mirror of
https://github.com/hanzo-docs/docs.git
synced 2026-10-24 20:09:02 +00:00
zooqueenandHanzo Dev
5e3dac2a12
The forge's KMS identity is granted HANZO_DEPLOY_TOKEN at /deploy only (hanzoai/universe kms-grants.yaml). deploy.yml published through hanzoai/ci .github/actions/site@v1, which reads the flat /HANZO_DEPLOY_TOKEN, and KMS answers that read 403. build.yml@v2 reads the token at /deploy. - .hanzo/workflows/cicd.yml calls build.yml@v2 with submodules: recursive and the org's KMS_CLIENT_ID/SECRET, one run per ref at a time, never cancelled. - hanzo.yml declares site: (slug docs-hanzo-ai, dir apps/docs/out, build scripts/site.sh, on main) and a test: that runs the docs vitest project against the packages it imports, built first. - scripts/site.sh does what deploy.yml did: bun 1.3.11, pnpm install, the ingest key check, the package build, the export under a memory heartbeat, check-export.sh and the key grep. - deploy.yml is removed, so one lane publishes the prefix. - images: is removed. No route serves the image, and its build_secrets read PUBLISHABLE_KEY, which this identity is not granted. Co-authored-by: Hanzo Dev <[email protected]>
32 lines
1.1 KiB
YAML
32 lines
1.1 KiB
YAML
name: CI/CD
|
|
|
|
# Tests and publishes docs.hanzo.ai through hanzoai/ci, which reads hanzo.yml:
|
|
# `test:` must pass, then `site:` builds apps/docs/out and publishes it to the
|
|
# Sites plane. It runs on git.hanzo.ai (hanzoai/docs, a pull mirror of this
|
|
# repo) with that org's KMS identity. RELEASE.md has the whole path.
|
|
|
|
on:
|
|
push:
|
|
branches: [main]
|
|
workflow_dispatch:
|
|
|
|
# One publish at a time, and a push waits for the running one rather than
|
|
# cancelling it: completing a deployment deletes the objects its manifest does
|
|
# not name, so two publishes at once would each delete the other's files.
|
|
# git.hanzo.ai applies this group to the run; it does not apply the reusable's
|
|
# own job-level group.
|
|
concurrency:
|
|
group: cicd-${{ github.ref }}
|
|
cancel-in-progress: false
|
|
|
|
jobs:
|
|
cicd:
|
|
uses: hanzoai/ci/.github/workflows/build.yml@v2
|
|
with:
|
|
# apps/docs/content/docs/studio is a submodule (hanzo-docs/studio-docs);
|
|
# scripts/check-export.sh refuses an export without its pages.
|
|
submodules: recursive
|
|
secrets:
|
|
KMS_CLIENT_ID: ${{ secrets.KMS_CLIENT_ID }}
|
|
KMS_CLIENT_SECRET: ${{ secrets.KMS_CLIENT_SECRET }}
|