release-manager
f0bb388587
contract-verb-binding / Vendored contract byte-identical to molecule-ai-sdk canonical (pull_request) Successful in 4s
lint-infisical-extractor / lint-infisical-extractor (pull_request) Successful in 4s
contract-credentials-binding / Vendored credentials contract byte-identical to molecule-ai-sdk canonical (pull_request) Successful in 5s
CI / provenance (pull_request) Failing after 5s
contract-credentials-binding / Reader-binding credentials test (management client reads contract name) (pull_request) Successful in 11s
meta-ci-advisory / meta (advisory) (pull_request) Successful in 12s
contract-verb-binding / Producer-binding verb test (management tool set ⊇ contract) (pull_request) Successful in 17s
CI / test (pull_request) Successful in 20s
81 lines
3.0 KiB
YAML
81 lines
3.0 KiB
YAML
name: contract-verb-binding
|
|
|
|
# Producer-side verb-SSOT enforcement (core#3082 / #3280).
|
|
#
|
|
# Two guards, both NEW (this repo is the PRODUCER of the management-MCP
|
|
# workspace-creation verb that molecule-core's online/degraded gate checks):
|
|
#
|
|
# 1. producer-binding-test — runs the unit test
|
|
# (src/__tests__/contract-verb-binding.test.ts) that asserts the
|
|
# management server registers the SHARED contract's `required_tool` verb
|
|
# (the singular SSOT field; provision_workspace). Renaming/dropping the
|
|
# verb fails here. Runs ALWAYS (offline, reads the vendored contract) —
|
|
# gating.
|
|
#
|
|
# 2. vendor-sync — byte-compares our vendored
|
|
# contracts/mcp-plugin-delivery.contract.json against molecule-ai-sdk's
|
|
# canonical so the vendored copy can't silently drift. molecule-ai-sdk is
|
|
# PUBLIC, so this needs NO secret: it reads the canonical over the public
|
|
# raw endpoint and is fail-closed on fetch-error or drift, on every
|
|
# context incl. fork PRs.
|
|
#
|
|
# Kept in a SEPARATE workflow from ci.yml so the producer-binding unit test is
|
|
# added to the gating set without editing the existing CI job.
|
|
#
|
|
# CONTRACT SHAPE: the verb SSOT is the SINGULAR `required_tool` (a string),
|
|
# landed in the molecule-ai-sdk SSOT. The vendored copy is byte-identical to
|
|
# the SDK canonical; vendor-sync enforces that byte-identity.
|
|
|
|
on:
|
|
push:
|
|
branches: [main]
|
|
pull_request:
|
|
branches: [main]
|
|
workflow_dispatch:
|
|
|
|
permissions:
|
|
contents: read
|
|
|
|
concurrency:
|
|
group: contract-verb-binding-${{ github.ref }}
|
|
cancel-in-progress: true
|
|
|
|
jobs:
|
|
producer-binding-test:
|
|
name: Producer-binding verb test (management tool set ⊇ contract)
|
|
runs-on: ubuntu-latest
|
|
timeout-minutes: 8
|
|
steps:
|
|
- uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
|
|
with:
|
|
persist-credentials: false
|
|
- uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4.4.0
|
|
with:
|
|
node-version: '20'
|
|
- name: Install dependencies
|
|
run: npm install
|
|
- name: Build
|
|
run: npm run build
|
|
- name: Producer-binding verb test
|
|
run: npx jest src/__tests__/contract-verb-binding.test.ts
|
|
|
|
vendor-sync:
|
|
name: Vendored contract byte-identical to molecule-ai-sdk canonical
|
|
runs-on: ubuntu-latest
|
|
timeout-minutes: 5
|
|
steps:
|
|
- uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
|
|
with:
|
|
persist-credentials: false
|
|
- name: Byte-compare vendored contract against core canonical
|
|
env:
|
|
# molecule-ai-sdk is public -> no secret required. CONTRACT_SYNC_TOKEN
|
|
# is sent only if present (rate-limit headroom / future-private SDK).
|
|
# Fail-closed on fetch error or byte drift regardless.
|
|
CONTRACT_SYNC_TOKEN: ${{ secrets.CONTRACT_SYNC_TOKEN }}
|
|
API_ROOT: ${{ github.server_url }}/api/v1
|
|
run: |
|
|
set -euo pipefail
|
|
export SSOT_REF=main
|
|
bash .gitea/scripts/check-contract-vendor-sync.sh
|