Files
1e0086678a ci: canonical hanzo.yml + hanzoai/ci (arc, no GHA minutes) — ZAP-native collector image (#5)
* ci: adopt canonical hanzo.yml + hanzoai/ci reusable (arc, no GHA minutes)

Build/test/deploy now driven by a root hanzo.yml read by the reusable
hanzoai/ci workflow, imported via a ~7-line .github/workflows/cicd.yml
(uses: hanzoai/ci/.github/workflows/build.yml@main, secrets: inherit).
Runs on the self-hosted arc pool (hanzo-build-linux-amd64) — zero
GitHub-hosted minutes; GHCR push via the automatic workflow token.

Two self-building images (compile in-image, no CI pre-build step):
  - collector       -> cmd/o11yotelcollector/Dockerfile.selfbuild
                       ghcr.io/hanzoai/otel-collector (tag-suffix zap-native)
  - schema-migrator -> cmd/o11yschemamigrator/Dockerfile.selfbuild (new)
                       ghcr.io/hanzoai/o11y-schema-migrator

* ci: remove broken/superseded workflows

Removed (all fail today):
  - build-ghcr.yaml, build-staging.yaml, build.yaml: broken reusables
    (hanzoai/.github docker-build.yml -> runtime-validation 'jobs: 0';
    o11y/primus.workflows -> inaccessible upstream org).
  - gor-signozotelcollector.yaml, gor-signozschemamigrator.yaml: goreleaser
    on GitHub-hosted ubuntu/macos runners (violates arc-only) + primus.
  - ci.yaml, postci.yaml: o11y/primus.workflows go-test/label; the go-test
    gate is folded into hanzo.yml test: instead.

Kept workflow-sanity.yml (unrelated Hanzo lint gate). cicd.yml supersedes.

* docs: canonical CI pattern note (hanzo.yml + hanzoai/ci on arc)

* ci: remove workflow-sanity.yml (broken hanzoai/.github reusable, jobs:0)

Same runtime-validation failure as the docker-build.yml reusable; fails at
0s on every PR touching .github/workflows. cicd.yml is the one CI path now.

* ci: temporarily pin hanzoai/ci@fix/provision-parse-toolchain (pending #4)

hanzoai/ci@main fails on the stock arc runner (no PyYAML/jq); hanzoai/ci#4
provisions them. Pin the fix branch so this repo's arc build goes green now;
flip back to @main (canonical) once #4 merges.

* ci: gate the ZAP surface in the build stage (bare/DinD runner has no Go)

The reusable runs hanzo.yml test: on a bare arc runner with no Go toolchain
and a DinD daemon (bind-mounts don't cross), so 'go test' there fails with
'go: command not found'. Move the ZAP receiver+exporter test into
Dockerfile.selfbuild's build stage — where the toolchain + source already are
and a failing test fails the image — and drop the runner-based test:.

---------

Co-authored-by: hanzo-dev <[email protected]>
2026-07-03 17:00:01 -07:00

26 lines
1.0 KiB
Docker

# Self-contained multi-stage build of the O11y ClickHouse schema migrator.
#
# Unlike ./Dockerfile (which COPYs a binary a CI pre-build-command produced), this
# compiles the migrator in-image, so the canonical Hanzo CI (hanzoai/ci reads the
# root hanzo.yml → plain `docker buildx build`, no pre-build step) can produce it,
# and an in-cluster Kaniko/BuildKit build can too. Mirrors
# cmd/o11yotelcollector/Dockerfile.selfbuild.
FROM golang:1.26-bookworm AS build
WORKDIR /src
# Prime the module cache first for better layer reuse.
COPY go.mod go.sum ./
RUN go mod download
COPY . .
ARG TARGETOS=linux
ARG TARGETARCH=amd64
RUN CGO_ENABLED=0 GOOS=${TARGETOS} GOARCH=${TARGETARCH} \
go build -trimpath -o /out/o11y-schema-migrator ./cmd/o11yschemamigrator
FROM debian:bookworm-slim
RUN apt-get update && apt-get install -y ca-certificates && rm -rf /var/lib/apt/lists/*
ARG USER_UID=10001
USER ${USER_UID}
COPY --from=build /out/o11y-schema-migrator /o11y-schema-migrator
ENTRYPOINT [ "/o11y-schema-migrator" ]
CMD ["--dsn", "tcp://localhost:9000"]