molecule-mcp-server/.gitea/workflows/contract-credentials-binding.yml

name: contract-credentials-binding

# Reader-side credentials-SSOT enforcement (molecule-ai-sdk contracts/credentials).
#
# This repo (@molecule-ai/mcp-server) is the READER of the Org API Key: the
# management surface authenticates every org-scoped tool call with
# `Authorization: Bearer ${MOLECULE_ORG_API_KEY}` (STRICT, no alias). The
# credentials contract in molecule-ai-sdk is the ROOT-level SSOT for that
# credential name; the seam whose drift caused the concierge AUTH_ERROR runs
# core setter (conciergePlatformMCPEnv) -> runtime forwarder (privileged_mcp_env)
# -> THIS reader. Two guards, both NEW:
#
#   1. reader-binding-test — runs the unit test
#      (src/__tests__/contract-credentials-binding.test.ts) that asserts the
#      management client reads the contract's CANONICAL org-api-key env
#      (MOLECULE_ORG_API_KEY) and IGNORES the deprecated ORG_API_KEY. Both key
#      names are read from the vendored contract, not hard-coded, so renaming
#      the reader back to the deprecated key fails HERE. Runs ALWAYS (offline,
#      reads the vendored contract) — gating.
#
#   2. vendor-sync — byte-compares our vendored
#      contracts/credentials.contract.json against molecule-ai-sdk's canonical so
#      the vendored copy can't silently drift. molecule-ai-sdk is PUBLIC, so this
#      needs NO secret: it reads the canonical over the public raw endpoint and
#      is fail-closed on fetch-error or drift, on every context incl. fork PRs.
#
# Kept in a SEPARATE workflow (mirrors contract-verb-binding.yml) so a new gate
# is added to the gating set without editing the existing CI job.

on:
  push:
    branches: [main]
  pull_request:
    branches: [main]
  workflow_dispatch:

permissions:
  contents: read

concurrency:
  group: contract-credentials-binding-${{ github.ref }}
  cancel-in-progress: true

jobs:
  reader-binding-test:
    name: Reader-binding credentials test (management client reads contract name)
    runs-on: ubuntu-latest
    timeout-minutes: 8
    steps:
      - uses: actions/checkout@v4
      - uses: actions/setup-node@v4
        with:
          node-version: '20'
      - name: Install dependencies
        run: npm install
      - name: Reader-binding credentials test
        run: npx jest src/__tests__/contract-credentials-binding.test.ts

  vendor-sync:
    name: Vendored credentials contract byte-identical to molecule-ai-sdk canonical
    runs-on: ubuntu-latest
    timeout-minutes: 5
    steps:
      - uses: actions/checkout@v4
      - name: Byte-compare vendored credentials contract against SDK canonical
        env:
          # molecule-ai-sdk is public -> no secret required. CONTRACT_SYNC_TOKEN
          # is sent only if present (rate-limit headroom / future-private SDK).
          # Fail-closed on fetch error or byte drift regardless.
          CONTRACT_SYNC_TOKEN: ${{ secrets.CONTRACT_SYNC_TOKEN }}
          API_ROOT: ${{ github.server_url }}/api/v1
        run: |
          set -euo pipefail
          export SSOT_REF=main
          bash .gitea/scripts/check-credentials-vendor-sync.sh