trust/hanzo.yml

# Canonical CI/CD config for hanzoai/trust — read by the shared hanzoai/ci
# reusable workflow (.hanzo/workflows/cicd.yml) and by platform.hanzo.ai.
#
# NO `images:` and NO `deploy:`, deliberately. This repo ships two things and
# neither is a container: a Go module hanzoai/cloud embeds (the goja bundle,
# consumed by version, not by a pull) and a static export the edge serves.
# Declaring an image would build an artifact nothing runs.

test:
  # The bundle is a COMMITTED artifact the Go embed reads, so "edited
  # controls.json, forgot to rebuild" is a real way to ship a stale score. The
  # suite rebuilds in memory and compares, which is what catches it — and it
  # runs against the built bundle in a bare node:vm, so what passes is the
  # thing that ships rather than the TypeScript it came from.
  #
  # It must run from goja/: esbuild records source paths relative to the
  # working directory, so the same source built from the repo root produces
  # different bytes and the staleness case fails on a build that was correct.
  - name: bundle
    run: |
      cd goja
      npm ci
      npm test
      npx tsc --noEmit

  # The embed, and the schema the bundle's SQL is written against.
  - name: embed
    run: go build ./... && go vet ./...

  # What a visitor's browser actually reaches, measured against what the
  # subprocessor list declares. The page says no advertising or analytics tag
  # runs on a Hanzo surface and that every third party reached is disclosed;
  # both are facts about the LIVE surfaces, so both are measured on every
  # release rather than remembered.
  #
  # The surfaces are named HERE and not in the tool. Which hosts this
  # deployment serves is deployment configuration — a default list compiled
  # into the tool would be a second copy of it, and the copy that goes stale is
  # always the one nobody is looking at. A surface added to the estate is added
  # to this line, and until it is, the page does not speak for it.
  #
  # It fails the run on a surface it cannot read, deliberately: a claim about
  # what a page loads is not one we can keep making while nobody can load it.
  - name: surface
    run: |
      node bin/surface.test.mjs
      node bin/surface.mjs \
        hanzo.ai hanzo.works hanzo.codes hanzoskills.com hanzo.ventures \
        hanzo.team hanzo.app hanzo.bot hanzo.chat hanzo.agency hanzo.id \
        docs.hanzo.ai blog.hanzo.ai status.hanzo.ai trust.hanzo.ai

  # NO copy gate here. certclaims matters more to this repo than to any other —
  # it names three frameworks on nearly every page it serves, and the bundle is
  # a tracked .js the gate reads, inventory prose included — but the shared
  # pipeline ALREADY runs it against every caller, in `Structural invariants`,
  # before anything is built. Declaring it again was one fact in two homes, and
  # the second copy cloned hanzoai/ci to /tmp/ci, which is where the pipeline
  # had already put it. The tools are on $CI_HOME/bin if a step ever needs one.

  # The page's own types. The build below is the rest of its gate.
  #
  # From INSIDE site/, not `pnpm --dir site` from the root. corepack picks a pnpm
  # by reading `packageManager` out of the package.json in the CURRENT directory,
  # and this repo has none at its root — so from there corepack provisions its
  # own default, pnpm then reads site/package.json, finds a different version
  # pinned, and refuses rather than switching under corepack.
  - name: site
    run: |
      corepack enable
      cd site
      pnpm install --frozen-lockfile
      pnpm typecheck

# trust.hanzo.ai. The page reads /v1/trust at RUNTIME, so the export is a shell
# and the numbers are never baked into it — a trust page compiled from a
# snapshot is stale the moment a control changes, which is the failure this
# whole repo exists to refuse.
site:
  slug: trust
  dir: site/out
  # `cd site` first, for the same reason the gate above does: corepack reads
  # `packageManager` from the CURRENT directory, and the root carries no
  # package.json. `dir` stays repo-relative — it is read by the publisher, not
  # by this shell.
  build: corepack enable && cd site && pnpm install --frozen-lockfile && pnpm build
  on: [main]

kms:
  org: hanzo