mirror of
https://github.com/hanzoai/cd.git
synced 2026-10-30 14:56:45 +00:00
zooqueenandHanzo Dev
47e90f6064
The image build has no usable git, so every image reported v3.7.0+unknown from GET /v1/version and the sidebar. hanzo.yml now passes GIT_TAG (the version CI publishes the image as: 3.7.11 from main, v3.7.5 from a git tag), GIT_COMMIT, GIT_TREE_STATE and BUILD_DATE as build args, which both the buildx and the delegated lane expand, so the binary reports exactly the tag it is published under. Co-authored-by: Hanzo Dev <[email protected]>
68 lines
2.9 KiB
YAML
68 lines
2.9 KiB
YAML
# Canonical CI/CD config for hanzoai/cd ("Hanzo CD") — read by both the
|
|
# hanzoai/ci reusable workflow (.github/workflows/cicd.yml) and
|
|
# platform.hanzo.ai.
|
|
#
|
|
# One image: the root multi-stage Dockerfile builds the UI plus every cd-*
|
|
# binary (cd, cd-server, cd-repo-server, cd-application-controller,
|
|
# cd-applicationset-controller, cd-commit-server, cd-cmp-server, cd-dex,
|
|
# cd-git-ask-pass, cd-k8s-auth) into it.
|
|
#
|
|
# The image is ghcr.io/hanzoai/cd — matching the repo, the binaries, the
|
|
# apps.hanzo.ai API group and the cd.hanzo.ai UI. It read ghcr.io/hanzoai/cd
|
|
# until now, the name from before the repo was renamed, and this file was the
|
|
# last place that name survived: universe's infra/k8s/hanzo-cd/README.md has
|
|
# documented the engine as ghcr.io/hanzoai/cd throughout. A build target that
|
|
# outlives the name of the thing it builds is how the two quietly stop meaning
|
|
# each other.
|
|
images:
|
|
- name: cd
|
|
context: .
|
|
dockerfile: Dockerfile
|
|
repo: ghcr.io/hanzoai/cd
|
|
# The binary reports what it is (GET /v1/version, the sidebar). The build
|
|
# context has no usable git, so CI tells it: the version this build is
|
|
# published as, and the commit it was built from.
|
|
args:
|
|
GIT_TAG: ${VERSION}
|
|
GIT_COMMIT: ${SHA}
|
|
GIT_TREE_STATE: clean
|
|
BUILD_DATE: ${BUILD_TIME}
|
|
|
|
# Light gate: the multi-stage Dockerfile build is slow (UI + full Go build),
|
|
# so `go-build` fails a broken PR fast, before waiting on the full image.
|
|
test:
|
|
- name: go-build
|
|
run: CGO_ENABLED=0 go build ./...
|
|
# The built UI in a browser against ui/smoke/stub.mjs: every page the smoke
|
|
# visits must render with no page error, console error or failed API call.
|
|
# v3.7.3 shipped a bundle that threw at load (withRouter, gone in
|
|
# react-router v7) and served a blank cd.hanzo.ai; this gate fails on it.
|
|
- name: ui-smoke
|
|
run: |
|
|
cd ui
|
|
corepack enable
|
|
pnpm install --frozen-lockfile
|
|
NODE_OPTIONS=--max_old_space_size=8192 pnpm build
|
|
# The runner image bakes browsers under /opt/playwright as root, so the
|
|
# job's own copy goes where the job may write.
|
|
export PLAYWRIGHT_BROWSERS_PATH="$PWD/.cache/ms-playwright"
|
|
pnpm exec playwright install chromium
|
|
pnpm smoke
|
|
|
|
# BUILD-ONLY, deliberately: no `deploy:` block. The live `hanzo-cd` namespace
|
|
# reconciles the whole Hanzo fleet — Hanzo CD IS the delivery mechanism for
|
|
# everything else — so a cutover is a separately-greenlit action, never an
|
|
# auto-deploy on merge. See universe: infra/k8s/hanzo-cd/ for the prepared swap.
|
|
# (Same controlled build-only-first pattern as hanzoai/cms.)
|
|
#
|
|
# The standing consequence, stated so it is a choice and not a surprise: nothing
|
|
# here rolls a new image out. The running engine changes only when someone
|
|
# applies it.
|
|
|
|
# KMS (kms.hanzo.ai, Universal Auth) supplies the GHCR push token at run time.
|
|
# Only KMS_CLIENT_ID/KMS_CLIENT_SECRET live in GitHub; everything else is
|
|
# fetched here.
|
|
kms:
|
|
path: /deploy
|
|
environment: prod
|