release-manager
f0bb388587
contract-verb-binding / Vendored contract byte-identical to molecule-ai-sdk canonical (pull_request) Successful in 4s
lint-infisical-extractor / lint-infisical-extractor (pull_request) Successful in 4s
contract-credentials-binding / Vendored credentials contract byte-identical to molecule-ai-sdk canonical (pull_request) Successful in 5s
CI / provenance (pull_request) Failing after 5s
contract-credentials-binding / Reader-binding credentials test (management client reads contract name) (pull_request) Successful in 11s
meta-ci-advisory / meta (advisory) (pull_request) Successful in 12s
contract-verb-binding / Producer-binding verb test (management tool set ⊇ contract) (pull_request) Successful in 17s
CI / test (pull_request) Successful in 20s
80 lines
3.2 KiB
YAML
80 lines
3.2 KiB
YAML
name: contract-credentials-binding
|
|
|
|
# Reader-side credentials-SSOT enforcement (molecule-ai-sdk contracts/credentials).
|
|
#
|
|
# This repo (@molecule-ai/mcp-server) is the READER of the Org API Key: the
|
|
# management surface authenticates every org-scoped tool call with
|
|
# `Authorization: Bearer ${MOLECULE_ORG_API_KEY}` (STRICT, no alias). The
|
|
# credentials contract in molecule-ai-sdk is the ROOT-level SSOT for that
|
|
# credential name; the seam whose drift caused the concierge AUTH_ERROR runs
|
|
# core setter (conciergePlatformMCPEnv) -> runtime forwarder (privileged_mcp_env)
|
|
# -> THIS reader. Two guards, both NEW:
|
|
#
|
|
# 1. reader-binding-test — runs the unit test
|
|
# (src/__tests__/contract-credentials-binding.test.ts) that asserts the
|
|
# management client reads the contract's CANONICAL org-api-key env
|
|
# (MOLECULE_ORG_API_KEY) and IGNORES the deprecated ORG_API_KEY. Both key
|
|
# names are read from the vendored contract, not hard-coded, so renaming
|
|
# the reader back to the deprecated key fails HERE. Runs ALWAYS (offline,
|
|
# reads the vendored contract) — gating.
|
|
#
|
|
# 2. vendor-sync — byte-compares our vendored
|
|
# contracts/credentials.contract.json against molecule-ai-sdk's canonical so
|
|
# the vendored copy can't silently drift. molecule-ai-sdk is PUBLIC, so this
|
|
# needs NO secret: it reads the canonical over the public raw endpoint and
|
|
# is fail-closed on fetch-error or drift, on every context incl. fork PRs.
|
|
#
|
|
# Kept in a SEPARATE workflow (mirrors contract-verb-binding.yml) so a new gate
|
|
# is added to the gating set without editing the existing CI job.
|
|
|
|
on:
|
|
push:
|
|
branches: [main]
|
|
pull_request:
|
|
branches: [main]
|
|
workflow_dispatch:
|
|
|
|
permissions:
|
|
contents: read
|
|
|
|
concurrency:
|
|
group: contract-credentials-binding-${{ github.ref }}
|
|
cancel-in-progress: true
|
|
|
|
jobs:
|
|
reader-binding-test:
|
|
name: Reader-binding credentials test (management client reads contract name)
|
|
runs-on: ubuntu-latest
|
|
timeout-minutes: 8
|
|
steps:
|
|
- uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
|
|
with:
|
|
persist-credentials: false
|
|
- uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4.4.0
|
|
with:
|
|
node-version: '20'
|
|
- name: Install dependencies
|
|
run: npm install
|
|
- name: Reader-binding credentials test
|
|
run: npx jest src/__tests__/contract-credentials-binding.test.ts
|
|
|
|
vendor-sync:
|
|
name: Vendored credentials contract byte-identical to molecule-ai-sdk canonical
|
|
runs-on: ubuntu-latest
|
|
timeout-minutes: 5
|
|
steps:
|
|
- uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
|
|
with:
|
|
persist-credentials: false
|
|
- name: Byte-compare vendored credentials contract against SDK canonical
|
|
env:
|
|
# molecule-ai-sdk is public -> no secret required. CONTRACT_SYNC_TOKEN
|
|
# is sent only if present (rate-limit headroom / future-private SDK).
|
|
# Fail-closed on fetch error or byte drift regardless.
|
|
CONTRACT_SYNC_TOKEN: ${{ secrets.CONTRACT_SYNC_TOKEN }}
|
|
API_ROOT: ${{ github.server_url }}/api/v1
|
|
run: |
|
|
set -euo pipefail
|
|
export SSOT_REF=main
|
|
bash .gitea/scripts/check-credentials-vendor-sync.sh
|