ci: make the native iam build actually run (main built nothing since 07-24)
.github/workflows/build.yml was neutralized to a dispatch-only echo on
2026-07-24 (f267b4ae8), handing the build to .hanzo/workflows/deploy.yml.
That file could never run, so main has shipped no image since. Measured:
main is diverged from the v1.33.x line that ships (136 ahead / 142 behind
v1.33.8); v1.33.8 came from a tag push on that other line; git.hanzo.ai had
Actions disabled on this mirror, so the native file had zero runs, ever.
Replace it with a builder that matches the forge as measured:
runs-on hanzo-build-linux-amd64 the only label the four online act_runners
advertise; the old hanzo-linux-amd64 matches nothing and queues forever
buildx + build-push-action buildctl-daemonless.sh is absent from
catthehacker/ubuntu:act-24.04, the image this pool serves
GHCR_USER/GHCR_TOKEN, GH_PAT org-level secrets that exist; the old
GIT_CLONE_TOKEN is on neither repo nor org, and the Dockerfile needs a
token to fetch the private hanzoai modules
no kubectl patch the App CR is ArgoCD-managed with selfHeal;
rollout stays a reviewed tag pin in hanzoai/universe
Immutable sha- tag only: a re-pushed semver leaves two digests behind one
name, which is how platform's v4.4.5 came to mean two builds on 2026-07-25.
Renamed deploy.yml -> build.yml because it builds and does not deploy.
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
This commit is contained in:
Claude Opus 5 (1M context)
@@ -0,0 +1,89 @@
|
||||
name: build
|
||||
# THE builder for ghcr.io/hanzoai/iam from main, on Hanzo's own forge.
|
||||
#
|
||||
# git.hanzo.ai push (incl. mirror-sync from GitHub) → act_runner
|
||||
# → buildx → ghcr.io/hanzoai/iam:sha-<7>
|
||||
#
|
||||
# WHY THIS FILE EXISTS. `.github/workflows/build.yml` was neutralized to a
|
||||
# dispatch-only echo on 2026-07-24 (f267b4ae8) in favour of a native pipeline
|
||||
# that could never run, so every commit on main since has built nothing
|
||||
# anywhere. Measured on 2026-07-25: main is `diverged` from the v1.33.x line
|
||||
# that actually ships (136 ahead / 142 behind v1.33.8), the last image
|
||||
# v1.33.8 came from a tag push on that OTHER line, and git.hanzo.ai had
|
||||
# Actions disabled on this mirror — zero runs, ever. This is the repair.
|
||||
#
|
||||
# The four defects in the file this replaces, each measured, not guessed:
|
||||
# 1. runs-on: hanzo-linux-amd64 — matches NO registered runner. The four
|
||||
# online act_runners advertise exactly ubuntu-latest, ubuntu-22.04,
|
||||
# ubuntu-24.04, hanzo-build-linux-amd64 (/api/v1/admin/actions/runners).
|
||||
# A job asking for the old label queues forever instead of failing.
|
||||
# 2. buildctl-daemonless.sh — absent from catthehacker/ubuntu:act-24.04, the
|
||||
# image this pool actually serves for hanzo-build-linux-amd64.
|
||||
# 3. secrets.GIT_CLONE_TOKEN — exists on neither the repo nor the org. The
|
||||
# Dockerfile needs a token here: GOPRIVATE=github.com/hanzoai/* means
|
||||
# `go mod download` cannot read hanzoai/orm + hanzoai/sqlite without one.
|
||||
# 4. kubectl patch app iam — the App CR is ArgoCD-managed with selfHeal, so
|
||||
# the patch is reverted on the next poll, and the runner has no
|
||||
# kubeconfig. Rollout is a reviewed tag pin in hanzoai/universe. Not here.
|
||||
#
|
||||
# The image is tagged by COMMIT SHA only. A semver tag that gets re-pushed
|
||||
# leaves two digests behind one name, and with imagePullPolicy: IfNotPresent a
|
||||
# node keeps whichever it cached first — that is how platform's v4.4.5 and
|
||||
# v4.4.6 each came to mean two different builds on 2026-07-25. A SHA cannot move.
|
||||
on:
|
||||
push:
|
||||
branches: [main]
|
||||
workflow_dispatch:
|
||||
|
||||
concurrency:
|
||||
group: build-iam-${{ github.ref }}
|
||||
cancel-in-progress: true
|
||||
|
||||
jobs:
|
||||
build:
|
||||
runs-on: [hanzo-build-linux-amd64]
|
||||
steps:
|
||||
- uses: actions/checkout@v4
|
||||
|
||||
- id: meta
|
||||
run: echo "tag=sha-$(echo "$GITHUB_SHA" | cut -c1-7)" >> "$GITHUB_OUTPUT"
|
||||
|
||||
- uses: docker/setup-buildx-action@v3
|
||||
with:
|
||||
driver: docker-container
|
||||
driver-opts: network=host
|
||||
|
||||
- uses: docker/login-action@v3
|
||||
with:
|
||||
registry: ghcr.io
|
||||
username: ${{ secrets.GHCR_USER }}
|
||||
password: ${{ secrets.GHCR_TOKEN }}
|
||||
|
||||
- uses: docker/build-push-action@v6
|
||||
with:
|
||||
context: .
|
||||
file: ./Dockerfile
|
||||
platforms: linux/amd64
|
||||
push: true
|
||||
provenance: false
|
||||
tags: ghcr.io/hanzoai/iam:${{ steps.meta.outputs.tag }}
|
||||
# The Dockerfile mounts this to rewrite github.com to an authenticated
|
||||
# fetch for the private hanzoai modules. Without it `go mod download`
|
||||
# fails on hanzoai/orm.
|
||||
secrets: |
|
||||
GIT_AUTH_TOKEN=${{ secrets.GH_PAT }}
|
||||
|
||||
# build-push-action can exit 0 before the manifest is resolvable at the
|
||||
# registry. Prove the image actually pulls, so a green run always means a
|
||||
# usable image rather than a future ImagePullBackOff.
|
||||
- name: Verify the pushed image resolves
|
||||
run: |
|
||||
set -euo pipefail
|
||||
img="ghcr.io/hanzoai/iam:${{ steps.meta.outputs.tag }}"
|
||||
for i in 1 2 3 4 5 6; do
|
||||
if docker manifest inspect "$img" >/dev/null 2>&1; then
|
||||
echo "$img is pullable"; exit 0
|
||||
fi
|
||||
echo "manifest not visible yet (attempt $i/6) — retrying"; sleep 5
|
||||
done
|
||||
echo "::error::$img not pullable after push"; exit 1
|
||||
@@ -1,24 +0,0 @@
|
||||
name: deploy
|
||||
on:
|
||||
push:
|
||||
branches: [main]
|
||||
jobs:
|
||||
deploy:
|
||||
runs-on: hanzo-linux-amd64
|
||||
steps:
|
||||
- uses: actions/checkout@v4
|
||||
- name: Build + push image
|
||||
run: |
|
||||
SHA="${GITHUB_SHA::8}"
|
||||
buildctl-daemonless.sh build --frontend=dockerfile.v0 \
|
||||
--opt context="${{ github.server_url }}/${{ github.repository }}.git#${GITHUB_SHA}" \
|
||||
--opt filename=Dockerfile --opt platform=linux/amd64 \
|
||||
--secret id=GIT_AUTH_TOKEN,env=GIT_AUTH_TOKEN \
|
||||
--output "type=image,name=ghcr.io/hanzoai/iam:${SHA},push=true" --progress=plain
|
||||
env:
|
||||
GIT_AUTH_TOKEN: ${{ secrets.GIT_CLONE_TOKEN }}
|
||||
- name: Deploy — declare tag to operator
|
||||
run: |
|
||||
for app in iam; do
|
||||
kubectl -n hanzo patch app "$app" --type=merge -p "{\"spec\":{\"image\":{\"repository\":\"ghcr.io/hanzoai/iam\",\"tag\":\"${GITHUB_SHA::8}\"}}}"
|
||||
done
|
||||
Reference in New Issue
Block a user