mirror of
https://github.com/hanzoai/papers.git
synced 2026-10-29 07:34:31 +00:00
zeekay
8ba2c831da
The image job has failed on every run with ::error::REGISTRY_TOKEN is unset, so nothing was published. Add the org secret. The guard is doing its job; the name is simply wrong. The hanzoai org defines exactly GHCR_TOKEN, GHCR_USER, GH_PAT, KMS_CLIENT_ID, KMS_CLIENT_SECRET, OCI_TOKEN and OCI_USER. There is no REGISTRY_TOKEN and never was, so the suggested remedy — add the org secret — would have minted a second credential for the registry every other repo already logs into with GHCR_*. Only ui and papers invented that name. Both now use the GHCR_* pair, and take the username from GHCR_USER instead of hardcoding hanzo-dev, so rotating the publishing identity stays a single org-level change. Tagging is untouched: still the short HEAD sha, which is what a CR pins.
53 lines
2.0 KiB
YAML
53 lines
2.0 KiB
YAML
name: deploy
|
|
|
|
# Builds papers.hanzo.ai and publishes the image the operator runs. Restored
|
|
# from the deleted .github/workflows/deploy-site.yml, which was the sole
|
|
# producer of ghcr.io/hanzoai/papers and went away with no replacement — the
|
|
# host has been frozen at its last build since, with no failing run to say so.
|
|
#
|
|
# The image tag is the run's commit, and the operator CR in hanzoai/universe
|
|
# names which tag is live — a build never deploys itself.
|
|
|
|
on:
|
|
push:
|
|
branches: [main]
|
|
paths: ['site/**', '.hanzo/workflows/deploy.yml']
|
|
workflow_dispatch:
|
|
|
|
concurrency:
|
|
group: deploy-${{ github.ref }}
|
|
cancel-in-progress: false
|
|
|
|
jobs:
|
|
image:
|
|
runs-on: hanzo-build-linux-amd64
|
|
timeout-minutes: 30
|
|
steps:
|
|
- uses: actions/checkout@v4
|
|
|
|
- name: build and push
|
|
# GHCR_TOKEN/GHCR_USER, which are the org secrets that actually exist.
|
|
# This job asked for REGISTRY_TOKEN, which was never defined anywhere —
|
|
# the org has exactly GHCR_TOKEN, GHCR_USER, GH_PAT, KMS_CLIENT_ID,
|
|
# KMS_CLIENT_SECRET, OCI_TOKEN, OCI_USER — so the guard below fired on
|
|
# every run and nothing was ever published. Every other image build in
|
|
# the org already uses the GHCR_* pair; this file and ui were the two
|
|
# that invented a name.
|
|
#
|
|
# The username comes from the secret too, rather than being hardcoded to
|
|
# hanzo-dev, so rotating the publishing identity is one org-level change.
|
|
env:
|
|
GHCR_TOKEN: ${{ secrets.GHCR_TOKEN }}
|
|
GHCR_USER: ${{ secrets.GHCR_USER }}
|
|
run: |
|
|
set -euo pipefail
|
|
if [ -z "${GHCR_TOKEN:-}" ] || [ -z "${GHCR_USER:-}" ]; then
|
|
echo "::error::GHCR_TOKEN/GHCR_USER are unset, so nothing was published."
|
|
exit 1
|
|
fi
|
|
tag="$(git rev-parse --short HEAD)"
|
|
image="ghcr.io/hanzoai/papers:${tag}"
|
|
echo "${GHCR_TOKEN}" | docker login ghcr.io -u "${GHCR_USER}" --password-stdin
|
|
docker build -t "${image}" ./site
|
|
docker push "${image}"
|