mirror of
https://github.com/hanzo-docs/docs.git
synced 2026-10-29 07:01:44 +00:00
zooqueen
955973b922
apps/bootnode-docs builds as `build:pre && next build && build:post`, and both hooks are `bun ./scripts/*.ts`. This lane never installed bun, so the build died as soon as pnpm reached the first hook. Of the nine sibling deploys, six build apps that need bun and eight install it; bootnode is the only bun-needing one that did not, and it is one of the two that have never gone green. On 2026-08-16T17:13 all nine fired on one commit, same runner and same secrets, and the six with bun succeeded.
75 lines
3.1 KiB
YAML
75 lines
3.1 KiB
YAML
name: Deploy Bootnode Docs
|
|
|
|
on:
|
|
push:
|
|
branches: [main]
|
|
paths:
|
|
- 'apps/bootnode-docs/**'
|
|
- 'packages/**'
|
|
- '.hanzo/workflows/deploy-bootnode-docs.yml'
|
|
workflow_dispatch:
|
|
|
|
jobs:
|
|
deploy:
|
|
runs-on: hanzo-docs-build-linux-amd64
|
|
permissions:
|
|
contents: read
|
|
deployments: write
|
|
steps:
|
|
- uses: actions/checkout@v4
|
|
- uses: pnpm/action-setup@v4
|
|
- uses: actions/setup-node@v4
|
|
with:
|
|
node-version: 22
|
|
cache: pnpm
|
|
# apps/bootnode-docs runs its build:pre and build:post hooks under bun.
|
|
- uses: oven-sh/setup-bun@v2
|
|
- run: pnpm install --frozen-lockfile
|
|
- run: pnpm build --filter bootnode-docs
|
|
|
|
- name: Fetch CF credentials from KMS
|
|
id: kms
|
|
env:
|
|
KMS_CLIENT_ID: ${{ secrets.KMS_CLIENT_ID }}
|
|
KMS_CLIENT_SECRET: ${{ secrets.KMS_CLIENT_SECRET }}
|
|
KMS_ENDPOINT: ${{ vars.KMS_ENDPOINT || 'https://kms.hanzo.ai' }}
|
|
KMS_SECRET_ENV: ${{ vars.KMS_SECRET_ENV || 'prod' }}
|
|
run: |
|
|
# Canonical Hanzo KMS (/v1/kms): machine-identity login -> bearer,
|
|
# then read CF Pages deploy creds from deploy/<NAME>.
|
|
#
|
|
# FLAT path, and the org rides on the TOKEN. The older
|
|
# /v1/kms/orgs/<org>/secrets/... form is answered by a DIFFERENT
|
|
# instance whose copy is stale, and it nests the value under
|
|
# .secret.value -- so this step read the wrong service and failed
|
|
# closed. deploy.yml in this repo has always used the flat form.
|
|
# Replaces the decommissioned Infisical /api routes (forwards-only).
|
|
token=$(curl -fsS "${KMS_ENDPOINT}/v1/kms/auth/login" \
|
|
-H 'Content-Type: application/json' \
|
|
-d "{\"clientId\":\"${KMS_CLIENT_ID}\",\"clientSecret\":\"${KMS_CLIENT_SECRET}\"}" \
|
|
| jq -r '.accessToken // empty')
|
|
if [ -z "${token}" ]; then
|
|
echo "::error::KMS login failed at ${KMS_ENDPOINT}/v1/kms/auth/login (check KMS_CLIENT_ID/KMS_CLIENT_SECRET)."
|
|
exit 1
|
|
fi
|
|
kms_get() {
|
|
curl -fsS "${KMS_ENDPOINT}/v1/kms/secrets/deploy/$1?env=${KMS_SECRET_ENV}" \
|
|
-H "Authorization: Bearer ${token}" | jq -r '.value // empty'
|
|
}
|
|
cf_token=$(kms_get CLOUDFLARE_API_TOKEN)
|
|
cf_account=$(kms_get CLOUDFLARE_ACCOUNT_ID)
|
|
if [ -z "${cf_token}" ] || [ -z "${cf_account}" ]; then
|
|
echo "::error::No CLOUDFLARE_API_TOKEN/CLOUDFLARE_ACCOUNT_ID at ${KMS_ENDPOINT}/v1/kms/secrets/deploy (env ${KMS_SECRET_ENV})."
|
|
exit 1
|
|
fi
|
|
echo "::add-mask::${cf_token}"
|
|
echo "::add-mask::${cf_account}"
|
|
echo "cf_token=${cf_token}" >> "$GITHUB_OUTPUT"
|
|
echo "cf_account=${cf_account}" >> "$GITHUB_OUTPUT"
|
|
|
|
- name: Deploy to Cloudflare Pages
|
|
run: npx wrangler pages deploy apps/bootnode-docs/out --project-name=bootnode-docs --commit-dirty=true
|
|
env:
|
|
CLOUDFLARE_API_TOKEN: ${{ steps.kms.outputs.cf_token }}
|
|
CLOUDFLARE_ACCOUNT_ID: ${{ steps.kms.outputs.cf_account }}
|