shadcn/hanzo.yml

# Canonical CI/CD config for hanzoai/shadcn — the one file both the hanzoai/ci
# reusable (.hanzo/workflows/cicd.yml) and platform.hanzo.ai read.
#
# Everything shadcn-lineage lives here: the CLI (pkg/cli), the component surface
# (pkg/components, published as @hanzo/shadcn), the registry and docs sites
# (app/, apps/v4/) and the scaffolds the CLI clones (templates/).

images:
  # ui.hanzo.ai — the docs site and the registry JSON the CLI reads, built from
  # app/ as a Next static export and served by ghcr.io/hanzoai/static.
  - name: shadcn
    context: .
    dockerfile: Dockerfile
    repo: ghcr.io/hanzoai/shadcn
    platforms: [linux/amd64]
    build_secrets: [PUBLISHABLE_KEY]

test:
  - name: components
    # The third step is the unusual one: pack the tarball and assert every path
    # the exports map points at is actually INSIDE it. typecheck and build both
    # read the source tree, so an exports entry naming a file the tarball does
    # not carry is green to both and broken for every consumer.
    run: |
      set -e
      corepack enable
      pnpm install --frozen-lockfile
      pnpm --filter @hanzo/shadcn run typecheck
      pnpm --filter @hanzo/shadcn run build
      cd pkg/components
      pnpm pack
      tar tzf hanzo-shadcn-*.tgz | sed 's#^package/##' | sort > /tmp/tarfiles.txt
      node -e '
        const fs = require("fs")
        const pkg = JSON.parse(fs.readFileSync("package.json", "utf8"))
        const inTar = new Set(fs.readFileSync("/tmp/tarfiles.txt", "utf8").split("\n").filter(Boolean))
        const targets = []
        ;(function walk(v) {
          if (typeof v === "string") return void targets.push(v)
          if (v && typeof v === "object") Object.values(v).forEach(walk)
        })(pkg.exports)
        ;["main", "module", "types"].forEach((k) => pkg[k] && targets.push(pkg[k]))
        let bad = 0
        for (const t of new Set(targets)) {
          const ok = inTar.has(t.replace(/^\.\//, ""))
          if (!ok) bad++
          console.log((ok ? "OK  " : "MISSING ") + t)
        }
        process.exit(bad ? 1 : 0)
      '

  - name: cli
    # `npx shadcn add <component>` is the product, so the gate builds it and
    # then runs the binary — a CLI whose dist/index.js cannot be executed is the
    # failure worth catching, and `--version` executes the whole command tree.
    #
    # pkg/tests is NOT run here. Its suite dies in globalSetup with
    # `ReferenceError: __vite_ssr_exportName__ is not defined`: the package pins
    # vitest ^2.1.9, whose vite-node cannot read the SSR transform the workspace's
    # vite 8 emits. Measured identical on hanzoai/ui before this repo existed, so
    # it is a version skew to resolve on its own terms, not a regression. A gate
    # that cannot go green is read once as "CI is just red here" and from then on
    # hides real breakage — so it is named in LLM.md instead of wired in.
    run: |
      set -e
      corepack enable
      pnpm install --frozen-lockfile
      pnpm --filter shadcn run build
      node pkg/cli/dist/index.js --version