The forge's KMS identity is granted HANZO_DEPLOY_TOKEN at /deploy only
(hanzoai/universe kms-grants.yaml). deploy.yml published through hanzoai/ci
.github/actions/site@v1, which reads the flat /HANZO_DEPLOY_TOKEN, and KMS
answers that read 403. build.yml@v2 reads the token at /deploy.
- .hanzo/workflows/cicd.yml calls build.yml@v2 with submodules: recursive and
the org's KMS_CLIENT_ID/SECRET, one run per ref at a time, never cancelled.
- hanzo.yml declares site: (slug docs-hanzo-ai, dir apps/docs/out, build
scripts/site.sh, on main) and a test: that runs the docs vitest project
against the packages it imports, built first.
- scripts/site.sh does what deploy.yml did: bun 1.3.11, pnpm install, the
ingest key check, the package build, the export under a memory heartbeat,
check-export.sh and the key grep.
- deploy.yml is removed, so one lane publishes the prefix.
- images: is removed. No route serves the image, and its build_secrets read
PUBLISHABLE_KEY, which this identity is not granted.
Co-authored-by: Hanzo Dev <[email protected]>
