Added documentation for all three in docs/tech/ci-cd-workflow.md
5. Add Script Separation Rules to AGENTS.md
Directory layout table with release impact
Import rules (GRM never imports from scripts, scripts may import from GRM)
PYTHONPATH configuration table (src vs . vs none)
Workflow convention: always use env: blocks
Shared constants documentation
6. Fix AGENTS.md user-facing paths
Removed dev tools incorrectly listed as user-facing
All scripts/ are workflow-only
Testing
774 tests pass with 100% branch coverage
All lint checks pass (ruff, pyright, bandit, ansible-lint, actionlint)
make workflow-check passes
Doc coverage: 30/30 (100%)
Closes GRM-53
## Summary
Audits and fixes the separation between CI/development scripts and the GRM user-facing tool.
## Changes
### 1. Move PLATFORMS to shared module (eliminates dev→CI cross-import)
- New `scripts/ci/platforms.py` — single source of truth for molecule platform matrix
- `distribute_molecule.py` and `molecule_all.py` both import from it
- Eliminates the dev tool (`molecule_all.py`) importing directly from a CI script (`distribute_molecule.py`)
### 2. Standardize PYTHONPATH in workflows
- All workflows now use `env:` blocks consistently (no more inline `PYTHONPATH=value`)
- Fixed `ci.yml`: doc_coverage and release-dry-run steps
### 3. Document cross-CI imports
- `release.py`: added inline comment explaining `PYTHONPATH=.` requirement
- `classify_changes.py`: enhanced docstring on `has_user_facing_changes()`
### 4. Complete doc_coverage.py REQUIRED_SCRIPTS
- Added `distribute_molecule.py`, `molecule_ci_guard.py`, `validate_commit_msg.py`
- Added documentation for all three in `docs/tech/ci-cd-workflow.md`
### 5. Add Script Separation Rules to AGENTS.md
- Directory layout table with release impact
- Import rules (GRM never imports from scripts, scripts may import from GRM)
- PYTHONPATH configuration table (src vs . vs none)
- Workflow convention: always use env: blocks
- Shared constants documentation
### 6. Fix AGENTS.md user-facing paths
- Removed dev tools incorrectly listed as user-facing
- All `scripts/` are workflow-only
## Testing
- 774 tests pass with 100% branch coverage
- All lint checks pass (ruff, pyright, bandit, ansible-lint, actionlint)
- `make workflow-check` passes
- Doc coverage: 30/30 (100%)
Closes GRM-53
## Automated PR Review
- Architecture compliance: OK
- Best practices: OK
- Security: OK
- Documentation: OK
- Tests: OK
- Commit conventions: OK
No issues found by automated checks.
---
**Manual review required:** Before approving, review every category in
[REVIEW_CHECKLIST.md](REVIEW_CHECKLIST.md) and confirm with:
```bash
python3 scripts/ci/review_pr.py <PR> <owner/repo> \
--event APPROVE --checklist-confirmed \
--body "<substantive review summary>"
```
Blocking a user prevents them from interacting with repositories, such as opening or commenting on pull requests or issues. Learn more about blocking a user.
emil
Summary
Audits and fixes the separation between CI/development scripts and the GRM user-facing tool.
Changes
1. Move PLATFORMS to shared module (eliminates dev→CI cross-import)
scripts/ci/platforms.py— single source of truth for molecule platform matrixdistribute_molecule.pyandmolecule_all.pyboth import from itmolecule_all.py) importing directly from a CI script (distribute_molecule.py)2. Standardize PYTHONPATH in workflows
env:blocks consistently (no more inlinePYTHONPATH=value)ci.yml: doc_coverage and release-dry-run steps3. Document cross-CI imports
release.py: added inline comment explainingPYTHONPATH=.requirementclassify_changes.py: enhanced docstring onhas_user_facing_changes()4. Complete doc_coverage.py REQUIRED_SCRIPTS
distribute_molecule.py,molecule_ci_guard.py,validate_commit_msg.pydocs/tech/ci-cd-workflow.md5. Add Script Separation Rules to AGENTS.md
6. Fix AGENTS.md user-facing paths
scripts/are workflow-onlyTesting
make workflow-checkpassesCloses GRM-53
Automated PR Review
No issues found by automated checks.
Manual review required: Before approving, review every category in
REVIEW_CHECKLIST.md and confirm with: