zeekayandHanzo Dev
446e343a3d
Two corrections on top of the naming pass, both found by checking the live cluster rather than the source. The rename had silently changed the user-facing annotation key from argocd.argoproj.io/sync-wave to cd.argoproj.io/sync-wave — 63 live Applications carry the old key, so deploying that would have ignored every sync-wave and broken fleet deploy ordering. The key is now cd.hanzo.ai/*, and universe 575650286 moves the ApplicationSet template that stamps it, so the controller regenerates all 63 consistently. The API group in code said argoproj.io/v1alpha1 in 157 places while the cluster has served apps.hanzo.ai/v1alpha1 since 2026-07-23 (the CRDs are applications.apps.hanzo.ai). Code now matches what is actually served. The legacy applications.argoproj.io/app-name label had ZERO live users, so it went with the rest. foo.argoproj.io test fixtures became foo.example.com — arbitrary test domains should not carry a vendor name. go build ./... exit 0. Co-authored-by: Hanzo Dev <[email protected]>
3.2 KiB
Maintaining Internal Hanzo CD Forks
Most Hanzo CD contributors don't need this section to contribute to Hanzo CD. In most cases, the Regular Developer Guide is sufficient.
This section will help companies that need to publish custom Hanzo CD images or publish custom Hanzo CD releases from their forks. Such companies need the below documentation in addition to the Regular Developer Guide. This section will also help Hanzo CD maintainers to test the release process in a test environment.
Understanding where and which upstream images are published
Official upstream release tags (vX.Y.Z*) publish their multi-platform images and the corresponding provenance attestations—to quay.io/argoproj/cd (or whatever registry a fork configures via IMAGE_* variables).
Upstream master builds continue to refresh the latest tag in the same primary registry, while also pushing commit-tagged images (and their provenance) to ghcr.io/argoproj/argo-cd/cd so cd.apps.apps.hanzo.ai can pin exact SHAs.
Forks inherit the same behavior but target their customized registries/namespaces and do not deploy to cd.apps.apps.hanzo.ai.
Publishing custom images from forked master branches
Fork builds can publish their own containers once workflow variables point at your registry/namespace instead of argoproj.
Configuring GitHub Actions variables
Adjust the variables below to match your setup (overriding IMAGE_NAMESPACE is required, because it flips the workflows out of “upstream” mode):
IMAGE_NAMESPACE– defaults toargoproj(overriding required)IMAGE_REPOSITORY– defaults tocd(may need overriding)GHCR_NAMESPACE– defaults to${{ github.repository }}, which translates to<YOUR_GITHUB_USERNAME>/<YOUR_FORK_REPO>, rarely needs overriding)GHCR_REPOSITORY– defaults tocd(may need overriding)
These values produce the final image names:
quay.io/$IMAGE_NAMESPACE/$IMAGE_REPOSITORYghcr.io/$GHCR_NAMESPACE/$GHCR_REPOSITORY
Example: if your GitHub account is my-user, your fork is my-argo-cd-fork, and you want to push release images to quay.io/my-quay-user/cd, configure:
IMAGE_NAMESPACE = my-quay-userYour master build images will then be published toquay.io/my-quay-user/cd:latest, and the commit tagged images along with the attestations will be published under the Packages (GHCR) of your GitHub fork repo.
Configuring GitHub Actions secrets
Supply credentials for your primary registry so the workflow can push:
RELEASE_QUAY_USERNAMERELEASE_QUAY_TOKEN
Enabling fork releases
Forks can run the full release workflow by setting ENABLE_FORK_RELEASES: true, ensuring all upstream tags are fetched (the release tooling needs previous tags for changelog diffs), and reusing the same image variables/secrets listed above so release images push to your custom registry. After that, follow the standard Release Process with one critical adjustment:
Warning
When invoking
hack/trigger-release.sh, point it at your fork remote (usuallyorigin) rather thanupstream, otherwise the script may try to push official tags.
Example:./hack/trigger-release.sh v2.7.2 origin