mirror of
https://github.com/hanzoai/ci.git
synced 2026-10-30 07:51:36 +00:00
zeekayandHanzo Dev
4a839ebf48
A caller in .github/workflows is scheduled by github.com, which has no runner for the hanzo-build-* labels, so every push left a queued or startup_failure run there while the forge ran the real one. Two planes, one gate, and the GitHub half can never finish. The forge reads .hanzo/workflows and .github/workflows both, so a caller here is scheduled by exactly one plane. The reusable it calls stays at hanzoai/ci/.github/workflows/build.yml, the one path github.com and the forge can both resolve. Co-authored-by: Hanzo Dev <[email protected]>
47 lines
2.4 KiB
YAML
47 lines
2.4 KiB
YAML
name: CI/CD
|
|
# The gate for hanzoai/ci itself, on our own runners against git.hanzo.ai.
|
|
#
|
|
# THE LAW: `.github/workflows` does not exist; everything that gates or builds
|
|
# lives here. All real config is the repo-root hanzo.yml — this file is the
|
|
# ~7-line caller, exactly like cloud/commerce/console/git.
|
|
#
|
|
# Self-referential on purpose: this repo's dashboard image is built by this
|
|
# repo's own reusable pipeline, pinned at the last RELEASE tag rather than at the
|
|
# working tree. That pin is what keeps a broken edit to build.yml from also
|
|
# breaking the build that would have caught it — it moves only when a release is
|
|
# cut, and moving it here is what proves that release before the fleet's @v1
|
|
# follows. Named as a role, not a number: the prose said @v2 while the pin below
|
|
# read @v1, because a version written into a sentence goes stale on the next one.
|
|
on:
|
|
push:
|
|
branches: [main]
|
|
# A v* tag is what produces a published, immutable image tag (branch pushes
|
|
# only ever yield sha-<sha7>). Without this trigger a release tag builds
|
|
# nothing at all and the CR has no version to pin.
|
|
tags: ['v*']
|
|
pull_request:
|
|
workflow_dispatch:
|
|
# Keyed on the COMMIT, not the ref. A push to main, a v* tag on that same
|
|
# commit and a pull request for it are three refs and were three groups, so one
|
|
# commit built three times at once and the runs raced to publish the image tag
|
|
# this pipeline calls immutable. What must not overlap is "everything that
|
|
# produces this artifact", and the artifact is a function of the commit.
|
|
#
|
|
# Not cancel-in-progress: a build is not made irrelevant by a newer commit — it
|
|
# is producing that commit's own immutable tag, and killing it loses the
|
|
# artifact rather than saving work.
|
|
concurrency:
|
|
group: cicd-${{ github.sha }}
|
|
cancel-in-progress: false
|
|
jobs:
|
|
gate:
|
|
uses: hanzoai/ci/.github/workflows/build.yml@v2
|
|
# buildx, because that is what this repo's image can be built by today.
|
|
# `mode: delegate` was measured here on this pin (run 338): the build door
|
|
# answers 403 to the identity a build holds, since its identity path admits
|
|
# an ADMIN of the org and a client-credentials principal is neither a member
|
|
# nor, by cloud's own denial, an admin. The lane presents the right thing and
|
|
# the door has to admit it; until it does, delegating here would only stop
|
|
# this repo's image from being built.
|
|
secrets: inherit
|