mirror of
https://github.com/hanzo-docs/docs.git
synced 2026-10-29 07:01:44 +00:00
zooqueen
5eaeb34449
All nine deploy-*.yml list '.github/workflows/<self>.yml' in their paths filter, but they live in .hanzo/workflows/ — the forge is what reads them and .github/workflows/ is empty. So editing one of these lanes could never re-run it, and a fix to a lane sat on main waiting for an unrelated change to apps/** to carry it. That is what happened to the KMS path correction: it landed, and the seven red CF Pages deploys stayed red on the commit before it, because nothing they watch had moved. Same defect the release lane already hit and recorded — ".hanzo/workflows was missing here since the .gitea move, so workflow edits were cutting no-op images." Nine more of them.
87 lines
3.3 KiB
YAML
87 lines
3.3 KiB
YAML
name: Deploy Cloud Landing Page
|
|
|
|
on:
|
|
push:
|
|
branches: [main, dev]
|
|
paths:
|
|
- 'apps/cloud/**'
|
|
- 'packages/**'
|
|
- 'pnpm-lock.yaml'
|
|
- '.hanzo/workflows/deploy-cloud.yml'
|
|
workflow_dispatch:
|
|
|
|
jobs:
|
|
deploy:
|
|
runs-on: hanzo-docs-build-linux-amd64
|
|
permissions:
|
|
contents: read
|
|
deployments: write
|
|
steps:
|
|
- uses: actions/checkout@v4
|
|
|
|
- uses: pnpm/action-setup@v4
|
|
|
|
- uses: actions/setup-node@v4
|
|
with:
|
|
node-version: 22
|
|
cache: pnpm
|
|
|
|
- run: pnpm install --frozen-lockfile
|
|
|
|
- run: pnpm --filter @hanzo/cloud build
|
|
env:
|
|
NODE_OPTIONS: '--max-old-space-size=8192'
|
|
|
|
- name: Create Cloudflare Pages project (if needed)
|
|
continue-on-error: true
|
|
run: npx wrangler pages project create cloud-site --production-branch=main
|
|
env:
|
|
CLOUDFLARE_API_TOKEN: ${{ steps.kms.outputs.cf_token }}
|
|
CLOUDFLARE_ACCOUNT_ID: ${{ steps.kms.outputs.cf_account }}
|
|
|
|
- name: Fetch CF credentials from KMS
|
|
id: kms
|
|
env:
|
|
KMS_CLIENT_ID: ${{ secrets.KMS_CLIENT_ID }}
|
|
KMS_CLIENT_SECRET: ${{ secrets.KMS_CLIENT_SECRET }}
|
|
KMS_ENDPOINT: ${{ vars.KMS_ENDPOINT || 'https://kms.hanzo.ai' }}
|
|
KMS_SECRET_ENV: ${{ vars.KMS_SECRET_ENV || 'prod' }}
|
|
run: |
|
|
# Canonical Hanzo KMS (/v1/kms): machine-identity login -> bearer,
|
|
# then read CF Pages deploy creds from deploy/<NAME>.
|
|
#
|
|
# FLAT path, and the org rides on the TOKEN. The older
|
|
# /v1/kms/orgs/<org>/secrets/... form is answered by a DIFFERENT
|
|
# instance whose copy is stale, and it nests the value under
|
|
# .secret.value -- so this step read the wrong service and failed
|
|
# closed. deploy.yml in this repo has always used the flat form.
|
|
# Replaces the decommissioned Infisical /api routes (forwards-only).
|
|
token=$(curl -fsS "${KMS_ENDPOINT}/v1/kms/auth/login" \
|
|
-H 'Content-Type: application/json' \
|
|
-d "{\"clientId\":\"${KMS_CLIENT_ID}\",\"clientSecret\":\"${KMS_CLIENT_SECRET}\"}" \
|
|
| jq -r '.accessToken // empty')
|
|
if [ -z "${token}" ]; then
|
|
echo "::error::KMS login failed at ${KMS_ENDPOINT}/v1/kms/auth/login (check KMS_CLIENT_ID/KMS_CLIENT_SECRET)."
|
|
exit 1
|
|
fi
|
|
kms_get() {
|
|
curl -fsS "${KMS_ENDPOINT}/v1/kms/secrets/deploy/$1?env=${KMS_SECRET_ENV}" \
|
|
-H "Authorization: Bearer ${token}" | jq -r '.value // empty'
|
|
}
|
|
cf_token=$(kms_get CLOUDFLARE_API_TOKEN)
|
|
cf_account=$(kms_get CLOUDFLARE_ACCOUNT_ID)
|
|
if [ -z "${cf_token}" ] || [ -z "${cf_account}" ]; then
|
|
echo "::error::No CLOUDFLARE_API_TOKEN/CLOUDFLARE_ACCOUNT_ID at ${KMS_ENDPOINT}/v1/kms/secrets/deploy (env ${KMS_SECRET_ENV})."
|
|
exit 1
|
|
fi
|
|
echo "::add-mask::${cf_token}"
|
|
echo "::add-mask::${cf_account}"
|
|
echo "cf_token=${cf_token}" >> "$GITHUB_OUTPUT"
|
|
echo "cf_account=${cf_account}" >> "$GITHUB_OUTPUT"
|
|
|
|
- name: Deploy to Cloudflare Pages
|
|
run: npx wrangler pages deploy apps/cloud/out --project-name=cloud-site --commit-dirty=true
|
|
env:
|
|
CLOUDFLARE_API_TOKEN: ${{ steps.kms.outputs.cf_token }}
|
|
CLOUDFLARE_ACCOUNT_ID: ${{ steps.kms.outputs.cf_account }}
|