Files
1e0086678a ci: canonical hanzo.yml + hanzoai/ci (arc, no GHA minutes) — ZAP-native collector image (#5)
* ci: adopt canonical hanzo.yml + hanzoai/ci reusable (arc, no GHA minutes)

Build/test/deploy now driven by a root hanzo.yml read by the reusable
hanzoai/ci workflow, imported via a ~7-line .github/workflows/cicd.yml
(uses: hanzoai/ci/.github/workflows/build.yml@main, secrets: inherit).
Runs on the self-hosted arc pool (hanzo-build-linux-amd64) — zero
GitHub-hosted minutes; GHCR push via the automatic workflow token.

Two self-building images (compile in-image, no CI pre-build step):
  - collector       -> cmd/o11yotelcollector/Dockerfile.selfbuild
                       ghcr.io/hanzoai/otel-collector (tag-suffix zap-native)
  - schema-migrator -> cmd/o11yschemamigrator/Dockerfile.selfbuild (new)
                       ghcr.io/hanzoai/o11y-schema-migrator

* ci: remove broken/superseded workflows

Removed (all fail today):
  - build-ghcr.yaml, build-staging.yaml, build.yaml: broken reusables
    (hanzoai/.github docker-build.yml -> runtime-validation 'jobs: 0';
    o11y/primus.workflows -> inaccessible upstream org).
  - gor-signozotelcollector.yaml, gor-signozschemamigrator.yaml: goreleaser
    on GitHub-hosted ubuntu/macos runners (violates arc-only) + primus.
  - ci.yaml, postci.yaml: o11y/primus.workflows go-test/label; the go-test
    gate is folded into hanzo.yml test: instead.

Kept workflow-sanity.yml (unrelated Hanzo lint gate). cicd.yml supersedes.

* docs: canonical CI pattern note (hanzo.yml + hanzoai/ci on arc)

* ci: remove workflow-sanity.yml (broken hanzoai/.github reusable, jobs:0)

Same runtime-validation failure as the docker-build.yml reusable; fails at
0s on every PR touching .github/workflows. cicd.yml is the one CI path now.

* ci: temporarily pin hanzoai/ci@fix/provision-parse-toolchain (pending #4)

hanzoai/ci@main fails on the stock arc runner (no PyYAML/jq); hanzoai/ci#4
provisions them. Pin the fix branch so this repo's arc build goes green now;
flip back to @main (canonical) once #4 merges.

* ci: gate the ZAP surface in the build stage (bare/DinD runner has no Go)

The reusable runs hanzo.yml test: on a bare arc runner with no Go toolchain
and a DinD daemon (bind-mounts don't cross), so 'go test' there fails with
'go: command not found'. Move the ZAP receiver+exporter test into
Dockerfile.selfbuild's build stage — where the toolchain + source already are
and a failing test fails the image — and drop the runner-based test:.

---------

Co-authored-by: hanzo-dev <[email protected]>
2026-07-03 17:00:01 -07:00

1.6 KiB

otel-collector

Hanzo O11y Otel Collector

Hanzo OpenTelemetry Collector distro. ZAP-native (zap-proto/http :4319) + OTLP (:4317/:4318) in → hanzoai/datastore (ClickHouse) out. Adds receiver/zapreceiver + exporter/zapexporter over upstream.

CI = root hanzo.yml + .github/workflows/cicd.yml importing hanzoai/ci

  • hanzo.yml (root, NO leading dot) declares images: / test: / deploy: / kms:. .github/workflows/cicd.yml is ~7 lines: uses: hanzoai/ci/.github/workflows/build.yml@main + secrets: inherit.
  • Runs on our self-hosted arc pool (hanzo-build-linux-amd64) — no GitHub-hosted minutes. GHCR push = automatic workflow token; KMS = deploy KUBECONFIG only.
  • Two self-building images (multi-stage, compile in-image, no CI pre-build):
    • collector → cmd/o11yotelcollector/Dockerfile.selfbuild → ghcr.io/hanzoai/otel-collector:zap-native-latest + :sha-<short>-amd64-zap-native.
    • schema-migrator → cmd/o11yschemamigrator/Dockerfile.selfbuild → ghcr.io/hanzoai/o11y-schema-migrator:latest + :sha-<short>-amd64.
  • The zap-native tag = the collector build that includes zapreceiver + zapexporter. Deploy manifests (config ConfigMap with the zap receiver on :4319 + the otel-agent log DaemonSet that ships over ZAP) live in hanzoai/universe infra/k8s/monitoring + infra/k8s/o11y.

This is the going-forward pattern for ALL native-PaaS repos. Onboard = add hanzo.yml + cicd.yml; nothing else. The legacy hanzoai/.github docker-build.yml and o11y/primus.workflows reusables were removed (broken: runtime-validation jobs: 0, and primus is inaccessible).