ci: one CI path — .hanzo/workflows

None of the three workflows here could run. release.yml's `plan` job named
`lux-build-amd64` and validate-asset-manifests.yml named the bare
`['self-hosted', 'linux', 'amd64']` triple; the pool on this forge is
`lux-build-linux-amd64` and nothing answers to either. A job naming a label no
runner carries does not fail — it waits. So Gate A has not been gating
anything, and it is the gate that proves every DEX asset manifest entry
resolves to a real on-chain asset.

release.yml had a second, independent reason to never produce anything: it
delegated the actual build to
`hanzoai/.github/.github/workflows/docker-build.yml@main`, and a cross-org
workflow_call from luxfi/* into hanzoai/.github fails before any job starts.
luxfi/operator recorded exactly this against exactly this reusable —
"startup_failure on EVERY run since the migration to that reusable ... every
attempt failed at 0-2s with zero jobs dispatched" — and inlined its own build
for that reason. These thirteen plugin images have not been built by this
workflow.

So the plugin build is inlined too, in .hanzo/workflows/release.yml. It is
short: compile the VM to build/<vm> on the runner, then Dockerfile.plugin copies
that one binary into a scratch image, one matrix leg per entry in
.github/images.json. The manifest file stays where it is and is still read from
`.github/images.json` — it is repo metadata, not a workflow.

Gate A becomes .hanzo/workflows/ci.yml with its three checks intact.

Two other things had to change for these to work off GitHub:

  * ghcr auth. The reusable was handed the ambient credentials; the direct build
    uses GHCR_USER and GHCR_TOKEN, the org Actions secrets sourced from KMS. The
    instance GITHUB_TOKEN is a Hanzo Git token and has no rights at ghcr.io.

  * arm64. The reusable was asked for an arm64 leg on a
    `["self-hosted","linux","arm64"]` pool that does not exist. These images are
    amd64-only until we own an arm64 runner and it can return as a native matrix
    entry.

Deleted rather than migrated: workflow-sanity.yml. It is
`uses: hanzoai/.github/.github/workflows/workflow-sanity.yml@main` — the same
cross-org reusable call that fails before dispatch, so it has never reported on
anything. The label checking it was meant to provide is what
.github/actionlint.yaml is for, locally.

All three files are accounted for, which is the constraint: the forge stops at
the first workflow directory that exists, so a repo's entire .github/workflows
suite goes dark the moment .hanzo/workflows appears.

Co-authored-by: Hanzo Dev <[email protected]>

.github/workflows/release.yml

@@ -1,52 +0,0 @@
-name: Build VM Plugins
-
-on:
-  push:
-    branches: [main]
-    tags: ['v*']
-  pull_request:
-    branches: [main]
-  workflow_dispatch:
-
-permissions:
-  contents: read
-  packages: write
-
-jobs:
-  plan:
-    runs-on: lux-build-amd64
-    outputs:
-      images: ${{ steps.load.outputs.images }}
-    steps:
-      - uses: actions/checkout@v4
-      - id: load
-        run: echo "images=$(jq -c . .github/images.json)" >> "$GITHUB_OUTPUT"
-
-  build:
-    needs: plan
-    if: github.event_name != 'pull_request'
-    strategy:
-      fail-fast: false
-      matrix:
-        image: ${{ fromJson(needs.plan.outputs.images) }}
-    uses: hanzoai/.github/.github/workflows/docker-build.yml@main
-    with:
-      image: ${{ matrix.image.image }}
-      dockerfile: Dockerfile.plugin
-      build-args: |
-        VM=${{ matrix.image.vm }}
-      pre-build-command: |
-        mkdir -p build
-        export GONOSUMCHECK=github.com/luxfi/*
-        export GONOSUMDB=github.com/lux-private/*
-        export CGO_ENABLED=${{ matrix.image.cgo }}
-        export CGO_CFLAGS="${{ matrix.image.cgo == '1' && '-O2 -D__BLST_PORTABLE__' || '' }}"
-        if [ -f ${{ matrix.image.vm }}/main.go ]; then
-          go build -trimpath -ldflags="-s -w" -o build/${{ matrix.image.vm }} ./${{ matrix.image.vm }}
-        else
-          go build -trimpath -ldflags="-s -w" -o build/${{ matrix.image.vm }} ./${{ matrix.image.vm }}/cmd/plugin
-        fi
-      runner-amd64: '["self-hosted","linux","amd64"]'
-      runner-arm64: '["self-hosted","linux","arm64"]'
-      runner-deploy: '["self-hosted","linux","amd64"]'
-    secrets: inherit

.github/workflows/workflow-sanity.yml

@@ -1,9 +0,0 @@
-name: Workflow Sanity
-on:
-  pull_request:
-  push:
-    branches: [main]
-
-jobs:
-  sanity:
-    uses: hanzoai/.github/.github/workflows/workflow-sanity.yml@main

.hanzo/workflows/ci.yml

@@ -1,19 +1,31 @@
-name: Validate DEX Asset Manifests
+name: CI
 
-# Gate A — the green-first gate for the DEX real-assets-only model. Every entry in
-# every per-network asset manifest MUST resolve to a real on-chain asset on its target
-# network, and the fail-closed registry gate MUST hold. This workflow proves both before
-# a change to the manifests or the registry can merge.
+# Gate A — the green-first gate for the DEX real-assets-only model, on the
+# native runners (git.hanzo.ai → git-runner).
 #
-#   1. registry unit + gate tests (structural: no synthetic asset/market can register,
-#      AssetID binds the real token address / UTXO assetID, consensus-mode value guard,
-#      startup gate refuses synthetic flags / Liquidity / mock / ticker references).
-#   2. dexvm Gate-A wiring tests (enforceRealAssetsOnly refuses bad configs end-to-end).
-#   3. LIVE validation: for each net, dex-assets-validate proves every manifest entry
-#      real against that net's public RPC (eth_chainId, C-Chain consensus id, code>0 +
-#      decimals() for ERC-20, UTXO assetID on X-Chain) and that the gate passes.
+# Every entry in every per-network asset manifest MUST resolve to a real
+# on-chain asset on its target network, and the fail-closed registry gate MUST
+# hold. This proves both before a change to the manifests or the registry can
+# merge:
 #
-# Any failure stops the job (and thus the merge/deploy). The live step is read-only.
+#   1. registry unit + gate tests (structural: no synthetic asset or market can
+#      register, AssetID binds the real token address / UTXO assetID, the
+#      consensus-mode value guard holds, and the startup gate refuses synthetic
+#      flags / Liquidity / mock / ticker references).
+#   2. dexvm Gate-A wiring tests (enforceRealAssetsOnly refuses bad configs
+#      end to end).
+#   3. LIVE validation: for each net, dex-assets-validate proves every manifest
+#      entry real against that net's public RPC (eth_chainId, C-Chain consensus
+#      id, code>0 + decimals() for ERC-20, UTXO assetID on X-Chain) and that the
+#      gate passes.
+#
+# Any failure stops the job, and thus the merge. The live step is read-only.
+#
+# This replaces .github/workflows/validate-asset-manifests.yml, whose two jobs
+# named the bare `['self-hosted', 'linux', 'amd64']` triple. The pool on this
+# forge is `lux-build-linux-amd64`; nothing answers to the triple, and a job
+# naming a label no runner carries does not fail — it waits. So this gate has
+# not actually been gating anything.
 
 on:
   push:
@@ -21,28 +33,35 @@ on:
     paths:
       - 'dexvm/registry/**'
       - 'cmd/dex-assets-validate/**'
-      - '.github/workflows/validate-asset-manifests.yml'
+      - '.hanzo/workflows/ci.yml'
   pull_request:
     branches: [main]
     paths:
       - 'dexvm/registry/**'
       - 'cmd/dex-assets-validate/**'
-      - '.github/workflows/validate-asset-manifests.yml'
+      - '.hanzo/workflows/ci.yml'
   workflow_dispatch:
 
 permissions:
   contents: read
 
+# A newer commit makes the older run irrelevant.
+concurrency:
+  group: ${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: true
+
 env:
-  # luxfi modules are re-tagged in place; skip the public sum DB for them (the same
-  # discipline release.yml uses). Never disables verification of third-party modules.
+  # luxfi modules are re-tagged in place; skip the public sum DB for them (the
+  # same discipline release.yml uses). Never disables verification of
+  # third-party modules.
   GONOSUMCHECK: github.com/luxfi/*
   GONOSUMDB: github.com/luxfi/*
   GOFLAGS: -mod=mod
 
 jobs:
   registry-tests:
-    runs-on: ['self-hosted', 'linux', 'amd64']
+    runs-on: [lux-build-linux-amd64]
+    timeout-minutes: 30
     steps:
       - uses: actions/checkout@v4
       - uses: actions/setup-go@v5
@@ -56,7 +75,8 @@ jobs:
 
   live-validation:
     needs: registry-tests
-    runs-on: ['self-hosted', 'linux', 'amd64']
+    runs-on: [lux-build-linux-amd64]
+    timeout-minutes: 30
     strategy:
       fail-fast: false
       matrix:

.hanzo/workflows/release.yml

@@ -0,0 +1,125 @@
+name: Release
+
+# Builds one ghcr.io/luxfi/chains/<vm> plugin image per entry in
+# .github/images.json, on the native runners (git.hanzo.ai → git-runner).
+#
+# This replaces .github/workflows/release.yml, which delegated the build to
+# `hanzoai/.github/.github/workflows/docker-build.yml@main`. A cross-org
+# workflow_call from luxfi/* into hanzoai/.github fails before any job starts —
+# luxfi/operator recorded the same thing against the same reusable
+# ("startup_failure on EVERY run since the migration to that reusable ...
+# every attempt failed at 0-2s with zero jobs dispatched") and inlined its build
+# for exactly this reason. So these thirteen plugin images have not been built
+# by this workflow at all.
+#
+# The build is inlined here instead. It is short: compile the VM to build/<vm>
+# on the runner, then Dockerfile.plugin copies that one binary into a scratch
+# image. Two runner labels were wrong on the way in — the `plan` job named
+# `lux-build-amd64` and the reusable was handed `["self-hosted","linux","amd64"]`,
+# neither of which any runner on this forge carries, and a job naming a label
+# nothing carries does not fail: it waits.
+#
+# ghcr auth is GHCR_USER / GHCR_TOKEN, org Actions secrets sourced from KMS. The
+# instance GITHUB_TOKEN is a Hanzo Git token and has no rights at ghcr.io.
+#
+# amd64 only. The reusable was asked for an arm64 leg on a
+# `["self-hosted","linux","arm64"]` pool that does not exist; arm64 returns as a
+# native matrix entry when we own an arm64 runner.
+#
+# Semver-only: a v* tag produces the version tags, and every run produces an
+# immutable sha tag. No :latest, no floating tags.
+
+on:
+  push:
+    branches: [main]
+    tags: ['v*']
+  workflow_dispatch:
+
+permissions:
+  contents: read
+
+# A release is not made irrelevant by a newer one — let it finish.
+concurrency:
+  group: release-${{ github.ref }}
+  cancel-in-progress: false
+
+jobs:
+  plan:
+    runs-on: [lux-build-linux-amd64]
+    timeout-minutes: 10
+    outputs:
+      images: ${{ steps.load.outputs.images }}
+    steps:
+      - uses: actions/checkout@v4
+      - id: load
+        run: echo "images=$(jq -c . .github/images.json)" >> "$GITHUB_OUTPUT"
+
+  build:
+    needs: plan
+    strategy:
+      fail-fast: false
+      matrix:
+        image: ${{ fromJson(needs.plan.outputs.images) }}
+    runs-on: [lux-build-linux-amd64]
+    timeout-minutes: 60
+    steps:
+      - uses: actions/checkout@v4
+
+      - uses: actions/setup-go@v5
+        with:
+          go-version-file: go.mod
+          cache-dependency-path: go.sum
+
+      - name: Build ${{ matrix.image.vm }}
+        env:
+          # luxfi modules are re-tagged in place; skip the public sum DB for
+          # them. This never disables verification of third-party modules.
+          GONOSUMCHECK: github.com/luxfi/*
+          GONOSUMDB: github.com/lux-private/*
+          CGO_ENABLED: ${{ matrix.image.cgo }}
+          # blst needs the portable build when CGO is on.
+          CGO_CFLAGS: ${{ matrix.image.cgo == '1' && '-O2 -D__BLST_PORTABLE__' || '' }}
+        run: |
+          set -euo pipefail
+          mkdir -p build
+          vm='${{ matrix.image.vm }}'
+          # Some VMs are their own main package, others keep it under cmd/plugin.
+          if [ -f "${vm}/main.go" ]; then
+            go build -trimpath -ldflags="-s -w" -o "build/${vm}" "./${vm}"
+          else
+            go build -trimpath -ldflags="-s -w" -o "build/${vm}" "./${vm}/cmd/plugin"
+          fi
+          test -s "build/${vm}"
+
+      - uses: docker/setup-buildx-action@v3
+        with:
+          driver: docker-container
+          driver-opts: network=host
+
+      - uses: docker/login-action@v3
+        with:
+          registry: ghcr.io
+          username: ${{ secrets.GHCR_USER }}
+          password: ${{ secrets.GHCR_TOKEN }}
+
+      - id: meta
+        uses: docker/metadata-action@v5
+        with:
+          images: ${{ matrix.image.image }}
+          flavor: latest=false
+          tags: |
+            type=semver,pattern={{version}}
+            type=semver,pattern=v{{version}}
+            type=sha,prefix=sha-
+
+      - uses: docker/build-push-action@v6
+        with:
+          context: .
+          file: Dockerfile.plugin
+          platforms: linux/amd64
+          build-args: |
+            VM=${{ matrix.image.vm }}
+          labels: ${{ steps.meta.outputs.labels }}
+          tags: ${{ steps.meta.outputs.tags }}
+          provenance: false
+          push: true