mirror of
https://github.com/hanzoai/mod.git
synced 2026-09-30 22:56:06 +00:00
zooqueen
f20c02ec0a
A module path is identity, not an address: `module github.com/hanzoai/o11y` is what every dependent's go.mod names, so the toolchain took a direct VCS fetch to github.com and needed a credential valid there. This answers for the name and reads the source from git.hanzo.ai, so a build resolves the module it already names with no GitHub credential in it. Resolution is the toolchain's own — module zips have rules about nested modules, vendor directories, symlinks, file modes and case collisions, and a zip that gets one wrong hashes differently and fails every caller's go.sum. Clients set GOPROXY and GONOSUMDB. Not GOPRIVATE: it means "bypass the proxy AND the checksum database", and bypassing the proxy is what reaches for github.com. Skipping the public checksum database for our namespaces is not skipping verification — go.sum still pins every module and is checked against these bytes. Inside our namespaces a failure answers 502, never 404: in this protocol 404 means "ask the next proxy", and the next proxy is public.
26 lines
765 B
YAML
26 lines
765 B
YAML
name: CI/CD
|
|
|
|
# The caller, and deliberately nothing else: triggers plus the import. All real
|
|
# config is the repo-root hanzo.yml, which platform.hanzo.ai reads too.
|
|
#
|
|
# `.hanzo/workflows`, NOT `.github/workflows`: the `git-runner` StatefulSet
|
|
# registers against the forge only, and that is the pool advertising the
|
|
# `hanzo-build-linux-amd64` label. A job asking for it on github.com is never
|
|
# claimed — it waits out the timeout rather than failing.
|
|
|
|
on:
|
|
push:
|
|
branches: [main]
|
|
# A `v*` tag is a RELEASE and publishes an image named after it, verbatim.
|
|
tags: ['v*']
|
|
workflow_dispatch:
|
|
|
|
concurrency:
|
|
group: cicd-${{ github.ref }}
|
|
cancel-in-progress: true
|
|
|
|
jobs:
|
|
cicd:
|
|
uses: hanzoai/ci/.hanzo/workflows/build.yml@v1
|
|
secrets: inherit
|