feat(ci): SECRET_PATTERNS drift lint across known consumers - #2212
Merged
Conversation
Adds a lint that diffs the canonical SECRET_PATTERNS array in
.github/workflows/secret-scan.yml against every known public
consumer mirror, failing on any divergence.
Why: every side that scans for credentials carries its own copy of
the pattern list. They drift — most recently the workspace-runtime
pre-commit hook lagged the canonical by one pattern (sk-cp- /
MiniMax F1088 vector), so a developer's local pre-commit would let
a sk-cp- token through while the org-wide CI scan would refuse it.
Useless friction; automated detection closes the gap.
Implementation:
.github/scripts/lint_secret_pattern_drift.py — pure stdlib, fetches
each consumer's RAW file via urllib, extracts the
SECRET_PATTERNS=( ... ) array via anchored regex (the closing
`)` is anchored to the start of a line because pattern comments
like `# GitHub PAT (classic)` contain their own paren mid-line),
diffs against canonical, fails on missing or extra patterns.
Fetch failures are warnings, not errors — a consumer whose
branch was renamed shouldn't fail the lint until someone updates
the URL list.
.github/workflows/secret-pattern-drift.yml — daily 05:00 UTC cron
+ on-push gate (when canonical, the workflow, or the script
changes) + workflow_dispatch. Read-only token, 5-minute timeout.
Initial consumer set: workspace-runtime's bundled pre-commit hook
(the one that drifted on sk-cp-). molecule-controlplane's inlined
copy is private so this workflow can't read it; that's tracked
separately and the controlplane's own self-monitor is the gap.
Verified locally: lint detects drift correctly when the runtime
hook is missing sk-cp-, returns clean when aligned.
Refs: task #139.
HongmingWang-Rabbit
requested a review
from hongmingwang-moleculeai
as a code owner
April 28, 2026 22:29
HongmingWang-Rabbit
enabled auto-merge
April 28, 2026 22:34
HongmingWang-Rabbit
pushed a commit
that referenced
this pull request
Jun 12, 2026
The `E2E Peer Visibility (literal MCP list_peers)` gate has been red on main because tests/e2e/test_peer_visibility_mcp_staging.sh created both the parent and the per-runtime sibling workspaces with a runtime + secrets but NO `model` field. Staging now enforces the workspace-create contract: there is no platform-side default model for a runtime (feedback_workspace_model_required_no_platform_default — the MODEL_REQUIRED gate). The create was therefore rejected with MODEL_REQUIRED before the peer-visibility assertion could run. Fix: supply the required `model` on every create via a small pv_platform_model_for_runtime helper that returns a PLATFORM-MANAGED id (Molecule owns billing — no tenant key needed; this gate only needs the workspace to boot + list peers). Ids are validated against the controlplane providers SSOT (internal/providers/providers.yaml runtimes.<rt>.providers [platform].models): - claude-code (parent + claude-code sibling) → anthropic/claude-sonnet-4-6 - hermes / openclaw siblings → moonshot/kimi-k2.6 E2E_MODEL_SLUG still overrides for operator-dispatched runs, mirroring lib/model_slug.sh. Contract enforcement is preserved; we supply the field rather than removing the gate. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Adds a daily lint that diffs the canonical `SECRET_PATTERNS` array in `secret-scan.yml` against every known public consumer mirror, failing on any divergence.
Why now
Every side that scans for credentials carries its own copy of the pattern list. They drift — most recently the workspace-runtime pre-commit hook lagged canonical by one pattern (`sk-cp-` / MiniMax F1088 vector), so a developer's local pre-commit would let a `sk-cp-` token through while the org-wide CI scan would refuse it. Useless friction; automated detection closes the gap.
Pre-shipping cleanup: molecule-ai-workspace-runtime#59 (already merged) brought the runtime hook back into alignment. So this lint is green from day 1; it's catching future drift, not flagging current.
Implementation
Initial consumer set
`molecule-controlplane`'s inlined copy is private so this workflow's GITHUB_TOKEN can't read it; the controlplane's own self-monitor is the gap, expected to be filled separately.
Verified locally
```
$ python3 .github/scripts/lint_secret_pattern_drift.py # against pre-fix runtime
canonical: 13 patterns
::error::DRIFT in molecule-ai-workspace-runtime/...:
$ python3 .github/scripts/lint_secret_pattern_drift.py # against post-fix runtime
canonical: 13 patterns
✓ molecule-ai-workspace-runtime/...: aligned (13 patterns)
✓ All known consumers aligned with canonical SECRET_PATTERNS.
```
Test plan
Refs
🤖 Generated with Claude Code