Build ghcr.io/hanzoai/flow on the forge

hanzo.yml declares the image and a core Go gate for hanzoai/ci's build.yml,
called from .hanzo/workflows/cicd.yml on every push to main. The image
version is the project version in pyproject.toml, now 1.8.5.

The forge reads the first workflow directory that exists, so security.yml
and storybook.yml move beside cicd.yml and ask for linux-amd64, the label
forge runners advertise.

Co-authored-by: Hanzo Dev <[email protected]>

.hanzo/workflows/cicd.yml

@@ -0,0 +1,11 @@
+name: CI/CD
+
+on:
+  push:
+    branches: [main]
+  workflow_dispatch:
+
+jobs:
+  cicd:
+    uses: hanzoai/ci/.github/workflows/build.yml@v1
+    secrets: inherit

.hanzo/workflows/security.yml

@@ -38,11 +38,10 @@ concurrency:
 
 jobs:
   semgrep:
-    # Must name a label a runner actually advertises. This fleet serves
-    # hanzo-build-linux-amd64 and deliberately offers no ubuntu-* label, so the
-    # `runs-on: ubuntu-latest` these files carried would not have failed — it
-    # would have queued until the timeout. Silence, not an error.
-    runs-on: hanzo-build-linux-amd64
+    # Must name a label a runner actually advertises. Forge runners advertise
+    # linux-amd64 and no ubuntu-* label; a job asking for a label nobody serves
+    # does not fail, it queues until the timeout. Silence, not an error.
+    runs-on: linux-amd64
     timeout-minutes: 20
     steps:
       - uses: actions/checkout@v4

.hanzo/workflows/storybook.yml

@@ -18,8 +18,8 @@ name: storybook
 # created idempotently before the enqueue, so committing this file is enough to
 # stand the site up.
 #
-# THIS IS A SEPARATE FILE FROM .hanzo/workflows/deploy.yml ON PURPOSE. That one
-# builds and pushes ghcr.io/hanzoai/flow — the App the operator runs. An App is
+# THIS IS A SEPARATE FILE FROM cicd.yml ON PURPOSE. That one builds and pushes
+# ghcr.io/hanzoai/flow — the App the cluster runs. An App is
 # a container the cluster executes; a Site is bytes S3 serves. They have
 # different outputs, different triggers and different failure modes, and folding
 # a storybook export into an image build would couple a docs publish to a
@@ -33,7 +33,7 @@ on:
       - 'src/frontend/.storybook/**'
       - 'src/frontend/package.json'
       - 'src/frontend/package-lock.json'
-      - '.github/workflows/storybook.yml'
+      - '.hanzo/workflows/storybook.yml'
   workflow_dispatch:
 
 concurrency:
@@ -42,10 +42,10 @@ concurrency:
 
 jobs:
   site:
-    # NOT ubuntu-latest. These run on the in-cluster act_runner, whose fleet
-    # advertises hanzo-build-linux-amd64. A label no runner answers does not
-    # fail — it queues until the 24h timeout, which is silence, not an error.
-    runs-on: hanzo-build-linux-amd64
+    # NOT ubuntu-latest. Forge runners advertise linux-amd64. A label no runner
+    # answers does not fail — it queues until the 24h timeout, which is silence,
+    # not an error.
+    runs-on: linux-amd64
     timeout-minutes: 30
     steps:
       - uses: actions/checkout@v4

hanzo.yml

@@ -0,0 +1,23 @@
+# Hanzo CI: read by hanzoai/ci's build.yml, which .hanzo/workflows/cicd.yml calls.
+#
+# One image for flow.hanzo.ai: flowweb (core/cmd/flowweb) serves the embedded UI
+# on :8080 and proxies the API to the Python backend on loopback (Dockerfile).
+
+# The image version is the project version in pyproject.toml. The root
+# package.json carries no version, so it is named here.
+version: 'pyproject.toml:sed -n ''s/^version = "\(.*\)"$/\1/p'' pyproject.toml'
+
+images:
+  - name: flow
+    context: .
+    dockerfile: Dockerfile
+    repo: ghcr.io/hanzoai/flow
+
+test:
+  - name: core
+    run: |
+      set -e
+      cd core
+      export GOWORK=off
+      go vet ./...
+      go test -count=1 ./...

pyproject.toml

@@ -1,6 +1,6 @@
 [project]
 name = "hanzo-flow"
-version = "1.8.2"
+version = "1.8.5"
 description = "A Python package with a built-in web application"
 requires-python = ">=3.12,<3.14"
 license = "MIT"

uv.lock

@@ -3250,7 +3250,7 @@ wheels = [
 
 [[package]]
 name = "hanzo-flow"
-version = "1.8.2"
+version = "1.8.5"
 source = { editable = "." }
 dependencies = [
     { name = "hanzo-flow-base", extra = ["complete"] },