helpdesk's after_migrate hook downloads the tagger, punkt_tab and brown
corpora when they are missing from the container. The image now holds
them, so a boot runs migrate without a network download.
Co-authored-by: Hanzo Dev <[email protected]>
Frappe refuses the telemetry switch to guests, so a guest opening the
Help Center no longer sends a request that answers 403.
Co-authored-by: Hanzo Dev <[email protected]>
gunicorn runs frappe.app with /assets and /files served in process, two
gthread workers as frappe_docker runs it. The Werkzeug debugger and
reloader are no longer in the request path. Frappe resolves the site from
the Host header.
Co-authored-by: Hanzo Dev <[email protected]>
The Frappe core (hanzoai/frappe) and telephony are fetched by commit from
GitHub, and helpdesk comes from the build context, so the build needs no
credential and the image holds exactly the commit it is named for.
hanzo.yml declares the amd64 image for the shared ci workflow, which the
develop push lane now calls at its .github path; the docker-action lane and
its GitHub notice are gone.
Co-authored-by: Hanzo Dev <[email protected]>
The build ended at ghcr.io/hanzoai/helpdesk:sha-<sha7> and stopped. A sha cannot
be read, ordered, or rolled back to by a human, and nothing moved the universe
pin afterward, so every build since 1.26.6 published bytes production had no way
to reach.
The next patch now comes from the REGISTRY, not from `git tag`: what is
published is the only authority on what has been used, and the tag is proven
unused (a 404 manifest probe) before anything is pushed. After the image is
proven to resolve, the run reads UNIVERSE_PIN_TOKEN from KMS and calls
charts/app/pin.sh, which resolves the tag and digest in one registry read and
refuses a non-semver version, an unpullable image, a rollback, or a repository
the caller chose.
The service is `help` — pin.sh resolves values/*/<service>.yaml and reads
image.repository out of the file it finds. Tags here are bare x.y.z, no leading
v, so the match is anchored to keep `stable`, `main` and `sha-*` out of the
ordering.
Still one build per commit: /hanzo.yml declares no `images:` on purpose, and
bench keeps its forge credential for the Frappe core clone.
The desk SPA's titles, marks and install icons come from this repo's own
source, so they change here: the shell title and apple title, the PWA
manifest name, the sidebar and welcome-ticket copy, the fallback logo
component, the SPA favicon and the 180/192/512 install icons.
The login page, navbar, footer and favicon are rendered by the Frappe core,
which reads those marks from Website Settings / Navbar Settings / System
Settings at run time. helpdesk/brand.py writes them and the entrypoint runs
it per site on every boot, next to the SSO setup. Each field is set to a
constant and guarded on the field existing, so a boot against a site that
already exists restores the same values instead of failing.
The marks are served from this app's own public directory
(helpdesk/public -> /assets/helpdesk), so no page reaches a third-party host
for a logo.
The previous commit moved both Hanzo clones to the forge on the strength
of an anonymous ls-remote that only succeeded because the machine running
it had forge credentials cached. It does not serve anonymously:
git ls-remote --heads --tags https://git.hanzo.ai/hanzoai/frappe develop
fatal: could not read Username for 'https://git.hanzo.ai'
So supply one. A credential helper reads the token from the BuildKit
mount, and the two RUNs that clone from the forge mount it; the secret
never lands in a layer. Public remotes never reach the helper, because
git only asks when the server challenges it.
The token is the run's own GITHUB_TOKEN. If that turns out to be scoped
too narrowly to read hanzoai/frappe from hanzoai/helpdesk, the fix is to
point `forge=` at an org-level forge token — the Dockerfile side does not
change.
Every image build died in bench init:
git ls-remote --heads --tags https://github.com/hanzoai/frappe develop
fatal: could not read Username for 'https://github.com'
bench.exceptions.InvalidRemoteException: Invalid frappe path
github.com/hanzoai/frappe answers "Repository not found" to an anonymous
clone — the repo moved off that org and the build had no credentials for
it. git.hanzo.ai/hanzoai/frappe is the same fork, public, and still has
the SQLite driver the bench is built around, so point FRAPPE_REPO there.
HELPDESK_REPO gets the same treatment: it still resolves on GitHub today,
but it is the same repo being built here and the same move will take it.
The build passed GH_PAT as the BuildKit secret GIT_AUTH_TOKEN, which the
Dockerfile never mounts. With both clones on the forge nothing in the
build needs a GitHub credential, so drop it.
github.com has no runner for hanzo-build-linux-amd64, so a caller under
.github/workflows is a gate that can never be scheduled. This is the ~7-line
caller on the plane that can (git.hanzo.ai git-runner fleet), pinned @v1.
Co-authored-by: Hanzo Dev <[email protected]>
The rewritten pipeline triggered on `main`. This repo's default branch
is `develop`, so pushes never matched and the workflow could not fire —
the same class of silent no-op it was rewritten to fix.
This pipeline could not work on this fleet and had not produced an image in
weeks, while looking idle rather than broken.
buildctl-daemonless.sh: command not found (exit 127). Jobs run in
catthehacker/ubuntu:act-24.04 per GIT_RUNNER_LABELS; there is no buildctl
in it. It also read secrets.GIT_CLONE_TOKEN, which exists on neither the
repo nor the hanzoai org on git.hanzo.ai.
The kubectl patch step failed the same way (kubectl: command not found) and
was futile anyway: cd.hanzo.ai selfHeal restores the App CR from the pin in
hanzoai/universe on its next poll. Rollout is a reviewed pin there, never a
CI side effect — so the deploy step is removed, not repaired.
Replaced with the shape proven on hanzoai/playground, the only one of these
whose build job has ever gone green here: setup-buildx + login-action +
build-push-action, using GHCR_USER/GHCR_TOKEN/GH_PAT which DO exist as org
secrets. Keeps playground's imagetools verification, because build-push-action
can exit 0 before the manifest resolves.
runs-on named hanzo-linux-amd64. No runner on git.hanzo.ai advertises that
label — the four online git-runners offer hanzo-build-linux-amd64 (plus
ubuntu-latest/22.04/24.04). A job asking for an unavailable label does not
fail; it queues forever and cancels at the 24h timeout, which reads as
'CI is slow' rather than 'CI is broken'.
Latent while the forge repo had actions disabled and the pipeline could not
fire at all; enabling it made the bug reachable, so it is fixed in the same
pass.
- custom_base_url=1 so Frappe prepends https://hanzo.id to authorize/token/
userinfo (relative paths were resolving to the Frappe host, breaking OAuth).
- login_with_email_link=0 removes the native passwordless path; IAM SSO is the
ONLY login. CR mirror -> 1.26.6.
- Social Login Key (Custom) requires a Redirect URL; derive it per-site from
frappe.utils.get_url so each org's site gets its correct callback host.
- Run _harden_login in a finally block so disabling native signup applies even
if social-login provisioning fails. CR tag 1.26.4.
Re-applies the DocType permission changes that were bundled into #3502
and lost when it was reverted (#3512):
- HD Ticket: replace 'All' with 'HD Customer' and 'HD Customer Manager'
- HD View: replace 'Guest' with 'HD Customer' and 'HD Customer Manager'
- HD Article / HD Article Category / HD Ticket Type: add 'HD Customer Manager'
- HD Ticket Template: add 'Agent Manager'
Also restores the Support Hour Distribution report export.
zeekay