infra: add CI / all-required sentinel (cross-repo hard-gate sweep) #11

New Issue

2026-05-12T05:38:44Z

hongming commented

2026-05-12 05:38:44 +00:00

Context

Cross-repo sweep adding CI / all-required (pull_request) (or equivalent
single-sentinel context) to each repo's default-branch protection so that
"main cannot be merged until all CI is green" can be enforced via a single
required-status-check entry, instead of having to enumerate every individual
required job per repo.

Older sibling PATCH (audit trail): molecule-ai/internal#345 — the
molecule-core PATCH that landed first under Hongming GO 2026-05-11 04:50-04:54Z
("until all CICD green main should not be merged by PR" + "apply that to all
repos and all future ones").

This repo is in Class B of the audit: it has CI workflows, the default
branch (main) is protected, but there is no all-required sentinel
job that posts a single hard-gate context. Without that sentinel, adding
a single org-wide required-check entry is not possible without breaking the
existing per-job status-check shape on main.

Current state (main BP)

enable_status_check: true
status_check_contexts: ["Test / test (3.11) (pull_request)", "Test / test (3.12) (pull_request)", "Test / test (3.13) (pull_request)"]
required_approvals: 1

Discovered CI workflows

.gitea/workflows/auto-promote-staging.yml
.gitea/workflows/ci.yml
.gitea/workflows/publish.yml

Ask

Add (or rename) a workflow that posts a single all-required status under
the existing CI workflow name. Recommended pattern from molecule-controlplane:

# .gitea/workflows/ci.yml  (top-level workflow `name:` already exists)
jobs:
  # ...existing jobs...

  all-required:
    name: all-required
    needs: [<every other job id>]
    if: always()
    runs-on: ubuntu-latest
    steps:
      - name: Verify all required jobs passed
        run: |
          if [ "${ needs.*.result }" != "success success success" ]; then
            echo "One or more required jobs failed"; exit 1
          fi

Once that sentinel posts at least once on a PR against main, the BP
on this repo can be PATCHed to APPEND <workflow-name> / all-required (pull_request)
to status_check_contexts — at which point a single required-check entry
covers all CI on this repo.

Why "append, don't replace"

Per feedback_phantom_required_check_after_gitea_migration: never add a
required-check name that no workflow currently posts. Adding the sentinel
job (this PR's scope) must land and produce a check-run on the default
branch BEFORE the BP PATCH is applied, or the sentinel context will be a
phantom-required-check and block every PR forever.

Cross-links

molecule-ai/internal#345 — molecule-core PATCH audit trail (older sibling)
molecule-ai/internal#XXXX — this sweep's audit issue (to be filed; will
link back here)
feedback_phantom_required_check_after_gitea_migration — the failure mode
this discipline avoids
Hongming GO 2026-05-11 04:50-04:54Z (chat)

Out of scope

Removing or renaming existing required-check entries on main BP.
Touching staging/release branch BPs.
Adding workflows the repo doesn't already need; this issue only adds the
meta-sentinel that gates on existing jobs.

## Context Cross-repo sweep adding `CI / all-required (pull_request)` (or equivalent single-sentinel context) to each repo's default-branch protection so that "main cannot be merged until all CI is green" can be enforced via a single required-status-check entry, instead of having to enumerate every individual required job per repo. Older sibling PATCH (audit trail): `molecule-ai/internal#345` — the molecule-core PATCH that landed first under Hongming GO 2026-05-11 04:50-04:54Z ("until all CICD green main should not be merged by PR" + "apply that to all repos and all future ones"). This repo is in **Class B** of the audit: it has CI workflows, the default branch (`main`) is protected, but there is no `all-required` sentinel job that posts a single hard-gate context. Without that sentinel, adding a single org-wide required-check entry is not possible without breaking the existing per-job status-check shape on `main`. ## Current state (main BP) - enable_status_check: true - status_check_contexts: ["Test / test (3.11) (pull_request)", "Test / test (3.12) (pull_request)", "Test / test (3.13) (pull_request)"] - required_approvals: 1 ## Discovered CI workflows - `.gitea/workflows/auto-promote-staging.yml` - `.gitea/workflows/ci.yml` - `.gitea/workflows/publish.yml` ## Ask Add (or rename) a workflow that posts a single `all-required` status under the existing CI workflow name. Recommended pattern from `molecule-controlplane`: ```yaml # .gitea/workflows/ci.yml (top-level workflow `name:` already exists) jobs: # ...existing jobs... all-required: name: all-required needs: [<every other job id>] if: always() runs-on: ubuntu-latest steps: - name: Verify all required jobs passed run: | if [ "${ needs.*.result }" != "success success success" ]; then echo "One or more required jobs failed"; exit 1 fi ``` Once that sentinel posts at least once on a PR against `main`, the BP on this repo can be PATCHed to APPEND `<workflow-name> / all-required (pull_request)` to `status_check_contexts` — at which point a single required-check entry covers all CI on this repo. ## Why "append, don't replace" Per `feedback_phantom_required_check_after_gitea_migration`: never add a required-check name that no workflow currently posts. Adding the sentinel job (this PR's scope) must land and produce a check-run on the default branch BEFORE the BP PATCH is applied, or the sentinel context will be a phantom-required-check and block every PR forever. ## Cross-links - `molecule-ai/internal#345` — molecule-core PATCH audit trail (older sibling) - `molecule-ai/internal#XXXX` — this sweep's audit issue (to be filed; will link back here) - `feedback_phantom_required_check_after_gitea_migration` — the failure mode this discipline avoids - Hongming GO 2026-05-11 04:50-04:54Z (chat) ## Out of scope - Removing or renaming existing required-check entries on `main` BP. - Touching staging/release branch BPs. - Adding workflows the repo doesn't already need; this issue only adds the meta-sentinel that gates on existing jobs.

hongming commented

2026-05-12 05:40:32 +00:00

Cross-link: this issue's parent sweep audit is molecule-ai/internal#349. See that issue for the org-wide classification table and the larger (class-D, 53 repos without BP) scope-decision still pending.

Cross-link: this issue's parent sweep audit is [molecule-ai/internal#349](https://git.moleculesai.app/molecule-ai/internal/issues/349). See that issue for the org-wide classification table and the larger (class-D, 53 repos without BP) scope-decision still pending.

sdk-dev referenced this issue from a commit

2026-05-13 04:25:57 +00:00

feat(ci): add all-required sentinel job

sdk-dev commented

2026-05-14 17:15:24 +00:00

PR #13 (feat(ci): add all-required sentinel job) addresses this issue — adds CI / all-required (pull_request) context to the SDK Python CI workflow. The sentinel is queued in the merge queue.

PR #13 (`feat(ci): add all-required sentinel job`) addresses this issue — adds `CI / all-required (pull_request)` context to the SDK Python CI workflow. The sentinel is queued in the merge queue.

sdk-dev self-assigned this 2026-05-16 18:45:41 +00:00

sdk-dev referenced this issue from a commit

2026-05-16 21:03:50 +00:00

feat(ci): add CI / all-required sentinel job

sdk-dev referenced this issue

2026-05-16 21:04:03 +00:00

feat(ci): add CI / all-required sentinel job #23

sdk-dev commented

2026-05-16 21:04:38 +00:00

I've implemented the all-required sentinel as PR #23. The changes:

Renamed workflow name: from Test → CI — this changes existing context names from Test / test (3.x) to CI / test (3.x). The branch protection BP update (separate step) should replace Test / test (3.x) entries with CI / test (3.x) and add CI / all-required as a new required check.
Added all-required job that needs: [test], uses if: always(), and fails if any matrix variant returned failure/cancelled/skipped.

CI is running on PR #23. Once it posts CI / all-required (pull_request) successfully, the BP can be updated.

I've implemented the `all-required` sentinel as PR #23. The changes: 1. **Renamed** workflow `name:` from `Test` → `CI` — this changes existing context names from `Test / test (3.x)` to `CI / test (3.x)`. The branch protection BP update (separate step) should replace `Test / test (3.x)` entries with `CI / test (3.x)` and add `CI / all-required` as a new required check. 2. **Added** `all-required` job that `needs: [test]`, uses `if: always()`, and fails if any matrix variant returned `failure`/`cancelled`/`skipped`. CI is running on PR #23. Once it posts `CI / all-required (pull_request)` successfully, the BP can be updated.

sdk-dev referenced this issue from a commit

2026-05-18 12:57:22 +00:00

infra(sdk): add all-required sentinel to CI workflow

sdk-dev referenced a pull request that will close this issue

2026-05-18 12:57:27 +00:00

infra(sdk): add all-required sentinel to CI workflow #25

Sign in to join this conversation.

2 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: molecule-ai/molecule-sdk-python#11