mirror of
https://github.com/hanzoai/sensei.group.git
synced 2026-11-03 03:16:52 +00:00
zooqueenandHanzo Dev
8398132197
deploy / site (push) Successful in 2m5s
The page opened a request to a Hanzo host on every load — the one visible piece of the vendor left on a customer domain, and the browser refused it anyway for want of a CORS header, so it named the vendor and collected nothing. The ingest key went with it: it was the build's only variable. @hanzo/event stays in package.json, unused. Dropping it there without also regenerating pnpm-lock.yaml is an install that stops on --frozen-lockfile. Co-authored-by: Hanzo Dev <[email protected]>
80 lines
3.5 KiB
YAML
80 lines
3.5 KiB
YAML
name: deploy
|
|
|
|
# sensei.group is a SITE, not an App: a static export with no compute. It ships on the
|
|
# Sites plane. Not GitHub Pages, not Cloudflare Pages, and not an image — baking
|
|
# files that never execute into a container so a Go binary can serve them means an
|
|
# image, a push, a tag pinned in a CR and running pods, all to hand back bytes.
|
|
#
|
|
# build -> dist
|
|
# -> site
|
|
#
|
|
# The publish mechanics are NOT here. They are bin/site in hanzoai/ci,
|
|
# reached through its action, and every static surface in the fleet calls that one
|
|
# script — ensure-project, enqueue, presigned per-file upload, complete. A
|
|
# contract transcribed per repo is a contract that drifts, and this file used to
|
|
# carry its own copy of every call. It also SELF-PROVISIONS: the project is
|
|
# created idempotently before the enqueue, so committing this file is enough to
|
|
# stand the site up.
|
|
#
|
|
# The one secret is HANZO_DEPLOY_TOKEN, which identifies us rather than granting
|
|
# storage. It is set ON GIT.HANZO.AI: this file lives under .hanzo/workflows/, which
|
|
# only git.hanzo.ai reads, so GitHub's secret store is not in this path at all.
|
|
|
|
on:
|
|
push:
|
|
branches: [main]
|
|
workflow_dispatch:
|
|
|
|
concurrency:
|
|
group: deploy-${{ github.ref }}
|
|
cancel-in-progress: false
|
|
|
|
jobs:
|
|
site:
|
|
# NOT ubuntu-latest. This file lives in .hanzo/workflows, which GitHub never
|
|
# reads — git.hanzo.ai is the only thing that can run it, and its fleet
|
|
# advertises linux-amd64. An unmatched label is not an error here,
|
|
# it is silence: the job queues until the 24h timeout and nothing says so.
|
|
runs-on: [linux-amd64]
|
|
timeout-minutes: 30
|
|
steps:
|
|
- uses: actions/checkout@v4
|
|
|
|
- uses: actions/setup-node@v4
|
|
with:
|
|
node-version: '22'
|
|
|
|
- name: build the static export
|
|
run: |
|
|
set -euo pipefail
|
|
# pnpm-lock.yaml is lockfileVersion 9.0. package.json names no
|
|
# packageManager, so pin the major here rather than inheriting whatever
|
|
# corepack happens to ship.
|
|
corepack enable && corepack prepare [email protected] --activate
|
|
pnpm install --frozen-lockfile
|
|
pnpm build
|
|
test -s dist/index.html || { echo "::error::vite build produced no dist/index.html"; exit 1; }
|
|
# NO 404.html. The export is ONE page, so every other path is genuinely
|
|
# not here and the edge says so with a 404 — which is what makes search
|
|
# engines drop the routes this site used to serve. A 404.html would be
|
|
# answered with a 200 and keep them indexed.
|
|
echo "exported $(find dist -type f | wc -l) files"
|
|
|
|
# ONE credential. The 202 carries a prefix-scoped, 30-minute presigned POST
|
|
# grant, so nothing here holds a bucket key. Do NOT add SITES_S3_* — that is
|
|
# the standing shared-bucket credential the grant replaced, and it could
|
|
# overwrite every other org's site.
|
|
- name: Publish to the Sites plane
|
|
# BARE, not an https:// URL. git.hanzo.ai serves no git anonymously —
|
|
# every repo answers /info/refs with 401, public or not — and an absolute
|
|
# ref is fetched with no credential, so the action itself never arrives and
|
|
# the job dies before its first step. A bare ref resolves through the
|
|
# forge's DEFAULT_ACTIONS_URL, which is github, where this tag is readable.
|
|
uses: hanzoai/ci/.github/actions/site@v1
|
|
with:
|
|
slug: sensei-group
|
|
dir: dist
|
|
env:
|
|
KMS_CLIENT_ID: ${{ secrets.KMS_CLIENT_ID }}
|
|
KMS_CLIENT_SECRET: ${{ secrets.KMS_CLIENT_SECRET }}
|