world/hanzo.yml

# Canonical CI/CD config for hanzoai/world — read by both the hanzoai/ci
# reusable workflow (.github/workflows/cicd.yml) and platform.hanzo.ai.
# One image: the Go binary serving the Vite SPA and /v1/world/*.
#
# `pnpm build` in the Dockerfile fails the image on any type error; `test:`
# runs the server and the retired-prefix gates before it is built.

images:
  - name: world
    context: .
    dockerfile: Dockerfile
    repo: ghcr.io/hanzoai/world
    # One architecture on purpose: the build reads KMS secrets, which only a
    # buildx runner can (the door mounts none), and one runner is one arch.
    platforms: [linux/amd64]
    # Publishable Mapbox token (pk, URL-restricted to world.hanzo.ai) baked into
    # the Vite SPA at build so the Satellite/Terrain basemaps load (Dark stays
    # keyless CartoDB). Sourced from KMS (hanzo/deploy/VITE_MAPBOX_TOKEN,
    # env=prod) by hanzoai/ci — the key name IS the build-arg. Never in git.
    build_secrets:
      - VITE_MAPBOX_TOKEN
      # Publishable ingest key (hanzo/deploy/PUBLISHABLE_KEY, env=prod). Without it
      # every logged-out pageview and error is refused 401 at the door.
      - PUBLISHABLE_KEY
    # The version this build cuts, so the bundle reports the tag it ships under
    # (__APP_VERSION__ keys the chunk-reload guard in src/main.ts).
    args:
      APP_VERSION: ${VERSION}

test:
  - name: go
    run: |
      set -e
      export GOWORK=off
      go vet ./...
      go test -tags sqlite_fts5 -count=1 ./...
  - name: api-prefix
    run: node --test tests/no-api-prefix.test.mjs src-tauri/sidecar/local-api-server.test.mjs

# NO `deploy:` BLOCK, and that is the whole point — cd.hanzo.ai owns rollout.
#
# Deploying is a reviewed pin bump in hanzoai/universe, applied by
# cd.hanzo.ai; a `kubectl patch` from CI would be reverted on the next poll.
#
# Measured, so nobody has to take it on faith: the `world` Deployment carries
# `apps.hanzo.ai/installation-id: hanzo-cd`, its Application has
# `syncPolicy.automated.selfHeal: true`, its source is
# `charts/app` + `values/hanzo/world.yaml` in hanzoai/universe, and the running
# image is exactly the digest pinned there. Sync: Synced, Health: Healthy.
#
# So: to ship world, bump `tag:` AND `digest:` in that values file. One way to
# deploy, not two.
#
# KMS (kms.hanzo.ai, Universal Auth) still supplies the GHCR push token and the
# build_secrets at run time. Only KMS_CLIENT_ID/KMS_CLIENT_SECRET live as CI
# secrets; everything else is fetched here.
kms:
  path: /deploy
  environment: prod