mirror of
https://github.com/hanzo-docs/docs.git
synced 2026-10-24 20:09:02 +00:00
zooqueenandHanzo Dev
5e3dac2a12
The forge's KMS identity is granted HANZO_DEPLOY_TOKEN at /deploy only (hanzoai/universe kms-grants.yaml). deploy.yml published through hanzoai/ci .github/actions/site@v1, which reads the flat /HANZO_DEPLOY_TOKEN, and KMS answers that read 403. build.yml@v2 reads the token at /deploy. - .hanzo/workflows/cicd.yml calls build.yml@v2 with submodules: recursive and the org's KMS_CLIENT_ID/SECRET, one run per ref at a time, never cancelled. - hanzo.yml declares site: (slug docs-hanzo-ai, dir apps/docs/out, build scripts/site.sh, on main) and a test: that runs the docs vitest project against the packages it imports, built first. - scripts/site.sh does what deploy.yml did: bun 1.3.11, pnpm install, the ingest key check, the package build, the export under a memory heartbeat, check-export.sh and the key grep. - deploy.yml is removed, so one lane publishes the prefix. - images: is removed. No route serves the image, and its build_secrets read PUBLISHABLE_KEY, which this identity is not granted. Co-authored-by: Hanzo Dev <[email protected]>
36 lines
1.6 KiB
YAML
36 lines
1.6 KiB
YAML
# CI config for hanzo-docs/docs, read by hanzoai/ci build.yml (called from
|
|
# .hanzo/workflows/cicd.yml on git.hanzo.ai). It ships one thing: the static
|
|
# export of apps/docs, published to the Sites plane and served at docs.hanzo.ai.
|
|
# RELEASE.md has the whole path.
|
|
|
|
test:
|
|
- name: docs
|
|
# The vitest project for apps/docs, against the workspace packages it
|
|
# imports, built first because their package exports resolve to dist/. It
|
|
# pins the surfaces the site prints: the SDK method names (openapi-
|
|
# generator's own derivation) and the MCP tool names, asserted against real
|
|
# generated clients and a real tools/list answer, plus the CLI commands and
|
|
# models the first-call pages name. A drift in any of them fails here rather
|
|
# than teaching a call that does not exist.
|
|
run: >-
|
|
pnpm install --frozen-lockfile &&
|
|
pnpm turbo run build --filter='docs^...' &&
|
|
pnpm vitest run --project docs
|
|
|
|
# The publish. hanzoai/ci runs `build` on its publish job, a fresh runner, after
|
|
# `test` is green, then uploads `dir` as Sites project `slug`: prefix
|
|
# s3://hanzo-sites/hanzo/docs-hanzo-ai, which the docs.hanzo.ai route serves.
|
|
# The project is named for its host because `docs` is a reserved label on the
|
|
# Sites plane (cloud apps/sites/reserved.go). scripts/site.sh installs, builds
|
|
# and checks the export; the checkout carries the submodules it needs
|
|
# (cicd.yml passes submodules: recursive).
|
|
site:
|
|
slug: docs-hanzo-ai
|
|
dir: apps/docs/out
|
|
build: bash scripts/site.sh
|
|
on: [main]
|
|
|
|
# The KMS tenant the publish job reads its deploy token from.
|
|
kms:
|
|
org: hanzo
|