mirror of
https://github.com/hanzoai/insights.git
synced 2026-10-30 16:15:31 +00:00
zeekay
4800f1e435
Every web pod on 1.52.84 died here: products/managed_warehouse/backend/metrics.py:6 from hanzo_insights.metrics_capture import InsightsMetrics ModuleNotFoundError: No module named 'hanzo_insights.metrics_capture' The module now exists in hanzo_insights (7.9.8), which records counters, gauges and histograms against /i/v1/metrics — the plane insights/otel_metrics.py already ingests through. Getting it installed took moving the pin. github.com/hanzoai/insights-python is archived: read-only, frozen a commit behind, and nothing can be pushed to it. The url.insteadOf redirect cloud/Dockerfile uses cannot route around that, because uv resolves a github.com git dependency through the GitHub REST API rather than through git — its log says 'Attempting GitHub fast path' — so the build would go on silently resolving the stale commit. The forge is the only address that answers with the code that exists. The forge serves nothing anonymously, so the build gets FORGE_TOKEN as a BuildKit secret, applied through GIT_CONFIG_* in the uv sync command's own environment: never written to /root/.gitconfig, so it cannot survive into a later layer, and never in the pin, so the lockfile keeps naming an address rather than a secret. bin/check-forge-credential asks whether that credential can read the repo in two seconds, before a build spends the hour finding out — the same reason check-imports-are-committed runs at the top of the job.
29 lines
1.3 KiB
Bash
Executable File
29 lines
1.3 KiB
Bash
Executable File
#!/usr/bin/env bash
|
|
#
|
|
# Can this build read our own Python SDK?
|
|
#
|
|
# hanzo-insights is pinned to git.hanzo.ai (see [tool.uv.sources] in
|
|
# pyproject.toml for why the archived github.com mirror cannot serve it), and the
|
|
# forge answers nothing anonymously. Without a working credential `uv sync` fails
|
|
# — but it fails deep inside a 30-60 minute image build, with a git auth error
|
|
# against a URL that reads like a network blip. This asks the same question in two
|
|
# seconds, before anything is spent, and says exactly what to fix.
|
|
#
|
|
# Same reason and same shape as check-imports-are-committed running at the top of
|
|
# the build job: the cheap question first.
|
|
set -euo pipefail
|
|
|
|
REPO="https://git.hanzo.ai/hanzoai/insights-python"
|
|
|
|
if [ -z "${FORGE_TOKEN:-}" ]; then
|
|
echo "::error::no forge credential in this job. hanzo-insights installs from ${REPO}, which needs one. Seal a token that can read it as the FORGE_TOKEN secret for this repository."
|
|
exit 1
|
|
fi
|
|
|
|
if ! git ls-remote --exit-code "https://x:${FORGE_TOKEN}@git.hanzo.ai/hanzoai/insights-python" main >/dev/null 2>&1; then
|
|
echo "::error::the forge credential cannot read ${REPO}, which this image installs from. Seal a token that can read it as the FORGE_TOKEN secret for this repository."
|
|
exit 1
|
|
fi
|
|
|
|
echo "forge credential reads hanzoai/insights-python"
|