mirror of
https://github.com/luxfi/aml.git
synced 2026-09-24 00:25:20 +00:00
zeekayandHanzo Dev
97efad3afa
CI and release move to .hanzo/workflows on git.hanzo.ai, and .github/workflows is removed. The old path could not have worked: lux-private/aml has zero repository runners, zero organisation runners, and has never run a single workflow, while release.yml required [self-hosted, linux, amd64] and stated GitHub-hosted runners were not a permitted fallback. A tag would have queued forever against a pool that does not exist — a release that claims artifacts nothing built. The native pool is live and already carries the label this needs: git-runner-0..5 register lux-build-linux-amd64 among their labels. Images go to oci.hanzo.ai/luxfi/aml. That is the canonical name for our own OCI registry — registry:2, S3-backed, Hanzo IAM token auth — so both the build and the publish run on infrastructure we operate. The luxfi/ namespace stays because the engine is a Lux product; Hanzo AML is a thin wrapper over it, the way hanzoai/kms wraps luxfi/kms and hanzoai/mpc wraps luxfi/mpc. The release keeps the discipline that makes a version trustworthy: build, smoke the image before it is allowed to exist at the registry, push, then prove the pushed manifest resolves. A tag is a receipt for an image that exists, and verifying it after the push is what makes it one. The smoke checks the two behaviours that have actually regressed here rather than liveness alone — an unauthenticated read must be refused rather than served, and an ordinary payment must come back allowed rather than carrying a saturated score, because a monitor that alerts on everything ranks nothing. The /v2/ in the registry path is the OCI Distribution Specification's. Every route this product serves is /v1/, and there are sixteen of them with no /api/ prefix. Co-authored-by: Hanzo Dev <[email protected]>