ci: reduce GitHub Actions to sync-notice; native deploy is .hanzo/workflows/deploy.yml

.github/workflows/cicd.yml

@@ -1,73 +1,17 @@
+# Sync-notice stub — the canonical deploy pipeline is native to Hanzo Git:
+#   .hanzo/workflows/deploy.yml (in-cluster act_runner → BuildKit →
+#   ghcr.io/hanzoai/templates-blueprints:<sha> → kubectl patch app
+#   templates-blueprints → operator reconcile → hanzocd).
+# GitHub is a mirror. This workflow builds/deploys NOTHING; it exists only so a
+# manual dispatch surfaces where the real pipeline lives.
 name: CI/CD
 
-# Build + push the templates.hanzo.ai catalog image (hanzoai/static serving the
-# blueprint catalog) to GHCR on our self-hosted arc pool. The rollout onto
-# do-sfo3-hanzo-k8s is owned by the operator App CR (universe:
-# infra/k8s/operator/crs/templates-blueprints.yaml), NOT this repo — CI only
-# produces the immutable image.
-#
-# Self-contained (mirrors hanzoai/sensei.group's proven workflow): the exact
-# `docker login` + `docker buildx build --push` steps, tag shape
-# sha-<short>-amd64 + latest. GHCR auth = the job's automatic GITHUB_TOKEN.
-# Before the build we REGENERATE meta.json from blueprints/ and VALIDATE the
-# whole catalog (every template.toml parses with `toml`, every compose parses as
-# YAML, meta.json is the array the platform expects) so a broken blueprint can
-# never reach a running pod.
-
 on:
-  push:
-    branches: [main]
-    tags: ['v*']
-  pull_request:
   workflow_dispatch:
 
-concurrency:
-  group: build-${{ github.ref }}
-  cancel-in-progress: false
-
-permissions:
-  contents: read
-  packages: write
-
 jobs:
-  build:
-    # hanzo-build-linux-amd64 = the warm-floor arc pool (minRunners:1), proven
-    # active (hanzoai/world + sensei.group build here in ~2 min).
-    runs-on: hanzo-build-linux-amd64
+  notice:
+    runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
-
-      # The arc pool image ships docker+buildx but no node on PATH; provision it
-      # so the validate gate (which uses the platform's own toml/yaml parsers)
-      # can run before we build the image.
-      - uses: actions/setup-node@v4
-        with:
-          node-version: '22'
-
-      - name: Regenerate meta.json + validate catalog
-        run: |
-          cd scripts
-          npm ci --no-audit --no-fund
-          node generate-meta.mjs ../blueprints ../meta.json
-          node validate.mjs ..
-
-      - name: Image tag (immutable sha-<short>-amd64)
-        id: tag
-        run: echo "tag=sha-$(echo ${{ github.sha }} | cut -c1-7)-amd64" >> "$GITHUB_OUTPUT"
-
-      - name: Log in to GHCR
-        if: github.event_name != 'pull_request'
-        run: echo "${{ secrets.GITHUB_TOKEN }}" | docker login ghcr.io -u "${{ github.actor }}" --password-stdin
-
-      - name: Build & push image
-        if: github.event_name != 'pull_request'
-        run: |
-          docker buildx build --platform linux/amd64 --push \
-            -t ghcr.io/hanzoai/templates-blueprints:${{ steps.tag.outputs.tag }} \
-            -t ghcr.io/hanzoai/templates-blueprints:latest \
-            -f Dockerfile .
-          echo "pushed ghcr.io/hanzoai/templates-blueprints:${{ steps.tag.outputs.tag }}"
-
-      - name: Build image (PR, no push)
-        if: github.event_name == 'pull_request'
-        run: docker buildx build --platform linux/amd64 -f Dockerfile -t templates-blueprints:pr .
+      - name: Native pipeline notice
+        run: echo "native pipeline is .hanzo/workflows/deploy.yml; GitHub is a mirror"