mirror of
https://github.com/hanzoai/works.git
synced 2026-10-30 18:17:58 +00:00
zeekay
81660426dc
A one-page site for the operator's half of the cloud — sales, marketing, support, books, cap table, incorporation, workflows — built so that a claim and a served route are the same object. Every card names a real capability, its real /v1 address, and the sentence that capability publishes about itself: its Go package doc, lifted into the OpenAPI tag and read back out of public.yaml, the ga-only public contract. Copy therefore cannot outrun the fleet. A gate asserts llms.txt still names every capability the page shows, because the drift that matters is the one where the site tells a person about something it never tells a model. robots.txt names the AI crawlers and allows them, and declares Content-Signal: search=yes, ai-input=yes, ai-train=yes. It carries no Disallow, and a gate fails the build if one appears. Auth is Hanzo IAM and nothing else — PKCE-S256, which is what lets a static export run it with no server. The gates prove it against the real issuer rather than asserting it.
36 lines
1.5 KiB
YAML
36 lines
1.5 KiB
YAML
# Canonical CI/CD config for hanzoai/works — read by the shared hanzoai/ci
|
|
# reusable workflow (.hanzo/workflows/cicd.yml) and by platform.hanzo.ai.
|
|
#
|
|
# NO `images:` and NO `deploy:`, deliberately. hanzo.works is a static export
|
|
# that ships to the Sites plane (.hanzo/workflows/deploy.yml), not a container
|
|
# the operator reconciles. Declaring an image here would build and push an
|
|
# artifact nothing pulls; declaring a deploy would name an App CR that does not
|
|
# exist. What remains is the gate the reusable runs on every push and PR.
|
|
|
|
test:
|
|
# Types are checked by tsc directly rather than through a lint pass. There is
|
|
# no eslint here on purpose: every rule that would have run is either already
|
|
# enforced by `tsc --strict` or is a style opinion, and a lint step that
|
|
# contributes no signal is a wall in front of the gate that does.
|
|
- name: typecheck
|
|
run: |
|
|
corepack enable
|
|
pnpm install --frozen-lockfile
|
|
pnpm typecheck
|
|
|
|
# The gate reads the EXPORTED BYTES, not the source, because what can go
|
|
# wrong here is invisible upstream of the export: a capability card that
|
|
# renders without its address, an llms.txt that ships stale after a
|
|
# capability is added, a robots.txt that stops welcoming a crawler. The build
|
|
# is therefore part of the gate and not a step before it.
|
|
- name: gates
|
|
run: |
|
|
corepack enable
|
|
pnpm install --frozen-lockfile
|
|
pnpm build
|
|
pnpm exec playwright install --with-deps chromium
|
|
pnpm gates
|
|
|
|
kms:
|
|
org: hanzo
|