Files
zeekayandHanzo Dev 6da7d59e14 the runner publishes this, not a laptop
Both releases so far went to npmjs from a developer machine. hanzoai/ui states
the rule plainly -- publish.yml on a version change is the only thing allowed to
reach npmjs -- and this repo had no way to honour it because it had neither a
gate nor a workflow.

The publish job asks the REGISTRY whether it is behind, rather than reading the
previous commit or filtering on paths. Both of those guess, and hanzoai/ui lost
a release to each: a path gate that could not re-run the lockfile fix that
repaired it, and a merge whose first parent already carried the bump. Forward
only, so a revert cannot walk the registry backwards.

The gate is `node --check`, and that is the honest whole of it. There is no
build here: src/control.js is served to a browser byte-for-byte, so a syntax
error reaches every embedding site at once and reads as a widget that silently
never mounts.

Co-authored-by: Hanzo Dev <[email protected]>
2026-08-16 13:40:11 -07:00

16 lines
850 B
YAML

# Canonical CI config for hanzoai/control — the one file ci.hanzo.ai reads.
#
# GATE ONLY, and no `images:`. This repo ships one dependency-free file to npm;
# the sites that use it copy those bytes into their own `public/` at install and
# before build (hanzo.app does this today), so there is nothing here to put in a
# container and no second place a version could come from.
#
# The gate is what the artifact actually has to survive. There is no build step
# and no bundler: `src/control.js` is served to a browser byte-for-byte, which
# means a syntax error reaches every embedding site at once and shows up as a
# widget that silently never mounts. `node --check` is the whole contract that
# matters here, and it is honest about being that rather than dressed up as a
# test suite that asserts nothing.
test:
- node --check src/control.js