mirror of
https://github.com/hanzo-apps/cms.git
synced 2026-10-30 14:47:33 +00:00
zeekay
433e024032
The rewritten pipeline triggered on `main`. This repo's default branch is `hanzo-cms`, so pushes never matched and the workflow could not fire — the same class of silent no-op it was rewritten to fix.
79 lines
3.0 KiB
YAML
79 lines
3.0 KiB
YAML
# Build the image and push it. Nothing else.
|
|
#
|
|
# REWRITTEN 2026-07-27. The previous version could not work on this fleet, in two
|
|
# independent ways, and produced no image for weeks while looking merely idle:
|
|
#
|
|
# 1. `buildctl-daemonless.sh: command not found` (exit 127). Jobs here run in
|
|
# catthehacker/ubuntu:act-24.04 (see GIT_RUNNER_LABELS on the git-runner
|
|
# StatefulSet) and that image has no buildctl. It also read
|
|
# `secrets.GIT_CLONE_TOKEN`, which exists on neither the repo nor the org.
|
|
# 2. The `kubectl patch app` step failed with `kubectl: command not found` for
|
|
# the same reason — and it was futile regardless: cd.hanzo.ai's selfHeal
|
|
# restores the App CR from the pin in hanzoai/universe on its next poll.
|
|
# Rollout is a reviewed tag pin there, never a CI side effect.
|
|
#
|
|
# So the deploy step is gone on purpose. CI's job is to make a tag EXIST;
|
|
# choosing which tag runs is a reviewed change in universe.
|
|
#
|
|
# This is the shape proven on hanzoai/playground, whose build job is the only
|
|
# one of these that has ever gone green on this fleet. GHCR_USER / GHCR_TOKEN /
|
|
# GH_PAT all exist as hanzoai org secrets on git.hanzo.ai.
|
|
name: deploy
|
|
on:
|
|
push:
|
|
branches: [hanzo-cms]
|
|
workflow_dispatch:
|
|
|
|
concurrency:
|
|
group: deploy-cms-${{ github.ref }}
|
|
cancel-in-progress: true
|
|
|
|
jobs:
|
|
build:
|
|
# Must name a label a runner ACTUALLY advertises. The four online
|
|
# git-runners offer hanzo-build-linux-amd64; a label nothing offers does not
|
|
# fail, it queues until the 24h timeout — silence, not an error.
|
|
runs-on: [hanzo-build-linux-amd64]
|
|
steps:
|
|
- uses: actions/checkout@v4
|
|
|
|
- id: meta
|
|
run: echo "tag=sha-$(echo "$GITHUB_SHA" | cut -c1-7)" >> "$GITHUB_OUTPUT"
|
|
|
|
- uses: docker/setup-buildx-action@v3
|
|
with:
|
|
driver: docker-container
|
|
driver-opts: network=host
|
|
|
|
# Without this the push is unauthenticated and 403s at the registry.
|
|
- uses: docker/login-action@v3
|
|
with:
|
|
registry: ghcr.io
|
|
username: ${{ secrets.GHCR_USER }}
|
|
password: ${{ secrets.GHCR_TOKEN }}
|
|
|
|
- uses: docker/build-push-action@v6
|
|
with:
|
|
context: .
|
|
file: ./Dockerfile
|
|
platforms: linux/amd64
|
|
push: true
|
|
provenance: false
|
|
tags: ghcr.io/hanzoai/cms:${{ steps.meta.outputs.tag }}
|
|
secrets: |
|
|
GIT_AUTH_TOKEN=${{ secrets.GH_PAT }}
|
|
|
|
# build-push-action can exit 0 before the manifest resolves, so a green run
|
|
# could still mean a future ImagePullBackOff. Prove it pulls.
|
|
- name: Verify the pushed image resolves
|
|
run: |
|
|
set -euo pipefail
|
|
img="ghcr.io/hanzoai/cms:${{ steps.meta.outputs.tag }}"
|
|
for i in 1 2 3 4 5 6; do
|
|
if docker buildx imagetools inspect "$img" >/dev/null 2>&1; then
|
|
echo "resolved $img"; exit 0
|
|
fi
|
|
sleep 5
|
|
done
|
|
echo "::error::pushed image never resolved: $img"; exit 1
|