ci: add SOP checklist gate #5

2026-05-13T03:38:19Z

hongming commented

2026-05-13 03:38:19 +00:00

Summary

add the org-wide SOP checklist gate workflow
consume the SSOT-backed SOP_TIER_CHECK_TOKEN org Actions secret
require PR body checklist answers plus peer /sop-ack comments

Root cause

The SOP checklist merge gate was piloted in molecule-core, but the quality bar should apply consistently across Molecule repositories. This PR installs the same local Gitea Actions workflow and script in this repo while keeping the secret source centralized through operator-config and Infisical/SSOT.

Verification

generated by /opt/operator-config/bin/sync-sop-checklist-gate.py
canonical gate files copied from operator-config/ops/sop-checklist-gate

SOP-Checklist

Comprehensive testing performed: Rollout generated from canonical operator-config source; target repo diff is limited to SOP gate files.
Local-postgres E2E run: N/A for CI workflow/script rollout.
Staging-smoke verified or pending: Pending on this repo's CI after PR creation.
Root-cause not symptom: Installs the gate in-repo and consumes centralized key-management-backed Actions secret.
Five-Axis review walked: Correctness, readability, architecture, security, and operations reviewed at the canonical source.
No backwards-compat shim / dead code added: Adds the required gate directly; no advisory-only fallback.
Memory/saved-feedback consulted: Follows the current Molecule SOP gate rollout decision.

## Summary - add the org-wide SOP checklist gate workflow - consume the SSOT-backed `SOP_TIER_CHECK_TOKEN` org Actions secret - require PR body checklist answers plus peer `/sop-ack` comments ## Root cause The SOP checklist merge gate was piloted in `molecule-core`, but the quality bar should apply consistently across Molecule repositories. This PR installs the same local Gitea Actions workflow and script in this repo while keeping the secret source centralized through operator-config and Infisical/SSOT. ## Verification - generated by `/opt/operator-config/bin/sync-sop-checklist-gate.py` - canonical gate files copied from `operator-config/ops/sop-checklist-gate` ## SOP-Checklist - [x] **Comprehensive testing performed**: Rollout generated from canonical operator-config source; target repo diff is limited to SOP gate files. - [x] **Local-postgres E2E run**: N/A for CI workflow/script rollout. - [x] **Staging-smoke verified or pending**: Pending on this repo's CI after PR creation. - [x] **Root-cause not symptom**: Installs the gate in-repo and consumes centralized key-management-backed Actions secret. - [x] **Five-Axis review walked**: Correctness, readability, architecture, security, and operations reviewed at the canonical source. - [x] **No backwards-compat shim / dead code added**: Adds the required gate directly; no advisory-only fallback. - [x] **Memory/saved-feedback consulted**: Follows the current Molecule SOP gate rollout decision.

hongming added 1 commit 2026-05-13 03:38:19 +00:00

ci: add SOP checklist gate 3c7208aaba

This pull request doesn't have enough required approvals yet. 0 of 2 official approvals granted.

You are not authorized to merge this pull request.

View command line instructions

Checkout

From your project repository, check out a new branch and test the changes.

git fetch -u origin chore/sop-checklist-gate:chore/sop-checklist-gate

git checkout chore/sop-checklist-gate

Sign in to join this conversation.

1 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: molecule-ai/.github#5