mirror of
https://github.com/hanzoai/kms-operator.git
synced 2026-10-30 18:32:57 +00:00
zeekay
1183395d27
The vendor tree carried 5,315 Go files and 74 MB on one stated ground: that github.com/luxfi/kms is private, so a build without it would need a PAT. That repository is public. Measured three ways with git's insteadOf rewrites disabled, since a rewrite is exactly what makes an unfetchable dependency build on a developer's machine and fail only in CI: an unauthenticated clone answers, github.com/luxfi/kms returns 200, and proxy.golang.org serves it. Then the whole module graph was resolved and built from an empty cache under a fresh HOME — no gitconfig, no rewrites, no keys — producing the same 58 MB manager the vendored build produced. go.sum is the integrity check the tree stood in for: a module whose hash does not match is refused whichever way it arrived. The Dockerfile downloads modules on a cache mount and drops -mod=vendor. The CI config repeated the private-repository claim and no longer does.
23 lines
1.2 KiB
YAML
23 lines
1.2 KiB
YAML
# Canonical CI/CD config for hanzoai/kms-operator — read by BOTH the shared
|
|
# hanzoai/ci reusable workflow (.hanzo/workflows/cicd.yml) AND platform.hanzo.ai
|
|
# (webhook → BuildScheduler → arcd). ONE file, the "one way" build contract.
|
|
#
|
|
# Replaces the deprecated `hanzoai/.github/.github/workflows/docker-build.yml`
|
|
# reference, whose GitHub-side wiring startup-failed and blocked releases.
|
|
#
|
|
# The image is the multi-stage root Dockerfile: it compiles the kubebuilder
|
|
# `manager` binary into a scratch runtime. Entrypoint /manager. Dependencies come
|
|
# from the module proxy — the 74 MB vendor tree this used to carry was justified
|
|
# by github.com/luxfi/kms being private, and that repository is public.
|
|
images:
|
|
- name: kms-operator
|
|
context: .
|
|
dockerfile: Dockerfile
|
|
repo: ghcr.io/hanzoai/kms-operator
|
|
|
|
# No `test:` — the shared reusable runs `test:` on a bare arc runner with no Go
|
|
# toolchain, and the manager already builds (and would fail the image) inside the
|
|
# Dockerfile. One gate, one place. Deploy is a raw Deployment in
|
|
# kms-operator-system (not an operator Service CR), so it is rolled out of band
|
|
# by bumping the image tag; no `deploy:` block here.
|