Claude
4585a1ae49
The deploy job asked for `ubuntu-latest`. This file lives in .hanzo/workflows, which GitHub never reads -- git.hanzo.ai is the only thing that can run it, and the fleet advertises no generic ubuntu-* label. That is deliberate and recorded in the runner ConfigMap: ~1400 mirrored upstream forks all ask for ubuntu-latest, and the forge errors rather than skipping a job it cannot place, so one bad job was retried ~520 times across 10 runners. An unmatched label is not a failure here, it is silence -- the job queues until the 24h timeout. So this deploy has never produced an image, and nothing ever said so. Same class as the playground regression, found by checking every .hanzo/workflows file against the labels the runner ConfigMap actually declares rather than against the ones I assumed. hanzo-build-linux-amd64 is registered (verified against cm/git-runner-config). Co-Authored-By: Claude Opus 5 (1M context) <[email protected]>
52 lines
2.0 KiB
YAML
52 lines
2.0 KiB
YAML
name: deploy
|
|
|
|
# Builds hanzo.sh and publishes the image the operator runs. This replaces the
|
|
# GitHub Pages workflow that used to live in .github/workflows: the site is
|
|
# served by hanzoai/static behind hanzoai/ingress, so there is no Pages and no
|
|
# Cloudflare in the path.
|
|
#
|
|
# git.hanzo.ai runs this file natively. The image tag is the run's commit, and
|
|
# the operator CR in hanzoai/universe names which tag is live — a build never
|
|
# deploys itself.
|
|
|
|
on:
|
|
push:
|
|
branches: [main]
|
|
workflow_dispatch:
|
|
|
|
concurrency:
|
|
group: deploy-${{ github.ref }}
|
|
cancel-in-progress: false
|
|
|
|
jobs:
|
|
image:
|
|
# hanzo-build-linux-amd64, not ubuntu-latest. This file lives in
|
|
# .hanzo/workflows, which GitHub never reads -- git.hanzo.ai is the only
|
|
# thing that can run it, and the fleet deliberately advertises no generic
|
|
# ubuntu-* label (~1400 mirrored forks all ask for it; one bad job was
|
|
# retried ~520 times across 10 runners). An unmatched label is not an
|
|
# error here, it is silence: the job queues until the 24h timeout, so this
|
|
# deploy has never produced an image and nothing ever said so.
|
|
runs-on: hanzo-build-linux-amd64
|
|
timeout-minutes: 30
|
|
steps:
|
|
- uses: actions/checkout@v4
|
|
|
|
- name: build and push
|
|
env:
|
|
REGISTRY_TOKEN: ${{ secrets.REGISTRY_TOKEN }}
|
|
run: |
|
|
set -euo pipefail
|
|
if [ -z "${REGISTRY_TOKEN:-}" ]; then
|
|
echo "::error::REGISTRY_TOKEN is unset, so nothing was published. Add the org secret."
|
|
exit 1
|
|
fi
|
|
tag="$(git rev-parse --short HEAD)"
|
|
image="ghcr.io/hanzoai/hanzo-sh:${tag}"
|
|
echo "${REGISTRY_TOKEN}" | docker login ghcr.io -u hanzo-dev --password-stdin
|
|
# The Dockerfile asserts the polyglot contract, so a build that reaches
|
|
# push has already proved `curl hanzo.sh | bash` still parses.
|
|
docker build -t "${image}" .
|
|
docker push "${image}"
|
|
echo "published ${image} — set spec.image.tag in universe crs/hanzo-sh.yaml to ${tag}"
|