finance/hanzo.yml

# Canonical CI/CD config for hanzoai/finance — read by both the hanzoai/ci reusable
# workflow (.hanzo/workflows/cicd.yml) and platform.hanzo.ai (webhook →
# BuildScheduler → operator rollout). The "one way" build+deploy contract.
#
# The finance Go core (this repo's umbrella) is EMBEDDED in the unified cloud binary
# (hanzoai/cloud) via the subsystem blank-import pattern — it is NOT a standalone image.
# The ONE deployable artifact here is the product web (finance.hanzo.ai): the landing +
# Hanzo IAM login + the treasury/payments app shell, built from the pnpm workspace
# (web/ consumes the shared @hanzo/finance-ui).

images:
  - name: finance-web
    context: .
    dockerfile: web/Dockerfile
    repo: ghcr.io/hanzoai/finance-web

# No separate `test:` block: the arc runner is bare (no Node), so the image build is the
# SINGLE gate — web/Dockerfile builds the shared package, runs its unit tests, and
# type-checks + builds the Next app, so a failing test / type error fails the build and
# nothing broken deploys. (Same pattern as hanzoai/console: the Dockerfile is the gate.)

# KMS (kms.hanzo.ai, Universal Auth) supplies the GHCR push token + the target
# kubeconfig at run time. Only KMS_CLIENT_ID / KMS_CLIENT_SECRET live in GitHub.
kms:
  path: /deploy
  environment: prod