docs: sync documentation with 2026-04-14 tick-3 merges (#53, #54, #55) - #56
Merged
Merged
Conversation
- docs/edit-history/2026-04-14.md: append tick-3 section covering the admin test-token route (#53), the prior-tick doc-sync PR (#54), and the hermes required_env alignment (#55). Record measured test counts (Go +4 for the TestAdminTestToken_* quartet). - CLAUDE.md: bump Go test count 695 → 699 with a note pointing at the new quartet. Route-table row and env-var mentions for the admin route already landed with #53; verified on main. - .env.example: add MOLECULE_ENABLE_TEST_TOKENS with a comment about the prod-hidden default. Closes the code-review doc-sync flag from #53 (var was in CLAUDE.md but missing from .env.example). No PLAN.md / README.md / README.zh-CN.md update needed — none of the three merges expose a user-visible surface. Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
3 tasks
3 tasks
HongmingWang-Rabbit
pushed a commit
that referenced
this pull request
Apr 26, 2026
…PI_TOKEN Drops the static PYPI_TOKEN secret in favor of OIDC trusted publishing. PyPI now mints a short-lived upload credential after verifying the workflow's OIDC claim against the trusted-publisher config registered for molecule-ai-workspace-runtime (Molecule-AI/molecule-core, publish-runtime.yml, environment pypi-publish). Why: - A leaked PYPI_TOKEN would let any holder publish arbitrary versions of molecule-ai-workspace-runtime to PyPI from anywhere — bypassing the monorepo's review and CI gates entirely. The 8 template repos pull this package; a malicious publish poisons all of them. - Trusted Publisher (OIDC) makes that exfil path moot: no long-lived credential exists to leak. Only this exact workflow, on this repo, in the pypi-publish environment, can upload. After this lands and the first OIDC publish succeeds, the PYPI_TOKEN repo secret should be deleted (it becomes dead weight + a leak surface with no purpose). Belt-and-suspenders companion to PR #56 in molecule-ai-workspace-runtime (sibling repo lockdown). Without OIDC, the sibling lockdown alone doesn't prevent local `python -m build && twine upload` from a laptop with a personal PyPI maintainer credential. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
HongmingWang-Rabbit
added a commit
that referenced
this pull request
Apr 26, 2026
…PI_TOKEN (#2113) Drops the static PYPI_TOKEN secret in favor of OIDC trusted publishing. PyPI now mints a short-lived upload credential after verifying the workflow's OIDC claim against the trusted-publisher config registered for molecule-ai-workspace-runtime (Molecule-AI/molecule-core, publish-runtime.yml, environment pypi-publish). Why: - A leaked PYPI_TOKEN would let any holder publish arbitrary versions of molecule-ai-workspace-runtime to PyPI from anywhere — bypassing the monorepo's review and CI gates entirely. The 8 template repos pull this package; a malicious publish poisons all of them. - Trusted Publisher (OIDC) makes that exfil path moot: no long-lived credential exists to leak. Only this exact workflow, on this repo, in the pypi-publish environment, can upload. After this lands and the first OIDC publish succeeds, the PYPI_TOKEN repo secret should be deleted (it becomes dead weight + a leak surface with no purpose). Belt-and-suspenders companion to PR #56 in molecule-ai-workspace-runtime (sibling repo lockdown). Without OIDC, the sibling lockdown alone doesn't prevent local `python -m build && twine upload` from a laptop with a personal PyPI maintainer credential. Co-authored-by: Hongming Wang <hongmingwangalt@gmail.com> Co-authored-by: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Doc-sync for the three merges in the 2026-04-14 tick-3 cron tick:
feat(platform): GET /admin/workspaces/:id/test-token for E2E (#6)— merge639c320. New dev-only admin route that mints a bearer token for E2E scripts; route 404s unlessMOLECULE_ENV != productionorMOLECULE_ENABLE_TEST_TOKENS=1. Also adds thee2e_mint_test_tokenhelper intests/e2e/_lib.shand theTestAdminTestToken_*quartet (+4 Go tests).docs: sync documentation with 2026-04-14 tick-2 merges (#50, #52)— mergec9f0a91. Docs-only (tick-2 sync).fix(hermes): align config.yaml required_env with executor (HERMES_API_KEY)— merge0485585. One-line template fix; executor already readsHERMES_API_KEYwithOPENROUTER_API_KEYfallback, this aligns the template'srequired_env:list.Files touched
docs/edit-history/2026-04-14.md— appended tick-3 section covering all three PRs and the measured test counts.CLAUDE.md— Go test count bumped 695 → 699 (+4 for theTestAdminTestToken_*quartet). The route-table row and env-var mention for the admin route already landed with PR feat(platform): GET /admin/workspaces/:id/test-token for E2E (#6) #53; verified on main and not re-added..env.example— addedMOLECULE_ENABLE_TEST_TOKENSwith a comment about the prod-hidden default. This closes the code-review doc-sync flag from feat(platform): GET /admin/workspaces/:id/test-token for E2E (#6) #53 — the var was documented inCLAUDE.mdbut missing from.env.example.Test counts (measured)
go test -v ./... | grep -c "^--- PASS"= 712 (subtests included); top-levelTest*functions = 713. Prior CLAUDE.md number was 695; +4 for the new quartet → 699, which is what CLAUDE.md now records.No PLAN.md / README.md / README.zh-CN.md update — none of the three merges ships a user-visible surface.
Test plan
.env.exampleaddition reads sensibly alongside the existingMOLECULE_ENVrow🤖 Generated with Claude Code