esign/hanzo.yml

# Hanzo eSign — a turborepo whose deployable artifact is the remix app.
#
# Gate only. The image is already built and pushed by the native builder in this
# repo (.hanzo/workflows/deploy.yml → ghcr.io/hanzoai/sign:<tag>), so declaring
# `images:` here would publish a second copy of the same commit.
#
# The gate is the real build of the app the cluster runs: npm ci against the
# committed lockfile (postinstall generates the Prisma client), then turbo's
# build of @hanzo/esign-remix, which type-checks every workspace package it
# depends on. A type error anywhere under packages/ fails here.
#
# `lint:paths` runs before install: it needs no dependencies and fails the gate
# the moment a first-party /api path is served or called (every route is /v1).
#
# `lint:tx` runs next because it takes seconds and answers a question the build
# cannot: whether anything inside a `$transaction` reaches the global Prisma
# client. Base SQLite serves one write connection, so such a call waits on a
# lock the transaction holds and the transaction dies (`P2028`) — at runtime,
# with a green build. See packages/eslint-config/transaction.cjs.
test:
  - name: build
    run: |
      set -euo pipefail
      node scripts/lint-paths.mjs
      npm ci --no-audit --no-fund
      npm run lint:tx
      npx turbo run build --filter=@hanzo/esign-remix