mirror of
https://github.com/luxfi/bridge.git
synced 2026-09-24 00:26:46 +00:00
ci: build the SPA image from .hanzo/workflows so the plain tag moves again
The SPA build lived in .github/workflows/docker.yml, which the forge no longer dispatches, so ghcr.io/luxfi/bridge stopped publishing on the plain semver line while the `-server` line kept building from .hanzo/workflows. Deployments that pin a plain tag were left on a June bundle whose chain RPCs still used the retired /ext/ prefix and addressed zoo's EVM as `zoo` rather than `C`, so every RPC call 404s. brand.json on main already carries the /v1/bc/C/rpc form; this just gets it built. Adds a sha- tag so a deployment can pin a digest, and drops the two superseded .github workflows (docker.yml, and cmd-bridge-image.yml which bridge.yml already replaced). Co-authored-by: Hanzo Dev <[email protected]>
This commit is contained in:
Hanzo Dev
@@ -1,50 +0,0 @@
|
||||
name: cmd-bridge image
|
||||
|
||||
# Publishes the single-binary Go bridge image built from cmd/bridge/Dockerfile —
|
||||
# the tenant-config-capable server that white-label shims (e.g. zooai/bridge-shim)
|
||||
# base their FROM on. The plain-semver image line (root Dockerfile) is the SPA;
|
||||
# this all-in-one Go variant carries the `-server` suffix so the two never
|
||||
# collide on a tag. Mirrors docker.yml (runs on the self-hosted `evo` runner —
|
||||
# no GitHub-hosted minutes).
|
||||
|
||||
on:
|
||||
push:
|
||||
tags: ['v*']
|
||||
workflow_dispatch: {}
|
||||
|
||||
env:
|
||||
IMAGE: ghcr.io/luxfi/bridge
|
||||
|
||||
jobs:
|
||||
build:
|
||||
runs-on: evo
|
||||
permissions:
|
||||
contents: read
|
||||
packages: write
|
||||
steps:
|
||||
- uses: actions/checkout@v4
|
||||
- uses: docker/setup-buildx-action@v3
|
||||
- uses: docker/login-action@v3
|
||||
with:
|
||||
registry: ghcr.io
|
||||
username: ${{ github.actor }}
|
||||
password: ${{ secrets.GITHUB_TOKEN }}
|
||||
- id: tag
|
||||
run: |
|
||||
if [[ "${GITHUB_REF}" == refs/tags/v* ]]; then
|
||||
echo "t=${GITHUB_REF#refs/tags/}-server" >> "$GITHUB_OUTPUT"
|
||||
else
|
||||
echo "t=server" >> "$GITHUB_OUTPUT"
|
||||
fi
|
||||
- uses: docker/build-push-action@v6
|
||||
with:
|
||||
context: .
|
||||
file: cmd/bridge/Dockerfile
|
||||
platforms: linux/amd64
|
||||
push: true
|
||||
build-args: |
|
||||
VERSION=${{ steps.tag.outputs.t }}
|
||||
GH_TOKEN=${{ secrets.HANZOAI_READ_TOKEN }}
|
||||
tags: |
|
||||
${{ env.IMAGE }}:${{ steps.tag.outputs.t }}
|
||||
${{ env.IMAGE }}:server
|
||||
@@ -1,63 +0,0 @@
|
||||
name: Docker
|
||||
|
||||
# Single-arch (linux/amd64) container build on the working `lux-build` ARC label.
|
||||
# Multi-arch (arm64) will return once the per-arch `lux-build-linux-arm64`
|
||||
# pool is verified online (current per-arch labels did not pick up jobs).
|
||||
# No QEMU, no cross-org reusable.
|
||||
|
||||
on:
|
||||
workflow_dispatch:
|
||||
push:
|
||||
branches: [main, dev, test]
|
||||
tags: ['v*']
|
||||
|
||||
permissions:
|
||||
contents: read
|
||||
packages: write
|
||||
|
||||
env:
|
||||
IMAGE: ghcr.io/luxfi/bridge
|
||||
|
||||
jobs:
|
||||
build:
|
||||
runs-on: lux-build-amd64
|
||||
steps:
|
||||
- uses: actions/checkout@v4
|
||||
- uses: docker/setup-buildx-action@v3
|
||||
- uses: docker/login-action@v3
|
||||
with:
|
||||
registry: ghcr.io
|
||||
# ghcr.io, from a self-hosted runner. `secrets.GITHUB_TOKEN` is minted by
|
||||
# git.hanzo.ai and ghcr.io has never seen it, so the login answered
|
||||
# denied: denied
|
||||
# and every job after it skipped. On GitHub that pair is correct and this
|
||||
# file was written for GitHub; every job here runs on a lux self-hosted
|
||||
# pool, so GitHub is not the executor and its token is not a credential.
|
||||
# orgs/luxfi provisions exactly GHCR_USER + GHCR_TOKEN — no GH_PAT, and a
|
||||
# missing org secret is "", so a `||` chain would hide which one was used.
|
||||
username: ${{ secrets.GHCR_USER }}
|
||||
password: ${{ secrets.GHCR_TOKEN }}
|
||||
- name: Compute tags
|
||||
id: meta
|
||||
run: |
|
||||
set -e
|
||||
tags=""
|
||||
if [[ "${GITHUB_REF}" == refs/tags/v* ]]; then
|
||||
v="${GITHUB_REF#refs/tags/}"
|
||||
tags="ghcr.io/luxfi/bridge:${v},ghcr.io/luxfi/bridge:latest"
|
||||
elif [[ "${GITHUB_REF}" == refs/heads/main ]]; then
|
||||
tags="ghcr.io/luxfi/bridge:main"
|
||||
elif [[ "${GITHUB_REF}" == refs/heads/dev ]]; then
|
||||
tags="ghcr.io/luxfi/bridge:dev"
|
||||
elif [[ "${GITHUB_REF}" == refs/heads/test ]]; then
|
||||
tags="ghcr.io/luxfi/bridge:test"
|
||||
fi
|
||||
echo "tags=${tags}" >> "$GITHUB_OUTPUT"
|
||||
- name: Build & push
|
||||
if: steps.meta.outputs.tags != ''
|
||||
uses: docker/build-push-action@v6
|
||||
with:
|
||||
context: .
|
||||
platforms: linux/amd64
|
||||
push: true
|
||||
tags: ${{ steps.meta.outputs.tags }}
|
||||
@@ -0,0 +1,74 @@
|
||||
name: SPA
|
||||
|
||||
# Builds the Vite SPA image (root Dockerfile, served by ghcr.io/hanzoai/spa) and
|
||||
# publishes it on the plain semver line — the counterpart to bridge.yml, which
|
||||
# builds the Go all-in-one on the `-server` line.
|
||||
#
|
||||
# Lives in .hanzo/workflows because the forge (git.hanzo.ai) dispatches only from
|
||||
# here. The SPA build previously sat in .github/workflows/docker.yml, which is no
|
||||
# longer read, so the plain-tag image stayed frozen while the `-server` line kept
|
||||
# publishing — leaving deployments that pin a plain tag on a months-old bundle
|
||||
# whose chain RPCs still used the retired /ext/ prefix.
|
||||
#
|
||||
# Login uses GHCR_USER / GHCR_TOKEN: the instance GITHUB_TOKEN is minted by
|
||||
# git.hanzo.ai and ghcr.io rejects it.
|
||||
#
|
||||
# BUILD ≠ DEPLOY. This publishes an image and stops; shipping is an `image.tag`
|
||||
# edit in universe/deploy/lux-bridge/*.yaml that Hanzo CD reconciles.
|
||||
|
||||
on:
|
||||
push:
|
||||
branches: [main, dev, test]
|
||||
tags: ['v*']
|
||||
workflow_dispatch:
|
||||
|
||||
concurrency:
|
||||
group: spa-${{ github.ref }}
|
||||
cancel-in-progress: false
|
||||
|
||||
permissions:
|
||||
contents: read
|
||||
packages: write
|
||||
|
||||
jobs:
|
||||
build:
|
||||
runs-on: [lux-build-linux-amd64]
|
||||
timeout-minutes: 45
|
||||
steps:
|
||||
- uses: actions/checkout@v4
|
||||
|
||||
- uses: docker/setup-buildx-action@v3
|
||||
|
||||
- uses: docker/login-action@v3
|
||||
with:
|
||||
registry: ghcr.io
|
||||
username: ${{ secrets.GHCR_USER }}
|
||||
password: ${{ secrets.GHCR_TOKEN }}
|
||||
|
||||
- name: Compute tags
|
||||
id: meta
|
||||
run: |
|
||||
set -euo pipefail
|
||||
sha="ghcr.io/luxfi/bridge:sha-${GITHUB_SHA:0:7}"
|
||||
case "${GITHUB_REF}" in
|
||||
refs/tags/v*) tags="ghcr.io/luxfi/bridge:${GITHUB_REF#refs/tags/},ghcr.io/luxfi/bridge:latest,${sha}" ;;
|
||||
refs/heads/main) tags="ghcr.io/luxfi/bridge:main,${sha}" ;;
|
||||
refs/heads/dev) tags="ghcr.io/luxfi/bridge:dev,${sha}" ;;
|
||||
refs/heads/test) tags="ghcr.io/luxfi/bridge:test,${sha}" ;;
|
||||
*) tags="" ;;
|
||||
esac
|
||||
echo "tags=${tags}" >> "$GITHUB_OUTPUT"
|
||||
|
||||
- name: Build & push
|
||||
if: steps.meta.outputs.tags != ''
|
||||
uses: docker/build-push-action@v6
|
||||
with:
|
||||
context: .
|
||||
file: Dockerfile
|
||||
platforms: linux/amd64
|
||||
push: true
|
||||
provenance: false
|
||||
tags: ${{ steps.meta.outputs.tags }}
|
||||
labels: |
|
||||
org.opencontainers.image.revision=${{ github.sha }}
|
||||
org.opencontainers.image.source=https://github.com/luxfi/bridge
|
||||
Reference in New Issue
Block a user