mirror of
https://github.com/hanzoai/sign.git
synced 2026-10-21 01:21:51 +00:00
zeekay
c1c95628bb
The purpose-prefixed labels (hanzo-build-*, hanzo-deploy-*, hanzo-docs-build-*) are retired in favour of the bare <os>-<arch> every runner already advertises. They were not a capability, only a habit, and the habit cost builds: papers asked for hanzo-build-linux-amd64, no online runner offered it, and two idle linux-amd64 runners sat beside the queue while the build simply never ran. The lux tree lost three days to lux-linux-amd64 the same way. What a job is FOR is the workflow's name. runs-on is the machine it needs.
65 lines
2.4 KiB
YAML
65 lines
2.4 KiB
YAML
# Build the image and push it. Nothing else.
|
|
#
|
|
# The previous pipeline called buildctl-daemonless.sh, absent from the job image
|
|
# (catthehacker/ubuntu:act-24.04) — exit 127 — and read secrets.GIT_CLONE_TOKEN,
|
|
# which exists nowhere. It had never produced an image.
|
|
#
|
|
# TARGET: this repo has FIVE Dockerfiles (apps/remix/{Dockerfile,.bun,.pnpm},
|
|
# docker/{Dockerfile,.chromium}). docker/Dockerfile is the app image — it is the
|
|
# multi-stage node:22-alpine build that `COPY . .` from the repo root, and the
|
|
# cluster runs ghcr.io/hanzoai/sign:0.1.0, so that is the name it owes.
|
|
# NOTE the image is `sign`, not `esign`: the GitHub repo was renamed (hanzoai/sign
|
|
# 307s to hanzoai/esign) but the published image name did not follow.
|
|
#
|
|
# No deploy step: kubectl is absent from the job image, and cd.hanzo.ai selfHeal
|
|
# restores the App CR from the reviewed pin in hanzoai/universe within minutes.
|
|
name: deploy
|
|
on:
|
|
push:
|
|
branches: [main]
|
|
workflow_dispatch:
|
|
|
|
concurrency:
|
|
group: deploy-esign-${{ github.ref }}
|
|
cancel-in-progress: true
|
|
|
|
jobs:
|
|
build:
|
|
runs-on: [linux-amd64]
|
|
steps:
|
|
- uses: actions/checkout@v4
|
|
|
|
- id: meta
|
|
run: echo "tag=sha-$(echo "$GITHUB_SHA" | cut -c1-7)" >> "$GITHUB_OUTPUT"
|
|
|
|
- uses: docker/setup-buildx-action@v3
|
|
with: { driver: docker-container, driver-opts: network=host }
|
|
|
|
- uses: docker/login-action@v3
|
|
with:
|
|
registry: ghcr.io
|
|
username: ${{ secrets.GHCR_USER }}
|
|
password: ${{ secrets.GHCR_TOKEN }}
|
|
|
|
- uses: docker/build-push-action@v6
|
|
with:
|
|
context: .
|
|
file: ./docker/Dockerfile
|
|
platforms: linux/amd64
|
|
push: true
|
|
provenance: false
|
|
# No `secrets:`. docker/Dockerfile is Node all the way down and mounts
|
|
# nothing, and this repo's go.mod requires no module at all — so the
|
|
# credential was reaching a build that had nothing to fetch with it.
|
|
tags: ghcr.io/hanzoai/sign:${{ steps.meta.outputs.tag }}
|
|
|
|
- name: Verify the pushed image resolves
|
|
run: |
|
|
set -euo pipefail
|
|
img="ghcr.io/hanzoai/sign:${{ steps.meta.outputs.tag }}"
|
|
for i in 1 2 3 4 5 6; do
|
|
docker buildx imagetools inspect "$img" >/dev/null 2>&1 && { echo "resolved $img"; exit 0; }
|
|
sleep 5
|
|
done
|
|
echo "::error::pushed image never resolved: $img"; exit 1
|