zeekayandHanzo Dev
0b4a9eb8a3
.github/workflows now holds sync.yml alone, carrying refs to git.hanzo.ai; every build runs natively there from .hanzo/workflows. .hanzo/workflows/deploy.yml publishes ghcr.io/hanzoai/hanzo-sh:<sha> and does not deploy — the operator CR in hanzoai/universe names which tag is live. The GitHub Pages workflow it replaces never served this host: Pages reports status null (no build ever succeeded) and hanzo.sh resolves to Cloudflare, where an assets Worker answers. Its two jobs asked for hanzo-build-linux-amd64 and hanzo-deploy-linux-amd64, retired labels nothing answers. public/CNAME goes with it: that file is a Pages control file and means nothing to hanzoai/static. The Dockerfile ends FROM ghcr.io/hanzoai/static:v0.5.1 with dist at /public, and asserts the polyglot before the image exists: dist/index.html must keep its `#!/bin/sh` first line, its `<!DOCTYPE html>`, and parse under bash -n, because `curl hanzo.sh | bash` runs the same bytes the browser renders. Measured: static returns the live 25426-byte polyglot byte-identical as text/html, and the served response still runs the installer under bash. wrangler.toml stays until the image is promoted; removing it first would strand the live host. Co-authored-by: Hanzo Dev <[email protected]>
45 lines
1.5 KiB
YAML
45 lines
1.5 KiB
YAML
name: deploy
|
|
|
|
# Builds hanzo.sh and publishes the image the operator runs. This replaces the
|
|
# GitHub Pages workflow that used to live in .github/workflows: the site is
|
|
# served by hanzoai/static behind hanzoai/ingress, so there is no Pages and no
|
|
# Cloudflare in the path.
|
|
#
|
|
# git.hanzo.ai runs this file natively. The image tag is the run's commit, and
|
|
# the operator CR in hanzoai/universe names which tag is live — a build never
|
|
# deploys itself.
|
|
|
|
on:
|
|
push:
|
|
branches: [main]
|
|
workflow_dispatch:
|
|
|
|
concurrency:
|
|
group: deploy-${{ github.ref }}
|
|
cancel-in-progress: false
|
|
|
|
jobs:
|
|
image:
|
|
runs-on: ubuntu-latest
|
|
timeout-minutes: 30
|
|
steps:
|
|
- uses: actions/checkout@v4
|
|
|
|
- name: build and push
|
|
env:
|
|
REGISTRY_TOKEN: ${{ secrets.REGISTRY_TOKEN }}
|
|
run: |
|
|
set -euo pipefail
|
|
if [ -z "${REGISTRY_TOKEN:-}" ]; then
|
|
echo "::error::REGISTRY_TOKEN is unset, so nothing was published. Add the org secret."
|
|
exit 1
|
|
fi
|
|
tag="$(git rev-parse --short HEAD)"
|
|
image="ghcr.io/hanzoai/hanzo-sh:${tag}"
|
|
echo "${REGISTRY_TOKEN}" | docker login ghcr.io -u hanzo-dev --password-stdin
|
|
# The Dockerfile asserts the polyglot contract, so a build that reaches
|
|
# push has already proved `curl hanzo.sh | bash` still parses.
|
|
docker build -t "${image}" .
|
|
docker push "${image}"
|
|
echo "published ${image} — set spec.image.tag in universe crs/hanzo-sh.yaml to ${tag}"
|