Social builds and publishes on push

The repository had its hanzo.yml and Dockerfile but no workflow to read them,
so nothing ever built it. The caller is the same one hanzoai/build uses. The
image now builds for both architectures, since the spa base it serves from is
published for both and the cluster runs one node of each.

Co-authored-by: Hanzo Dev <[email protected]>

.github/workflows/cicd.yml

@@ -0,0 +1,30 @@
+name: CI/CD
+
+# The caller, and deliberately nothing else: triggers plus the import. All real
+# config is the repo-root hanzo.yml, which platform.hanzo.ai reads too.
+#
+# `.github/workflows`, because this repository lives on github.com and nowhere
+# else — git.hanzo.ai has no copy of it, so a workflow filed under `.hanzo` is
+# collected by nobody and the repo simply never builds. That is what it did.
+#
+# The runner is ours regardless. A queued job here reaches the GitHub App, which
+# mints a registration for exactly that job and asks platform to launch it, so
+# `linux-amd64` is answered by the same fleet the forge lane uses. No job runs
+# on a builder we do not own.
+
+on:
+  push:
+    branches: [main]
+    # A `v*` tag is a RELEASE and publishes an image named after it, verbatim.
+    tags: ['v*']
+  pull_request:
+  workflow_dispatch:
+
+concurrency:
+  group: cicd-${{ github.ref }}
+  cancel-in-progress: true
+
+jobs:
+  cicd:
+    uses: hanzoai/ci/.github/workflows/build.yml@v2
+    secrets: inherit

hanzo.yml

@@ -27,7 +27,6 @@ images:
     context: .
     dockerfile: Dockerfile
     repo: ghcr.io/hanzoai/social
-    platforms: [linux/amd64]
     # No build_secrets, and none belong here. Every credential that names a
     # person is minted by hanzo.id at sign-in; every credential that names a
     # network is sealed in KMS and read only by the publisher, server-side.

package.json

@@ -1,6 +1,6 @@
 {
   "name": "@hanzo/social",
-  "version": "0.1.1",
+  "version": "0.1.2",
   "private": true,
   "type": "module",
   "license": "Apache-2.0 OR MIT",