] fix(ci): replace gh api calls with Gitea-compatible alternatives 2026-05-09 23:10:07 +00:00
check-migration-collisions.yml
ci.yml [core-be-agent] fix(ci): replace gh api calls with Gitea-compatible alternatives 2026-05-09 23:10:07 +00:00
codeql.yml fix(ci): convert CodeQL workflow to no-op stub on Gitea (#156) 2026-05-07 14:26:57 -07:00
continuous-synth-e2e.yml
e2e-api.yml tech-debt: rename molecule-monorepo-net -> molecule-core-net 2026-05-09 20:51:48 +00:00
e2e-staging-canvas.yml chore(workflows): drop staging-branch triggers (Phase 3b of internal#81) 2026-05-08 13:08:51 +00:00
e2e-staging-external.yml chore(workflows): drop staging-branch triggers (Phase 3b of internal#81) 2026-05-08 13:08:51 +00:00
e2e-staging-saas.yml chore(workflows): drop staging-branch triggers (Phase 3b of internal#81) 2026-05-08 13:08:51 +00:00
e2e-staging-sanity.yml
handlers-postgres-integration.yml tech-debt: rename molecule-monorepo-net -> molecule-core-net 2026-05-09 20:51:48 +00:00
harness-replays.yml fix(ci): replace dorny/paths-filter with shell-based git diff (Gitea Actions compatibility) 2026-05-10 01:11:45 +00:00
lint-curl-status-capture.yml
pr-guards.yml fix(ci): close 3 chronic Gitea-Actions workflow flakes (closes #88) 2026-05-07 17:06:09 -07:00
promote-latest.yml
publish-canvas-image.yml
publish-runtime.yml ci: pin GitHub Actions by SHA instead of mutable tags 2026-05-10 07:55:39 +00:00
publish-workspace-server-image.yml chore(ci): retrigger publish-workspace-server-image after ECR repo create (#173) 2026-05-07 13:54:11 -07:00
railway-pin-audit.yml
redeploy-tenants-on-main.yml fix(ci): migrate canary-verify from GHCR to ECR + add POST route smoke tests 2026-05-10 02:10:12 +00:00
redeploy-tenants-on-staging.yml chore(workflows): drop staging-branch triggers (Phase 3b of internal#81) 2026-05-08 13:08:51 +00:00
runtime-pin-compat.yml
runtime-prbuild-compat.yml
secret-pattern-drift.yml ci: pin GitHub Actions by SHA instead of mutable tags 2026-05-10 07:55:39 +00:00
secret-scan.yml
sweep-aws-secrets.yml
sweep-cf-orphans.yml
sweep-cf-tunnels.yml
sweep-stale-e2e-orgs.yml
test-ops-scripts.yml