mirror of
https://github.com/hanzoai/compute.git
synced 2026-10-30 14:50:41 +00:00
zeekayandHanzo Dev
1331f41eae
GOTOOLCHAIN=auto landed in build.sh in v1.108.17. Move it to ENV in the BACK stage: one mechanism, the same one the rest of the Go builders use, and it covers every go command in the stage rather than only the ones build.sh runs. The Dockerfile is also what a base-image gate can read. Outside a container Go already defaults to auto, so build.sh needs no export of its own. The base image stays on ghcr.io/hanzoai/golang:1.26-alpine. An anonymous puller gets HTTP 403 and zero listable tags, which looks like a dead mirror and has now been read that way twice. It is not: golang, alpine and guacd are private packages, so GHCR refuses to mint an anonymous scope token, while the public hanzoai/node and hanzoai/visor do mint one — that asymmetry is the tell. The builder authenticates with the org-level GH_PAT and a real BuildKit run reached [back 6/6], past every FROM. The tag is left floating rather than pinned because the mirror's tag list cannot be enumerated without read:packages, so pinning to a patch nobody can confirm exists would trade a working build for a manifest-unknown failure. GOTOOLCHAIN=auto is what makes a floating base tag safe. LLM.md records the private-vs-absent distinction so the 403 is not misdiagnosed a third time. Co-authored-by: Hanzo Dev <[email protected]>
20 lines
1.0 KiB
Bash
20 lines
1.0 KiB
Bash
#!/bin/bash
|
|
set -e
|
|
|
|
# Private Hanzo modules (e.g. github.com/hanzoai/commerce/metering) live in
|
|
# private repos; go-mod's direct git fetch is authenticated with the BuildKit
|
|
# BuildKit secret gh_token, mounted at /run/secrets/gh_token by the Dockerfile
|
|
# (RUN --mount=type=secret,id=gh_token). GOPRIVATE routes those modules
|
|
# direct-to-git (never through a public proxy).
|
|
export GOPRIVATE="github.com/hanzoai,github.com/lux-private,github.com/zooai,github.com/zenlm,github.com/parsdao,github.com/adnexustech"
|
|
if [ -f /run/secrets/gh_token ]; then
|
|
git config --global url."https://x-access-token:$(cat /run/secrets/gh_token)@github.com/".insteadOf "https://github.com/"
|
|
fi
|
|
export GOPROXY="${GOPROXY:-https://proxy.golang.org,direct}"
|
|
|
|
# GOTOOLCHAIN is set by the Dockerfile (ENV GOTOOLCHAIN=auto in the BACK stage),
|
|
# which is where every other Hanzo Go builder sets it. Outside a container Go
|
|
# already defaults to auto, so this script needs no export of its own.
|
|
|
|
CGO_ENABLED=0 GOOS=linux GOARCH=${TARGETARCH:-amd64} go build -ldflags="-w -s" -o visor .
|